Help with information displayed by ComboFix?

Nybegynner · Jun 17, 2011

First, english is not my language, but i will try my best

My situation:

Yesterday I discovered that the home page of my blog was gone, there was just a white, blank page.
I could reach all the other pages, just not the home page.

I contacted my webhosting support, and they sent my "case" to their security team as they thought my site could be under attac.

This is the answer I got from the securuty team:

It appears that malicious code has been uploaded to your account via FTP using a stolen username and password. At this time, I have removed the malicious code from the account.

From our experience with malware of this nature, the account passwords are stolen using viruses/malware located on your local computer. This malware sniffs out passwords used and stored by FTP and other programs. In order to protect against future attack, you will need to run full virus and malware scans on your computers to ensure that they are clean. I recommend using multiple scanners as we have found that some scanners do not detect the malware.

You should clean your computer using the instructions found here: http://forums.majorgeeks.com/showthread.php?t=35407 . After the clean has completed, please change all account passwords.
Click to expand...

I followed the advices, and I followed the instructions in "READ & RUN ME FIRST. Malware Removal Guide"

That guide helped me find and remove this:

* Trojan Agent/Gen-FraudPack
* Adware Agent/Gen-Zango
* Adware Agent

I am now at the beginning of step 4 in "Vista and Win 7 Malware Removal/Cleaning Procedure."

But I write to you first, because on bleepingcomputer.com i read this about ComboFix:

ComboFix also displays a report that can be used by trained helpers to remove malware that is not automatically removed by the program
Click to expand...

So....after all this text, my question is, can you take a look at my Combofix log?

I'm grateful for your time and effort!

I Attach 4 logs, just in case you need them all

By the way, my blog is now running fine, no problems as I can see

TimW · Jun 17, 2011

I am not finding any malware in your logs. What little there was has been removed by the scans. But I must warn you about allowing BitTorrent to be running at startup!! This leaves your system open to anyone. I suggest you remove it from your start ups and only use it when needed, then shut it down.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.We recommend them for doing backup scans when you suspect a malware infection.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 7 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Malware removal from a National Chain = $149
Malware removal from MajorGeeks = $0

Help Support MajorGeeks
Buy Discounted Software @ Majorgeeks Store. Giveaways Too!

Majorgeeks Geek Wear. Hats, T-Shirts, Hoodies

MajorGeeks on FaceBook

Nybegynner · Jun 17, 2011

Thank you so very much for your help!

I uninstalled BitTorrent after the logs were created, so that sholud be ok.

Have a nice day!

TimW · Jun 17, 2011

You are most welcome. Safe surfing.

Log in or Sign up

Help with information displayed by ComboFix?

Nybegynner Private E-2

Attached Files:

SASlog.txt

mbam-log-2011-06-17 (03-23-54).txt

Combofix log.txt

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Nybegynner Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Log in or Sign up

Help with information displayed by ComboFix?

Nybegynner Private E-2

Attached Files:

SASlog.txt

mbam-log-2011-06-17 (03-23-54).txt

Combofix log.txt

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Nybegynner Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Useful Searches