Am I still infected?

[jamie89]

My computer has just been infected with Trojan.FakeAlert and Spyware.Passwords.XGen the logs for which I have included along with the latest quick scan log. My problem is that although the quick scan was clean my computer is noticeably slower, I

attach.zip

[screen317]

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, download DDS by sUBs and save it to your Desktop.

Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post only DDS.txt directly into your reply.

[jamie89]

Thanks for the help, here is the MBAM log and DDS.txt as requested.

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6714

Windows 6.0.6002 Service Pack 2

Internet Explorer 9.0.8112.16421

29/05/2011 15:31:45

mbam-log-2011-05-29 (15-31-45).txt

Scan type: Quick scan

Objects scanned: 259511

Time elapsed: 14 minute(s), 18 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

DDS (Ver_2011-05-26.01) - NTFS_x86

Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_24

Run by James at 15:32:09 on 2011-05-29

Microsoft

[screen317]

Please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

• When the tool is finished, it will produce a report for you.
  
• Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

[jamie89]

ComboFix 11-06-01.07 - James 02/06/2011 20:19:38.1.2 - x86

Microsoft

[screen317]

Hi,

Next, please run a free online scan with the ESET Online Scanner

Note: You will need to use Internet Explorer for this scan.

1. Tick the box next to YES, I accept the Terms of Use.
   
2. Click Start
   
3. When asked, allow the ActiveX control to install
   
4. Click Start
   
5. Make sure that the options Remove found threats and the option Scan unwanted applications is checked
   
6. Click Scan
   Wait for the scan to finish
   
7. Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
   
8. Copy and paste that log as a reply to this topic
   

Next, download my Security Check from here or here.

• Save it to your Desktop.
  
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.
  

Let me know how things are running now and what issues remain.

-screen317

[jamie89]

Hi, I ran ESET Online Scanner and Security Check. For some reason ESET Online Scanner didn

[jamie89]

Something else I

[screen317]

Hi,

Nah it's probably just a version I don't check for. What version of McAfee do you use?

Please download ATF Cleaner by Atribune from here, and save it to your Desktop.

Double click ATF-Cleaner.exe to run the program.

Check the boxes to the left of:

Windows Temp

Current User Temp

All Users Temp

Temporary Internet Files

Java Cache

The rest are optional - if you want to remove the whole lot, check Select All.

Finally click Empty Selected. When you get the "Done Cleaning" message, click OK.

Navigate to Start --> Run, and type Combofix /uninstall in the box that appears. Click OK afterward. Notice the space between the X and the /uninstall

This uninstalls all of ComboFix's components.

Delete SecurityCheck.

After that, navigate to Start --> Control Panel --> Add or Remove Programs, and uninstall the following program (if present):

ESET Online Scanner v3

Java

[screen317]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

[screen317]

Topic re-opened at request of topic starter.

[jamie89]

Hi, sorry for the added complication. I got yet another virus in the temporary internet folder so I ended up running combofix and ESET again as well as full scans with MBAM and McAfee none of which turned up anything so hopefully it

[screen317]

Hi,

Yes it's flagging ComboFix's folder.

Download my Security Check from here or here.

• Save it to your Desktop.
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.

[jamie89]

Results of screen317's Security Check version 0.99.12

Windows Vista Service Pack 2 (UAC is enabled)

Internet Explorer 8

``````````````````````````````

Antivirus/Firewall Check:

Windows Firewall Enabled!

ESET Online Scanner v3

McAfee Security Scan Plus

WMI entry may not exist for antivirus; attempting automatic update.

```````````````````````````````

Anti-malware/Other Utilities Check:

Malwarebytes' Anti-Malware

Java 6 Update 26

Adobe Flash Player

Adobe Reader X (10.1.0)

````````````````````````````````

Process Check:

objlist.exe by Laurent

``````````End of Log````````````

[screen317]

Hi,

Navigate to Start --> Run, and type Combofix /uninstall in the box that appears. Click OK afterward. Notice the space between the X and the /uninstall

This uninstalls all of ComboFix's components.

Delete SecurityCheck.

After that, navigate to Start --> Control Panel --> Add or Remove Programs, and uninstall the following program (if present):

ESET Online Scanner v3

Adobe Flash Player

Restart your computer.

Get the latest version of Adobe Flash Player.

Let me know what issues remain.

-screen317

[jamie89]

Hi, I’ve followed your instructions. Adobe Flash Player is actually up to date but hasn’t been working properly since I uninstalled and then reinstalled it a couple of weeks ago, and after several hours of failing to get it working I’ve given up on it until a new update comes out. I’m surprised your program picked up on it as both Adobe’s website and Secunia seem to think it’s working and up to date. Apart from Flash Player everything seems fine now so is it ok to use DeFogger to re-enable the emulation drivers?

[screen317]

Yes feel free to enable Defogger.

I highly recommend the PRO version of MBAM; with it, it's likely that this issue would have been prevented in the first place.

Now that your computer seems to be in proper working order, please take the following steps to help prevent reinfection:

1) Download and install Javacool's SpywareBlaster, which will prevent malware from being installed on your computer. A tutorial on it can be found here.

2) Go to Windows Update frequently to get all of the latest updates (security or otherwise) for Windows.

3) Make sure your programs are up to date! Older versions may contain security risks. To find out what programs need to be updated, please run Secunia's Software Inspector.

4) WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:

• Green to go
  
• Yellow for caution
  
• Red to stop
  

WOT has an addon available for both Firefox and IE.

5) Be sure to update your Antivirus and Antispyware programs often!

Finally, please also take the time to read Tony Klein's excellent article on: So How Did I Get Infected in the First Place?

Safe surfing,

-screen317

[jamie89]

Ok, thank you very much for all your help, I really appreciate the effort and I hate to think what state my computer would be in without your assistance. I installed Secunia a few days ago and I will look over the other links in the next few days.

[jamie89]

Just when I thought my computer was fine it has gone wrong again in spectacular style. McAfee anti-virus and firewall and windows defender crashed / switched themselves off and then the whole computer crashed. The boot screen suggested there was a problem with one of the hard drives and ran check disk and I’m still unsure if the problem is resolved. The problem might be something to do with AxCrypt a piece of software for encrypting and password protecting folders (as it turns out it wasn’t even the right thing as all I was looking to do was password protect my external hard drive not encrypt it) which id just installed and was running however as far as I can tell AxCrypt is legitimate. I’ve run a full system scan with MBAM and it found nothing however all my ant-virus software and firewalls switching themselves off seems to suggest there must be some kind of problem with a virus. I’ve spent the last few hours trying to work out what’s wrong and I’m pretty much tearing my hair out by this point.

[screen317]

Sounds like you hard drive may be beginning to fail. I suggest backing up your data and getting a new one.

[jamie89]

Yeah, having looked into it a bit further I have a horrible feeling you may be right. Still I’ve got everything backed up so I’m going to try my best to learn to fix it before considering a new one, anyways thanks again for all the help before.

[screen317]

My pleasure to help and I hope you get it sorted out one way or another.

[screen317]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!