Removal of worm succesful - feedback & questions

Discussion in 'Malware Help (A Specialist Will Reply)' started by Zwaplat, May 22, 2009.

  1. Zwaplat

    Zwaplat Private E-2

    Hi,

    A PC running Windows XP Pro at work got infected with malware some time ago (exact date of infection unknown). This was due to the PC having no protection whatsoever, and probably people reading their mails while being bored in the lab or using a USB-key to retrieve data.

    AVG 8.5 Free identified I-Worm/VB.DV, avast! called it Win32:Brontok [Wrm]. Both AV were able to see it, but not to remove it completely, even in Safe Mode or on Boot scan respectively.

    I have performed the complete Read&Run protocol with great success (no problems whatsoever) and I believe to have purged said computer from the annoying little ***** *** ******* **. Please find attached logs below.
    I hope they might be helpful to people in training, and I was hoping as well that someone might take a look to see if the computer is indeed purged (I'm in no hurry, the computer is fine and works as intended).


    I was wondering, should I leave the programs installed on this PC, if they're needed in the future? Or is it best to remove them and download an up to date version when needed?

    Also, I currently have avast!, SpyBot, SpywareBlaster and Ad-Aware installed on this computer. Can I leave it like that, or will Ad-Aware interfere with the other programs? Also, do I have redundancy with this combination (notably Ad-Aware)?

    Thanks
     

    Attached Files:

    Zwaplat, May 22, 2009
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Ad-Aware is a useless program...you are much better off keeping SAS and MBAM.

    Your logs are clean.....you need to tell me exactly what is being reported.
     
    TimW, May 23, 2009
    #2
  3. Zwaplat

    Zwaplat Private E-2

    Alright, I'll throw Ad-Aware out the window and keep SAS and MBAM then.


    As I said, nothing is being reported anymore by avast! or any other program, and the PC seems to be healthy, so I guess the Read&Run First protocol was succesful (which would explain the clean logs). ;)


    Thanks for your time, my 'superior' will be very happy with that.

    You guys are doing a great job here, thanks a bunch!
     
    Zwaplat, May 24, 2009
    #3
  4. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    You are most welcome......If you are not having any other malware problems, it is time to do our final steps:

    1. We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They are useful as backup scanners. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /u
        • Notes: The space between the combofix" and the /u, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

      • Delete the C:\combofix folder from combofix (if it exists)

    3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    4. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Go to add/remove programs and uninstall HijackThis.
    6. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    7. If you are running Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.

    8. After doing the above, you should work thru the below link:

     
    TimW, May 25, 2009
    #4

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds