4 replies to this topic

[bb223]

I've done everything I was told to do with Malewarebytes to remove my "You Have a Security Problem" virus and it's still here.

So here are my logs and maybe one of you could help me figure it out:


Malwarebytes' Anti-Malware 1.34
Database version: 1798
Windows 5.1.2600 Service Pack 3

2/24/2009 3:26:44 PM
mbam-log-2009-02-24 (15-26-44).txt

Scan type: Full Scan (C:\|)
Objects scanned: 129643
Time elapsed: 1 hour(s), 4 minute(s), 28 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 23

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\userinit.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\userinit.exe -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\System Volume Information\_restore{43D604FE-8A8B-4315-9160-7F7000C31A8B}\RP174\A0029666.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{43D604FE-8A8B-4315-9160-7F7000C31A8B}\RP175\A0029743.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{43D604FE-8A8B-4315-9160-7F7000C31A8B}\RP175\A0029744.scr (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{43D604FE-8A8B-4315-9160-7F7000C31A8B}\RP175\A0029753.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{43D604FE-8A8B-4315-9160-7F7000C31A8B}\RP175\A0029754.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{43D604FE-8A8B-4315-9160-7F7000C31A8B}\RP175\A0029757.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{43D604FE-8A8B-4315-9160-7F7000C31A8B}\RP175\A0029758.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{43D604FE-8A8B-4315-9160-7F7000C31A8B}\RP175\A0029759.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{43D604FE-8A8B-4315-9160-7F7000C31A8B}\RP175\A0029761.SCR (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{43D604FE-8A8B-4315-9160-7F7000C31A8B}\RP175\A0029763.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{43D604FE-8A8B-4315-9160-7F7000C31A8B}\RP175\A0029764.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{43D604FE-8A8B-4315-9160-7F7000C31A8B}\RP175\A0029766.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{43D604FE-8A8B-4315-9160-7F7000C31A8B}\RP175\A0029769.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{43D604FE-8A8B-4315-9160-7F7000C31A8B}\RP175\A0029770.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{43D604FE-8A8B-4315-9160-7F7000C31A8B}\RP175\A0029755.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{43D604FE-8A8B-4315-9160-7F7000C31A8B}\RP175\A0029775.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{43D604FE-8A8B-4315-9160-7F7000C31A8B}\RP175\A0029776.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{43D604FE-8A8B-4315-9160-7F7000C31A8B}\RP175\A0029781.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{43D604FE-8A8B-4315-9160-7F7000C31A8B}\RP175\A0029782.DLL (Adware.FunWeb) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{43D604FE-8A8B-4315-9160-7F7000C31A8B}\RP175\A0030667.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{43D604FE-8A8B-4315-9160-7F7000C31A8B}\RP175\A0030669.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{43D604FE-8A8B-4315-9160-7F7000C31A8B}\RP175\A0030672.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{43D604FE-8A8B-4315-9160-7F7000C31A8B}\RP175\A0030673.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.

[Tigger93]

Please post a HijackThis log. If you need instructions and a download link, there is one posted in the sticky topic and the top of this forum.

[bb223]

Tigger93, on Feb 25 2009, 01:43 AM, said:

Please post a HijackThis log. If you need instructions and a download link, there is one posted in the sticky topic and the top of this forum.

Well, I just reinstalled XP and there doesn't seem to be any issues.

I think I'm fine.

But am I?

Thanks.

[Tigger93]

Yep, thanks for letting me know. Would have been fixable, your choice however.

[bb223]

Actually, I tried to start in safe mode to run a scan and I couldn't get past the page where you pick which user name to log onto Windows under, if that makes any sense, lol.

I would click on "Administrator" and it would load, then it would say "Logging Out"

But reinstalling XP fixed all of my issues, expect it was a PITA trying to find another sound device.

But I finally did, and all is well.