52 replies to this topic

[Elise]

You are most welcome!

I will request this topic to be closed.

[LDTate]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

[LDTate]

Topic re-opened

[Elise]

Hello, please let me know what issues you are still having.

[heidiiiii5]

Everything was fine until the MP needed to be upgraded. Then Windows defender quarantined the same two malware`s that I posted before. The Dora and the other one (up thread). The computer is acting fine. None of the other issues with the browser`s like before. Just this morning the trial malwarebytes told me that it stopped a virus from getting in.

So I am wondering if it is coming from the virus protection.
I am going to purchase Malwarebytes when the trial is over.
Another weird thing happened that makes me think it is related. About a few days after you fixed the computer, I get a weird phone call from the NY area. They told me that there were virus attacks in my area and that they had been told I had an issue. I needed to turn on my computer.
I told them off basically because I did not fall off the turnip truck. But it creeped us out and wondered if it was connected at all.

Anyway, I did the upgrade on the iolo and it is quarantined.

If It happens again, I am gonna fling this laptop off my front porch.

[Elise]

Those phone calls unfortunately are more and more common. For more information see here.

Can you post the MBAM protection log so I can see what was blocked (open MBAM and click the Logs tab).

It is possible the two detected items were simply already in quarantine, did you see in what location they were detected?

[heidiiiii5]

Here are the two things that popped up. I will do the scan now
.1. C:\programdata\Iolo\systemshield\quarantined\DoraAdventure
W32/NewMalware-LSR-based-Maxim

2. C:\Programdata\iolo\systemshield\quarantined\71B5DAE-302B
W32/NewMalware-LSR-based-Maxim

[heidiiiii5]

Which log do you want from Mbam?
The todays protection log or the most current mbam log?

[heidiiiii5]

Okay. duh. I need more coffee. You said protection log. I will post one from yesterday and today.
2012/05/29 10:34:02 -0400 HEIDI-PC Heidi MESSAGE Starting protection
2012/05/29 10:34:05 -0400 HEIDI-PC Heidi MESSAGE Protection started successfully
2012/05/29 10:34:08 -0400 HEIDI-PC Heidi MESSAGE Starting IP protection
2012/05/29 10:34:12 -0400 HEIDI-PC Heidi MESSAGE IP Protection started successfully
2012/05/29 10:37:35 -0400 HEIDI-PC Heidi MESSAGE Executing scheduled update: Daily
2012/05/29 10:37:52 -0400 HEIDI-PC Heidi MESSAGE Scheduled update executed successfully: database updated from version v2012.05.27.06 to version v2012.05.29.04
2012/05/29 10:37:52 -0400 HEIDI-PC Heidi MESSAGE Starting database refresh
2012/05/29 10:37:52 -0400 HEIDI-PC Heidi MESSAGE Stopping IP protection
2012/05/29 10:40:41 -0400 HEIDI-PC Heidi MESSAGE IP Protection stopped
2012/05/29 10:40:45 -0400 HEIDI-PC Heidi MESSAGE Database refreshed successfully
2012/05/29 10:40:45 -0400 HEIDI-PC Heidi MESSAGE Starting IP protection
2012/05/29 10:40:48 -0400 HEIDI-PC Heidi MESSAGE IP Protection started successfully
2012/05/29 17:04:23 -0400 HEIDI-PC Heidi MESSAGE Starting protection
2012/05/29 17:04:28 -0400 HEIDI-PC Heidi MESSAGE Protection started successfully
2012/05/29 17:04:31 -0400 HEIDI-PC Heidi MESSAGE Starting IP protection
2012/05/29 17:04:34 -0400 HEIDI-PC Heidi MESSAGE IP Protection started successfully
2012/05/29 19:17:26 -0400 HEIDI-PC chelsea MESSAGE Starting protection
2012/05/29 19:17:30 -0400 HEIDI-PC chelsea MESSAGE Protection started successfully
2012/05/29 19:17:33 -0400 HEIDI-PC chelsea MESSAGE Starting IP protection
2012/05/29 19:17:36 -0400 HEIDI-PC chelsea MESSAGE IP Protection started successfully

2012/05/30 00:01:15 -0400 HEIDI-PC chelsea MESSAGE Executing scheduled update: Daily
2012/05/30 00:01:28 -0400 HEIDI-PC chelsea MESSAGE Starting database refresh
2012/05/30 00:01:28 -0400 HEIDI-PC chelsea MESSAGE Stopping IP protection
2012/05/30 00:01:28 -0400 HEIDI-PC chelsea MESSAGE Scheduled update executed successfully: database updated from version v2012.05.29.04 to version v2012.05.29.07
2012/05/30 00:04:51 -0400 HEIDI-PC chelsea MESSAGE IP Protection stopped
2012/05/30 00:04:55 -0400 HEIDI-PC chelsea MESSAGE Database refreshed successfully
2012/05/30 00:04:55 -0400 HEIDI-PC chelsea MESSAGE Starting IP protection
2012/05/30 00:04:59 -0400 HEIDI-PC chelsea MESSAGE IP Protection started successfully
2012/05/30 05:50:16 -0400 HEIDI-PC Heidi MESSAGE Starting protection
2012/05/30 05:50:20 -0400 HEIDI-PC Heidi MESSAGE Protection started successfully
2012/05/30 05:50:23 -0400 HEIDI-PC Heidi MESSAGE Starting IP protection
2012/05/30 05:50:26 -0400 HEIDI-PC Heidi MESSAGE IP Protection started successfully
2012/05/30 07:01:56 -0400 HEIDI-PC Heidi IP-BLOCK 173.192.183.195 (Type: outgoing, Port: 51106, Process: firefox.exe)
2012/05/30 07:01:56 -0400 HEIDI-PC Heidi IP-BLOCK 173.192.183.195 (Type: outgoing, Port: 51107, Process: firefox.exe)
2012/05/30 07:01:56 -0400 HEIDI-PC Heidi IP-BLOCK 173.192.183.195 (Type: outgoing, Port: 51108, Process: firefox.exe)
2012/05/30 07:03:00 -0400 HEIDI-PC Heidi IP-BLOCK 173.192.183.196 (Type: outgoing, Port: 51160, Process: firefox.exe)
2012/05/30 07:03:00 -0400 HEIDI-PC Heidi IP-BLOCK 173.192.183.196 (Type: outgoing, Port: 51164, Process: firefox.exe)
2012/05/30 07:03:00 -0400 HEIDI-PC Heidi IP-BLOCK 173.192.183.196 (Type: outgoing, Port: 51173, Process: firefox.exe)

I have noticed an issue with Windows Defender now too. It will turn off and then will not turn on again (time out) unless you restart the computer.

[Elise]

That block looks as originating from a specific sit you accessed. If that is the case then there is nothing to worry about.

And nothing to worry about the two detected items either, they were already quarantined and therefore harmless.

Do you have any other issue left at this point?

[heidiiiii5]

Nope. Just making sure. sorry to bother you.

[Elise]

No problem at all, better safe than sorry!

I will request this topic to be closed.

[LDTate]

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.