Please help - possibly infected with several trojans

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by geek342, Aug 25, 2010.

  1. geek342

    geek342 Private E-2

    When running a Malwarebytes' Anti-Malware quick scan yesterday, NOD32 detected the following when MBAM tried to access it for scanning:

    8/24/2010 6:43:29 AM Real-time file system protection file
    C:\Documents and Settings\Mike\Local Settings\Temp\plugtmp-4\plugin-Notes1.pdf

    JS/Exploit.Pdfka.OEG trojan

    cleaned by deleting - quarantined

    MIKESLAPTOP\Mike

    Event occurred during an attempt to access the file by the application: C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe.

    I then ran a NOD32 scan on C:\Documents and Settings\Mike\Local Settings\temp\ or C:\Documents and Settings\Mike\Local Settings\ (I forget which) and NOD32 detected these:

    C:\Documents and Settings\Mike\Local Settings\temp\jar_cache4444483575285538563.tmp » ZIP » yahoo/ConfMgr.class - probably a variant of Win32/Agent.LCXOUHW trojan
    C:\Documents and Settings\Mike\Local Settings\temp\jar_cache4444483575285538563.tmp » ZIP » yahoo/Informer.class - probably a variant of Win32/Agent.BURPDE trojan
    C:\Documents and Settings\Mike\Local Settings\temp\jar_cache7883339061517569415.tmp » ZIP » JavaUpdateManager.class - a variant of Java/Mugademel.A trojan

    I ran all of the steps of the Major Geeks READ & RUN ME FIRST Malware Removal Guide.

    NOTE: While running ComboFix, I thought I had the firewall and all antivirus and antispyware software disabled, but the ComboFix log says the firewall was enabled. There must have been a background Comodo firewall process running without my knowledge. I am not sure whether it interfered with anything, though I did not notice any problems.

    The first 4 logs are attached.

    Thanks!
     

    Attached Files:

  2. geek342

    geek342 Private E-2

    Here is the last log.

    Thanks!
     

    Attached Files:

  3. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I am not seeing any malware in your logs. As to what NOD found, it is hard to tell if it was truly malware or a false positive.

    If you want to delve a little further, do an online scan with Bit Defender>
    Using BitDefender Online Scan.
     
  4. geek342

    geek342 Private E-2

    Thanks, Tim!
     
  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You are most welcome.

    If you are not having any other malware problems, it is time to do our final steps:

    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.We recommend them for doing backup scans when you suspect a malware infection.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.


    3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.

    10. After doing the above, you should work thru the below link:




    Support MajorGeeks with Geek Wear!
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds