re-new malware to me ?

joe134

waddler_8 wrote: »

Just do a quick scan. The quick scan looks in all the areas malware's likely to be loading from or running from. Over the quick scan, the full scan might only find harmless traces. 99.9% of the time the full scan isn't needed.

Hi, waddler, thanks. stopped full, removed 3 detected adwares, now running short scan, see if that pulls anything up, and finishes.
How do I change windows login password, changed google mail one, and aol one, but windows still the same?

waddler_8

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/usercpl_change_password.mspx?mfr=true

joe134

Paddy_H wrote: »

Just because you didn't enter your password doesn't mean it hasn't sent it to all your address book, these virus's do sometimes exploit and spam your address book sometimes they fail. However do not worry but take note that links to 'logins/user account updates etc' emails can be very dangerous and not to open any links that dont look right to you.

Like somebody said, this is a massively popular virus and the only way to avoid it is to know when to open an email and when not to... more the case of clicking a link in an email i mean.

Hi, Thanks, I am usually very careful opening any e-mail, as you say, it could have used my address book, but pc is showing all clear.
Several people have contacted daughter about the phishing e-mail.
I,ve found another 4 adware, that,s 7 in total using malwarebytes, its ADWARE, MyWe from funweb products, removed them.
Scanning with her Avira A/v now.:beer:

waddler_8

joe134 wrote: »

I,ve found another 4 adware, that,s 7 in total using malwarebytes, its ADWARE, MyWe from funweb products, removed them.

http://forums.moneysavingexpert.com/showpost.php?p=50219687&postcount=27

joe134

waddler_8 wrote: »

http://forums.moneysavingexpert.com/showpost.php?p=50219687&postcount=27

Thanks waddler, cleaner daughters pc, all clear now, unless there,s something deep in registry, ran ccleaner reg+.
Don,t know if that MyWe was the 1 that got in her address book,seems harmless enough, her pc is a Dell laptop;;;:beer: I saw 2 urls; on my Avast detection, neither was MyWE; cannot recall what it was;
I will soon know if I get complaints from my E-mail recipients.
Thanks for everything.

waddler_8

joe134 wrote: »

all clear now, unless there,s something deep in registry, ran ccleaner reg+.

Malware itself can't reside "deep in the registry" per se.

Basically the registry is just a database containing user by user settings/configuration information about Windows, and your software & hardware. So anything malware related in the registry is just settings/configuration information about the malware - just the same as any other software.

For example, malware may write a load point to the registry to ensure it's files are autostarted when windows loads, or when other programs/files are run/executed. Without there being associated files on the disk, any information in the registry is redundant & essentially harmless.

You might also see malware associated detections in the registry when certain settings have been changed - for example the information for your homepage & search providers when using Internet Explorer are contained within the registry. Malware may change these for nefarious means. They're relatively easy to change back, and so long as the malware that did it is no longer active, they will stay that way.

What HijackThis does is enumerate certain settings/configuration data from within the registry that is known to be utilised by malware as well as legitimate programs. Someone who knows how to interpret the information can then check that data to determine if there are any tell tale signs of malware present. Unfortunately little has been done with HijackThis since Trend acquired the software from it's original developer. Malware uses more ways now to get itself loaded - from places HijackThis just doesn't look - and sadly Trend haven't kept it updated enough in respect of this.

The Malwarebytes quick scan does scan & enumerate the registry to check those places malware may have installed to & may autostart from etc.., and check the settings malware may have modified. So, as you've run mbam, you can be sure the registry has been scanned for any data within the registry associated with malware.

All CCleaner does in respect of the registry is delete what it thinks are redundant entries - It can't distinguish between legitimate software & malware, so cleaning the registry with CCleaner after an infection isn't really going to clean any malware, it'll only remove the redundant entries/information - As I said earlier, essentially harmless without the associated file(s) on disk. If the files were there on disk, CCleaner wouldn't (or shouldn't) be removing them.

joe134 wrote: »

Don,t know if that MyWe was the 1 that got in her address book

Unlikely.