The Official Malware/Antivirus Thread - Need help or general advice? Read this first!

[Pushead2]

update is that my LAN works but the laptop won't connect via wireless.

I'm working on it my job though. Is it possible its set up for his router? Should I delete it & re-install the wireless driver?

[Pushead2]

I'm all set! Everything works

[DaveNull]

Never use a computer that you didn't install the operating system on...especially one that spits out log files that look like this.

Unless you installed LimeWire yourself from a known source (and even then using that network is asking for a vile note from your ISP or one of the record labels) I'd certainly consider it riddled with stuff that's part of a bonnet at this point.

[Mr. Plow]

My son had the "Win 7 anitspyware 2012" virus: http://www.bleepingcomputer.com/viru...tispyware-2012


Followed the steps in the above link....rkill; malwarebytes; etc....Malwarebytes found it and I got it removed. Computer seems to be running fine now.

I've just rerun Malwarebytes a second time before doing another virus scan, here is a log of the files that it detects as malicious. Could someone in "the know" look at the files and make sure they are either A: malicious and need to be removed or B: normal and can be ignored on future scans.

I don't want to ignore something that I need to remove, and I definitely don't want to remove something that should be ignored.

Thanks!


Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 8318

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

12/5/2011 6:02:51 PM
mbam-log-2011-12-05 (18-02-41).txt

Scan type: Full scan (C:\|)
Objects scanned: 294023
Time elapsed: 29 minute(s), 50 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 7
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 2
Files Infected: 10

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{9193fbaf-bdaf-4751-a99a-1f5ef255c35b} (PUP.FCTPlugin) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9193FBAF-BDAF-4751-A99A-1F5EF255C35B} (PUP.FCTPlugin) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9193FBAF-BDAF-4751-A99A-1F5EF255C35B} (PUP.FCTPlugin) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{9193FBAF-BDAF-4751-A99A-1F5EF255C35B} (PUP.FCTPlugin) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9193FBAF-BDAF-4751-A99A-1F5EF255C35B} (PUP.FCTPlugin) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\facetheme-apl (PUP.FCTPlugin) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\kincjchfokkeneeofpeefomkikfkiedl (PUP.FCTPlugin) -> No action taken.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
c:\program files (x86)\Object (PUP.FCTPlugin) -> No action taken.
c:\program files (x86)\Object\chromeaddon (PUP.FCTPlugin) -> No action taken.

Files Infected:
c:\program files (x86)\Object\status.txt (PUP.FCTPlugin) -> No action taken.
c:\program files (x86)\Object\bho_project.dll (PUP.FCTPlugin) -> No action taken.
c:\program files (x86)\Object\chromeaddon.pem (PUP.FCTPlugin) -> No action taken.
c:\program files (x86)\Object\config.ini (PUP.FCTPlugin) -> No action taken.
c:\program files (x86)\Object\enable.txt (PUP.FCTPlugin) -> No action taken.
c:\program files (x86)\Object\facetheme-apl_uninstall.exe (PUP.FCTPlugin) -> No action taken.
c:\program files (x86)\Object\status2.txt (PUP.FCTPlugin) -> No action taken.
c:\program files (x86)\Object\chromeaddon\._included.js (PUP.FCTPlugin) -> No action taken.
c:\program files (x86)\Object\chromeaddon\background.html (PUP.FCTPlugin) -> No action taken.
c:\program files (x86)\Object\chromeaddon\included.js (PUP.FCTPlugin) -> No action taken.

[DaveNull]

Back up your data and reinstall windows. This is really the only way that you can be sure that all of this stuff is gone. "Good" malware will avoid all of these tools.

This is another reason to keep your data separate and constantly backed up so reinstalling windows isn't that big of a deal.

Or, you know, stop using Windows.

[pearlblue]

Thanks guys! This is what I've been looking for. Such a helpful and informative thread.

[durtyrute]

Sorry if this has been asked, but does anyone know how to get rid of win.32.pup.bandoo from a XP computer?

[DaveNull]

Back up your data and reinstall windows.

Seriously. Malware is designed in many instances to steal login credentials and other sensitive information. It's foolish to rely on free tools which may or may not be completely effective to remove this crap. Once that's done, try to figure out what you did to get infected and stop doing that. Here are some other thoughts on how to avoid this situation entirely.

0. Back up your data so that reinstallation or hardware failure isn't so hard to recover from. If you don't have three copies (one working, one local backup, one offsite backup) then you're at risk of losing data.
1. If you can avoid using Windows, do so.
2. If you have to use Windows, use Windows 7.
3. Don't use IE. Chrome is a nice alternative.
4. Install Ad-Block extensions to any browsers that you use.
5. If you insist on installing Flash, use the Click-to-Flash extension. This way you're only loading flash content you actually want to see. The only way I run Flash is through Chrome which has it's own sandboxed version.
6. Install all of your system updates when they become available including Flash and Acrobat.
7. Stop using Windows. Mac hardware isn't as comparatively expensive as it used to be. What's your time worth? Is wrestling with constant malware infections and account compromises really worth saving a couple hundred bucks on a computer?

[Fish]

FYI..... this looks to be a great offline tool to clean your Windows machines..

Windows Defender Offline Beta

Microsoft this week released a beta version of what appears to be a very useful tool: An offline version of its Windows Defender anti-malware solution. This tool can help final and remove malicious software, much like the version built into Windows. But because it can be installed to CD, DVD, or USB flash drive, it can be run in offline mode, when the Windows OS isn't running. And that makes it more effective, since many exploits, like rootkits, are hard to remove when Windows is running.

You can find the Windows Defender Offline Beta on the Microsoft web site. You'll need a blank CD, DVD, or a USB flash drive you don't mind formatting. There are basically two downloads that need to occur; the tiny installer and then a later 214 MB Setup package that is expanded and copied onto the media. This package includes all the files needed to boot your PC plus the Windows Defender Offline tool itself.



To use the tool, you need to reboot your PC from the created optical disk or USB flash drive. (This could require interrupting the boot process and choosing a different boot device, of course.) The interface is straightforward and basically resembles a full-screen version of Windows Defender, giving you a chance to perform Quick, Full, and Custom scans of the underlying PC.

Intriguingly, this tool also appears to be based on the Windows 8 version of Windows Defender, in that it provides both spyware and anti-virus scanning.

[QuikSsurfer]

Originally Posted by KC Fish

FYI..... this looks to be a great offline tool to clean your Windows machines..

Windows Defender Offline Beta

Microsoft this week released a beta version of what appears to be a very useful tool: An offline version of its Windows Defender anti-malware solution. This tool can help final and remove malicious software, much like the version built into Windows. But because it can be installed to CD, DVD, or USB flash drive, it can be run in offline mode, when the Windows OS isn't running. And that makes it more effective, since many exploits, like rootkits, are hard to remove when Windows is running.

You can find the Windows Defender Offline Beta on the Microsoft web site. You'll need a blank CD, DVD, or a USB flash drive you don't mind formatting. There are basically two downloads that need to occur; the tiny installer and then a later 214 MB Setup package that is expanded and copied onto the media. This package includes all the files needed to boot your PC plus the Windows Defender Offline tool itself.



To use the tool, you need to reboot your PC from the created optical disk or USB flash drive. (This could require interrupting the boot process and choosing a different boot device, of course.) The interface is straightforward and basically resembles a full-screen version of Windows Defender, giving you a chance to perform Quick, Full, and Custom scans of the underlying PC.

Intriguingly, this tool also appears to be based on the Windows 8 version of Windows Defender, in that it provides both spyware and anti-virus scanning.

This would be encouraging if Windows Defender actually did anything useful.
Save your flashdrives/dvds for a useful tool(s), like Hirens or UBCD.

[Fish]

Originally Posted by QuikSsurfer

This would be encouraging if Windows Defender actually did anything useful.
Save your flashdrives/dvds for a useful tool(s), like Hirens or UBCD.

Actually this isn't the same Defender that you're used to. If you'll read the last sentence in bold, this is the Win8 version of Defender, which is a beefed up version that scans for virus, spyware, and malware.

It's not perfect, or foolproof. But you're selling it way short by calling it not useful. And instructing non-tech folks to create a Hirens bootdisk can be pretty confusing. Although perhaps someone should undertake that sometime....

[QuikSsurfer]

Originally Posted by KC Fish

Actually this isn't the same Defender that you're used to. If you'll read the last sentence in bold, this is the Win8 version of Defender, which is a beefed up version that scans for virus, spyware, and malware.

It's not perfect, or foolproof. But you're selling it way short by calling it not useful. And instructing non-tech folks to create a Hirens bootdisk can be pretty confusing. Although perhaps someone should undertake that sometime....

I've downloaded it and slapped it on a jumpdrive. I'll test this out on the next infected machine I get, which shouldn't be long based on how business is going.

[durtyrute]

Please help me remove win.32.pup.bandoo from an bootleg xp. My original os was so ****ed my tech friend put a bootleg version on it. Is there anyway to get it off without reinstalling (he did not give me the disk and has since moved)