GenericFakeAlert!htm(Trojan) - Detected by McAfee

On 9/2/09 I was acccessing a website called (I think) inselhaus.com, when Mcafee detected a GenericFakeAlert(trojan). McAfee claims they quarantined the two files in question, but I would appreciate it if you would check my attached logs to make sure I'm clean.

I do not appear to be having any problems at the present time.

I had a similar problem on 7/18 and Tim W helped me resolve those issues. For reference here is a link to that thread if you think it would be of assistance in analyzing today's threat:

http://home.mcafee.com/Root/Newslet...d=n2SUt+8iJAmCYpwOrEbpYn4MUB8KSrbLRsZgpPJip1M

I followed all the steps in the READ and RUN ME FIRST guide and all my log files are attached.

All the scans ran in normal mode on my PC. I did encounter a couple of anomolies during the runs as follows:

1. When I had the problems back on 7/16 I could only get SUPERAntispyware to run by downloading the free version from the SAS website and renaming it to Text.exe and running in SAFE mode. With today's problem I decided to download a fresh version of SAS to clean things up, but during the install process I got a message saying SAS already existed on my computer and the older version needed to be uninstalled. The SAS uninstall process did not work. I assume this may have something to do with my renaming the earlier version to Text.exe. Note the old version still works and I can update it o.k. and I ran it to produce the attached log. I just don't know if the free version from SAS is the same version I would get by downloading SAS from the MajorGeeks website.

Any advice?

2. While running Malwarebytes, McAfee detected a trojan called : Artemis!2ED4528CB45C. This may be a file or script in ComboFix(?).

I assume this was an erroneous detection by McAfee.

Is that correct?


That's it. Hopefully, I'm clean. Let me know.

Thanks for all your help!

 

Attached is the MGtools log file. The other four logs were attached in the previous message.

 

Tim W,

Thanks for the instructions...


1. I got a "successful entered" response for the regedit function.

2. When I try to delete C:\SpywareTools\Super AntiSpyware\Text.exe, I get a message stating:

Cannot delete Text: Access is denied

Make sure the disk is not full or write-protected and that the file is not
currently in use.

SuperAntiSpyware starts up automatically when I boot my PC. So, I tried to end the application and then tried to delete the file again. Same message.


3. I did not try to delete the other 4 files in your message as I wasn't sure if order made a difference.


Anyway, stuck not being able to delete the Text.exe file????

I checked and SAS still runs o.k. on my PC.