guys i have a wiered message that appears

tito335 · June 8, 2011

http://imageshack.us...mbamreport.jpg/

also i have a report of a recent scan and the removal was done by the help of one of avira's team .

and i already started topic but in general section so you may just delete it as i can't delete it.

also the removal report was done 2 days ago:

Malwarebytes' Anti-Malware 1.51.0.1200

www.malwarebytes.org

Database version: 6776

Windows 6.1.7600

Internet Explorer 9.0.8112.16421

6/6/2011 5:24:38 AM

mbam-log-2011-06-06 (05-24-3.txt

Scan type: Full scan (C:\|E:\|Q:\|)

Objects scanned: 326562

Time elapsed: 40 minute(s), 6 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 2

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

e:\rockstar games\GTAIII\grand theft auto 3 nocd.exe (RiskWare.Tool.CK) -> Not selected for removal.

c:\programdata\common.data (Malware.Trace) -> Quarantined and deleted successfully.

please help as the annoying message of the pic keeps on appearing but with different no. is also appearing while i open avira's

forum or this forum !!!!!!!!

also the no in the log which is between ( ) is missing so i'm gonna right it again

Malwarebytes' Anti-Malware 1.51.0.1200

www.malwarebytes.org

Database version: 6776

Windows 6.1.7600

Internet Explorer 9.0.8112.16421

6/6/2011 5:24:38 AM

mbam-log-2011-06-06 (05-24-38).txt

Scan type: Full scan (C:\|E:\|Q:\|)

Objects scanned: 326562

Time elapsed: 40 minute(s), 6 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 2

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

e:\rockstar games\GTAIII\grand theft auto 3 nocd.exe (RiskWare.Tool.CK) -> Not selected for removal.

c:\programdata\common.data (Malware.Trace) -> Quarantined and deleted successfully.

also the 3 new logs of the message in order :

10:38:29 Tito MESSAGE Protection started successfully

10:38:32 Tito MESSAGE IP Protection started successfully

21:36:41 Tito MESSAGE Protection started successfully

21:36:45 Tito MESSAGE IP Protection started successfully

22:04:47 Tito IP-BLOCK 173.192.105.217 (Type: outgoing, Port: 8)

22:29:08 Tito MESSAGE Protection started successfully

22:29:11 Tito MESSAGE IP Protection started successfully

02:53:06 Tito MESSAGE Protection started successfully

02:53:09 Tito MESSAGE IP Protection started successfully

02:55:19 Tito MESSAGE Scheduled update executed successfully

02:55:59 Tito MESSAGE IP Protection stopped

02:56:01 Tito MESSAGE Database updated successfully

02:56:02 Tito MESSAGE IP Protection started successfully

06:14:03 Tito MESSAGE Protection started successfully

06:14:06 Tito MESSAGE IP Protection started successfully

07:25:02 Tito MESSAGE Protection started successfully

07:25:05 Tito MESSAGE IP Protection started successfully

08:25:45 Tito MESSAGE Protection started successfully

08:25:48 Tito MESSAGE IP Protection started successfully

09:28:33 Tito MESSAGE Protection started successfully

09:28:37 Tito MESSAGE IP Protection started successfully

18:40:57 Tito MESSAGE Protection started successfully

18:41:01 Tito MESSAGE IP Protection started successfully

19:17:10 Tito MESSAGE Protection started successfully

19:17:14 Tito MESSAGE IP Protection started successfully

21:02:26 Tito MESSAGE Protection started successfully

21:02:30 Tito MESSAGE IP Protection started successfully

21:43:37 Tito IP-BLOCK 188.229.88.82 (Type: outgoing, Port: 49486, Process: iexplore.exe)

21:43:38 Tito IP-BLOCK 188.229.88.82 (Type: outgoing, Port: 49487, Process: iexplore.exe)

21:43:38 Tito IP-BLOCK 188.229.88.82 (Type: outgoing, Port: 49488, Process: iexplore.exe)

22:33:21 Tito IP-BLOCK 173.192.105.217 (Type: outgoing, Port: 8)

22:34:41 Tito IP-BLOCK 173.192.105.217 (Type: outgoing, Port: 8)

22:52:09 Tito MESSAGE Protection started successfully

22:52:12 Tito MESSAGE IP Protection started successfully

04:27:47 Tito MESSAGE Protection started successfully

04:27:50 Tito MESSAGE IP Protection started successfully

04:30:05 Tito MESSAGE Scheduled update executed successfully

04:30:47 Tito MESSAGE IP Protection stopped

04:30:49 Tito MESSAGE Database updated successfully

04:30:49 Tito MESSAGE IP Protection started successfully

04:37:22 Tito IP-BLOCK 188.229.88.82 (Type: outgoing, Port: 49271, Process: iexplore.exe)

04:37:22 Tito IP-BLOCK 188.229.88.82 (Type: outgoing, Port: 49270, Process: iexplore.exe)

04:37:22 Tito IP-BLOCK 188.229.88.82 (Type: outgoing, Port: 49272, Process: iexplore.exe)

04:37:22 Tito IP-BLOCK 188.229.88.82 (Type: outgoing, Port: 49273, Process: iexplore.exe)

also the removal of the files step by step was in this topic : at avira if it helps:

http://forum.avira.com/wbb/index.php?page=Thread&threadID=131600

screen317 · June 11, 2011

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, download DDS by sUBs and save it to your Desktop.

Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post only DDS.txt directly into your reply.

screen317 · June 17, 2011

Are you still with us?

tito335 · June 20, 2011

Are you still with us?

actually i was helped again by the avira's team

sorry but my pc was getting worse every minute

and they helped me you can follow the avira's link to see if it was done or it needs another thing

http://forum.avira.com/wbb/index.php?page=Thread&postID=1085828

they told me it is a hijack over dns ,something like that (a side effect of a malware infection)

but i have a question regarding the same detection

as one of the detections was moved to quarentine (days ago)

and i wanted to completely delete it from quarentine section

so i clicked delete and it was gone

so how do i make sure (or double check) that i pressed delete and not restore ''important''

as it didn't confirm me with a message like ( are you sure you want delete)

any way here is a recent scan report

and

Malwarebytes' Anti-Malware 1.51.0.1200

www.malwarebytes.org

Database version: 6897

Windows 6.1.7601 Service Pack 1

Internet Explorer 9.0.8112.16421

6/20/2011 3:13:53 PM

mbam-log-2011-06-20 (15-13-53).txt

Scan type: Quick scan

Objects scanned: 162912

Time elapsed: 2 minute(s), 57 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

screen317 · June 23, 2011

Hi,

If you restored it, it would be getting detected again.

Are you experiencing any further issues?

tito335 · June 23, 2011

Hi screen 317

thanks a lot

to double check i applied a full scan and it wasn't there

2- i'm not experiencing any issues any more except once

when my computer started and task bar blinked while for a second and it was back to normal but

the language icon remained white untill you press it and i restarted pc and it was back to normal again.

http://imageshack.us/photo/my-images/220/desktopwiered.jpg/

that's all

screen317 · June 27, 2011

Is it still changed? You said it was normal after a restart.

tito335 · July 4, 2011

yes it was back to normal but i have another issues see the post link

does this related to any kind of security threats?

also while i use internet and reading info like(on avira's forum) sometimes i notice the blue loading arrow of the mouse

while the page is not loading shall i worry?

sorry for the delay but i have some issues regarding sp2 of avira and i was very busy...

also how do i check my whole computer from threats?

the issues are here issues here :

http://forums.malwarebytes.org/index.php?&showtopic=88729

thanks

please reply

screen317 · July 6, 2011

Hi,

No I do not see anymore infections. Continue in your other topic and hopefully you can get your other issues resolved.

tito335 · July 7, 2011

thanks a lot and i will

but i have one more question how do i make sure that i don't have a threat

i always run full system scan via mbam and avira personal

do i need any other app to double check ?

just a check up.

screen317 · July 11, 2011

Hi,

I highly recommend the PRO version of MBAM; with it, it's likely that this issue would have been prevented in the first place.

1) Download and install Javacool's SpywareBlaster, which will prevent malware from being installed on your computer. A tutorial on it can be found here.

2) Go to Windows Update frequently to get all of the latest updates (security or otherwise) for Windows.

3) Make sure your programs are up to date! Older versions may contain security risks. To find out what programs need to be updated, please run Secunia's Software Inspector.

4) WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:

Green to go
Yellow for caution
Red to stop

WOT has an addon available for both Firefox and IE.

5) Be sure to update your Antivirus and Antispyware programs often!

Finally, please also take the time to read Tony Klein's excellent article on: So How Did I Get Infected in the First Place?

Safe surfing,

-screen317

screen317 · August 5, 2011

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

guys i have a wiered message that appears

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information