Disk Optimizer virus

[tomio]

My XP laptop got infected with the Disk Optimizer virus, apparently a well known variant of HDD Defragmenter virus. It had installed itself in D:\Documents and Settings\All Users\Application Data (D= system disc). I scanned with the latest update but MBAM would not detect it.

2 exe files attached in zip.

[Firefox]

Please provide following details, so that someone may be able to assist you:

• 1. OS version including 32/64-bit
  2. Installed Security Product(s) including Firewall and Program Versions
  3. MBAM version (current 1.50.1.1100) (Free or Pro)
  4. Definition version (current 5525)
  

[exile360]

I've removed the sample from the post. In the future, please post all malicious samples in one of the areas here so that any innocent users browsing this area do not risk infection.

Thanks.

[exile360]

And just for info, I just scanned the files you uploaded with Malwarebytes' Anti-Malware and here's the log:

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 5525

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

1/15/2011 1:19:27 PM

mbam-log-2011-01-15 (13-19-24).txt

Scan type: Quick scan

Objects scanned: 7

Time elapsed: 3 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 3

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\Users\exile7x64\Desktop\disk_optimizer_virus\cioclfagvr.dll (Rogue.FakeHDD) -> No action taken.

c:\Users\exile7x64\Desktop\disk_optimizer_virus\fcfucyewlu.exe (Rogue.FakeHDD) -> No action taken.

c:\Users\exile7x64\Desktop\disk_optimizer_virus\w0zj5twwkpc.exe (Rogue.FakeHDD) -> No action taken.

[zanth07]

My PC became infected last night with both Security Sheild and Disk Optimizer. Security Sheild was preventing me from being able to run Malwarbytes in non safe mode, so I ran it once in Safe Mode, then again in Safe Mode with Networking. Both scans removed several threats. I then tried to boot up normally to run Malwarbytes again and both Security Sheild and Disk Optimizer were still active, Security Sheild again was, again, preventing me from running Malwarebytes. I booted again in safe mode and ran Malwarebytes again, it found and removed 1 threat. I booted up normally this morning and it appears Security Sheild is now gone, I was able to open Malwarebytes, and I didn't see the Blue Sheild on my tray. I did see Disk Optimizer still on my desktop, and in Program Files. I had to leave for work, so I shut the PC down.

It's my intention to run Malwarebytes again when I get home to try and get rid of the Disk Optimizer which is still hanging around.

I guess that I'm having the same problem as the OP. Disk Optimizer came with Security Sheild, or maybe Security Sheild came with Disk Optimizer. Malwarebytes hasn't detected Disk Optimizer when run in safe mode, is it possible that this is something that will only be detected when running Malwarebytes in non safe mode?

Thanks!

[Firefox]

@ zanth07

Hi, and Welcome to Malwarebytes!

Malwarebytes was designed to be run in Normal mode for best detection rates and removal. Even though it will run in Safe Mode it is only recommended to do so under the advice form the Experts on this forum.

If you want help with the cleanup process of your computer please follow the instructions below.

Please read the following so that you can begin the cleaning process:

As we don't deal with malware removal in the General Malwarebytes' Anti-Malware Forum, you need to start a topic in the Malware Removal forum so a qualified helper can help you fix any malware related problems/infections you may have.

• Please read and follow the directions here, skipping any steps you are unable to complete. Then post a NEW topic here.
  
• After posting your new post, make sure under options, you select Track this topic and choose Immediate Email Notification, so that you're alerted when someone has replied to your post.
  
• One of the expert helpers there will give you one-on-one assistance when one becomes available.
  
• Please refrain from making any further changes to your computer (Install/Uninstall programs, use special fix tools, delete files, edit the registry, etc...) unless advised by a malware removal helper. Doing so can result in system changes which may hinder the attempts by a helper to clean your machine.
  

NOTE: Please DO NOT post back to (bump) your topic within the first 48 hours.

Replying to your own posts changes the post count and helpers are looking for topics with zero replies. If you reply to your own post helpers may think that you're already being helped and thus overlook your post.

• • If there is no reply from any experts after 48 hours, you can reply to the topic, asking for help again.
    Or
    
  • You may send a Private Message to a Moderator asking for assistance.
    

Alternatively, as a paying customer, you can contact the help desk at support@malwarebytes.org or here.

Please be patient, someone will assist you as soon as it is possible.

PS: Please use the "ADDREPLY" button instead of other ones when you start replying.

[TeMerc]

Malwarebytes hasn't detected Disk Optimizer when run in safe mode, is it possible that this is something that will only be detected when running Malwarebytes in non safe mode?

Thanks!

Unless otherwiase instructed always run Malwarebytes in normal Windows mode. Our software id designed to detect all threats as they're loaded into memory, safe mode will not always load all components of malware infections

[zanth07]

Thanks Firefox, thanks TeMerc.

I ran Malwarebytes in safe mode because I couldn't do it regularly, the Security Sheild kept blocking Malwarebytes from coming up, and I couldn't get on the internet to come to the forums either. I really had no choice but to boot up in safe mode. I had no other access to the internet, and figured running the program in safe mode, where I could actually do it, would be better than nothing.

When I booted the system up regularly this morning, it appeared as if Malwarebytes will be able to run, but I couldn't do it then as I had to leave for work. I'll take my work laptop home with me in case the virus keeps me from getting on the internet again tonight, so that I can follow the advice that you've given me.

I'm sorry if I've done something wrong.

Zanth07

[Firefox]

zanth07, we look forward to continuing with you in the HJT section should it be necessary.

When you get home, update Malwarebytes so you are scanning with the latest database, then run a scan in Normal Mode and see if it finishes and cleans up the Disk Optimizer for you.

Let us know how it goes....