Still finding Infections

Crystal Dragon · Nov 4, 2008

Greetings,

When I started on this computer all I had was the blue screen that said, among other things, that the beep.sys file was corrupted. I found that someone downloaded Antivirus 2008. That was all I knew, it is a friends computer. After booting with the cd to recovery dos prompt I found the beep.sys file in c:windows.system32.drivers, and deleted it. Then I was able to get into safe mode. From there I ran a ccleaner and started deleting junk from the add/remove. After I was able to I did all the process in the “Read Me” section. After finishing that everything seamed fine until AVG ran a scan and found more:

Trojan horse BackDoor.Generic10.MBI
Trojan horse Generic11.AQQH
Trogan horse SHeur.CLNM
Trojan horse BackDoor.Generic10.MBI

AVG did put them into the virus valt but dose that mean I did not get every thing out?

Here are the logs,

Crystal Dragon · Nov 4, 2008

Here is the finel file.

Thank you sooooooo much!

TimW · Nov 5, 2008

Your logs are clean.....but bear in mind that you are using a version of AVG which is no longer supported. So you will not be getting updates for definitions. You should consider installing a different AV after removing AVG 7.5.

Plus you are way too low in the amount of installed ram:
Code:
Total Physical Memory    256.00 MB    
Available Physical Memory    92.09 MB
You should consider using atleast 1 GB of RAM.

Finish the below steps before running another scan with AVG.

If you are not having any other malware problems, it is time to do our final steps:

We recommed you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combofix folder from combofix (if it exists)

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

If you are running Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Click to expand...

Crystal Dragon · Nov 6, 2008

Thank you so much for what you do!!!!!!!!!!!

Everything seems fine.

TimW · Nov 7, 2008

You are most welcome.

Log in or Sign up

Still finding Infections

Crystal Dragon Private E-2

Attached Files:

SASlog.txt

mbam-log-2008-11-04 (15-04-16).txt

combo_fix_log.txt

Crystal Dragon Private E-2

Attached Files:

MGlogs.zip

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

Crystal Dragon Private E-2

TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member