No infected files but.......

JoelSim · Jan 31, 2011

Hi folks,

I am hoping for a little help and some information if possible.

I have been doing some work via a VPN connection. Now, when I connect the 3rd party system does a security check of my system which is good, aside from the fact that it reports back saying that Malware was found on my system.

I have run many scans all turning up no infected files, etc. I have also followed the recommended Malware removal steps on this site. All of these returned no infected files although I did notice combofix has quite the list of quarantined files and so on.

I will not go ahead and attach the log files or anything just yet. I will wait and see if any of you guys have any suggestions or if you recommend I attach the files so you can have a look at them if you have time.

I am a little curious if the security check via the VPN is a little over zealous with it's reporting or if there is an actual problem.

I have not noticed any real runtime issues with my system and the Malware detection via the VPN has only occurred after returning from Xmas holidays and the computer hadn't even been turned on for 3 weeks.

All and any help is greatly appreciated.

Thanks for your time,
Joel.

Kestrel13! · Jan 31, 2011

Yes. Attach all of the requested logs please. Without those I am clueless.

JoelSim · Jan 31, 2011

Hi Kestrel13,

Thanks for replying.

I would most certainly not want to leave you clueless so i will attach the files now.

I've not been able to locate the Root Repeal log. I can't recall if I had issues running that or not. I think I very well may have not been able to run it. By all means let me know if I need to re-attempt this process.

As an interesting note, I re-connected via the VPN connection earlier today and it didn't report finding Malware. I see that as a good thing. But, I will attach the files anyway and if you could have a look at them it would be most appreciated.

Thanks for your time,
Joel.

Kestrel13! · Jan 31, 2011

I would like for you to use MSConfig to put this machine back into normal start up mode. Any other mode is used primarily for troubleshooting and diagnostic purposes. If you wish to control what starts up or not then you are best off using third party software such as StartupCPL for example.

Not seeing any malware at all in those logs. Combofix just removed a bunch of temp files.

Uninstall outdated Java.

Java(TM) 6 Update 16

Java(TM) 6 Update 22

Reboot your machine and install the most current and up to date version of Java available here at the below link:

Java Runtime 6

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 7 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

JoelSim · Jan 31, 2011

Kestrel13,

Thanks a lot for your time and help.

I have gone through and carried out all the steps you have listed.

Hopefully all is well from here on.

Thanks again,
Joel.

Kestrel13! · Jan 31, 2011

You're welcome. Safe surfing.

Log in or Sign up

No infected files but.......

JoelSim Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

JoelSim Private E-2

Attached Files:

ComboFix.txt

MGlogs.zip

SASlog.txt

mbam-log-2011-01-25 (17-07-21).txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

JoelSim Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member