Virus appears to have wiped laptop

debitcardmayhem

I don't think you updated MBAM first , I am not on my Windows PC so I can't check immediately but I am sure the database should be 68xx , someone will confirm soon tho

Toxteth_OGrady

debitcardmayhem wrote: »

I don't think you updated MBAM first , I am not on my Windows PC so I can't check immediately but I am sure the database should be 68xx , someone will confirm soon tho

6818 is latest.

gremlin

debitcardmayhem wrote: »

I don't think you updated MBAM first , I am not on my Windows PC so I can't check immediately but I am sure the database should be 68xx , someone will confirm soon tho

Toxteth_OGrady wrote: »

6818 is latest.

ok sorry guys - i cant get internet access downstairs on the infected lappie so am working between two laptops with a pen drive

have now updated mbam and run another test - found another infection and deleted it so heres the latest log:

Malwarebytes' Anti-Malware 1.51.0.1200
https://www.malwarebytes.org

Database version: 6818

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

09/06/2011 15:34:16
mbam-log-2011-06-09 (15-34-16).txt

Scan type: Quick scan
Objects scanned: 145180
Time elapsed: 2 minute(s), 46 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Users\matty\AppData\Local\Temp\jar_cache1951420948477896635.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.

again thankyou all for your patience and help

alistair.long

this is good !!!!. I had to do a relatives with a similar virus.

I loaded safemode and created a new account, and deleted his old 1. seemed to solve the problem and let him use the net. He's not bothered about the hidden files and has no work to worry about.

stilltheone

alistair.long wrote: »

this is good !!!!. I had to do a relatives with a similar virus.

I loaded safemode and created a new account, and deleted his old 1. seemed to solve the problem and let him use the net. He's not bothered about the hidden files and has no work to worry about.

So why did you not just run a Factory Restore?

debitcardmayhem

alistair.long wrote: »

this is good !!!!. I had to do a relatives with a similar virus.

I loaded safemode and created a new account, and deleted his old 1. seemed to solve the problem and let him use the net. He's not bothered about the hidden files and has no work to worry about.

stilltheone wrote: »

So why did you not just run a Factory Restore?

I don't think stilltheone was suggesting you should Gremlin :wave:
Just a quick question from me (not an expert ) did you run unhide ? , and wait for some more reliable advice from RussJK/stilltheone/Alienrik/Gunjack/Browntoa

Edited: oh and others too Spud won't be here til evenings/weekends and then closed will help you with speeding up when it is clean, and then asbokid will come in with helpful advice too...the list is too long

Jeff_Bridges_hair

oh yeh just to mention that Mbam is now up to 6820 now. just done my scan with it.

gremlin

@debitcardmayhem

yeh sorry I realised after after I posted that is was to the other poster so I deleted it straight away.

I did run unhide and a lot of stuff showed - so I think its sorted that problem.

I am really grateful to everyone in here for the help they've given me.

aliEnRIK

Id recommend a FULL scan with malwarebytes, then run combofix as youve had/have a nasty infection

Please run COMBOFIX
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Shut down your anti virus
Follow the simple instructions it gives
Post the COMPLETE log it creates here (Split into sections if need be) ~ if there are loads of 'SNAPSHOT' pages then leave them out

If it comes up with a RENAMING error then RIGHT click the exe file and RENAME and call it QWERTY (Making the complete file name 'QWERTY.exe') Or SAVE as 'QWERTY' on download
(If no log comes up or you lose it, COMBOFIX.TXT can be found in C drive)