Found Trojan Downloader (All Logs Attached)

MisuzuKamio · Jun 8, 2009

I did a quick scan with MBAM this morning and it found an infection:
"c:\WINDOWS\system32\taskmgr.exe (Trojan.Downloader)"

I quarantined it and restarted my computer as prompted. I then started the READ ME Guide and completed all the steps as well as running Avast! and Spybot as an extra. Avast! and Spybot found nothing, but I think ComboFix and MGTools both found other infections.

All logs are attached below. If you want me to attach the initial MBAM log where taskmgr.exe (Trojan.Downloader) was found I will do that right away.

Thanks a lot for taking the time to look over my logs. I'll be awaiting your reply.

TimW · Jun 10, 2009

Your logs are clean......MBAM was doing it's job.

If you are not having any other malware problems, it is time to do our final steps:

We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They are useful as backup scanners. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combofix folder from combofix (if it exists)

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

MisuzuKamio · Jun 10, 2009

Last night, I found out that my task manager was not working. I panicked at this since I use it somewhat frequently, so I updated MBAM, restored the taskmgr.exe that it quarantined, rescanned and MBAM found nothing. The task manager also started working again when I pressed ctrl+alt+del. I'm glad I didn't just delete the file from the quarantine because I would have no task manager. o.o False positives happen so I must be more careful and not just jump on things...

Thanks for your help. I'm going to work on the final steps now.

TimW · Jun 12, 2009

No problem......safe surfing.

Log in or Sign up

Found Trojan Downloader (All Logs Attached)

MisuzuKamio Private E-2

Attached Files:

ComboFixLOG.txt

MBAMLOG.txt

MGlogs.zip

SASLOG.log

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

MisuzuKamio Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member