[Resolved] Memman.vxd (Rogue.SysCleanerPro) - can't get rid of.

Hi,

Please do one more scan for me.

Some programs use memman.vxd legitimately such as Folder Phantom, you don''t have that on your pc but perhaps one of your other programs also uses it and that is why it is constantly getting recreated and is a false positive by Malwarebytes, so we should get your particular file analyzed.


Please do the following:

• Make sure to use Internet Explorer for this
• Please go to VirSCAN.org FREE on-line scan service
• Copy and paste the following file path into the "Suspicious files to scan" box on the top of the page:
  

  
  C:\WINDOWS\system32\Memman.vxd
  

• Click on the Upload button
• If a pop-up appears saying the file has been scanned already, please select the ReScan button.
• Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
• Paste the contents of the Clipboard in your next reply.

Hi,

I did 'delete' the Memman that MBAM found as I do repeatedly. I scan, delete Memman, reboot, re-scan (immediately) and re-delete the Memman that MBAM again finds and so on.

I couldn't clear the DNS.
————————–
C:\Documents and Settings\Arjun>ipconfig /flushdns
Windows IP Configuration
Could not flush the DNS Resolver Cache: Function failed during execution.
————————–

I haven' yet completed the HostsXpert, Flash_Disinfector or Registry Search instructions.

Folder Phantom has the same GUI and, from I've just read, appears to work in exactly the same way as the folder/file 'hiding' program I do have: Macrosoft's Invisible Security 1.2. They both look like the same product, with PCMag's Folder Phantom being a re-skin of the other.

VirSCAN.org Scanned Report :
Scanned time : 2009/09/16 16:38:59 (BST)
Scanner results: All Scanners reported not find malware!
File Name : Memman.vxd
File Size : 5765 byte
File Type : MS-DOS executable, LE executable for MS Windows (VxD)
MD5 : 73009575522f741fc9ee14391ef3f6bb
SHA1 : 2f1eae3de17bbc225dadc984295e21ad554c8d36
Online report : http://virscan.org/report/a219c1ffe117dfca…b39ba2ec1e.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.8 20090916233347 2009-09-16 8.29 -
AhnLab V3 2009.09.17.00 2009.09.17 2009-09-17 1.27 -
AntiVir 8.2.1.18 7.1.5.251 2009-09-16 0.48 -
Antiy 2.0.18 20090916.2817737 2009-09-16 0.12 -
Arcavir 2009 200909161248 2009-09-16 0.02 -
Authentium 5.1.1 200909161017 2009-09-16 1.24 -
AVAST! 4.7.4 090916-0 2009-09-16 0.00 -
AVG 8.5.288 270.13.101/2376 2009-09-16 0.52 -
BitDefender 7.81008.4193714 7.27725 2009-09-16 3.97 -
CA (VET) 9.0.0.143 31.6.6739 2009-09-16 19.63 -
ClamAV 0.95.2 9809 2009-09-16 0.01 -
Comodo 3.11 2337 2009-09-16 0.87 -
CP Secure 1.3.0.5 2009.09.16 2009-09-16 0.01 -
Dr.Web 4.44.0.9170 2009.09.16 2009-09-16 7.20 -
F-Prot 4.4.4.56 20090916 2009-09-16 1.22 -
F-Secure 7.02.73807 2009.09.16.06 2009-09-16 0.13 -
Fortinet 2.81-3.120 10.836 2009-09-15 0.18 -
GData 19.7889/19.477 20090916 2009-09-16 4.91 -
ViRobot 20090915 2009.09.15 2009-09-15 0.44 -
Ikarus T3.1.01.72 2009.09.16.73642 2009-09-16 4.25 -
JiangMin 11.0.800 2009.09.16 2009-09-16 6.68 -
Kaspersky 5.5.10 2009.09.16 2009-09-16 0.12 -
KingSoft 2009.2.5.15 2009.9.16.22 2009-09-16 0.55 -
McAfee 5.3.00 5743 2009-09-16 3.44 -
Microsoft 1.5005 2009.09.16 2009-09-16 6.07 -
Norman 6.01.09 6.01.00 2009-09-16 4.02 -
Panda 9.05.01 2009.09.15 2009-09-15 1.96 -
Trend Micro 8.700-1004 6.450.01 2009-09-16 0.02 -
Quick Heal 10.00 2009.09.16 2009-09-16 1.55 -
Rising 20.0 21.47.24.00 2009-09-16 0.35 -
Sophos 2.90.1 4.45 2009-09-16 7.43 -
Sunbelt 5392 5392 2009-09-15 1.69 -
Symantec 1.3.0.24 20090916.003 2009-09-16 0.05 -
nProtect 20090916.01 5499551 2009-09-16 8.30 -
The Hacker [removed] v00404 2009-09-14 0.72 -
VBA32 3.12.10.10 20090915.1506 2009-09-15 2.00 -
VirusBuster 4.5.11.10 10.112.38/1863643 2009-09-15 0.00 -

Hi,

That solves the mystery then.

It is a virtual device driver, some programs use it legitimately. It would appear the program you have is identical to Folder Phantom, so I would say that your version also requires memman.vxd

Unfortunately, there are some malware uses for a file of the same name, so MalwareBytes is reporting it as malware.


There is no other malware remaining on your system, so time to clean up.

Don't worry about the other procedures. I'm satisfied it is a required file by your Macrosoft program.

Time to clean up our tools,

please do the following:

Follow these steps to uninstall Combofix

• Click START then RUN
• Now type Combofix /u in the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]


Should you wish to contribute to the ongoing development of ComboFix, donations are being accepted via PayPal.



Next

Download ToolsCleaner2 to your desktop and run it ( by de A.Rothstein & Dj Quiou )

• Click the Pt. Restauration button and press OK to the prompts.
• Click the Corbeille button and press OK to the prompt.
• Click the Fichiers temp button and press OK to the prompt.
• Click the Recherche button and let it run ( it may look like it freezes but let it continue )
• Once it is done click the Suppression button and let it remove anything it finds.
• Close the program

If there are any remaining logs/tools on your desktop - right click and delete them.



Next

Below I have included a number of recommendations for how to protect your computer against malware infections.

• Keep Windows updated by regularly checking their website at :
  http://windowsupdate.microsoft.com/
  This will ensure your computer has always the latest security updates available installed on your computer.
• SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.
• SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.
• Make Internet Explorer more secure
  
  • Click Start > Run
  • Type Inetcpl.cpl & click OK
  • Click on the Security tab
  • Click Reset all zones to default level
  • Make sure the Internet Zone is selected & Click Custom level
  • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
  • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
• ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
• MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
  
• WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
  
  • Green to go
  • Yellow for caution
  • Red to stop
  WOT has an addon available for both Firefox and IE
  
• For Firefox, I highly recommend this add-on to keep your PC even more secure.
  
  • NoScript - for blocking ads and other potential website attacks
• Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  
• ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
  
• Please read these useful guides How did I get infected in the first place?
• PC Safety and Security–What Do I Need?
• miekiemoes' Prevention topic.

Thank you for your patience, and performing all of the procedures requested.

Please respond to this thread one more time so we can mark this thread as resolved.

Hi, I've completed all the stages. Can I ask if there is any free tool to defrag the MFT, if a defrag is needed on a 2-year-old hard-drive that hasn't ever had one, bar "C:" and "D:" defrags? I try to keep a control of which programs install to the SysTray and hence load on every boot, but the P.C. for a while hasn't felt as fast as it once was. Is some extra RAM the only option?

Hi,

Sorry, no, I'm not aware of any free utilities that will do the job.

http://www.diskeeper.com/diskeeper/home/home.asp

I've heard good things about diskeeper, not sure if their trial version has the MFT option or not.


More RAM might be your best option.

O.K. I think that's everything. Thanks for all your help - it is much appreciated.

You are more than welcome stay safe ~CB

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.