Windows Privacy Extension or Similar Infection

Fake scanner of malware like Windows Privacy Extension was downloaded by user (method unknown). Scanner would appear upon trying to run typical exe files for user applications (browser, Word, etc.) Also would get fake Firewall message informing it was blocking malware from running and option to allow scans. Could close scanner by right clicking and choosing close option on taskbar.

Effectively prevented use of computer. Most trouble limited to initial user, as admin account had internet access and was able to run scans. However, had to rename mbam.exe to run program and scan after normal install. Deletion of Malwarebytes detected infections (788 instances) triggered the fake scan program under admin account (first time seen there). Scan program also triggered when taskmgr was called (with C-A-D).

Manually kept closing fake scanner as Malwarebytes deleted infected files. Eventually finished as asked for restart. Infection does not appear to have returned. Initial user can use browser and other programs.

 

Hello pbmax

Your logs are clean.

__

If you are not having any other malware related problems, it is time to do our final steps:

• Any programs we had you download and/or install can be removed at this time.
• If we had you download and run ComboFix, here is how to uninstall it:
  • Press and hold the Windows key http://i1106.photobucket.com/albums/h363/debojyotidas/Windows_Logo_key.gif and then press the letter R on your keyboard.
  • This opens the Run dialog box.
  • Copy and paste the below text inside the text-field:
    • "%userprofile%\desktop\ComboFix" /uninstall
  • Now press ENTER
  • ComboFix will extract its files one last time and you should receive a notification that ComboFix has been uninstalled shortly after.
• You can re-enable your Disk Emulation software at this time via DeFogger.
• If we had you create or download a registry patch or "fix" script, these can be deleted at this time.
• Go into the C:\MGtools folder and run the MGclean.bat file to remove additional traces of our tools.
• Now we will toggle System Restore to remove any infected system restore points.
  • Read this: How to Disable And Enable System Restore
• Lastly, here is a guide to protect you from future infections: How to Protect yourself from malware!
• Be safe

 

Thanks thisisu,

The trouble mbam had in deleting it had me worried it was a rootkit as well. But nothing on any restarts yet (2 so far).

Appreciate you checking the logs for me.

 

Yes MBAM can struggle versus this type of infection (FakeVimes). RogueKiller can always delete all those IFEO entries in the first try.
If MBAM didn't work, we could have deleted the bulk of the infection using RogueKiller and then run Malwarebytes to clean up.