Pub. BundleInstaller, trojan.backdoor and trojan.dropper.pe4 :(

[give]

Hello,

Since two days I have been having problems with my laptop. Everytime I open a website the following sign appears: "to help protect your security, Internet explorer has blocked this website from displaying content with security certificate errors. Click here for options". Initially I thought it was a certificate-related problem to log in into my facebook account, so I ignored the expiration warning of the certificate of the website and clicked continue. However, since these messages appeared in all websited, I decided to scann my laptop against malwares. Initially I got the following results using the quick scan option on normal mode:

Malwarebytes Anti-Malware (PRO) 1.62.0.1300

www.malwarebytes.org

Database version: v2012.07.03.05

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 8.0.6001.18702

Administrator :: GLV [administrator]

Protection: Enabled

6/14/2012 8:37:18 AM

mbam-log-2012-06-14 (08-37-18).txt

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 228445

Time elapsed: 5 minute(s), 36 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 4

C:\Documents and Settings\Administrator\Desktop\soft_pcp_conduit.exe (PUP.BundleInstaller.IB) -> Quarantined and deleted successfully.

C:\Documents and Settings\Administrator\Desktop\soft_pcp_conduit[1].exe (PUP.BundleInstaller.IB) -> Quarantined and deleted successfully.

C:\WINDOWS\Installer\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\n (Trojan.Dropper.PE4) -> Quarantined and deleted successfully.

C:\WINDOWS\Installer\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\U\800000cb.@ (Rootkit.0Access) -> Quarantined and deleted successfully.

(end)

------------------------------

Then I performed a full scan on a safe mode and got this:

Malwarebytes Anti-Malware (PRO) 1.62.0.1300

www.malwarebytes.org

Database version: v2012.07.03.05

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 8.0.6001.18702

Administrator :: GLV [administrator]

Protection: Disabled

6/14/2012 11:36:56 AM

mbam-log-2012-06-14 (11-36-56).txt

Scan type: Full scan (C:\|D:\|)

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 697314

Time elapsed: 8 hour(s), 12 minute(s), 15 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 6

C:\Documents and Settings\Administrator\Desktop\Stubs\a90753731c746efd3752d897dd0efced8435956\wlcomm.exe (Trojan.Backdoor) -> Quarantined and deleted successfully.

C:\Documents and Settings\Administrator\Local Settings\Application Data\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\n (Trojan.Dropper.PE4) -> Quarantined and deleted successfully.

C:\Program Files\Uninstall Information\ib_uninst_515\uninstall.exe (PUP.BundleInstaller.IB) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP248\A0079731.exe (PUP.BundleInstaller.IB) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP248\A0079732.exe (PUP.BundleInstaller.IB) -> Quarantined and deleted successfully.

C:\WINDOWS\Tasks\bProtector.job (PUP.BProtector) -> Quarantined and deleted successfully.

(end)

-----------------------------------

A couple of minutes ago, I did another quick scan on a normal mode and I still have the problem with my internet and with what ever the laptop has. I got the following results:

Malwarebytes Anti-Malware (PRO) 1.62.0.1300

www.malwarebytes.org

Database version: v2012.07.13.01

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 8.0.6001.18702

Administrator :: GLV [administrator]

Protection: Enabled

6/14/2012 11:46:01 PM

mbam-log-2012-06-14 (23-46-01).txt

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 230042

Time elapsed: 10 minute(s), 30 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 1

C:\WINDOWS\Tasks\bProtector.job (PUP.BProtector) -> Quarantined and deleted successfully.

(end)

Could you please help me?

Thank you in advance!!!!

[AdvancedSetup]

Hello and welcome to Malwarebytes

You have signs of Zero Access rootkit which will require assistance to clean.

Here are the steps needed to get your computer cleaned....

Please read the following so that you can begin the cleaning process:

Don't use any temporary file cleaners unless requested - this can cause data loss and make recovery difficult

You have 3 Options that you can choose from as listed below:

• Option 1 —— Free Expert advice in the Malware Removal Forum
  
• Option 2 —— Paying customer -- Contact Support via email
  
• Option 3 —— Premium, Fee-Based Support
  

OPTION 1

As we don't deal with malware removal in the

General Malwarebytes' Anti-Malware Forum

, you need to start a topic in the

Malware Removal forum

so a qualified helper can help you fix any malware related problems or infections you may have.

• Please read and follow the directions here, skipping any steps you are unable to complete.
  
• After posting your new post, make sure under options, you select Follow this topic and choose Instantly,
  so that you're alerted when someone has replied to your post.
  

NOTE: Please do not post back to (bump) your topic within the first 48 hours.

Replying to your own posts changes the post count and helpers are looking for topics with zero replies.

If you reply to your own post helpers may think that you're already being helped and thus overlook your post.

• 
  
  • If there is no reply from any experts after 48 hours, you can reply to the topic, asking for help again.
    Or
    
  • You may send a Private Message to a Moderator asking for assistance.
    

OPTION 2

Alternatively, as a paying customer, you can contact the help desk

here

OPTION 3

If you would like to use our

Malwarebytes Premium Consumer Services

partner, Comprehensive solutions to all your computer support needs—from installation and set-up to troubleshooting and tune-ups go to our

Malwarebytes Premium Services

support site.

Please be patient, someone will assist you as soon as possible.