Bad case of infection, disables most programs - Page 2

kielee6166 · 07-07-2009, 12:28 AM

Do you mean the link? I don't see an "unblock" button in the Properties...

Ried · 07-07-2009, 12:30 AM

No, the file that was downloaded. Perhaps I'm misunderstanding. I thought you were able to download it via Internet Explorer, just can't run it.

kielee6166 · 07-07-2009, 12:38 AM

Oh, IE completed the action of downloading, but I guess it wasn't able to place the file anywhere. It said to check if the disk was full or write-protected and I had to cancel the download.

kielee6166 · 07-07-2009, 01:22 AM

Okay, since this new issue is not related to the original infected machine, I've started new threads about it in the Windows XP and General Security forums (under the Baejung92 account). Sorry about this--perhaps I shouldn't have bothered backing up that old drive. I'm not sure what to do about the flash disinfector.

kielee6166 · 07-07-2009, 02:35 PM

Hello again Ried. I didn't get your PM until this morning

Some updates... I did get GMER running on the infected machine, but it looks like the scan will take several hours. I'll try and post the log later today or tomorrow.

As for the Flash Disinfector issue, doing a System Restore allowed me to download and run the program. However, that Restore made my McAfee malfunction (apparently a known issue) and I had to reinstall McAfee. Now, as soon as installation finished, McAfee did a real-time scan and identified Flash Disinfector as a Generic.dx Trojan, affecting the Firefox.exe process. It must have removed the thing altogether, because I can't find Flash Disinfector now... what a mess.

Ried · 07-07-2009, 11:52 PM

Kill McAfee and download Flash_Disinfector again. Keep McAfee disabled while you run the tool. It never ceases to amaze me that these AV's will allow the nastiest rootkits and infections in...but kill our tools.

kielee6166 · 07-13-2009, 11:33 AM

Hi Ried, sorry for delayed post.
I wasn't in contact with the machine's owner for a few days, but when I did he said that the GMER scan ran for a while, then when he checked on it after a few hours the computer was unresponsive with a black screen. Apparently he had a scratched-up hard drive anyways, so he got a technician to just replace the hard drive and reinstall Windows. So I think the point of the thread has become moot :/ Thank you for the help as always though, the owner appreciates it too.

Final thing about Flash Disinfector by the way. I haven't plugged my drive back to my own computer since using it on the infected machine (trying to delay that as long as possible), but I am supposed to use it on the drive both before AND after doing that, right? I also don't have any important information on there, and so was thinking about just formatting it.

Ried · 07-13-2009, 11:33 PM

Thanks for letting me know, and you're welcome - as always.

For your flash drive, you can kill two birds with one stone by not allowing the flash drive to autorun as soon as you plug it in. To stop the autorun function, hold down the Shift key as you insert the drive.

Once it has been inserted, run Flash_Disinfector.

07-07-2009, 12:28 AM	#21 (permalink)
kielee6166 Registered User Join Date: Jun 2009 Posts: 16 OS: XP	Re: Bad case of infection, disables most programs Do you mean the link? I don't see an "unblock" button in the Properties...

07-07-2009, 12:30 AM	#22 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 26,970 OS: WinXP and Vista	Re: Bad case of infection, disables most programs No, the file that was downloaded. Perhaps I'm misunderstanding. I thought you were able to download it via Internet Explorer, just can't run it. __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."

07-07-2009, 12:38 AM	#23 (permalink)
kielee6166 Registered User Join Date: Jun 2009 Posts: 16 OS: XP	Re: Bad case of infection, disables most programs Oh, IE completed the action of downloading, but I guess it wasn't able to place the file anywhere. It said to check if the disk was full or write-protected and I had to cancel the download.

07-07-2009, 01:22 AM	#24 (permalink)
kielee6166 Registered User Join Date: Jun 2009 Posts: 16 OS: XP	Re: Bad case of infection, disables most programs Okay, since this new issue is not related to the original infected machine, I've started new threads about it in the Windows XP and General Security forums (under the Baejung92 account). Sorry about this--perhaps I shouldn't have bothered backing up that old drive. I'm not sure what to do about the flash disinfector.

07-07-2009, 02:35 PM	#25 (permalink)
kielee6166 Registered User Join Date: Jun 2009 Posts: 16 OS: XP	Re: Bad case of infection, disables most programs Hello again Ried. I didn't get your PM until this morning Some updates... I did get GMER running on the infected machine, but it looks like the scan will take several hours. I'll try and post the log later today or tomorrow. As for the Flash Disinfector issue, doing a System Restore allowed me to download and run the program. However, that Restore made my McAfee malfunction (apparently a known issue) and I had to reinstall McAfee. Now, as soon as installation finished, McAfee did a real-time scan and identified Flash Disinfector as a Generic.dx Trojan, affecting the Firefox.exe process. It must have removed the thing altogether, because I can't find Flash Disinfector now... what a mess.

07-07-2009, 11:52 PM	#26 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 26,970 OS: WinXP and Vista	Re: Bad case of infection, disables most programs Kill McAfee and download Flash_Disinfector again. Keep McAfee disabled while you run the tool. It never ceases to amaze me that these AV's will allow the nastiest rootkits and infections in...but kill our tools. __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."

07-13-2009, 11:33 AM	#27 (permalink)
kielee6166 Registered User Join Date: Jun 2009 Posts: 16 OS: XP	Re: Bad case of infection, disables most programs Hi Ried, sorry for delayed post. I wasn't in contact with the machine's owner for a few days, but when I did he said that the GMER scan ran for a while, then when he checked on it after a few hours the computer was unresponsive with a black screen. Apparently he had a scratched-up hard drive anyways, so he got a technician to just replace the hard drive and reinstall Windows. So I think the point of the thread has become moot :/ Thank you for the help as always though, the owner appreciates it too. Final thing about Flash Disinfector by the way. I haven't plugged my drive back to my own computer since using it on the infected machine (trying to delay that as long as possible), but I am supposed to use it on the drive both before AND after doing that, right? I also don't have any important information on there, and so was thinking about just formatting it.

07-13-2009, 11:33 PM	#28 (permalink)
Ried Assistant Manager, TSF Academy; Moderator/Analyst Security Team Join Date: Jan 2005 Location: Ohio Posts: 26,970 OS: WinXP and Vista	Re: Bad case of infection, disables most programs Thanks for letting me know, and you're welcome - as always. For your flash drive, you can kill two birds with one stone by not allowing the flash drive to autorun as soon as you plug it in. To stop the autorun function, hold down the Shift key as you insert the drive. Once it has been inserted, run Flash_Disinfector. __________________ Member of ASAP since 2005 Member of UNITE since 2006 "It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."