Is this legit

dixie_dean_2

Is this the right log/info?

dixie_dean_2

Apoloigies if people are busy or this takes a long time but i really need to go to bed and just want to know if probably ok just to delete the trojan malaware is showing and turn computer off...if anyone can advise that would be great. Ta.

closed

yes delete it using malwarebytes, leave a kaspersky scan running overnight as well if you want to save "watching time" tomorrow.

I'd also consider switching your AV to avast 6 free, and running the mcafee removal tool. While there is no guarantee any antivirus can catch everything, avast would have stopped you getting to that website in the first place. Your machine might also speed up as a result.

dixie_dean_2

removed it, said this:

01/03/2011 00:27:03
mbam-log-2011-03-01 (00-27-03).txt
Scan type: Full scan (C:\|D:\|E:\|)
Objects scanned: 238198
Time elapsed: 1 hour(s), 22 minute(s), 34 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
c:\Users\Bob\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\46C5E9BO\setup[1].exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

aliEnRIK

TICK and FIX these in hijack -
O9 - Extra button: eBay.co.uk - Buy It Sell It Love It - {76577871-04EC-495E-A12B-91F7C3600AFA} - http://rover.ebay.com/rover/1/710-44557-9400-3/4 (file missing)
O9 - Extra button: Amazon.co.uk - {8A918C1D-E123-4E36-B562-5C1519E434CE} - (file missing)


Let Kaspersky run as closed suggested

Please run COMBOFIX
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Shut down your anti virus
Follow the simple instructions it gives
Post the COMPLETE log it creates here (Split into sections if need be) ~ if there are loads of 'SNAPSHOT' pages then leave them out
If it comes up with a RENAMING error then RIGHT click the exe file and RENAME and call it QWERTY (Making the complete file name 'QWERTY.exe') Or SAVE as 'QWERTY' on download
(If no log comes up or you lose it, COMBOFIX.TXT can be found in C drive)

dixie_dean_2

am downloading avast...couldn't see a free kasper scan apart from a file-specific one

closed

setting ie to delete temp files on exit might be a good idea, keeps your cache clean

ie, tools, internet options, advanced. tick empty temp internet files when browser is closed

if your mcafee has a built in firewall, make sure windows firewall is switched on when uninstalling it

http://devbuilds.kaspersky-labs.com/devbuilds/AVPTool/

the kaspersky link above is a one off scanner, not a resident scanner to replace mcafee, it's just a way of checking with another independent scanner that nothing is lurking

dixie_dean_2

aliEnRIK wrote: »

TICK and FIX these in hijack -
O9 - Extra button: eBay.co.uk - Buy It Sell It Love It - {76577871-04EC-495E-A12B-91F7C3600AFA} - http://rover.ebay.com/rover/1/710-44557-9400-3/4 (file missing)
O9 - Extra button: Amazon.co.uk - {8A918C1D-E123-4E36-B562-5C1519E434CE} - (file missing)


Let Kaspersky run as closed suggested

Please run COMBOFIX
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Shut down your anti virus
Follow the simple instructions it gives
Post the COMPLETE log it creates here (Split into sections if need be) ~ if there are loads of 'SNAPSHOT' pages then leave them out
If it comes up with a RENAMING error then RIGHT click the exe file and RENAME and call it QWERTY (Making the complete file name 'QWERTY.exe') Or SAVE as 'QWERTY' on download
(If no log comes up or you lose it, COMBOFIX.TXT can be found in C drive)

Cheers. will look into all this tomorrow. Sleep is calling me. Thanks to all.

closed

you've got a bit of bloat that could be taken out of startup, if you want to speed the machine up a little, discuss tomorrow if you are interested

dixie_dean_2

Speeding the machine up would be sensational too!