Windows Recovery/Resident Shield virus

[jc8036]

Hi,

This morning my computer got infected with a windows recovery virus (there were fake "Threat warning" windows and a bogus "Windows Vista recovery" application, and it hid a lot of files, deleted shortcuts etc). I used malwarebytes to successfully remove most of it, however there is a file which returns every time malwarebytes removes it. The logs are here. Any help you could give me would be wonderful! Thanks in advance.

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6711

Windows 6.0.6001 Service Pack 1

Internet Explorer 7.0.6001.18000

29/05/2011 12:58:49

mbam-log-2011-05-29 (12-58-49).txt

Scan type: Quick scan

Objects scanned: 38640

Time elapsed: 1 minute(s), 45 second(s)

Memory Processes Infected: 1

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

c:\programdata\utyutxppbb.exe (Trojan.FakeMS) -> 4012 -> Unloaded process successfully.

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UtYUtxpPbB (Trojan.FakeMS) -> Value: UtYUtxpPbB -> Quarantined and deleted successfully.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\programdata\utyutxppbb.exe (Trojan.FakeMS) -> Quarantined and deleted successfully.

******************************The DDS log

.

DDS (Ver_11-05-19.01) - NTFSx86

Internet Explorer: 7.0.6001.18000

Run by Admin at 16:31:46 on 2011-05-29

Microsoft

Attach.zip

ark.zip

[screen317]

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

• When the tool is finished, it will produce a report for you.
  
• Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

[jc8036]

Hi Chris,

Thanks for the reply! Here's the MBAM log:

ComboFix 11-05-31.01 - Admin 31/05/2011 22:03:44.1.1 - x86

Microsoft

ComboFix.txt

Attach.txt

[screen317]

Hi,

Next, please run a free online scan with the ESET Online Scanner

Note: You will need to use Internet Explorer for this scan.

1. Tick the box next to YES, I accept the Terms of Use.
   
2. Click Start
   
3. When asked, allow the ActiveX control to install
   
4. Click Start
   
5. Make sure that the options Remove found threats and the option Scan unwanted applications is checked
   
6. Click Scan
   Wait for the scan to finish
   
7. Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
   
8. Copy and paste that log as a reply to this topic
   

Next, download my Security Check from here or here.

• Save it to your Desktop.
  
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.
  

Let me know how things are running now and what issues remain.

-screen317

[jc8036]

Hi Chris,

I tried to use the ESET scanner but it couldn't run because of anti-virus software (I've tried to disable everything I can find but it still couldn't run). However in the process I ran Malwarebytes quite a lot an eventually the threat it detected did stop appearing, so I guess it was finally removed?

Thanks so much for all your help!

[screen317]

Try this online scanner instead please:

Next, please use the Internet Explorer browser and click here to use the F-Secure Online Scanner.

• Click Start Scanning.
  
• You should get a notification bar (on top) to install the ActiveX control.
  
• Click on it and select to install the ActiveX.
  
• Once the ActiveX is installed, you should accept the License terms by clicking OK below to start the scan.
  
• In case you are having problems with installing the ActiveX/starting the scan, please read here.
  
• Click the Full System Scan button.
  
• It will start to download scanner components and databases. This can take a while.
  
• The main scan will start.
  
• Once the scan has finished scanning, click the Automatic cleaning (recommended) button
  
• It could be possible that your firewall gives an alert - allow it, because that's a connection you establish to submit infected files to F-Secure.
  
• The cleaning can take a while, so please be patient.
  
• Then click the Show report button and Copy/Paste what is present under results in your next reply.
  

Next, download my Security Check from here or here.

• Save it to your Desktop.
  
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  
• A Notepad document should open automatically called checkup.txt; please post the contents of that document.
  

Let me know how things are running now and what issues remain.

-screen317

[screen317]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!