Virus /Rootkits Thread

Lowyat.NET forums

Lowyat.NET Kopitiam Garage Sales

Lowyat.NET Rules and Regulations FAQ Help Search Members

Welcome Guest ( Log In | Register )

Lowyat.NET -> Technical Support

Bump Topic Add Reply RSS Feed

Outline · [ Standard ] · Linear+

Virus/Malware Virus /Rootkits Thread, Work In Progress

views

chrisling	Apr 4 2013, 10:47 AM Return to original view \| Post #1
Helper Trainee+ Senior Member 1,684 posts Joined: Nov 2006 From: KL	QUOTE(ally19 @ Apr 3 2013, 10:34 PM) hi, i hope im posting in the correct thread. please guide to the proper thread if im not. My dad's pc (windows 7) has been infected with some virus. I installed Malwarebytes and these are the 2 virus it found. I removed it and then restarted according to the instructions. I did a re-scan and the virus is still there. 1. PUM.UserWLoad 2. Trojan.Ransom This lead to another problem as 3 of our thumb drive was also infected with "Backdoor.Bot". This got me worried as I did a search and it says it can compromise security. For some reason our thumb drive files changed into a "shortcut". I transferred some files from the pc to my ex-hd before realising it was infected. When I plugged my ex-hd into my mac laptop, it became a ".lnk" file. I myself is using a mac and I'm wondering when I plugged my ex-hd in, would it infect my mac too. I'm not really an IT person so I'm thinking of sending it to a professional to clean the pc and thumb drives and my mac to the service center. A result log from MBAM posted over here would be much helpful and at least can let us go through which entries or value did not get cleared. Malware that infects Windows has different execution method and Mac is running in a totally different environment. So do not worry the Mac will get infected, instead, if you send your Windows PC to any shop, people will just ask you to format it. That would be last resort for you if the malware could not be got rid.
Card PM	Report Top Like Quote Reply

chrisling	Apr 4 2013, 09:52 PM Return to original view \| Post #2
Helper Trainee+ Senior Member 1,684 posts Joined: Nov 2006 From: KL	QUOTE(ally19 @ Apr 4 2013, 07:34 PM) My dad has already sent it to the shop. He always goes there whenever the pc/printer has problems. Anyways I've posted both mbam report. MBAM log (pc) » Click to show Spoiler - click again to hide... « Malwarebytes Anti-Malware 1.70.0.1100 www.malwarebytes.org Database version: v2013.04.03.05 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 9.0.8112.16421 CHOWPK :: CHOWPK-PC [administrator] 3/4/2013 9:20:25 PM mbam-log-2013-04-03 (21-20-25).txt Scan type: Quick scan Scan options enabled: Memory \| Startup \| Registry \| File System \| Heuristics/Extra \| Heuristics/Shuriken \| PUP \| PUM Scan options disabled: P2P Objects scanned: 237231 Time elapsed: 7 minute(s), 31 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 2 HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\|Load (PUM.UserWLoad) -> Data: C:\Users\CHOWPK\LOCALS~1\Temp\msdicjkr.com -> Delete on reboot. HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\|Load (Trojan.Ransom) -> Data: C:\Users\CHOWPK\LOCALS~1\Temp\msdicjkr.com -> Delete on reboot. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) MBAM log (pendrive) » Click to show Spoiler - click again to hide... « Malwarebytes Anti-Malware 1.70.0.1100 www.malwarebytes.org Database version: v2013.04.03.05 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 9.0.8112.16421 CHOWPK :: CHOWPK-PC [administrator] 3/4/2013 10:14:47 PM mbam-log-2013-04-03 (22-14-47).txt Scan type: Custom scan (G:\\|) Scan options enabled: File System \| Heuristics/Shuriken \| PUP \| PUM Scan options disabled: Memory \| Startup \| Registry \| Heuristics/Extra \| P2P Objects scanned: 6 Time elapsed: 3 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 1 G:\~$WB.FAT (Backdoor.Bot) -> Quarantined and deleted successfully. (end) It shouldn't be "Quick Scan" though when you want to clean the culprit. Next time use Full System Scan instead. Scanning on the pen drive is needed when you had inserted the pen drive at another PC, and it should be scanned after the PC is cleaned. It's useless to scan the pen drive while the PC is still infected. Anyway, good luck to you as you have already sent the PC to the shop
Card PM	Report Top Like Quote Reply

chrisling	Mar 21 2014, 12:52 PM Return to original view \| Post #3
Helper Trainee+ Senior Member 1,684 posts Joined: Nov 2006 From: KL	QUOTE(mensa @ Mar 20 2014, 08:21 PM) guys may i know what is Wcenter60.exe? i noticed serious lagg and high memory consumption. from the properties the location is C:\Users\ADAMDHIYAA\AppData\Roaming\Microsoft. But couldnt find it. Is it some sort of virus or etc? TQ Unhide the system files and user files you should be able to view at it.
Card PM	Report Top Like Quote Reply

« Next Oldest · Technical Support · Next Newest »

Add Reply Options

Change to:

0.0146sec

0.66

7 queries

GZIP Disabled
Time is now: 12th December 2025 - 09:48 AM

All Rights Reserved © 2002- 2025 Vijandren Ramadass (~unite against racism~)

Removal Request

Powered by Invision Power Board © 2025 IPS, Inc.