Help with infected PC.

waddler_8

To be fair to MSE all AV's miss stuff.

I've just got my test PC infected with a rootkit which MSE detects but Avast (amongst others) doesn't.

https://www.virustotal.com/file/2ceb6c275be08324fcf1ee884fa2914169048c5e5e5bf19ccc4706c79186bf7f/analysis/

It's missing the rogue's .exe as well.
(Windows Security System - Rogue:Win32/Winwebsec)

https://www.virustotal.com/file/8e39d9384b6bbb52319c28c9b0eb8dfa4742806e639120eb9fd1fabcce91e116/analysis/1343336968/

Jon_01

waddler_8 wrote: »

Are you up for the manual fix?

http://support.microsoft.com/kb/2483120#LetMeFixItMyselfAlways

That's the thing.

When the Fixit app failed to remove it, I tried the manual fix. Nothing. I've checked it twice and everything listed has been removed, but a new install always fails (no error code, just starts and then stops).
And the Action Center still lists MSE but can't turn it on or update it !

I'm guessing that something in the restore has corrupted?

I can't even restore to an even earlier point as the infection has wiped all the restore point prior to its install !
(I think I'm stuffed :eek:)

waddler_8

The combofix log shows these:

2012-07-22 17:58:30

---

d

---

w- C:\Users\Steve\AppData\Roaming\Panda Security
2012-07-22 17:55:51

---

d

---

w- C:\ProgramData\Panda Security
2012-07-22 17:55:51

---

d

---

w- C:\Program Files (x86)\Panda Security

2012-07-22 17:07 . 2012-07-03 16:21 285328 ----a-w- c:\windows\system32\aswBoot.exe
2012-07-22 17:06 . 2012-07-22 17:37

---

d

---

w- c:\programdata\AVAST Software
2012-07-22 17:06 . 2012-07-22 17:06

---

d

---

w- c:\program files\AVAST Software

It may be refusing to install because it detecting previous AV's leftovers.

Run the Avast & Panda uninstall utilities and then try again.

http://www.avast.com/uninstall-utility

http://www.pandasecurity.com/homeusers/support/card?id=55509

closed

If you want to save some time ...

waddler_8

Lol, must upgrade to the newest version of Hindsight. :whistle:

Jon_01

waddler_8 wrote: »

The combofix log shows these:It may be refusing to install because it detecting previous AV's leftovers.

Run the Avast & Panda uninstall utilities and then try again.

http://www.avast.com/uninstall-utility

http://www.pandasecurity.com/homeusers/support/card?id=55509

At last! That's sorted it out.

Many thanks for all your help on this (again).

waddler_8

Glad it sorted it. Everything ok now?