MBAM finds rogue.multiple, here are Combofix results

[gregrocker]

Hi all -

I was working on my Uncles office PC tonight installing 13 optional Updates while running a MBAM scan, which suddenly popped up with rogue.multiple infection I googled to find Combofix suggested. Ran Combofix which log I am uploading here for your wisdom.

Incidentally, at restart after Combofix the Updates attempted to install and then Reverted for 20 minutes, back to Desktop. It took running Windows Update troubleshooter to get them back into the Updates queue and installed.

Another MBAM scan comes out clean, but I don't see the rogue found earlier in Quarantine file. I wonder if CF deleted it?

Thanks!

 

[Jacee]

Greg, these items were deleted:
c:\program files\ShopperPro
c:\program files\ShopperPro\config.json
c:\program files\ShopperPro\database1_0_0.json
c:\program files\ShopperPro\FireFox\content\overlay.xul
c:\program files\ShopperPro\FireFox\content\shopperpro_128.png
c:\program files\ShopperPro\FireFox\install.rdf
c:\program files\ShopperPro\JSDriver\1.37.0.871\config.json
c:\program files\ShopperPro\JSDriver\1.37.0.871\database1_0_0.json
c:\program files\ShopperPro\manifest.json
c:\programdata\ShopperPro
c:\programdata\ShopperPro\config.json
c:\programdata\ShopperPro\database1_0_0.json
c:\users\MPCHOA\AppData\Local\nstF105.tmp
c:\windows\system32\SET709C.tmp
C:\Windows6.1-KB2533552-X86.msu

Did you look in here? C:\Qoobox\ComboFix-quarantined-files.txt

 

[gregrocker]

Yeah, it's all there. Can I delete it and all other Combofix folders out of C?

Does anything it found look serious? Just adware?

I guess the more serious rogue virus which was found earlier by MBAM got deleted from its quarantine, possibly by Combofix?

When MBAM found rogue.multiple I googled and was pointed to Combofix which is why I ran it.

 

[Jacee]

Looks like CF found all adware, but to be sure, run ESET OnlineScan.... ESET OnlineScan
[*]Click the

button.
[*]For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

1. Click on
   
   to download the ESET Smart Installer. Save it to your desktop.
2. Double click on the
   
   icon on your desktop.

[*]Check

[*]Click the

button.
[*]Accept any security warnings from your browser.
[*]Check

[*]Push the Start button.
[*]ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
[*]When the scan completes, push

[*]Push

, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
[*]Push the

button.
[*]Push

[/list]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The following will implement important cleanup procedures as well as reset System Restore points:
Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /Uninstall

 

[Layback Bear]

From post #1

I was working on my Uncles office PC tonight installing 13 optional Updates while running a MBAM scan

I would not recommend running any scans while using Windows 7 Updates.
Update Windows 7, reboot and then run the scans.

 

[1PW]

Running sUBs' ComboFix to mitigate adware found by a MBAM2 scan is a bit like using a M183 C4 Satchel Charge to clean out a back yard fish pond. The OP is quite fortunate that ComboFix did not brick the Uncle's office PC.

If MBAM2 finds anything actionable, a simple follow-up with a quarantine (if not already automatically done), followed by a subsequent deletion from quarantine a week later, would suffice. Small Job = Small Tool.

HTH

 

[gregrocker]

Thank you all.

As stated in OP the rogue.multiple found by Combofix when googled suggested to run ComboFix. Was this not advisable?

I have run ComboFix before and realize it is a powerful tool which should not be run casually.

In hindsight I should have cleared the Updates which were running in background before running it.

 

[1PW]

As stated in OP the rogue.multiple found by Combofix when googled suggested to run ComboFix. Was this not advisable?

If MBAM2 does flag malware after a scan, MBAM2 can optionally deal with it/them.

Even Malware Removal professionals will not run ComboFix until other diagnostic information has been thoroughly analyzed.

HTH

 

[gregrocker]

Again and as stated in OP, MBAM said it quarantined rogue.multiple, but it didn't show up in MBAM Quarantine folder.

At least two disinfection sites suggested CF for that infection. I have used CF in the past many times.

 

[Layback Bear]

If it was my computer I would ask Jacee to take a look at the Combofix log before going any farther.

 

[gregrocker]

She did above, Jack.

"ComboFix /uninstall" finds nothing. There was still a quarantine file named Qoobox in C. I manually cleaned out all Temp files with the time stamp when CF was run, which then allowed me to delete C:\Qoobox.

 

[Layback Bear]

I had a brain fart and completely missed Jacee's post 2.
Sorry about that.