Jump to content

Worm.AutoRun dedected in deleted User Account folder.

Recommended Posts

Today, when while trying to upload files to a website from my work computer I kept getting this error message from my Internet Explorer 9 browser -

A malfunctioning or malicious add-on has caused Internet Explorer to close this webpage.

It kept happening everytime I tried to upload something to and from a website. Also happened when I went to Wikipedia. Anyways, I did a malware scan and it found and deleted worm.autorun in folder of a User that no longer exists. I tried looking for this folder myself after restarting and couldnt find it anywhere on the hard drive even after doing a Windows search. Now this is the second time Malwarbytes detected worm.autorun on the same deleted User folder. The last time was a few months ago when my hotmail account started to automatically send out spam emails. I have since been able to prevent my email account from sending spam by changing my password.

Here is the log from today's scan:


Database version: 6085

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.19019

17/03/2011 8:24:59 AM

mbam-log-2011-03-17 (08-24-59).txt

Scan type: Quick scan

Objects scanned: 193110

Time elapsed: 8 minute(s), 4 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 1

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CLASSES_ROOT\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

c:\Users\MalouC\AppData\Local\Temp\E_4 (Worm.AutoRun) -> Quarantined and deleted successfully.

Files Infected:

(No malicious items detected)

Link to post
Share on other sites

  • Staff


Can you take a screenshot of the error please? Post it here.

Next, please visit this webpage for instructions for running ComboFix:


  • When the tool is finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.


Link to post
Share on other sites

  • Staff


Looking better!

Next, please run a free online scan with the ESET Online Scanner

Note: You will need to use Internet Explorer for this scan.

  1. Tick the box next to YES, I accept the Terms of Use.
  2. Click Start
  3. When asked, allow the ActiveX control to install
  4. Click Start
  5. Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  6. Click Scan
    Wait for the scan to finish
  7. Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  8. Copy and paste that log as a reply to this topic

Next, download my Security Check from here or here.

  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Let me know how things are running now and what issues remain.


Link to post
Share on other sites

  • Staff


Navigate to Start --> Run, and type Combofix /uninstall in the box that appears. Click OK afterward. Notice the space between the X and the /uninstall

This uninstalls all of ComboFix's components.

Delete SecurityCheck.

After that, navigate to Start --> Control Panel --> Add or Remove Programs, and uninstall the following program (if present):

ESET Online Scanner v3

Java 6 Update 24

Adobe Flash Player

Restart your computer.

Get the latest version of Java and Adobe Flash Player.

Also update Thunderbird; ensure that you're using version 6.

Let me know what issues remain.


Link to post
Share on other sites

  • 2 weeks later...
  • 3 weeks later...
  • Staff

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.