MSE finds and removes Trojan three times

While on a reputable site for my local newspaper MSE signaled it found TrojanDownloader:JS/Qakbot.H, classifying it as severe. I told it to remove it and it said it succeeded. Ran a Quick Scan right away which came up clean.

12 hours later when I ran CCleaner to clean temp files MSE again found the same Trojan. I had it remove it and it again found it while CCleaner removed the temp files.

So in my history there are three instances of this same Trojan all listed as being removed. Is it really gone?

IF MSE removed the Trojan the first time why did it remain in a temp file? If I had never cleared the temp files using CCleaner it seems to me the Trojan would have remained on my computer. What damage was done in the twelve hours between when MSE initially removed it and it hopefully was removed for good from the temp files?

Is this how MSE is supposed to work? Seems like a flaw if it leaves what it cleans in a temp file? Would a full scan have found the temp file infection?

An MSE quick scan checks the places, processes in the memory, and registry files on your computer's hard disk that malicious software is most likely to infect. A full scan checks all files on the hard disk and all currently running programs.

Unless dealing with a rogue such as HDD Defragmenter, which makes it so that certain folders on your computer display no contents, it is generally recommended to run a temp file cleaner prior to scanning. My current preference is TFC by OldTimer.

Yes it certainly appears to be a nasty one. But I'm pretty confident MSE did it's job properly. Full Scans using MSE, MBAM and SAS in regular and Safe mode all come up clean.

I spoke with MS support and they said that MSE did it's job by initially preventing the Trojan from downloading. They also said it was residing in a temp file waiting for a chance to infect my system but CCleaner and/or MSE also removed it from there (I'm still a bit unsure of this part). Apparently it's a good thing I regularly clean temp files. I'm not sure everyone does.

I have used TFC in the past on another computer. I probably should revisit it. The fact that it hasn't been updated in two years was one reason I was a bit hesistant to install it on my new system.

What is disturbing is that this was a very reputable website. It probably gets thousands if not millions of visitors a day. Who knows how many of them are now infected.

It's truly scary out there. Even safe surfing doesn't mean much anymore.

Crossing fingers that this one is solved. And am happy MSE did it's job.

For this reason, and this reason alone is why virtualization should be your first line of defense, not MSE. Sandboxie is a great tool to prevent drive-by infections.