And a third Virus!

Hi Art,
In the future, just go to the last comment of your old question and click on the "Ask a related question" link below that comment. When you use that feature, a special email alert will be sent to any Expert who posted in the old question.

Did you install the Premium version of Malwarebytes?

I haven't yet had a re-infected system when the customer is running MSE + MBAM (Pro).

Post the results of your scanner logs and give us any symptoms (especially names/banners) that are displaying.

I probably gave you this link before - it has all the details.
Rogue-Killer-What-a-great-name
MALWARE - "An Ounce of Prevention..."
Ask an Expert
Search Solutions
      ID:36471185Author:artismobileDate:09/01/11 09:37 PMYour Comment      
Was this comment helpful?
Yes No
Ok,
I see where I can re-post now. I don't think I'm running the pro. Funny, but now I'm running a full scan (not done yet) it's found 3 since I killed the fake trojan alert. AND MSE just found and item not yet been classified for risks.  MSE was silent before that.  I have not sent it yet.
      ID:36471218Author:artismobileDate:09/01/11 09:51 PMYour Comment      
Was this comment helpful?
Yes No
Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7633

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

9/1/2011 9:45:52 PM
mbam-log-2011-09-01 (21-45-32).txt

Scan type: Full scan (C:\|)
Objects scanned: 311183
Time elapsed: 37 minute(s), 45 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Users\Michala\AppData\Local\Temp\C13D.tmp (Malware.Gen) -> No action taken.
c:\Users\Michala\AppData\Local\Temp\C6E8.tmp (Malware.Gen) -> No action taken.
c:\Users\Michala\AppData\Local\Temp\CA43.tmp (Malware.Gen) -> No action taken.


MSE detected 1 file and removed it.  Why is there no action taken by MWB?
      ID:36471233Author:artismobileDate:09/01/11 09:55 PMYour Comment      
Was this comment helpful?
Yes No
RogueKiller V5.3.1 [08/06/2011] by Tigzy
contact at http://www.sur-la-toile.com
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.sur-la-toile.com/discussion-193725-1-BRogueKillerD-Remontees.html

Operating System: Windows 7 (6.1.7600 ) 64 bits version
Started in : Normal mode
User: Michala [Admin rights]
Mode: Scan -- Date : 09/01/2011 21:01:48

Bad processes: 1
[SUSP PATH] win4036e0.dat -- c:\users\michala\appdata\local\temp\win4036e0.dat -> KILLED [TermProc]

Registry Entries: 2
[SUSP PATH] 2906828992.job : \\.\globalroot\device\harddiskvolume2\users\michala\appdata\local\temp\win4036e0.dat -> FOUND
[SUSP PATH] win4036e0.job : \\.\globalroot\device\harddiskvolume2\users\michala\appdata\local\temp\win4036e0.dat -> FOUND

HOSTS File:


Finished : << RKreport[10].txt >>
RKreport[10].txt ; RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt ; RKreport[4].txt ;
RKreport[5].txt ; RKreport[6].txt ; RKreport[7].txt ; RKreport[8].txt ; RKreport[9].txt

This was the 2nd time I ran it in Windows SAFE mode
      ID:36471409Author:artismobileDate:09/01/11 11:18 PMYour Comment      
Was this comment helpful?
Yes No
Just purchased MWB pro.  We'll see what happens!
      ID:36472065Author:phototropicDate:09/02/11 03:55 AMAssisted Solution      
Was this solution helpful?
Yes No
125 PointsA EXCELLENT
"...Why is there no action taken by MWB?..."   Mbam allows you to decide which items you wish to remove by checking or unchecking the box next to each entry.  You then click on "Remove selected" to quarantine the items.  From there you can permanently delete them.  "No action taken" means Mbam has not been asked to remove any of the selected items which it found.  Run the scan again and click on "Remove selected" and see if it can remove the malware.

Getting infected twice in a month suggests that there is a problem with safe surfing.of the internet.  Review the sites you routinely visit.  Are any in any way disreputable?  The most common source for infections is visiting disreputable sites:  adult sites; peer-to-peer networks and torrent sites; infected codecs; online games downloads; cracks and keygens; etc.

I apologise in advance for bringing this up, but the viral infection must be coming from somewhere.  Did you make a data backup during the last infection?  If so, that may be infected.  Do you have a flashdrive that may be re-infecting your pc? I think once your machine is once again clean you should review recent internet activity so that you can narrow down exactly where this infection is coming from.  Prevention is better than cure.
      ID:36473280Author:tskellyDate:09/02/11 09:28 AMAssisted Solution      
Was this solution helpful?
Yes No
125 PointsA EXCELLENT
For safer web searching, Web of Trust has benefited me.

Although some Web of Trust users unfortunately don't like Experts Exchange, and have marked it unsafe,  Web of Trust otherwise identifies many malicious web sites that show up in Google search results, helping avoid malware. (The discussion of Web of Trust can be seen elsewhere.)

Link to Web of Trust:

http://www.mywot.com/
      ID:36476006Author:SSharmaDate:09/02/11 05:06 PMAssisted Solution      
Was this solution helpful?
Yes No
125 PointsA EXCELLENT
@artismobile,

You have posted MalwareBytes logs first and then RogueKiller logs. Ideally RogueKiller should be run first and then MalwareBytes.

Once you are done with RogueKiller run MBAM again (do the update first and run Full System Scan)

Systems also get infected if they have older version of software installed as they are vulnerable and often are target of hackers.

Software like Flash, Shockwave, Java JRE should be updated too with the latest available version.

I hope that would help too.

Sudeep
      ID:36476507Author:artismobileDate:09/02/11 07:52 PMYour Comment      
Was this comment helpful?
Yes No
I ran Rouge first then MEB.  I posted the 2nd time I ran MWB after the first one I deleted the note. It is my daughter's computer and we just went over her search features, again. I'll have her update the old software versions as well.
Thanks
      ID:36477556Author:younghvDate:09/03/11 06:21 AMExpert Comment      
Was this comment helpful?
Yes No
Art,
I apologize for losing track of this one and not responding.
If I remember right, your daughter was doing her best to help us Experts stay on our toes :)
*************

You might want to consider a permanent solution to this problem as was discussed in my question from several years ago: https://www.experts-exchange.com/questions/23528044/Image-creation-storage-recommendations.html

The Expert (garycase) making the recommendation of "Boot-It NG" is an MS MVP and one of those people whose knowledge levels are way off the charts.

If you decide to go this route, creating a fresh image involves clicking a desktop icon and then go getting a cup of coffee (or other adult beverage) and coming back in about 5 minutes. The image is auto-stored on a separate partition and available to re-image simply by re-booting and following the directions.

As you can tell by reading through his comments, Gary is one of those guys who will walk you through the entire process - step-by-step. He hangs out in the Hardware Zones if you would like to post for some current advice/recommendations.

Use the "Ask a related question" function in my question and Gary will get the notification that you've done so.

Good luck with your lifetime project and say hey to your daughter for us.