Tr/Trash Gen Vundo AGAIN

[Sooz]

Jean in Montana--

You cut me off last time so I am back since this issue isn't quite resolved (see below on original response from you). I am a relative newbie to this stuff, which should be obvious, and I very much do not deserve your reprimand -- I neither have the skills, motivation or the interest to fool you. I was most appreciative of your help two weeks ago after a *different* Vundo infection so the very day I got your response I tried to implement your suggestions to prevent another infection. This is what I did per your suggestions that day: purchased MBAM, installed Avira Anti-Virus (dropped F-Prot), installed Online Armor, installed Secunia (nifty program!), and installed Spywareblaster. This last one confused me because it never loaded into memory at startup (not an option either) and I remember some kind of notice that it works without doing so which makes no sense to me at all. I put that item on my computer to-do list to work on later. I already have Spybot Search & Destroy but do not use it for prevention since I have only 1 gb memory. I have to balance protection with functionality -- have learned that too many programs that load on startup really impact speed and performance (have really tried hard to trim that list down to bare minimum). Since I implemented much of what you suggested I thought that was a reasonable course of action given my memory restrictions.

And I most definitely DID reset System Restore that day!!! In fact, I bet I can copy that page to prove I did. So how I got this new Trash Gen (rootkit) bugger I don't know but my plan now is to see if I can disinfect it since I only asked Avira to quarantine it (renamed). Then I will reset the System Restore AGAIN and do another scan. Then I will get to figuring out why Spywareblaster won't load in memory. You don't have to help me with this stuff, only just don't be so darn jaded that some jerk is always trying to fool you (I bet a professional hazard working in the spyware business). For me I am most appreciative of the help I have gotten here which is reflected in purchasing the program and implementing as much of what was recommended as I thought possible given my resources. Thanks, Sue

Sooz Avira cleaned the trojan it shows in the log. It was located in your system restore. If you had done as you say and implemented the prevention things I mentioned, they would show up in your HJT log, at least some would, and none do. There is no Spybot Search & Destroy, no WinPatrol and I'm betting you didn't install SpywareBlaster or a hosts file. you didn't reset System Restore or Avira woudn't have found a trojan there. In other words, you didn't do much you were advised. Here is my final advice to you.

Turn on the root scan in Avira you have it off.

Choose a secondary action for any found threats. Ignore is not a good one, choose repair, remove something. Don't try to fool the people that help you.

[JeanInMontana]

You need to go to the proper forum and post the logs, if you do indeed have new things showing in an MBAM scan. But as I said, your not infected by what Avira is telling you. You jump to conclusions because you don't understand what the program is saying, and you don't follow instructions, you argued about whether updating MBAM was going to help during the clean up. Learn how your programs work. This is part of the instructions you didn't follow.

Read the overviews of what each program below does so you have an understanding of their importance and how to use.

I stand by my statement, if you had cleaned all Restore points no malware could be found in them. The Avira log showed stuff found in System Restore, it was removed moved to quarantine renamed and awaits your deletion. Turn on the rootkit scan, choose a second action when malware is found.

I already have Spybot Search & Destroy but do not use it for prevention since I have only 1 gb memory. I have to balance protection with functionality -- have learned that too many programs that load on startup really impact speed and performance (have really tried hard to trim that list down to bare minimum). Since I implemented much of what you suggested I thought that was a reasonable course of action given my memory restrictions.

1 gig of memory is huge. You are NOT limited, and again, you don't know what SBS&D does, or how the protection works, it uses nothing from system resources. Immunize! If you would just do as you have been advised and not double guess or assume, you would be fine. SpywareBlaster doesn't load into memory, if you had read the program details in the instructions you would know that. I make all recommendations based on how the system will be affected, cost, which is free and how well it will save someone. Secunia will scan for stuff known to be exploitable if not updated. It will not protect you if you don't update what it tells you is in need of that. It is not a stand alone program.

I might be a bit jaded, and I lose patience when people will not read and follow instructions. I tend to be short and to the point, I have lots to do in a short time. Sorry if you were offended that was not my intention.

[Sooz]

You need to go to the proper forum and post the logs, if you do indeed have new things showing in an MBAM scan. But as I said, your not infected by what Avira is telling you. You jump to conclusions because you don't understand what the program is saying, and you don't follow instructions, you argued about whether updating MBAM was going to help during the clean up. Learn how your programs work. This is part of the instructions you didn't follow.

I stand by my statement, if you had cleaned all Restore points no malware could be found in them. The Avira log showed stuff found in System Restore, it was removed moved to quarantine renamed and awaits your deletion. Turn on the rootkit scan, choose a second action when malware is found.

1 gig of memory is huge. You are NOT limited, and again, you don't know what SBS&D does, or how the protection works, it uses nothing from system resources. Immunize! If you would just do as you have been advised and not double guess or assume, you would be fine. SpywareBlaster doesn't load into memory, if you had read the program details in the instructions you would know that. I make all recommendations based on how the system will be affected, cost, which is free and how well it will save someone. Secunia will scan for stuff known to be exploitable if not updated. It will not protect you if you don't update what it tells you is in need of that. It is not a stand alone program.

I might be a bit jaded, and I lose patience when people will not read and follow instructions. I tend to be short and to the point, I have lots to do in a short time. Sorry if you were offended that was not my intention.

You are not the only one with a busy life. This has taken me several hours to figure out and complete -- it's been quite a journey. What you can simply do in a few minutes with your eyes closed takes a newbie far longer and often with frustration or puzzlement. OK, I will get out of your hair now -- case closed. Thanks, Sue

[JeanInMontana]

Following instructions saves lots of time.