[Baggyboy]

After a 20hr struggle to clean a friends PC, infected with over twenty thousand malware related files I am left with one small problem which has me totally stumped.

While I was repairing the machine and installing programs from my emergency toolkit, the cd burning wizard was kindly informing me that i had files ready to be copied to a disc. A quick reveal of hidden files revealed an autorun.inf and a companion autorun.exe file awaiting my permission to copy onto my rescue disc.... needless to say that request was strongly denied.... As if!

Anyway, now that everything has been cleaned up to my satisfaction (none of the top freeware anti-spyware apps or AVG report anything untoward), I am still left with the cd burning balloon popping up at each log-on. The autoexec.exe file has gone (taken care of by AVG I assume) but the .inf remains.

I am assuming that this is due to some orphaned registry file somewhere or other which is not being picked up as it is not in itself malicious as it has no payload.

My question is this: Can anyone recommend another scanner or tool which I could use to get rid of this latent bug? Or perhaps I can post a log from HJT or some sort of reg analysis in here for review and advice?

[Advertisements]

This site

http://www.sysinternals.com/

has alot of good freeware utilities. One that might help with this problem is Process explorer

EMCguy

edit I didnt realize this was in the malware forum. Sorry

Edited by EMCguy, 06 October 2005 - 01:29 AM.

[EMCguy]

This site

http://www.sysinternals.com/

has alot of good freeware utilities. One that might help with this problem is Process explorer

EMCguy

edit I didnt realize this was in the malware forum. Sorry

Edited by EMCguy, 06 October 2005 - 01:29 AM.

[Baggyboy]

Thanks for that EMCGuy, I'll have a go with that util the next time I am over at my friends house. See if i can't find out what's causing this.

PS. I dont think your reply to this in the malware forum will be too much of a problem (apologies if you've already been warned by a mod/admin!) as it's not specifically HJT log fix related, rather a request for more information.

[Baggyboy]

errr, ok... I had a go with Process Explorer on my friends computer. I couldn't find anything that looked suspicious, to my eyes anyway. To be honest, I dont think that there is any infection left on the system but for some reason I cannot get this balloon to stop appearing.

Is it worthwile posting a HijackThis log here just to check that I have indeed cleared up all infection?

[EMCguy]

I would post an HJT log here.

BUT make sure you start a new topic so it doesnt look like your being helped already. Your new topic will have zero replies

EMCguy

[Baggyboy]

naturally EMC, I will get a log posted from his place probably next week sometime. It will be interesting to see if I missed anything. Especially if it was anything major!!!

Ohh yeah, the chances are that they have already managed to get re-infected with various malware since I repaired it so I'll probably repair that damage before posting a fresh topic/HJT log. Afterall, I wouldn't want to say,
"OK, Here's a HJT Log from a PC I just cleaned, can someone check it please?"
And it turns out there are maybe 10-20 infections lurking there!!

Even with my favourite raft of anti malware programs merrily running in the background it's impossible to keep a pc completely safe if the user themselves has only half a clue how to use them properly.

It can be very difficult to understand what is the right course of action when TeaTimer pops up a box asking to (dis)allow certain changes, etc. If you are not very experienced with the inner workings of your PC then how can you tell what is the right answer? (speaking from a n00b point of view there, not my own!)

I try to tell them the most common things to look out for, ie. Names you recognise = good, random letters & numbers = bad... If it happens while you are installing software = usually good but take extra special care that it is what you asked for and not some added on malware. ie Quicktime changes your start-up but is not malicious, whereas other programs may try to install extra stuff at the same time which you do not want.

Far from foolproof I know but what can I say. If it was so easy to spot Malware then we wouldn't need to learn the tricks of the trade from places like GeeksToGo. Everyone would be a malware hunter.

[EMCguy]

sounds like a plan. good luck.