Fake "Firewall Warning" alert and msg. about dlactrlw.exe- is it fixed?

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by AndrewC, Jan 20, 2011.

  1. AndrewC

    AndrewC Private E-2

    Hi-

    We have a PC that was showing the fake "Firewall Warning" and messages about "dlacrtlw.exe" being infected, as well as messages about private info being stolen over the Internet.

    I tried to go through the WinXP cleaning process, but as soon as I launched any executable, the malware killed it immediately. It turned off Symantec Endpoint protection, and would not allow me to launch Task Manager or Regedit.

    Finally, I logged on as a different user and was able to go through the WinXP cleaning process. Logging on as the originally infected user appears OK now, but I'm uneasy.

    Should I go ahead and re-run all the steps of the cleaning process logged in as the originally infected user? I have not yet toggled System Restore.

    Could someone take a look at my logs and recommend my next step?
    Thank you.
     

    Attached Files:

    AndrewC, Jan 20, 2011
    #1
  2. AndrewC

    AndrewC Private E-2

    Remaining Logs

    Here is the remaining log.

    It appears I misread the instructions, and I ran MGTools from the Desktop. Let me know if I need to re-run it.

    Thanks.
     

    Attached Files:

    AndrewC, Jan 20, 2011
    #2
  3. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Yes please. :)
     
    Kestrel13!, Jan 20, 2011
    #3
  4. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    FilmFanatic <--- Uninstall this unless you actually use it.
     
    Kestrel13!, Jan 20, 2011
    #4
  5. AndrewC

    AndrewC Private E-2

    OK, I'll go ahead and re-run the scans. Will take awhile.

    I had actually gone ahead and un-installed that Film Fanatic nonsense. Amazing what users install without even intending to! ;-)

    Will get back to you after the scans finish.
     
    AndrewC, Jan 20, 2011
    #5
  6. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Alright. I will be here floating about somewhere. :)
     
    Kestrel13!, Jan 20, 2011
    #6
  7. AndrewC

    AndrewC Private E-2

    Hey Kestrel-

    I re-ran SAS and MBAM successfully, but I'm having trouble with ComboFix.

    I placed it on the Desktop and ran it. I received an error message stating something about "n.pif - Application Error", something about trying to write to memory that couldn't be written to? The message went away before I could get it all down. I ignored the error, since the same thing happened earlier when I was running under the other account. BTW, both accounts have Admin rights.

    At that point, the ComboFix box with the progressbar came up, and the window that tells you where you can download CF. I clicked OK (or is it Yes?)--then it just went away. I did receive warnings about disabling Symantec Endpoint Protection, which I did, then retried. Sometimes I get the progressbar window, sometimes nothing; but I can't get anything past that to show up anymore.

    I am continuing with the rest of the procedures.
     
    AndrewC, Jan 20, 2011
    #7
  8. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Yes. Continue on. :)
     
    Kestrel13!, Jan 20, 2011
    #8
  9. AndrewC

    AndrewC Private E-2

    OK, some of the programs reported malware.

    Logs are attached.

    I will see if ComboFix appears to have created any logs and will attch them if so.

    Thanks!
     

    Attached Files:

    AndrewC, Jan 20, 2011
    #9
  10. AndrewC

    AndrewC Private E-2

    Nope, the only ComboFix log is from earlier today when I was logged in as the other user (Administrator).
     
    AndrewC, Jan 20, 2011
    #10
  11. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    I am not seeing much to take care of.

    delete these folders using windows explorer.
    • C:\Program Files\FilmFanaticEI
    • C:\Program Files\FilmFanatic

    Run Ccleaner. Only use the Run Cleaner button. Do not run anything else on any other forms.

    Before we wrap up, just tell me how things are running on this account.
     
    Kestrel13!, Jan 21, 2011
    #11
  12. AndrewC

    AndrewC Private E-2

    Kestrel-

    Thanks, I have taken care of those last couple steps. Everything seems OK now.

    Time to toggle System Restore?
     
    AndrewC, Jan 21, 2011
    #12
  13. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     
    Kestrel13!, Jan 21, 2011
    #13
  14. AndrewC

    AndrewC Private E-2

    OK, I have finished the final steps. Thanks for your help.

    BTW, what was the name of the malware we had, do you know?

    Thanks again.
     
    AndrewC, Jan 21, 2011
    #14
  15. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    You can check the Malware Bytes log yourself to see.

    You're welcome.
     
    Kestrel13!, Jan 21, 2011
    #15

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds