Screensaver logs on Administrator

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by whanenbu, Oct 6, 2011.

  1. whanenbu

    whanenbu Private E-2

    XP w/SP3. Story: Came to work and I was logged on as Adminstrator in the screensaver. This is strange since I am the only person to know this password. I suspected a virus and ran SuperAntispyware with no luck. Ran Malwarebytes and it found the virus and deleted it. Upon reboot it returned. I did some searching on cache.txt virus and found that the cache.txt in the Offline web pages directory belonged to the Morto Worm Virus. I followed the Malware removal steps here at MajorGeeks and also remove the registry keys found on different web sites to remove the virus. I reran the SuperAnti, Malware, Combofix, RootKit, and MGtools and all appeared good. I also turned off the screensaver and reset the password. Last night I turned on the screensaver and found this morning I was again logged off and administrator logged on. I reran superantispyware and malwarebytes and all the scans show clean. I also log in through terminal services from home. The PC also still appears a little sluggish.

    I need help so that the screen saver does not log me off and the administrator on so I lose work. I am not sure if it is the remote services.

    This one is beyond me at the point so let me know what to try on how to get it fixed. Thanks for the help in advance.
     
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Please attach those logs. ;)
     
  3. whanenbu

    whanenbu Private E-2

    Here are the logs. SAS and Malware are from today. The other are from last week. In SAS you will find a Trojan but those are false positives. They are my scripts compiled with Autoit.
     

    Attached Files:

  4. whanenbu

    whanenbu Private E-2

    Last one.
     

    Attached Files:

    • mbam.txt
      File size:
      901 bytes
      Views:
      0
  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    I am not finding any malware in your logs. I suggest that you post in the software forum for additional assistance.

    since you are not having any malware problems, it is time to do our final steps:

    1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no real time protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.We recommend them for doing backup scans when you suspect a malware infection.
    2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
      • "%userprofile%\Desktop\combofix" /uninstall
        • Notes: The space between the combofix" and the /uninstall, it must be there.
        • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.


    3. Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
    4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    7. Go to add/remove programs and uninstall HijackThis.
    8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
      • Refer to the cleaning procedures pointed to by step 7 of the READ ME
        for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.

    10. After doing the above, you should work thru the below link:


    Malware removal from a National Chain = $149
    Malware removal from MajorGeeks = $0


    Majorgeeks Geek Wear. Hats, T-Shirts, Hoodies

    MajorGeeks on FaceBook
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds