System Security 4.51 Infection

strappyblues · May 16, 2009

My computer is infected with System Security 4.51. I was unable to run any programs, I could not look at the task manager to stop any suspcious processes nor could I use the add and remove programs to remove any applications.

I did an Internet search on an uninfected computer and found a site that directed me to the all users/application data folder, I started the computer in safemode with dos and I removed two suspicous directories and its contents. The directories were: all users\application data\12297964 and all users\application data 92307956

I know have control of my computer and I used the list of program to uninstall from your site to remove Viewpoint. System Security showed up but when I tried to remove it, it said it was already gone. I have an old version of java on the computer and I removed that. The current version was also on the computer.

Msconfig is set for normal setup. I have emptied the recycle bin.

I have run CCleaner on all accounts including the Administrator account.

I have followed all the steps listed. My logs are attached. Please review.

Thank you.

Strappyblues

dr.moriarty · May 18, 2009

Welcome to MajorGeeks!

I am currently reviewing your logs and will get back to you with a set of instructions as soon as possible. Our queue is working the oldest threads first.

Thanks for your patience.
dr.m

dr.moriarty · May 25, 2009

Hello, strappyblues.

The below fixes are specific to your problem and should only be used for issue(s) on this machine. Also, please do not install any other software while we are still working with you unless instructed. Once we have given you the all clean and final instructions you will be free to install what you want.

*Comment: Giving all users of this pc "Adminstrator Accounts" is bound to lead to problems.

Step 1:
Please look in Add/Remove Programs for the following and uninstall if found. If you get any errors just make a note and proceed

Java(TM) 6 Update 11
Click to expand...

Step 2:
Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

Note: We don't recommend having any entries in your Trusted Zone unless absolutely necessary - so fix these as well.
O15 - Trusted Zone: *.cdcovers.cc
O15 - Trusted Zone: http://*.mcafee.com
Click to expand...

After clicking Fix, exit HJT.

Step 3:
Open Ccleaner - select "Cleaner" > "Run Cleaner" <---use this function ONLY!

Step 4:
Now install the latest Sun Java Runtime Environment

Step 5:
Now go to this link MGTools and download the new version of MGtools....overwrite your previous MGtools.exe file with this one.

Then run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, use right click and select Run As Administrator).

Attach the below log to your next reply:

C:\MGlogs.zip

Make sure you tell me if you had any problems running this procedure and give a description of how things are working now!

dr.m

strappyblues · May 26, 2009

Dr. M,

Thanks for your assistance.

I followed all your instructions in order. I did not encounter any problems. I did reduce the rights of one user to a Power User.

The computer seems to be working well. Attached is my latest log.

I will wait for the all clean.

Thanks again.

strappyblues

dr.moriarty · May 28, 2009

Hello again, strappyblues

Please refer to this guide for dealing with controlling your startups:
Dealing with Startup Processes

Your logs look good! If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significan amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (=This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combofix folder from combofix (if it exists)

If we had you run Avenger, you can delete all files related to Avenger now.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware

Click to expand...

Safe surfing!

Log in or Sign up

System Security 4.51 Infection

strappyblues Private E-2

Attached Files:

SUPERAntiSpyware Scan Log - 05-16-2009 - 09-46-40.log

mbam-log-2009-05-16 (10-48-15).txt

combofix.txt

MGlogs.zip

dr.moriarty Malware Super Sleuth Staff Member

dr.moriarty Malware Super Sleuth Staff Member

strappyblues Private E-2

Attached Files:

MGlogs.zip

dr.moriarty Malware Super Sleuth Staff Member

Log in or Sign up

System Security 4.51 Infection

strappyblues Private E-2

Attached Files:

SUPERAntiSpyware Scan Log - 05-16-2009 - 09-46-40.log

mbam-log-2009-05-16 (10-48-15).txt

combofix.txt

MGlogs.zip

dr.moriarty Malware Super Sleuth Staff Member

dr.moriarty Malware Super Sleuth Staff Member

strappyblues Private E-2

Attached Files:

MGlogs.zip

dr.moriarty Malware Super Sleuth Staff Member

Useful Searches