Pls check if Trojan has gone!

Betsyboo · Feb 1, 2010

Hi All
On 29 Jan 10 Avast! picked up Trojan-Spy.Zbot.Yeth and Trojan-Spy.Zbot.A on my system. I followed ur Vista cleaning procedure & ran SuperAntiSpyware, Malwarebytes Anti-Malware, combofix.exe & MGtools. Had problems with RootRepeal which really slowed the system down and after trying to run it for 2 days had to stop it so haven't got a log file for it.
MalwarebytesAnti-Malware ran successfully and picked up 6 infections but now I can't find the log file (sorry).
SuperAntiSpyware also ran but didn't create a log file as far as I can see.
At some point I was told to delete my quarantine files but I don't know how to do this so they'll still be there.

Now have no obvious problems with pc but SpywareDoctor is picking up 21 infections of Application.NirCmd. Have read that this could be something to do with Combofix??
Could you pls check my scans as I'm sooo concerned there might still be something on my machine. Have attached the 2 log files that I can find.

Thanks v much for any help.
Betsyboo

TimW · Feb 2, 2010

Your MBAM log is here:

"C:\Users\Liz\AppData\Roaming\Malwarebytes\Malwarebytes' Anti-Malware\Logs\"
mbam-l~1.txt 30 Jan 2010 1595 "mbam-log-2010-01-30 (15-18-46).txt"
Click to expand...

Is Spyware Doctor a paid for or freeware version? If freeware, uninstall it.

The only thing I am seeing in your logs is this:
C:\Users\Liz\AppData\Local\rifW --> delete it.

What issues are you still having?

Betsyboo · Feb 3, 2010

Thanks for getting back to me.

SpywareDoctor is paid for.
I have deleted the rifW file.

I have tried not to use the computer too much since I ran your clean up procedure because I am so worried that something may be lurking - was really waiting for you guys to give me the go-ahead (I read that my virus was a key logger and also I had the Vista Internet Security 2010 on there). But when I HAVE used it, I haven't had any problems.

I have attached my mbam log file.

Thanks again for your time and help.

TimW · Feb 7, 2010

Your logs look clean. I just suggest that you keep SAS and MBAM up to date and run them on occasion.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real-time protection. They are useful as backup scanners.They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures ian step 3 the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore ato create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Betsyboo · Feb 7, 2010

It looks as though I may have another infection now, and I have started another thread for that which hopefully someone will be able to look at soon.

Thank you for your help, I really appreciate it. You guys are life-savers for people like me!

TimW · Feb 8, 2010

If it was the same machine, you should have just stayed in this thread. So I will close this one.

Log in or Sign up

Pls check if Trojan has gone!

Betsyboo Private E-2

Attached Files:

ComboFix.txt

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Betsyboo Private E-2

Attached Files:

mbam-log-2010-01-30 (15-18-46).txt

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Betsyboo Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member