Have I successfully removed malware?

guest2814 · Mar 9, 2011

Hi there!

The other day I got a malware program along the lines of vista internet security 2010 (possibly 2011) that claimed to be a Microsoft firewall.

Every time I tried getting onto Firefox a legitimate looking Windows pop up would say Firefox is infected with a virus and I needed to pay to download particular software in order to get rid of it; directing me to a site in order to facilitate this.

I was immediately suspicious and did a search to explore what this software was. A brief search told me that it was malware seeking to con me out of credit card details and also containing key stroke detection software.

I did a system restore to 3 days prior to the date that I started getting these symptoms when I had had no problems. The obvious symptoms like the Windows pop ups have gone and all seems well. To be sure I downloaded and ran Malwarebytes which detected and deleted 4 moles.

After all that can I be fairly sure that the malware has gone? There don't seem to be any more symptoms but my big concern is the reported key stroke detection software remains and I am concerned about doing any kind of online banking or purchasing.

I am fairly certain it has gone, and just hoped for some piece of mind as I don't really know what I am looking for when examining processes and the like to see if anything untoward is happening. Thanks very much.

TimW · Mar 9, 2011

Welcome to MG's. The only way for us to determine this would be for you to do the following:

READ & RUN ME FIRST. Malware Removal Guide

guest2814 · Mar 9, 2011

I'm sorry, I did take a look at that before posting but the vast bulk was just way over my head. And I'm really worried about digging around manually in case I do more damage than I stop. :-o

Today I've installed and run scans with SUPERantispyware, Windows Defender and my family's Norton 360 4.0 pack. All of them have come back as saying I'm all clear.

I'm sorry but that really is the extent of my capabilities and I was just hoping to find out, as best as someone with more knowledge than I can say, how much confidence I can put in my security?

TimW · Mar 10, 2011

Again, I can't say without seeing logs. And the instructions are pretty simple:

Now download the below tools ( PLEASE only download at this point ):

SUPERAntiSpyware

Malwarebytes Anti-Malware

Important: Rename the downloaded mbam-setup.exe file to mb.exe to help work around certain malware that will block it from being run.

combofix.exe

Important Notes:

You MUST save & later run this to from directly from your Desktop not from anywhere else (not even from a folder that is on your Desktop). Do not run it yet!!!!!!

When trying to download, if you receive a message like "ComboFix is currently not available for download until an issue with the program is resolved" then just skip ComboFix for now and tell us later about this problem.

If you are running AVG anti-virus, you will need to either try to disable it or totally uninstall it in order to run ComboFix:
AVG Removal Tool.

If you are running Kaspersky antivirus, it may popup warnings about combofix.exe and catchme.exe being infected as Heur.Invader. These are false indications. You must tell Kaspersky to Skip or Ignore these and let ComboFix run. McAfee may also intefere with ComboFix

If you are using Online Armor's Firewall, you will have to uninstall it in order to run ComboFix properly. Otherwise you will not be able to get ComboFix to run properly thru all phases.

RootRepeal - do not download or run on 64 bit systems. See: How to check for 32 bit or 64 bit Windows

MGtools - Recent bugs in many antivirus programs are detecting this as malware. Disable your AV while you download and run MGtools if you have this problem. Rest assured that it is clean. Your AV is incorrect. We prefer that you download this file to the root folder of the drive where you have installed Windows (Typically this would be C:\ and thus you would have a C:\MGtools.exe file after downloading). If you use FireFox and still have it set to defaults, it will not let you choose where to download files to. To change FireFox, run FireFox and Click Tools, Options, and on the Main tab select Always ask me where to save files. If for some reason you still have a problem trying to save MGtools.exe properly which can happen with Vista and Win7, you can download and run it from your Desktop as long as your Desktop folder is located on the same drive that you boot Windows from.

Step 2: Installing Tools and Running Scans - please only run each scan one time and complete all scans before attaching any logs!

Follow the instructions in the below link for installing and running SuperAntiSpyware

SUPERAntiSpyware - running & getting a log

NOTE: If you had any problem trying to download, install, and run SUPERAntiSpyware then try the portable version in the below link since it requires no installation

SUPERAntiSpyware_Portable

Now we need to run Malwarebytes Anti-Malware. Please carefully follow the instructions in the below link to most effectively run it and obtain a log:

Using Malwarebytes Anti-Malware

Now we need to run ComboFix. Please carefully follow the instructions in the below link to most effectively run ComboFix. PLEASE DO NOT stop and post the ComboFix log as suggested in the below procedure. We want you to finish ALL of our procedures and attach all logs at the end. If you have any problems running ComboFix, skip it and continue on but explain your problems when you come back to attach your logs.

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Now run this procedure Running RootRepeal to get a RootRepeal log

Now follow the directions in the below link for running MGtools It also explains possible reasons for not being able to run MGtools

Using MGtools

Click to expand...

Then when you are done, come back and attach the requested logs.

Please read this:
How to attach items to your post or view How to Attach Items: the Video.

Log in or Sign up

Have I successfully removed malware?

guest2814 Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

guest2814 Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member