Unsure if clear of Ramnit virus and MGtools unable to create log.

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Mounse, Jul 12, 2012.

  1. Mounse

    Mounse Private E-2

    Hey all,

    Yesterday I was infected by the Ramnit virus so ran the recovery tools on my laptop (Lenovo G570) to reinstall the OS.

    Today MSE found it again, but on the partition used for system recovery (it was found in install files for various bits of bloatware) so I removed all infected files and ran full scans with MSE and ESET and neither has found any traces since but I wanted to make sure so followed the steps in the READ ME thread here.

    RogueKiller and HitmanPro both found something though unsure what it is.

    I would very much appreciate it if one of the experts could glance over the logs and let me know if I'm clear. For some reason MGTools seems unable to create the log file so obviously can't attach that.

    Also, if MSE found Ramnit after the recovery does this mean anytime I use the recovery in the future it's going to find it again or do the recovery images only format C:\ and now it's possibly gone from D:\ I'll be clear?

    Thanks in advance,

    Simon
     

    Attached Files:

    Mounse, Jul 12, 2012
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Major Geeks!
    Why not? Where did you look? It is the most useful tool for us when checking for Ramnit; however if neither MSE or ESET are finding any traces of Ramnit then you are probably okay and caught it before it spread too much.

    Your other logs were all clean.
     
    chaslang, Jul 13, 2012
    #2
  3. Mounse

    Mounse Private E-2

    As it runs at numerous points it displays:

    zip I/O error: Invalid argument
    zip error: Could not create output file <C:/MGlogs.zip>

    The individual logs may have been created so if you need certain reports I may be able to attach them.

    Thanks, looking promising so far then.
     
    Mounse, Jul 13, 2012
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Normally this happens due to any one or all of the below reasons:
    • UAC was not disable as requested
    • did not run as administrator as requested
    • did not shutdown protection software as requested.
    Were any of these the case? If so, please try again.
     
    chaslang, Jul 13, 2012
    #4
  5. Mounse

    Mounse Private E-2

    Okay, after uninstallling MSE and running from GetLogs.bat, eventually it managed to save the output.

    Thanks.
     

    Attached Files:

    Mounse, Jul 13, 2012
    #5
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Your logs are clean.


    If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase it, it provides no protection.
    3. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    6. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
      related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    10. After doing the above, you should work thru the below link:
     
    chaslang, Jul 13, 2012
    #6
  7. Mounse

    Mounse Private E-2

    That's good to hear.

    Thanks for all your help.
     
    Mounse, Jul 17, 2012
    #7
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Surf safely!
     
    chaslang, Jul 17, 2012
    #8

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds