Malware: winrscmde/Trojan.agent/Trojan:DOS/Alurean.A

Page 3 of 3 Previous  1, 2, 3

View previous topic View next topic Go down

Solved Malware: winrscmde/Trojan.agent/Trojan:DOS/Alurean.A

Post by rlslagle on Sun 02 Sep 2012, 8:11 am

First topic message reminder :

I have an HP Pavillion G60 laptop computer.
I have been having issues with what I suspect is malware.
Malwarebytes Anti-Malware scan reveals the 2 following malware:
Vendor: Trojan.Agent Category: File Item: c:\windows\svchost.exe
Vendor: Trojan.Agent Category: Memory Process Item: c:\windows\svchost.ext Other: 8984
After telling Malwarebytes to remove selected, it rebooted. After scanning again, I get the same results with the number 7064 instead of 8984.
Microsoft Malicious software remover tool found the following: Trojan:DOS/Alurean.A It said to use an antivirus program to remove, but Norton SystemWorks did not find it.
I am enclosing the OTL logs and AdwCleaner logs in the next posts.

rlslagle

Rookie Surfer
Rookie Surfer

Posts : 80
Joined : 2009-06-03
Operating System : Windows 7

View user profile

Back to top Go down


Solved Re: Malware: winrscmde/Trojan.agent/Trojan:DOS/Alurean.A

Post by DragonMaster Jay on Thu 13 Sep 2012, 7:16 pm

You're welcome. Now, time to finish up, so I can make sure your computer is fully secure.

Clean up System Restore

Now, to get you off to a clean start, we will be creating a new Restore Point, then clearing the old ones to make sure you do not get reinfected, in case you need to "restore back."

To manually create a new Restore Point

  • Go to Control Panel and select System and Maintenance
  • Select System
  • On the left select Advance System Settings and accept the warning if you get one
  • Select System Protection Tab
  • Select Create at the bottom
  • Type in a name i.e. Clean
  • Select Create
Now we can purge the infected ones
  • Go back to the System and Maintenance page
  • Select Performance Information and Tools
  • On the left select Open Disk Cleanup
  • Select Files from all users and accept the warning if you get one
  • In the drop down box select your main drive i.e. C
  • For a few moments the system will make some calculations:

  • Select the More Options tab

  • In the System Restore and Shadow Backups select Clean up

  • Select Delete on the pop up
  • Select OK
  • Select Delete


Run OTC to remove our tools

To remove all of the tools we used and the files and folders they created, please do the following:
Please download OTC.exe by OldTimer:
  • Save it to your Desktop.
  • Double click OTC.exe.
  • Click the CleanUp! button.
  • If you are prompted to Reboot during the cleanup, select Yes.
  • The tool will delete itself once it finishes.

Note: If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.

Purge old temporary files

Download CCleaner Slim and save it to your Desktop - Alternate download link

When the file has been saved, go to your Desktop and double-click on ccsetupxxx_slim.exe
Follow the prompts to install the program.

* Double-click the CCleaner shortcut on the desktop to start the program.
* Click on the Options block on the left, then choose Cookies.
* Under Cookies to Delete, highlight any cookies you would like to retain permanently
* Click the right arrow > to move them to the Cookies to Keep window.
* Go into Options > Advanced & uncheck Only delete files in Windows Temp folders older than 48 hours
* Click Cleaner on the left then Run Cleaner on the right to run the program.
* Important: Make sure that ALL browser windows are closed before selecting Run Cleaner

Caution: Only use the Registry feature if you are very familiar with the registry.
Always back up your registry before making any changes. Exit CCleaner after it has completed it's process.

Security Check

Please download Security Check by screen317 from SpywareInfoforum.org or Changelog.fr.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.


[You must be registered and logged in to see this link.] - Get $30 off Kaspersky products.

~DMJ
GeekPolice Academy Manager


Donations/Contributions

DragonMaster Jay

Manager | Tech Officer
Manager | Tech Officer

Posts : 13451
Joined : 2009-09-07
Operating System : Windows 7 Ultimate

View user profile http://www.twitter.com/jaypfoutz

Back to top Go down

Solved Re: Malware: winrscmde/Trojan.agent/Trojan:DOS/Alurean.A

Post by rlslagle on Fri 14 Sep 2012, 8:41 am

Results of screen317's Security Check version 0.99.50
Windows 7 Service Pack 1 x64 (UAC is disabled!)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Norton Internet Security
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Java(TM) 6 Update 29
Java(TM) 6 Update 18
Java version out of Date!
Adobe Flash Player 11.3.300.271 Flash Player out of Date!
Adobe Reader X 10.1.2 Adobe Reader out of Date!
Mozilla Firefox 12.0 Firefox out of Date!
Google Chrome 21.0.1180.83
Google Chrome 21.0.1180.89
````````Process Check: objlist.exe by Laurent````````
Norton ccSvcHst.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 2%
````````````````````End of Log``````````````````````

rlslagle

Rookie Surfer
Rookie Surfer

Posts : 80
Joined : 2009-06-03
Operating System : Windows 7

View user profile

Back to top Go down

Solved Re: Malware: winrscmde/Trojan.agent/Trojan:DOS/Alurean.A

Post by DragonMaster Jay on Fri 14 Sep 2012, 9:18 pm

Adobe Reader Update!

Please download the newest version of Adobe Acrobat Reader from Adobe.com

Before installing: it is important to remove older versions of Acrobat Reader since it does not do so automatically and old versions still leave you vulnerable.
Go to the Control Panel and enter Add or Remove Programs (Programs and Features in Vista/7).
Search in the list for all previous installed versions of Adobe Acrobat Reader. Uninstall/Remove each of them.

Once old versions are gone, please install the newest version.

Java Update!

Please download the newest version of Java from Java.com.

Before installing: it is important to remove older versions of Java since it does not do so automatically and old versions still leave you vulnerable.
Go to the Control Panel and enter Add or Remove Programs (Programs and Features in Vista/7).
Search in the list for all previous installed versions of Java. (J2SE Runtime Environment). Please uninstall/remove each of them.

Once old versions are gone, please install the newest version.

Read more about Java exploit problems

Adobe Flash Player Update!

Please download the newest version of Adobe Flash Player from Adobe.com

Before installing: it is important to remove older versions of Flash Player since it does not do so automatically and old versions still leave you vulnerable.
Go to the Control Panel and enter Add or Remove Programs (Programs and Features in Vista/7).
Search in the list for all previous installed versions of Adobe Flash Player. Uninstall/Remove each of them.

Once old versions are gone, please install the newest version.

Firefox update
Firefox is out of date. Firefox is a very popular web browser, and if it is out of date, it is very vulnerable to security bugs, and other holes. To update it now, click Help > About Firefox > Check for Updates.


Personal Tips on Preventing Malware

See this page for more info about malware and prevention.

Any other questions before I mark this topic solved?


[You must be registered and logged in to see this link.] - Get $30 off Kaspersky products.

~DMJ
GeekPolice Academy Manager


Donations/Contributions

DragonMaster Jay

Manager | Tech Officer
Manager | Tech Officer

Posts : 13451
Joined : 2009-09-07
Operating System : Windows 7 Ultimate

View user profile http://www.twitter.com/jaypfoutz

Back to top Go down

Solved Re: Malware: winrscmde/Trojan.agent/Trojan:DOS/Alurean.A

Post by rlslagle on Sat 15 Sep 2012, 8:25 am

You have helped a lot.
Thank you.
I have no further questions.
rlslagle

rlslagle

Rookie Surfer
Rookie Surfer

Posts : 80
Joined : 2009-06-03
Operating System : Windows 7

View user profile

Back to top Go down

Solved Re: Malware: winrscmde/Trojan.agent/Trojan:DOS/Alurean.A

Post by DragonMaster Jay on Sun 16 Sep 2012, 5:20 am

Marked as such. You're welcome! √


[You must be registered and logged in to see this link.] - Get $30 off Kaspersky products.

~DMJ
GeekPolice Academy Manager


Donations/Contributions

DragonMaster Jay

Manager | Tech Officer
Manager | Tech Officer

Posts : 13451
Joined : 2009-09-07
Operating System : Windows 7 Ultimate

View user profile http://www.twitter.com/jaypfoutz

Back to top Go down

Solved Re: Malware: winrscmde/Trojan.agent/Trojan:DOS/Alurean.A

Post by Sponsored content Today at 2:29 pm


Sponsored content


Back to top Go down

Page 3 of 3 Previous  1, 2, 3

View previous topic View next topic Back to top


 
Permissions in this forum:
You cannot reply to topics in this forum