Getting Vista Antispyware 2012 popups

[HALLGATOR]

Originally Posted by biomedgator

I used the .exe. File is that bad? Everything you said happened. The malwarebytes program locked up after about an hour so I killed it and ran it again.

No, that was OK as long as you got it from the link that OBOb provided. As the site says the reasons there are different downloads is to try to get around infections blocking the use of the program. Where one might not download and work another might.

[biomedgator]

Ok, it took over 5 hours for the Malwarebytes to run. It found 8 objects and i cleaned them off. I have the log file i can copy and paste to see what it cleaned. Well I am running it again just to see if it comes up zero.

After I do the second run i will make sure Microsoft Security Essentials is turned on again. Is there anything else I should check or do to make sure I am clean. Thanks for all the advice.

[HALLGATOR]

Why don't you go ahead and post the log from MalwareBytes so we can take a look at it. Then I would run a scan with your Security Essentials to see if it found anything.

[biomedgator]

Hopefully there is no personal information in the logs. After the second fun of Malwarebytes it found zero objects. rebooted and made sure Microsoft Security essentials was up to date and running. Is there anything else I can do to make sure there is not something lurking.

Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org

Database version: v2012.01.13.05

Windows Vista Service Pack 2 x86 NTFS (Safe Mode/Networking)
Internet Explorer 9.0.8112.16421
Duane :: DUANE-PC [administrator]

1/13/2012 7:40:01 PM
mbam-log-2012-01-13 (19-40-01).txt

Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 1066835
Time elapsed: 5 hour(s), 20 minute(s), 50 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 2
HKCR\CouponAlert_2pInstaller.Start (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKCR\CouponAlert_2pInstaller.Start.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 3
HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EX E\shell\open\command| (Hijack.StartMenuInternet) -> Bad: ("C:\Users\Duane\AppData\Local\tvj.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe") Good: (firefox.exe) -> Quarantined and repaired successfully.
HKLM\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EX E\shell\safemode\command| (Hijack.StartMenuInternet) -> Bad: ("C:\Users\Duane\AppData\Local\tvj.exe" -a "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode) Good: (firefox.exe -safe-mode) -> Quarantined and repaired successfully.
HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.E XE\shell\open\command| (Hijack.StartMenuInternet) -> Bad: ("C:\Users\Duane\AppData\Local\tvj.exe" -a "C:\Program Files\Internet Explorer\iexplore.exe") Good: (iexplore.exe) -> Quarantined and repaired successfully.

Folders Detected: 0
(No malicious items detected)

Files Detected: 3
C:\Users\Duane\AppData\Local\tvj.exe (Trojan.ExeShell.Gen) -> Quarantined and deleted successfully.
C:\Users\Duane\AppData\Local\Temp\oiu0.56741609813 81792.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Users\Angeline\AppData\Local\Temp\kolf0.4302941 7643250156.exe (Exploit.Drop.6) -> Quarantined and deleted successfully.

(end)

[HALLGATOR]

I like to run eset online scanner after any infection. It's not absolutely necessary but it sure won't hurt anything. Link is below.

http://www.eset.com/us/online-scanner/

No worry about the log you posted it doesn't show any info that could be used against you. As you see from the log you had Fake Alert Trojan and MBAM took care of it.

For the future make sure you keep all of your programs as up to date as possible. As OBOB said earlier Java and Flash are often exploited due to people not updating them. Also use caution with what you click on. If it is the least bit suspicious my suggestion is to not open it. Good common sense approaches to surfing and opening emails will go a long way to help with avoiding infections in the future.

By the way if you use the Eset let it clean anything it finds. If you have any more questions just ask.

[biomedgator]

Microsoft Security Essentials found 12 items.

Some may have been old. This computer is about 5-6 years old.

[HALLGATOR]

What did it find? Might want to run another Quick Scan with MalwareBytes. It shouldn't take very long this time.

[HALLGATOR]

By the way if you didn't update the definitions in MalwareBytes make sure to do that before running it again.

[biomedgator]

ran the www.eset.com scan and it found one file but it was a file that Microsoft Security Essentials found several monthes ago.

ran Malwarebytes again and did not find anything. defnitions were up to date.

[HALLGATOR]

That sounds good. Looks like you are OK now.

[biomedgator]

You guys were alot of help before. Malwarebytes keep finding this trojan.agent.gen, I deleted it and it came back. Is there something I can do to get rid of it permanently?

[orangeblueorangeblue]

I assume you're booting in safe mode before running this?

[biomedgator]

Yes I followed the same steps above.

When I run eset should it be in safe mode. It found three files in websearch

[biomedgator]

Both Microsoft essentials and eset catch nothing in safe mode. And yes Microsoft security essentials is up to date

[HALLGATOR]

Don't boot into safe mode and run MalwareBytes that way. Then post the log it produces. Make sure you do an update MalwareBytes before doing so.

[biomedgator]

Did not find anything in non safe mode

3/26/2012 12:10:48 AM
mbam-log-2012-03-26 (00-10-48).txt

Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 759928
Time elapsed: 4 hour(s), 42 minute(s), 45 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

[HALLGATOR]

Run it in normal startup mode and see what if finds.

[biomedgator]

Yeah the log above was in normal startup mode. I'll run again in safe mode to see if it catches anything.

[HALLGATOR]

Are you have some kind of symptoms now that is affecting your computer?

[biomedgator]

Well I have not really been using it since the re infection. But it did seems slow before like taking a long time for programs to load and not so much now. Also not getting that you been affected popups since the first time I ran malware bytes. I think I might have gotten rid of it but just being cautious.