I did not get this:
In your initial post, you posted a screenshot of your Norton Auto Protect. However, I notice that you can scroll a bit more to the right to see the file directory. That's the one I need to see. Or better yet, if you could produce a log here for your Norton.
Ohh…that is not happening anymore but I can provide you the log. Can you please let me know, how to view that log?
I have Norton Antiviris Corporate Edition
If that's the case, the only thing we need to make sure now is whether your computer is running fine now?
I think attaching excel file is not allowed in this forum. I am attaching logs from the latest dat it happened and the first date it happened. The log file has 2396 entries like this. This is huge between these two dates (7 days)Here is the Log:
Thank you. Apparently those are just temp files.. Let's do a check up
Malwarebytes' Anti-Malware
Download
Malwarebytes' Anti-Malware here and save to your desktop.
Double-click mbam-setup.exe and follow the prompts to install the program. (Note to Vista users, please right-click and select Run as Administrator.) At the end, be sure a checkmark is placed next to:Update Malwarebytes' Anti-MalwareLaunch Malwarebytes' Anti-Malware Then click Finish . If an update is found, it will download and install the latest version. Once the program has loaded, select Perform quick scan , then click Scan . When the scan is complete, click OK, then Show Results to view the results. Be sure that everything is checked, and click Remove Selected . When completed, a log will open in Notepad. Please copy and paste the log back into your next reply Note: The log can also be found here:C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt Or via the Logs tab when Malwarebytes' Anti-Malware is started. Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. =================================================== ESET Online Scanner I'd like us to scan your machine with ESET OnlineScan
Note: If you are using Windows Vista/7, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.
*Note It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time. Hold down Control and click on the following link to open ESET OnlineScan in a new window.ESET OnlineScan Click the [external image: Posted Image] button. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop. Double click on the [external image: Posted Image] icon on your desktop. Check [external image: Posted Image] Click the [external image: Posted Image] button. Accept any security warnings from your browser. Check [external image: Posted Image] Make sure that the option "Remove found threats" is Unchecked Push the Start button. ESET will then download updates for itself, install itself, and begin Look for report in C:\Program Files\ESET\ESET Online Scanner\log.txt . Include the contents of this report in your next reply. Select Uninstall application on close check box and push [external image: Posted Image] =================================================== On your next reply please post : MBAM log
Let me know if you have any problems in performing with the steps above or any questions you may have.
Good Day!
MBAM Log:
Now that could be your source of problem.
Open
Notepad and copy/paste the entire contents of the codebox below into Notepad:
@echo off
if exist "%temp%\log.txt" del "%temp%\log.txt"
for %%g in (
"D:\dumps\VMWARE\keygen\keygen.exe"
) do (
del /a/f/q %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)
if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt"
) else echo.Deleted Successfully !!
pause
del %0
Save this Notepad file as
fix.bat and choose to
Save as type: - All Files then close the Notepad file.
It should look like this:
[external image: Posted Image]
Double-click on
fix.bat to run it.
Tell me what it says in your next reply. Press any key to continue.
It doesn't say anything command prompt disappears after pressing any key and fix.dat got deleted itself….cna you please let me know, what this means?
Try to navigate yourself to D:\dumps\VMWARE\keygen\keygen.exe and see if it's gone by now.
Yes. It is not there. Was it the only problematic file?
Yes, that is actually one of the major source of infection. Which is why we don't encourage people to use pirated software as it can create backdoors, trojans, etc without the user's knowledge. If you are happy with your computer's condition now, you are good to go. Anymore outstanding issues that you wish to address?
No Conspire. I will let you know if it happens again. Thank you very much for the support
Ok, time for us to do cleanups then
Follow these steps to uninstall Combofix
Click START then RUN Now copy/paste the code into the runbox and click OK . Note the space between the ..X and the /U , it needs to be there. Combofix /Uninstall
[external image: Posted Image]
===================================================
Thank you for your patience, and performing all of the procedures requested. I would also like to take this opportunity to apologize for any delay that may have occurred.
————————————————————————————————————–
MICROSOFT UPDATES
It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to
Microsoft and download all the critical updates to help prevent possible re-infection.
Passwords
It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them and consider a
password keeper , to keep all your passwords safe.
SPYWARE PREVENTION
This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:
To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:
WOT Green Yellow Red WOT has an add-on available for both Firefox and IE.
SpywareBlaster here MVPS HOSTS FILE here and for Windows Vista here Download Host.zip and Save it to your Desktop. Right-click hosts.zip and select 'Extract all files' or 'Extract files…'. Follow the prompts and click 'Finish'. This will open the newly created hosts folder on your Desktop. Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine. Once updated you should see another prompt that the task was completed.
Follow this list and keep your antivirus program and antispyware programs updated and scan with them on a regular basis. By doing so, your potential for being infected again will reduce dramatically.
Hopefully this should take care of your problems! Good luck.
Do you have any questions or problems to ask? Please do not hesitate to do so.
**Please respond this one more time to ensure it is resolved and close this topic.
Thanks Conspire for looking in to this issue and following up till the issue is resolved. But I think there were other files also that were deleted due to which this issue was happened? Can you please let me know about those files? Those were in temp folder I think.
Apparently, those files seem to originate from Symantec which you are using now. I'm not entirely sure what could be the cause, probably what I think it's some kind of bug and according to one of the Tech Support from Symantec, it has been fixed on the later version. Yours I think it's the old one. Scroll down to the bottom of that page and have a look.
http://www.symantec.com/connect/forums/dwhtmp
