Am I clean?

Lee_W · Jul 30, 2009

The computer in question here is a dual boot system - via GRUB - between Windows XP Professional SP3 and Ubuntu 9.04 Linux if it makes any difference.

In April I got whacked with spyware that completely took over all of my windows computers on the network. One by one I have been low level formatting the drives and trying to rebuild the systems. The drives on this particular computer are brand new. I have been careful to not network any of the machines together until I am perfectly sure that they are not infected.

I am running Avast on the windows partition and a couple of days ago Avast identified Windows\system32\svchost.exe as a rootkit and then reported that it could not delete it. I shut the computer down and rebooted under Linux and deleted that file. I also deleted all of the temporary internet files, user temp files, and Windows\temp files.

I replaced the svchost.exe file from another installation of Windows XP through Linux by mounting the partition. I have BitDefender on the Linux installation and any file that I need to transfer between machines gets scanned with the BitDefender - through Linux - before I copy it to the Windows drives.

Also of note, CCcleaner identified around 150 broken links in the registry that pointed to oddly - seemingly random numbers and letters - named .dll files that were to be located in my temp folder under documents and settings.

I think I'm clean but a second opinion would be great. SuperAntiSpyware and MalwareBytes reported no problems whatsoever and I cannot locate their logs.

TIA,

...Lee

TimW · Aug 1, 2009

Your logs are clean. And just for your information, the SAS and MBAM logs are here:

C:\Documents and Settings\Lee\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\Logs\"
supera~1.log Jul 30 2009 465 "SUPERAntiSpyware Scan Log - 07-30-2009 - 22-16-58.log"

C:\Documents and Settings\Lee\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\"
mbam-l~1.txt Jul 30 2009 846 "mbam-log-2009-07-30 (22-48-40).txt"
Click to expand...

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real-time protection. They are useful as backup scanners.They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures in step 3 the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Log in or Sign up

Am I clean?

Lee_W Private E-2

Attached Files:

MGlogs.zip

rr.txt

ComboFix.txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member