FakeAlert

GermWarfare · Jun 17, 2009

Hello:

My wife opened something today from an email that a friend of hers had sent her. I think she was taken to a website and then told to install something in order to view a video. Of course, after she did this, she got an email from said friend saying "don't open any emails from me, I'm infected!" or something to that effect...

Anyway, she started getting messages from AVG (Free 8.5.364) regarding FakeAlert and FakeAlert.KJ, she had popups stating something to effect of "You are infected! Click here to fix this!", and then popups with porn stuff.

I ran through the entirety of the malware guide here and I did have a problem with getting RootRepeal to run (kept getting errors). Otherwise, things seem to be OK now... but would like to post my logs to see if there is anything further I ought to do.

Thank you.

GermWarfare · Jun 17, 2009

And the logs from RootRepeal (which gave errors).

Thank you for your help.

GermWarfare · Jun 17, 2009

And, FYI. The OS is Vista Ultimate SP2.

dr.moriarty · Jun 19, 2009

Welcome to MajorGeeks!

I am currently reviewing your logs and will get back to you with a set of instructions as soon as possible. Our queue is working the oldest threads first.

Thanks for your patience.
dr.m

GermWarfare · Jun 19, 2009

dr.moriarty said: ↑

Welcome to MajorGeeks!

I am currently reviewing your logs and will get back to you with a set of instructions as soon as possible. Our queue is working the oldest threads first.

Thanks for your patience.
dr.m
Click to expand...

Cool, thanks for your help!

dr.moriarty · Jun 23, 2009

Hello, GermWarfare

Your logs are clean, however - I strongly recommend that you clean up your Desktop immediately leaving only links. Do not store downloads, exe files, iso files....etc on your Desktop. First it is not a safe place to keep them (i.e., you may loose them due to malware, and a cluttered Desktop is an easy hiding place for malware), and last but not least it can have an effect on your PCs performance.

* I recommend that you install Sun Java which will improve your surfing enjoyment since many sites require Java to work properly.

Sun Java Runtime Environment

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (=This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combofix folder and the C:\QooBox folders from combofix (if it exists and note that you may need to substitute a different drive letter than C: if you have Windows installed on a different drive.)

Also delete the below two files that are left behind by ComboFix, some scanners falsely detect these as problems which they are not:

C:\WINDOWS\NirCmd.exe

C:\WINDOWS\PEV.exe

If we had you run Avenger, you can delete all files related to Avenger now.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware

Click to expand...

Safe surfing! http://i268.photobucket.com/albums/jj5/drmoriarty/Emoticons/char145.gif

Log in or Sign up

FakeAlert

GermWarfare Private E-2

Attached Files:

SUPERAntiSpyware Scan Log - 06-16-2009 - 21-46-42.log

mbam-log-2009-06-16 (22-06-17).txt

ComboFix.txt

MGlogs.zip

GermWarfare Private E-2

Attached Files:

RootRepeal_crash_061609.222122.txt

RootRepeal_crash_061609.222125.txt

RootRepeal_crash_061609.222126.txt

GermWarfare Private E-2

dr.moriarty Malware Super Sleuth Staff Member

GermWarfare Private E-2

dr.moriarty Malware Super Sleuth Staff Member