FYI: Be careful of what you download...

[s2driveruk]

...and i don't mean dodgy stuff.

http://www.bleepingcomputer.com/forums/topic382403.html

My laptop has been infected with a whole raft of stuff over the last few days, starting off with what looked to have been a pretty innocent flash update off the BBC site for allowing the kids to play some interactive games on CBBC website. Apparently these latest infections are known as cocktails because they incorporate a whole assortment of malware, trojans and other backdoor stuff which are near impossible to shift.

I have subsequently tried combo, rkill, MBAM, trend titanium, DDS, avg and this bloody thing continues to morph itself. the last thing i plucked from the PC earlier using MBAM again was pum.BAD.proxy malware Windows defender on the latest scan found nothing but doesnt seem to mean anything. I'm about to kick off a full scale reformat as i am not 100% sure the machine will ever be totally free until that point.

It hides personal files, backgrounds, removes buttons, limits functionality and scatters **** all over the registry and either hides or deletes installed AV software - i was re-loading some via SD card and as soon as it touched the pC, it hid or removed it

interestingly, i have just recieved update requests for Java and windows...again

Just be careful out there, this looks like a nasty batch and its the first time i haven't been able to recover a pc from such an event, not that i am some wizard, far from it but usually able to get back from a hit.

Cheers
David

[ericd]

david, what's stopping using a restore point or backup (if you have one ?)

[s2_bo]

Get a mac, problem solved

(sorry if that was not what you wanted to here mate)

[s2driveruk]

david, what's stopping using a restore point or backup (if you have one ?)

I have just done a restore but this thing is so ingrained in the system files I am not 100% happy that it won't be back again in a couple of days time. most stuff has been found in system32 and despite following instructions a few days back, its been reinfected. Advice seems to be to wipe and restart

[s2driveruk]

Get a mac, problem solved

(sorry if that was not what you wanted to here mate)

nah just will not be using IE anymore I dont think though

[prj]

Mac is just as susceptible to the stuff.
There have been some outbreaks in the past.

When you download a nastie and then give it superuser rights, it can do whatever it wants to your system on any platform. Be it windows, linux or mac.
The weakest link with these nasties is not the computer or the platform - it's a Layer 8 problem...

[ericd]

I have just done a restore but this thing is so ingrained in the system files I am not 100% happy that it won't be back again in a couple of days time. most stuff has been found in system32 and despite following instructions a few days back, its been reinfected. Advice seems to be to wipe and restart

is it clever enough to stop you loading new anti malware ?, say something like malwarebytes anti-malware from filehippo or similar

[irishs2]

MBAM is malwarebytes ericd, superantispyware is good sometimes as is gmer for rootkit, but is this thing slapping a proxy between you and the web? I had to manually remove the rogue proxy entry from the registry and then reboot and was able to kill it then with superantispyware.

[s2_wot]

I've got a paypal activated virus at the moment. If I open a paypal in a tab it proceeds to close the browser and reopen it with only one tab and paypal is shown. It also opens the browser in another window which stays blank in the background. A real PITA to work around.

I have McAfee and Spybot S&D repeatedly getting rid of these trojans but they keep coming back. Anything else I could try? I'm backing up stuff the last day and a half to prepare for a format and start again.

[ericd]

MBAM is malwarebytes ericd, superantispyware is good sometimes as is gmer for rootkit, but is this thing slapping a proxy between you and the web? I had to manually remove the rogue proxy entry from the registry and then reboot and was able to kill it then with superantispyware.

aye sorry didn't make myself clear there, ripout/delete an existing malware product , reinstall it from scratch (location on the web), see what happens, the scenario you describe with the proxy entry is historical in relation to IE , david you indicated that you're running IE is that still the case ?

[irishs2]

Shane, does your 'paypal virus' do the same thing in IE, Firefox or Chrome?

[s2driveruk]

yep tried superantispyware and Gmer and Gmer higlighted a huge trail of rootkit stuff

Will try doing it through firefox or soomething and see what occurs

[varia]

I removed that bs from 2 laptops by Malwerebyte's Anti-malware

[Masterblaster]

try stinger and tune up 2011

[urS6Tom]

Get a mac, problem solved

(sorry if that was not what you wanted to here mate)

+1

used to spend a frustrating amount of time battling all the **** out there... got a mac and i haven't had a single problem in 3 years