Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Backdoor on computer created 4 user profiles and remote download

Backdoor:MSIL/Bladabindi HackTool:Win32/Rabased!rfn

  • Please log in to reply

#16
reppucci

reppucci

    Member

  • Topic Starter
  • Member
  • PipPip
  • 15 posts

Thank you again for your help! You have been very kind!

 

fmshelper.exe is still functional on the computer? If not... do i need to do anything about that?

 

HKey-user  1007 registry key was not there.

 

would you recommend avast over MSE?

 

Vincent


  • 0

Advertisements


#17
RKinner

RKinner

    Malware Expert

  • Expert
  • 24,624 posts
  • MVP

I do recommend Avast especially for Win 7 systems.  Avast will support Win 7 for a long time yet. No idea how long MS will support MSE for Win 7 since they think it's obsolete.  Also the Avast boot-time scan is the best around.

 

Click on the Avast ball.  Then click on Protection, then on Antivirus, then on Other Scans then on Boot-time Scan.  Click on Install Special Definitions.  Click on Run on Next PC Reboot.

  Reboot and let it run a scan.  It may take hours.
Once it finishes it should load windows.   Mute your speakers so it doesn't wake you up when Windows boots.

When you reboot you will see the scan start.  It will tell you where it saves its log.  Usually it's C:\ProgramData\AVAST Software\Avast\report\aswBoot.txt but it might change so verify the location.   This is a hidden location so you will need to tell Windows to let you see it:

http://www.howtogeek...-windows-vista/

Copy and paste the text from the log to a Reply when done.

 

 

If the ads to upgrade bother you:  Right click on the Avast icon and select Silent Mode.  That will shut it up but you should check for program upgrade periodically as you may not get a notice.


  • 0

#18
reppucci

reppucci

    Member

  • Topic Starter
  • Member
  • PipPip
  • 15 posts

would you recommend, if i go with Avast, to also uninstall Malwarebytes Premium? or keep them both?


  • 0

#19
RKinner

RKinner

    Malware Expert

  • Expert
  • 24,624 posts
  • MVP

Appears your version of MBAM is not the one that includes an AntiVirus so it should not mind having Avast.

AV: Microsoft Security Essentials (Enabled - Up to date) {71A27EC9-3DA6-45FC-60A7-004F623C6189}
AV: Avast Antivirus (Disabled - Out of date) {EB19B86E-3998-C706-90EF-92B41EB091AF}
AS: Microsoft Security Essentials (Enabled - Up to date) {CAC39F2D-1B9C-4A72-5A17-3B3D19BB2B34}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avast Antivirus (Disabled - Out of date) {5078598A-1FA2-C888-AA5F-A9C66537DB12}

 

 

You will need to uninstall Microsoft Security Essentials since Avast won't be happy with another antivirus.  I would probably download the latest (offline) version of Avast:

https://www.avast.co...ST&locale=en-us

Save it then uninstall both your old Avast and Microsoft Security Essentials, reboot then right click on your downloaded Avast file and Run As Admin.

Decline any optional software and stick with the Basic (Free) version.  Do not accept the free trial.  Once it installs skip the quick scan and instead run the Boot-kit-scan tonight while you sleep.

 

Click on the Avast ball.  Then click on Protection, then on Antivirus, then on Other Scans then on Boot-time Scan.  Click on Install Special Definitions.  Click on Run on Next PC Reboot.

  Reboot and let it run a scan.  It may take hours.
Once it finishes it should load windows.   Mute your speakers so it doesn't wake you up when Windows boots.

When you reboot you will see the scan start.  It will tell you where it saves its log.  Usually it's C:\ProgramData\AVAST Software\Avast\report\aswBoot.txt but it might change so verify the location.   This is a hidden location so you will need to tell Windows to let you see it:

http://www.howtogeek...-windows-vista/

Copy and paste the text from the log to a Reply when done.

 


  • 0

#20
reppucci

reppucci

    Member

  • Topic Starter
  • Member
  • PipPip
  • 15 posts

sorry I ran avast boot check before I saw your reply. here is the requested file.

 

I will uninstall and downlaod the offline version as you recommended

Attached Files


  • 0

#21
RKinner

RKinner

    Malware Expert

  • Expert
  • 24,624 posts
  • MVP

That's not the log of what it found, just what it did.  Look for:

 

C:\ProgramData\AVAST Software\Avast\report\aswBoot.txt   


  • 0

#22
reppucci

reppucci

    Member

  • Topic Starter
  • Member
  • PipPip
  • 15 posts

my bad looks good. 

 

Attached Files


  • 0

#23
RKinner

RKinner

    Malware Expert

  • Expert
  • 24,624 posts
  • MVP

True.  Looks good.  How is your computer running now?


  • 0

#24
reppucci

reppucci

    Member

  • Topic Starter
  • Member
  • PipPip
  • 15 posts

seems to be running well. I have a medical practice and my EMR (filemaker based) is on that box. Later tonite or this week I will uninstall MSE (for now disabled). I will also uninstall/disable  Bonjour service and see if  Filemaker server needs it to allow clients to easily connect. On my little office lan here may not be an issue.

 

I see the reference to Orcas Island.  If you are based there I hope you are staying safe. Wash your hands!!!!

 

Truly appreciate your help and expertise! 

 

Vinny


  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP