I think I have Malware

Discussion in 'Malware Help (A Specialist Will Reply)' started by MsApril, Jul 21, 2009.

  1. MsApril

    MsApril Private E-2

    I've worked through the Read and Run me first and all the logs with the exception of SASlog.txt because I couldn't find a log for this one. Also, I was unable to run the Root Repeal -I was getting an error message while trying to run it [attempt to read from address: 0x00d89000].

    While surfing the web one night all of my windows closed and something popped up that I had a critical virus and needed to download a program for protection. I didn't download the program -It took several attempts to close the window as it kept promting me to download a scanner. Anyway, since then I've had trouble with my computer. It is running very slow when I can get it to do anything and it seems that something is interefering with my internet connection as I keep getting knocked offline [I have DSL connection]. After completing the Read and Run me First steps it seems to be better but still not running like it should.
     

    Attached Files:

  2. MsApril

    MsApril Private E-2

    It happened again tonight, all my windows closed saying my computer was infected prompting me to download something. I took a screen shot of what popped up and saved it to wordpad but I am unable to attach the document.

    The address showing in the address bar was : http://spywarefolderscannerv2.com/1/?id=2009-1549&qyery=65e83c223&q==DQw2zDxOYZMMI=M

    It shows a scan with a bunch of trojans found on my PC -not sure if it is even relevant but wanted to include this information just incase.
     
  3. dr.moriarty

    dr.moriarty Malware Super Sleuth Staff Member

    Hello, MsApril

    1: Your MBAM version is very outdated. The current version is v1.39 database 2491

    Please run MBAM and click the Update tab > then click the Check for Updates button. Run a new Quick Scan and attach the new log.

    2: The SASlog.txt is located at:
    C:\Users\The McKinney's\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\Logs

    Note: To save time - please look at your SASlog.txt and make sure that the version is 4.26.1006 database version atleast 1953. If not - follow these instructions:
    • Please uninstall your current version (this is necessary).
    • Then download this SUPERAntiSpyware
    • Install this new version. It may tell you that you need to reboot to complete the installation. You must reboot at this time.
    • After the reboot, run SUPERAntiSpyware and immediately click the Check for Updates button to get more updates for the database.
    • Now run a new Quick Scan of your system. And attach this new log.

    3: Now go to this link MGTools and download the new version of MGtools....overwrite your previous MGtools.exe file with this one.

    Then run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, use right click and select Run As Administrator).

    Please attach the below logs to your next reply:
    • updatedSASlog.txt
    • updatedMBAM log
    • updatedC:\MGlogs.zip

    dr.m
     
  4. MsApril

    MsApril Private E-2

    Thank you. I updated everything as instructed with exception of Saslog because the first scan was the updated version.

    Thanks again,
    April
     

    Attached Files:

  5. dr.moriarty

    dr.moriarty Malware Super Sleuth Staff Member

    :-D

    Good! Where are the updated logs? :p

    Edit: You beat me to it!! Please give me some time to review them.
    dr.m
     
    Last edited: Jul 24, 2009
  6. dr.moriarty

    dr.moriarty Malware Super Sleuth Staff Member

    Hi, MsApril


    No malware is found in your logs. If you are not having any other malware problems, it is time to do our final steps:
    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /u
        • Notes: The space between the combofix" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    7. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures in step 3 the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    8. After doing the above, you should work thru the below link:

    Safe surfing! http://i268.photobucket.com/albums/jj5/drmoriarty/Emoticons/char145.gif
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds