Please help with malware situation

[tetonbob]

Ok, great. Is all well with the machine now?

I'd like to see that log from MBAM. You can access it from the Logs tab of the application interface.

[Kay27]

Here is the log. Is there anything else I should do to keep my computer from being infected again?


Malwarebytes' Anti-Malware 1.41
Database version: 3098
Windows 5.1.2600 Service Pack 2

11/4/2009 9:23:13 AM
mbam-log-2009-11-04 (09-23-13).txt

Scan type: Quick Scan
Objects scanned: 98022
Time elapsed: 6 minute(s), 35 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 9

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servises (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Documents and Settings\All Users\Start Menu\AlphaAV (Rogue.AlphaAV) -> Quarantined and deleted successfully.

Files Infected:
C:\Documents and Settings\All Users\Start Menu\AlphaAV\Alpha Antivirus.lnk (Rogue.AlphaAV) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\AlphaAV\Computer Scan.lnk (Rogue.AlphaAV) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\AlphaAV\Help.lnk (Rogue.AlphaAV) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\AlphaAV\Registration.lnk (Rogue.AlphaAV) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\AlphaAV\Security Center.lnk (Rogue.AlphaAV) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\AlphaAV\Settings.lnk (Rogue.AlphaAV) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Start Menu\AlphaAV\Update.lnk (Rogue.AlphaAV) -> Quarantined and deleted successfully.
C:\Documents and Settings\Kalet\Desktop\Alpha Antivirus.lnk (Rogue.AlphaAV) -> Quarantined and deleted successfully.
C:\Documents and Settings\Kalet\Application Data\Microsoft\Internet Explorer\Quick Launch\AlphaAV.lnk (Rogue.AlphaAntivirus) -> Quarantined and deleted successfully.

[tetonbob]

If there are no other issues, we should be done here.

As far as what to do to prevent infection, read on below....but also realize that prevention begins at the keyboard. Many infections start due to visits to unsavory sites. Rogues such as this latest infection we removed often come disguised as "codecs" or "flash player updates" supposedly for watching a video on such sites. Having a frank talk with all who access the machine will also help prevent infection in the future.

Some infections happen from visiting poorly protected but legitimate sites. Those are more difficult to prevent, but use of protective tools can help.

The item Eset found is in ComboFix quarantine, and will be addressed by uninstalling ComboFix as instructed below.

Other than that....We should be done here. Some final housekeeping instructions, and protection information for you.

Your logs appear clean.You should be good to go. We still have a few items to address.


Disconnect from the internet and disable your AntiVirus temporarily.

Go to -> Run -> copy/paste in the following single line command & click OK

ComboFix /Uninstall

This will uninstall ComboFix. It will also implement some cleanup procedures and reset System Restore points.

Re-enable your AntiVirus now. Reconnect to the internet at your leisure.

Delete any remaining tools we've used (DDS and GMER) and logs from them.

Empty your Recycle Bin.

Now that your system is clean, to help protect your computer in the future I recommend that you follow these steps and look into the following free programs:

• Microsoft Windows Update - http://www.windowsupdate.com
  Visit regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  
  
• SpywareBlaster to help prevent spyware from installing in the first place.
  • Install & update SpywareBlaster with the latest definitions.
    After you have updated, click the button - enable protection for all unprotected items
• WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites - green to go, yellow for caution and red to stop, helping you avoid the dangerous sites. WOT has an addon available for both Firefox and IE.
  
  
• Winpatrol
  
  Winpatrol is heuristic protection program, meaning it looks for patterns in codes that work like malware. It also takes a snapshot of your system's critical resources and alerts you to any changes that may occur without you knowing. You can read more about Winpatrol's features here.
  
  You can get a free copy of Winpatrol or use the Plus version for more features.
  
  You can read Winpatrol's FAQ if you run into problems.
  
  
• MVPS HOST FILE
  The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.
  
• ANTIVIRUS SOFTWARE
  It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. It is imperative that you update your antivirus software at least once a week (even more if you wish). If you do not update your antivirus software then it will not be able to catch new malware that may have come out.
  
  Do not install more than one AntiVirus program because they will conflict with each other.
  
  
• Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer
  
  
• http://www.trillian.cc ? Trillian or http://www.miranda-im.com ? Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)
  
  
• http://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP//Vista. It's made up of two parts - ERUNT & NTREGOPT.
  
  ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.
  
  NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.

In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles

• How did I get infected in the first place?
• PC Safety and Security--What Do I Need?

If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it.

Please respond to this thread one more time so we can mark this thread as resolved.

[Kay27]

Thank you so much for all your help. What you guys do on this forum is awesome. Thanks again for everything. Hopefully I won't have to come back for this problem again.

Thank you and best of luck.

[tetonbob]

You're quite welcome, I'm happy to have helped. We also hope visits to this section of the forum are a one time event. Do feel free to visit the rest of the forum as much as you like.

Surf Safely, and Think Prevention!

Since this issue is resolved, this topic will be archived.