Solved MSE warning me of threats but not detecting them.

[Matthew Harbuz]

A few days ago I noticed my system was performing slower than usual. MSE was also alerting me of numerous threats that it had dealt with.
I ran a full scan and found around 5 trojans called "trojan: Win32/Peals.B!plock"
I ran scan after scan, MSE would remove these threats but new ones would be detected.
After a few days I ran another scan and during the scan, MSE displayed the same message it had done for the other scans: "preliminary scans show that there may be malicious or unwanted content on your system" but the scan came up clean for the first time in days.

Is this message normal? Have I actually removed this trojan permanantly or should I be more worried?

I understand there has been a recent Windows 7 update which has addressed some security issues so that might have sorted it.

I hope I don't seem too paranoid, I just want peace of mind.

 

[Victek]

After a few days I ran another scan and during the scan, MSE displayed the same message it had done for the other scans: "preliminary scans show that there may be malicious or unwanted content on your system" but the scan came up clean for the first time in days.

I would not trust that the system is clean. I suggest installing and scanning with MalwareBytes AntiMalware. Go into detection settings first and enable "scan for rootkits". I would also recommend HitmanPro and Kaspersky TDSSkiller.

 

[Matthew Harbuz]

I have ran a scan with MalwareBytes AntiMalware and it found 1 Trojan.
I will run a scan again tomorrow as well as scans with the other software you have suggested.

Here is the scan log:

Malwarebytes Anti-Malware
Malwarebytes | Free Anti-Malware & Internet Security Software

Scan Date: 11/06/2015
Scan Time: 21:01:31
Logfile:
Administrator: Yes

Version: 2.01.6.1022
Malware Database: v2015.06.11.04
Rootkit Database: v2015.06.02.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Matthew

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 427336
Time Elapsed: 58 min, 24 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 19
PUP.Optional.Babylon.A, HKU\S-1-5-21-216897892-2917457338-297840139-1005\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}, Quarantined, [73fd9524a5e5a393b8e80466bc470000],
PUP.Optional.Delta.A, HKU\S-1-5-21-216897892-2917457338-297840139-1005\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{82E1477C-B154-48D3-9891-33D83C26BCD3}, Quarantined, [7df38831870361d59369e3bfe320c937],
PUP.Optional.Delta.A, HKU\S-1-5-21-216897892-2917457338-297840139-1005\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{82E1477C-B154-48D3-9891-33D83C26BCD3}, Quarantined, [7df38831870361d59369e3bfe320c937],
PUP.Optional.Wajam.A, HKU\S-1-5-21-216897892-2917457338-297840139-1005\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}, Quarantined, [4f215861afdbf442570fcea37093b44c],
PUP.Optional.Wajam.A, HKU\S-1-5-21-216897892-2917457338-297840139-1005\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C}, Quarantined, [4f215861afdbf442570fcea37093b44c],
PUP.Optional.Delta.A, HKU\S-1-5-21-216897892-2917457338-297840139-1005\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}, Quarantined, [5b151c9d7c0ed56138c3039f5ea533cd],
PUP.Optional.Delta.A, HKU\S-1-5-21-216897892-2917457338-297840139-1005\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}, Quarantined, [5b151c9d7c0ed56138c3039f5ea533cd],
PUP.Optional.MediaWatch.A, HKLM\SOFTWARE\WOW6432NODE\MediaWatchV1home43, Quarantined, [e789fdbc98f2de584f2c91dabe4755ab],
PUP.Optional.MediaWatch.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\IAPMMHMOCMHPNHGFIOBIPBJMNDIBFOFK, Quarantined, [ef8164559befbf77dce1ae42669d6f91],
PUP.Optional.CrossRider.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{21111111-1111-1111-1111-110211621178}, Quarantined, [601061581f6b55e1c4356520d62f0cf4],
PUP.Optional.WhiteSmoke.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WhiteSmoke_US Toolbar, Quarantined, [c5abeccd068431053d81ee256d97ea16],
PUP.Optional.APNToolBar.Gen, HKU\S-1-5-18\SOFTWARE\AskPartnerNetwork, Quarantined, [125e2594acdeea4c4b33db112cd77888],
PUP.Optional.Iminent.A, HKU\S-1-5-18\SOFTWARE\Iminent, Quarantined, [b7b946732d5d072ffb030537a55fe41c],
PUP.Optional.Ask.A, HKU\S-1-5-21-216897892-2917457338-297840139-1002\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{49B957AC-0FD0-4C11-AAEA-B60B59E39AF6}, Quarantined, [165a18a1f99156e0fc67f2972fd63dc3],
PUP.Optional.Spigot.A, HKU\S-1-5-21-216897892-2917457338-297840139-1002\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{B7FD0850-C623-436B-9758-A25808C867A7}, Quarantined, [d39db20715750c2a549e29c611f2669a],
PUP.Optional.KeepMySearch.A, HKU\S-1-5-21-216897892-2917457338-297840139-1002_Classes\keepmysearch, Quarantined, [205002b7f199e2548399f60d60a49e62],
PUP.Optional.Ask.A, HKU\S-1-5-21-216897892-2917457338-297840139-1005\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{49B957AC-0FD0-4C11-AAEA-B60B59E39AF6}, Quarantined, [b7b90dacd9b15fd7e87b05847491d828],
PUP.Optional.MediaWatch.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{6f49f52b-cf79-44bd-821e-f714ab39eb8f}, Quarantined, [4e223e7b5c2ed95d3b4e3013cd3917e9],
PUP.Optional.WebExpEnhanced.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{7a730830-4872-4d4f-922c-328561b67ea1}, Quarantined, [1c5495245832999d49ec1c2712f40000],

Registry Values: 11
PUP.Optional.MediaWatch.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\iapmmhmocmhpnhgfiobipbjmndibfofk|path, C:\Program Files (x86)\MediaWatchV1\MediaWatchV1home43\ch\MediaWatchV1home43.crx, Quarantined, [ef8164559befbf77dce1ae42669d6f91]
PUP.Optional.CrossRider.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{21111111-1111-1111-1111-110211621178}|AppName, Solid Savings-bg.exe, Quarantined, [601061581f6b55e1c4356520d62f0cf4]
PUP.Optional.MediaWatch.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|[email protected], C:\Program Files (x86)\MediaWatchV1\MediaWatchV1home43\ff, Quarantined, [77f9e7d2b6d478be7903abc063a26898]
PUP.Optional.Ask.A, HKU\S-1-5-21-216897892-2917457338-297840139-1002\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{49B957AC-0FD0-4C11-AAEA-B60B59E39AF6}|URL, http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=kw&q={searchTerms}&locale=en_UK&apn_ptnrs=^U3&apn_dtid=^OSJ000^YY^GB&apn_uid=10313BD5-67B4-4341-BBB1-F07CC4C840EF&apn_sauid=6A0F605A-4001-4DB3-AB28-5CEE7D4E5D57, Quarantined, [165a18a1f99156e0fc67f2972fd63dc3]
PUP.Optional.Spigot.A, HKU\S-1-5-21-216897892-2917457338-297840139-1002\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{B7FD0850-C623-436B-9758-A25808C867A7}|URL, https://uk.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=667671&p={searchTerms}, Quarantined, [d39db20715750c2a549e29c611f2669a]
Rootkit.Fileless.MTGen, HKU\S-1-5-21-216897892-2917457338-297840139-1002\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|^ca87e755, Quarantined, [2a46f0c9b5d522145875bdc70ff6a25e],
PUP.Optional.Delta.A, HKU\S-1-5-21-216897892-2917457338-297840139-1005\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}|URL, http://www.yhs.delta-search.com/?q={searchTerms}&affID=119776&tt=210213_yh&babsrc=SP_ss&mntrId=e41583b800000000000008606e679cf2, Quarantined, [c9a713a64545d85e89c17d02fc094cb4]
PUP.Optional.Babylon.A, HKU\S-1-5-21-216897892-2917457338-297840139-1005\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}|FaviconURL, search.babylon.com/favicon.ico, Quarantined, [4f21e9d01e6cdc5a5b596686b84b49b7]
PUP.Optional.Ask.A, HKU\S-1-5-21-216897892-2917457338-297840139-1005\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{49B957AC-0FD0-4C11-AAEA-B60B59E39AF6}|URL, http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=kw&q={searchTerms}&locale=en_UK&apn_ptnrs=^U3&apn_dtid=^OSJ000^YY^GB&apn_uid=10313BD5-67B4-4341-BBB1-F07CC4C840EF&apn_sauid=6A0F605A-4001-4DB3-AB28-5CEE7D4E5D57, Quarantined, [b7b90dacd9b15fd7e87b05847491d828]
PUP.Optional.SmartBar.A, HKU\S-1-5-21-216897892-2917457338-297840139-1005\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|Browser Infrastructure Helper, C:\Users\UpdatusUser\AppData\Local\Smartbar\Application\QuickShare.exe startup, Quarantined, [58189425cfbbc1753648f759ff06a15f]
PUP.Optional.OptimizerPro.A, HKU\S-1-5-21-216897892-2917457338-297840139-1005\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|Optimizer Pro, C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe, Quarantined, [8ee223963a5090a61b47097f29dc2bd5]

Registry Data: 1
PUP.Optional.StartPage, HKU\S-1-5-21-216897892-2917457338-297840139-1005\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, Delta Search, Good: (Google), Bad: (Delta Search,[07694376cfbbed4995407ac3f21429d7]

Folders: 5
PUP.Optional.OffersWizard.A, C:\Program Files (x86)\Common Files\Config, Quarantined, [5f119128b6d490a6288adf3a12f2e020],
PUP.Optional.SolidSavings.A, C:\Users\Matthew\AppData\Local\Solid Savings, Quarantined, [aac67742bad0e353be100eb7bd46639d],
PUP.Optional.TrustMediaViewer.A, C:\Program Files (x86)\TrustMediaViewerV1, Quarantined, [cba53b7e8cfea1957205f3d913f05aa6],
Trojan.Clicker.FMS, C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}, Quarantined, [d59ba811246663d39c11716f986b35cb],
PUP.Optional.APNToolBar.Gen, C:\ProgramData\APN\APN-Stub, Quarantined, [2b4506b3f595c076690721cae32057a9],

Files: 8
PUP.Optional.WebInstr.A, C:\Windows\System32\drivers\Msft_Kernel_webinstr_01009.Wdf, Delete-on-Reboot, ,
PUP.Optional.Amonetize, C:\Users\Matthew\Downloads\SpyHunter+4+Email+And+Password+2015+Crack+Free+Download_10924_i18381718_il345.exe.zip, Quarantined, [0f6103b6acde6fc7243ac8742dd5b34d],
PUP.Optional.Amonetize, C:\Users\Matthew\Downloads\SpyHunter+4+Email+And+Password+2015+Crack+Free+Download_10924_i18382052_il345.exe.zip, Quarantined, [650b8c2da3e7e452aab47ac25aa8966a],
PUP.Optional.SnapDo.A, C:\Windows\Installer\5ce47f.msi, Quarantined, [630d6752078369cdbdc76753f70ae917],
PUP.Optional.AZLyrics.A, C:\Users\Matthew\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.azlyrics.com_0.localstorage, Quarantined, [3f314f6a92f83df980682ad85ba922de],
PUP.Optional.AZLyrics.A, C:\Users\Matthew\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.azlyrics.com_0.localstorage-journal, Quarantined, [76faf0c91971122497515ca66c98d22e],
PUP.Optional.OffersWizard.A, C:\Program Files (x86)\Common Files\Config\ver.xml, Quarantined, [5f119128b6d490a6288adf3a12f2e020],
PUP.Optional.OffersWizard.A, C:\Program Files (x86)\Common Files\Config\uninstinethnfd.exe, Quarantined, [5f119128b6d490a6288adf3a12f2e020],

Physical Sectors: 0
(No malicious items detected)


(end)

 

[Jacee]

Quarantine and remove all PUP. Optional, that Malwarebytes found.

Next, Copy and paste these lines in Note pad.

@Echo on
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0

Save as flush.bat to your desktop. Right
click on the flush.bat file to run it as Administrator.. Your computer will reboot itself.

Now download AdwCleaner by Xplode and save to your Desktop.

Right click on AdwCleaner.exe and choose to run as Administrator to run the tool.
Click on the Clean button.
Press OK when asked to close all programs and follow the onscreen prompts.

Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
After rebooting, a logfile report (AdwCleaner[S#].txt) will open automatically (where the largest value of # represents the most recent report).

Copy and paste the contents of that logfile in your next reply.
A copy of that logfile will also be saved in the C:\AdwCleaner folder

 

[Matthew Harbuz]

Ok here is the contents of the log file:

0# AdwCleaner v4.206 - Logfile created 12/06/2015 at 10:44:32
# Updated 01/06/2015 by Xplode
# Database : 2015-06-09.1 [Server]
# Operating system : Windows 7 Home Premium Service Pack 1 (x64)
# Username : Matthew - MATTHEW-PC
# Running from : C:\Users\Matthew\Desktop\AdwCleaner.exe
# Option : Cleaning

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\apn
Folder Deleted : C:\ProgramData\KingSoft
Folder Deleted : C:\Program Files (x86)\KingSoft
Folder Deleted : C:\Users\Matthew\AppData\Local\DM
Folder Deleted : C:\Users\Matthew\AppData\Roaming\Update Manager
Folder Deleted : C:\Users\Matthew\AppData\Roaming\KingSoft
Folder Deleted : C:\Users\Matthew\AppData\Local\Google\Chrome\User Data\Default\Extensions\ganlifbpkcplnldliibcbegplfmcfigp
Folder Deleted : C:\Users\Matthew\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg
File Deleted : C:\Users\Matthew\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ganlifbpkcplnldliibcbegplfmcfigp_0.localstorage
File Deleted : C:\Users\Matthew\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ganlifbpkcplnldliibcbegplfmcfigp_0.localstorage-journal

***** [ Scheduled tasks ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{99E29823-2F67-41C3-8AA5-6425097A771F}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{243D5E51-FB67-45EE-8D26-7BBAD6C25CCE}
Key Deleted : HKLM\SOFTWARE\Better-Surf
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ask.com

***** [ Web browsers ] *****

-\\ Internet Explorer v11.0.9600.17840


-\\ Mozilla Firefox v


-\\ Google Chrome v43.0.2357.124

[C:\Users\Matthew\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [Search Provider] : hxxp://uk.ask.com/web?q={searchTerms}
[C:\Users\Matthew\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Deleted [Homepage] : management","nativeMessaging","searchProvider","startupPages","storage","tabs","webRequest","webRequestBlocking"],"explicit_host":["hxxp://*/*","hxxps://*/*"],"manifest_permissions":[],"scriptable_host":["*://*.ask.com/

-\\ Chromium v


*************************

AdwCleaner[R0].txt - [17359 bytes] - [12/10/2014 17:28:16]
AdwCleaner[R1].txt - [2676 bytes] - [12/06/2015 10:42:37]
AdwCleaner[S0].txt - [17279 bytes] - [12/10/2014 17:29:41]
AdwCleaner[S1].txt - [2520 bytes] - [12/06/2015 10:44:32]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [2579 bytes] ##########

 

[Matthew Harbuz]

I did another MalwareBytes Anti-Malware scan and it again detected 1 trojan.
Here is the log:

Malwarebytes Anti-Malware
Malwarebytes | Free Anti-Malware & Internet Security Software

Scan Date: 12/06/2015
Scan Time: 12:14:37
Logfile:
Administrator: Yes

Version: 2.01.6.1022
Malware Database: v2015.06.12.02
Rootkit Database: v2015.06.02.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Matthew

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 427442
Time Elapsed: 38 min, 37 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 1
Trojan.Agent.AI, C:\Users\Matthew\AppData\Local\Temp\Quarantine.exe, Quarantined, [8a48843539510a2c3a91e18c03ff1be5],

Physical Sectors: 0
(No malicious items detected)


(end)

 

[Jacee]

Copy and paste these lines in Note pad.

@Echo on
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0

Save as flush.bat to your desktop. Right
click on the flush.bat file to run it as Administrator. Your computer will reboot itself.

Next, download TFC by Old Timer TFC - Temp File Cleaner by OldTimer Download - Geeks to Go Forum and save it to your desktop.

Save any unsaved work. TFC will close ALL open programs including your browser! This will also eliminate all desktop shortcuts, so just be aware!

Windows 7 right-click on the file and choose Run As Administrator.

Click the Start button to begin the cleaning process and let it run uninterrupted to completion.

Important! Manually reboot the machine to ensure a complete clean.

Reboot once again and let me know how your computer is running.

 

[Matthew Harbuz]

I think that has done the trick!
Computer is running much better, CPU usage is down, physical memory usage has been cut in half.
I have also done a MalwareBytes scan and it has detected 0 threats.

I will keep this thread unsolved for a few days to see how things go but thanks for helping me

 

[Jacee]

Good, I hope! ...