[Resolved] Has anyone heard of Security Tool?

I was on the internet and all of a sudden I got a pop saying that someone was trying to get my credit card number. This is the exact message that I am getting: ieuser.exe is infected with worm Lsas.Blaster.Keyloger.This worm is trying to send your credit card details using ieuser.exe to connect to remote host Now everytime I try and go to a different screen it pops up. Can you tell me how to go about getting it off my computer? ETA: my laptop runs Vista! Thanks!

Anyone?

Hi,

Please do the following:

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.

• Disable any script blocking protection
• Double click dds.pif to run the tool.
• When done, two DDS.txt's will open.
• Save both reports to your desktop.

—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.


NEXT


[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

• Extract the contents of the zipped file to desktop.
• Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
• If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
  
  [external image: Posted Image]
  Click the image to enlarge it
  
• In the right panel, you will see several boxes that have been checked. Uncheck the following …
  • Sections
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  
• Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

I believe I have attached everything you need. Please let me know if I am missing something. the Gmer.txt froze my computer so I had to shut it down and restart so I am not sure if that is what you need. Thank you!

Hi,

Please do the following:

Download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2



**Note: It is important that it is saved directly to your desktop**

——————————————————————–
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
——————————————————————–

Double click on ComboFix.exe & follow the prompts.

• When finished, it will produce a report for you.
• Please post the C:\ComboFix.txt for further review.

Ok, neither link is working. One pops up with the save or run box, and I select save but nothing happens. The other link takes me to a site in spanish and I have no idea where the download is located.

Sorry, so I was able to get both links to the run or save box, but everytime I select save it goes away and nothing happens. And nothing is on my desktop either.

Do you have access to another computer where you can download it to - then transfer over via USB

or tap into safe mode with networking and run it from safemode

or download it and rename it before saing it to the desktop,,,,rename it to explorer.exe

Not sure how to do the first two suggestions…will try the third!

Do the following to enter safe mode:

To Enter Safemode

• Go to Start> Shut off your Computer> Restart
• As the computer starts to boot-up, Tap the F8 KEY repeatedly,
• this will bring up a menu.
• Use the Up and Down Arrow Keys to scroll up to Safemode
• Then press the Enter Key on your Keyboard
• go into your usual account

OR

If you have another computer - download it to the other computer. If you have a USB stick - plug it in to the USB port.

When the computer asks you where you want to save the file - choose the drive for the USB device (it's usually F:\) then ComboFix will save to the USB stick.

Now take that to the infected computer:

Go to my the run box: (windows key + R) type in F:\ComboFix.exe (if F:\ is your USB drive letter - if it is another letter - change it to the proper letter)

Hit > OK, ComboFix will now run on the infected computer.

Thank you for all your help, none of this is working for me. Looks like it may be a goner…

are you able to enter safe mode? does your computer recognize the USB? what happens when you try and run ComboFix?

Ok, so not wanting to give up I found myself at the "restore" feature. So I did this and restored my computer to a few days ago before the virus and now it's working fine. Is there something I need to do to ensure it keeps working this way? Will it come back? Thank you!

post the DDS and GMER logs, just to make sure there is no trace of it on your computer.

do I run new ones? or post the same ones from before?