Antivirus 2010 pop ups

kocoa_brown317 · Mar 20, 2010

Hi and thanks in advance for looking over my logs...

I had to use the Read and Run me a couple of weeks ago for redirect problems and Antivirus 2010 pop ups...Everything seemed fine after, but now i'm thinking that i didn't clean everything..

Anyway yesterday i was sent an email and before i could open it i got a pop up saying my pc was infected...It was that Antivirus 2010
Now my inbox is full of spam and my spam folder is were my trusted emails are...

here are my logs for some reason i couldnt run MGtools

kocoa_brown317 · Mar 21, 2010

i just realized i had to run mgtools under safe mode...here is the attachment

TimW · Mar 21, 2010

I am not seeing anything in your logs. Your emails will have to be sorted out by you. As a general guide:

Malware detected in email databases has to be cleaned up by you. You have a few choices:

1. delete the whole file which is not an option you normally want to use
2. load the email folder that contains the infection and delete ALL unnecessary emails (hoping to remove the problem email) and then use the Mailbox Cleanup option to delete all old emails. Then compact the Outlook database to permanently remove data. See http://support.microsoft.com/kb/196990 If you do not cleanup and compact the databases, the deleted emails may still be leaving hidden information in the database that you just cannot see but a scanner may still pickup on it.
3. create a new folder and move only emails you really need into the new folder and then delete the infected folder.
Click to expand...

Why can't you run MGTools.exe in normal mode? Or can you? Boot to normal mode and:

Run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

Then attach the below logs:
* C:\MGlogs.zip

chaslang · Mar 21, 2010

TimW said: ↑

Why can't you run MGTools.exe in normal mode?
Click to expand...

Because instructions were not properly followed for running it with Vista.

UAC was not disabled and followed by a reboot. The runkeys.txt log shows the below

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=dword:00000001
Click to expand...

which means UAC is still enabled.

TimW · Mar 21, 2010

Good catch Chas!

Log in or Sign up

Antivirus 2010 pop ups

kocoa_brown317 Private E-2

Attached Files:

ComboFix log.txt

mbam.txt

RootRepeallog.txt

SAS.log

kocoa_brown317 Private E-2

Attached Files:

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member