AntiVir is finding problems

page28 · Feb 4, 2009

Yesterday I noticed the start menu looked different. There were fewer icons and they were smaller in size than they had been. I ran AntiVir (it had been a week since I last scanned) and it found three problems: WORM/Rbot.828744.2, TR/Agent.837200.B, and TR/Agent.886088.B. I put them in quarantine. I have since read and followed the malware removal steps (including emptying the quarentine folder). AntiVir now finds TR/Dldr.Java.Agent.C. I am attaching the first three logs to this message and will follow up with the other.

Thank you very much,
Page

page28 · Feb 4, 2009

My fourth set of logs.

TimW · Feb 7, 2009

It would appear that Avira is doing its job. Your logs are clean.

If you are not having any other malware problems, it is time to do our final steps:

We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They are useful as backup scanners. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combofix folder from combofix (if it exists)

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

page28 · Feb 8, 2009

Thanks so much Tim. Avira is still finding a possible problem. I'm not sure if it's a false positive or not though I think it probably is.

Virus or unwanted program 'TR/Dldr.Java.Agent.C [trojan]'
detected in file 'C:\Users\Page\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19\59e95193-30db2db0.

What do you think? Many thanks!

TimW said: ↑

It would appear that Avira is doing its job. Your logs are clean.

If you are not having any other malware problems, it is time to do our final steps:

We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They are useful as backup scanners. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combofix folder from combofix (if it exists)

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Click to expand...

TimW · Feb 10, 2009

You can remove it from the application data folder. It's nothing to worry about.

Log in or Sign up

AntiVir is finding problems

page28 Private E-2

Attached Files:

SUPERAntiSpyware Scan Log - 02-04-2009 - 10-38-33.log

mbam-log-2009-02-04 (11-26-44).txt

combofx_log.txt

page28 Private E-2

Attached Files:

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

page28 Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member