Solved Two minor security questions

[Lorien]

Hello everyone,

I just ran a full MSE scan on my system and for the first time in more than a decade found some actual infections. I've attached the report which shows all were successfully removed. A full MBAM scan showed nothing. Prevx also missed these when they arrived. I just wanted some confirmation that I'm OK and don't need to do anything further.

=================================================

Also, I recently recovered from a BSOD and it was suggested I update some drivers. I checked the computer manufacturer (all were up-to-date despite the old dates), the device manufacturers (none of which had updated drivers or drivers at all), and the suggested web site which listed some but led me nowhere they could be obtained except one where they wanted $30 for the one driver update!

So I looked further and found the following (which also shows the results for my computer): DriverAgent Scan Results - E1705LAPTOP. I just wonder if this is a safe site. It reminds me of some of the Registry Cleaner sites. Nothing came up in MSE or Prevx when visiting or after the scan (though by coincidence, it was after the visit that I ran the above malware scans and found what I found). I'd rather not pay for this, but it does seem the simplest solution if it's safe and if I can trust the drivers it provides. Does anyone have any opinions on this?

Thanks in advance for any help, advice, suggestions or assistance.

 

[Shadowjk]

I Wouldn't trust the Site and I would only use Device Manger to Find out if your Drivers are Up to date or Not

Also It looks like the Viruses were Downloaded automatically for it was in your Temporary Internet Files Folder

Be careful it is Dangerous out there

 

[niemiro]

I would use that website to find the outdated drivers, but not download from them. I would never, ever recommend or use that myself. I am not going to say that you are clean with that malware. That one needs more digging. Please can you post a screenshot of the MSE results for Prolaco to see what has been removed. Your BSoD minidumps were pretty accurate and conclusive, but I still don't want to rule out a rootkit/driver driven malware. Have you run MBAM (Full Scan)?

That would be a good starting point, although hopefully Jacee will see this.

Richard

 

[Lorien]

I would use that website to find the outdated drivers, but not download from them. I would never, ever recommend or use that myself. I am not going to say that you are clean with that malware. That one needs more digging. Please can you post a screenshot of the MSE results for Prolaco to see what has been removed. Your BSoD minidumps were pretty accurate and conclusive, but I still don't want to rule out a rootkit/driver driven malware. Have you run MBAM (Full Scan)?

That would be a good starting point, although hopefully Jacee will see this.

Richard

I did include the screenshot of the MSE results in the initial post. I did run a full MBAM scan and nothing came up. I re-ran the MSE scan as well and it was clean the second time.

Unfortunately, although that program identifies a number of outdated drivers (as shown in the link), I've looked everywhere and can't find them in any legitimate site (like the manufacturers). I guess I'll just live with what I have and hope for the best.

Thanks for the reply. I guess I'll stay away from that Driver Download site.

 

[niemiro]

Sorry, I did not make myself too clear. Could you please re-post it, now showing (highlighting) Win32.Prolaco.Gen!C so that I can see what exactly MSE has picked up please.

 

[Lorien]

This is very, very old. I don't understand why it just showed up now. But I checked Explorer and it all seems to be gone. I've attached the details about that one - it doesn't seem to add very much.

Thanks!

 

[niemiro]

That could actually be good news. It seems to imply that the infection never properly got onto your system, and that explains the lack of some other infections associated with this one. Wait for Jacee, but I am much happier now. Thanks for that!

 

[Lorien]

Just in case this helps, I ran Hijack This and the .txt file is attached.

Thanks!

 

[niemiro]

Just in case this helps, I ran Hijack This and the .txt file is attached.

Thanks!

I do not have any authorisation for this, so wait for Jacee, but I see nothing except Viewpoint. Viewpoint is just a bit of junk that many people would not want on their system, but wait for Jacee.

 

[Lorien]

I've deleted Viewpoint with Revo. I don't think I ever used it and had no use for it. It was installed just to answer a question asked in the forums and I forgot to uninstall it when I was done.

Thanks!

 

[niemiro]

I've deleted Viewpoint with Revo. I don't think I ever used it and had no use for it. It was installed just to answer a question asked in the forums and I forgot to uninstall it when I was done.

Thanks!

Good decision!

 

[Jacee]

Lorien, download TFC by Old Timer TFC - Temp File Cleaner by OldTimer - Geeks to Go Forums and save it to your desktop.
Save any unsaved work. TFC will close ALL open programs including your browser!
Right-click on TFC.exe to run it. Click the Start button to begin the cleaning process and let it run uninterrupted to completion.

Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.

TFC (Temp File Cleaner) will clear out all temp folders for all user accounts (temp, IE temp, java, FF, Opera, Chrome, Safari), including Administrator, All Users, LocalService, NetworkService, and any other accounts in the user folder. It also cleans out the %systemroot%\temp folder and checks for .tmp files in the %systemdrive% root folder, %systemroot%, and the system32 folder (both 32bit and 64bit on 64bit OSs). It shows the amount removed for each location found (in bytes) and the total removed (in MB). Before running, it will stop Explorer and all other running apps. When finished, if a reboot is required the user must reboot to finish clearing any in-use temp files.

 

[niemiro]

Hello Jacee!

Thanks for jumping on this! Could I please ask you a question? I am always slightly concerned about recommending TFC now, as I have heard that some modern malware stores genuine Windows Files in the Temp folder (the originals of the now infected files) I have not yet figured out which malware actually does this. Do you, off hand and easily available, know the name of this new malware, so that I can look it up.

Thanks so much!

Richard

 

[Jacee]

I don't know it off hand ... I'll have to do a bit of research

 

[Lorien]

Thank you, Jacee. I will do the procedure later (when I have chores so it doesn't interfere too much with my normal work). I assume since you asked for no testing or AV/AM/AS cleaning that what I provided above doesn't warrant anything else (other than this procedure) and I'm OK (as much as that can ever be said of anyone).

I very much appreciate you taking a look and giving me a sense of ease.

Thanks, again!

 

[niemiro]

I don't know it off hand ... I'll have to do a bit of research

Don't worry! Thanks again!

 

[Jacee]

You definitely need to update Adobe\Acrobat 6.0! Adobe - Adobe Reader download - All versions

This is an explanation of your malware: Encyclopedia entry: Worm:Win32/Prolaco.gen!C - Learn more about malware - Microsoft Malware Protection Center
and
Microsoft sees "unprecedented wave" of Java malware exploits

 

[Lorien]

You definitely need to update Adobe\Acrobat 6.0! Adobe - Adobe Reader download - All versions

This is an explanation of your malware: Encyclopedia entry: Worm:Win32/Prolaco.gen!C - Learn more about malware - Microsoft Malware Protection Center
and
Microsoft sees "unprecedented wave" of Java malware exploits

I've uninstalled Acrobat 6.0 with Revo as it was old and I haven't used it in years anyway (and forgot it was even there). The Reader was already up-to-date.

I ran TFC and it removed quite a lot but worked fine and I now feel cleaner, have a new tool for my periodic maintenance, and have more free space - thanks.

I appreciate the links to what I had. I double-checked and it seems like they got caught before they could actually install and cause problems. So it seems like I'm OK.

Thanks so much for the help and information (and setting me at ease). I appreciate it greatly.