Author Topic: Virus detected  (Read 2235 times)

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
Virus detected
« Reply #20 on: July 30, 2010, 10:53:35 PM »
Quote
Also, keep me informed how things are now running
Quote
Also, keep me informed how things are now running


A couple times, I asked the above
So how are things now running, any problems??

EDIT>>Can you let me know if you just recently intentionally installed the following
MemTurbo 4
« Last Edit: July 31, 2010, 11:46:08 AM by guestolo »

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here


Offline Josetann

  • admin
  • Administrator
  • Hero Member
  • *****
  • Posts: 10136
  • Karma: +0/-0
    • View Profile
Virus detected
« Reply #21 on: July 31, 2010, 05:01:47 PM »
I'll answer for her.  She thought everything was running fine after I deleted the nasties in her temp folder.  Took some persuading to get her to come here.  I knew if a virus found its way on her laptop, something else could be there (and with the really crappy connection I have currently, it took over an hour for me just to find the lhh.exe in her temp folder and wipe that out).

So, she thinks everything's fine.  I doubt she intentionally installed Memturbo or anything like that (maybe the occasional browser toolbar).  My younger brother uses the laptop too, so it's possible he installed something.

She does want to know if she should change important passwords.  She already did after I took care of the first virus...but before you found the other.

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
Virus detected
« Reply #22 on: July 31, 2010, 06:35:39 PM »
Quote
I couldn't find Browser Defender here. Could it be hiding somewhere else?

It probably got removed when you uninstalled SpywareDoctor

It wouldn't hurt to reset passwords again, just to ensure your secure
If you didn't intentionally install Memturbo, might want to uninstall it

If everything seems fine, right click on OTL.exe and choose to "Run as Admin"
Click on the CLEANUP button, follow the prompts and reboot when prompted

Why not hold onto Malwarebytes Antimalware
Update and run a Quick Scan occassionally

Hope that helps  http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/smile.gif\' class=\'bbc_emoticon\' alt=\':)\' />
« Last Edit: July 31, 2010, 06:36:26 PM by guestolo »

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here


Offline sharont6

  • Newbie
  • *
  • Posts: 20
  • Karma: +0/-0
    • View Profile
Virus detected
« Reply #23 on: July 31, 2010, 07:21:56 PM »
[quote name='guestolo' date='31 July 2010 - 06:35 PM' timestamp='1280619339' post='471097']
It probably got removed when you uninstalled SpywareDoctor

It wouldn't hurt to reset passwords again, just to ensure your secure
If you didn't intentionally install Memturbo, might want to uninstall it

If everything seems fine, right click on OTL.exe and choose to "Run as Admin"
Click on the CLEANUP button, follow the prompts and reboot when prompted

Why not hold onto Malwarebytes Antimalware
Update and run a Quick Scan occassionally

Hope that helps  
[/quote]

Offline sharont6

  • Newbie
  • *
  • Posts: 20
  • Karma: +0/-0
    • View Profile
Virus detected
« Reply #24 on: July 31, 2010, 07:24:30 PM »
Sorry, it took so long to answer. I didn't know to go to the second page.

I tried to uninstall Mem turbo but it tells me that it is in use and can't be uninstalled. Of course, I don't know what it is doing or how to turn it off. Any suggestions?
As soon as I can uninstall it I will run the OTL again.

Thank you so much for helping me.
You must be a computer genius!!!
Thanks again,
SharonT

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
Virus detected
« Reply #25 on: July 31, 2010, 07:31:09 PM »
I've never used Memturbo, but I can install it and try removing it if needed

But try this first, Memturbo should have an icon by the clock on the bottom right hand side of your desktop
Right click on Memturbo4's icon and choose CLOSE or EXIT, not sure which one
Then try uinstalling it, see if that helps

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here


Offline sharont6

  • Newbie
  • *
  • Posts: 20
  • Karma: +0/-0
    • View Profile
Virus detected
« Reply #26 on: July 31, 2010, 09:05:06 PM »
[quote name='guestolo' date='31 July 2010 - 07:31 PM' timestamp='1280622669' post='471100']
I've never used Memturbo, but I can install it and try removing it if needed

But try this first, Memturbo should have an icon by the clock on the bottom right hand side of your desktop
Right click on Memturbo4's icon and choose CLOSE or EXIT, not sure which one
Then try uinstalling it, see if that helps
[/quote]

Offline sharont6

  • Newbie
  • *
  • Posts: 20
  • Karma: +0/-0
    • View Profile
Virus detected
« Reply #27 on: July 31, 2010, 09:06:23 PM »
That did it!
Now do I change just my bank password or email and everything?

yahoo has been running very slowly but everything else seems okay.

thanks again, so much!
SharonT

Offline Josetann

  • admin
  • Administrator
  • Hero Member
  • *****
  • Posts: 10136
  • Karma: +0/-0
    • View Profile
Virus detected
« Reply #28 on: July 31, 2010, 09:35:03 PM »
I think you need to do this first:

[quote name='guestolo' date='31 July 2010 - 06:35 PM' timestamp='1280619339' post='471097']
If everything seems fine, right click on OTL.exe and choose to "Run as Admin"
Click on the CLEANUP button, follow the prompts and reboot when prompted
[/quote]

Offline sharont6

  • Newbie
  • *
  • Posts: 20
  • Karma: +0/-0
    • View Profile
Virus detected
« Reply #29 on: July 31, 2010, 10:19:32 PM »
[quote name='Josetann' date='31 July 2010 - 09:35 PM' timestamp='1280630103' post='471107']
I think you need to do this first:


[/quote]

Offline sharont6

  • Newbie
  • *
  • Posts: 20
  • Karma: +0/-0
    • View Profile
Virus detected
« Reply #30 on: July 31, 2010, 10:22:40 PM »
I did that already. I'm changing my bank now. What about email? I was logged in the whole time.

Offline Josetann

  • admin
  • Administrator
  • Hero Member
  • *****
  • Posts: 10136
  • Karma: +0/-0
    • View Profile
Virus detected
« Reply #31 on: July 31, 2010, 10:33:20 PM »
[quote name='sharont6' date='31 July 2010 - 10:22 PM' timestamp='1280632960' post='471109']
I did that already. I'm changing my bank now. What about email? I was logged in the whole time.
[/quote]

I would probably change any passwords that you typed in between the time you got the initial virus, and when everything was finally wiped out.

If you didn't type the password, and simply stayed logged in, you should be ok.  That's assuming the virus/trojan that guestolo found wasn't on your laptop before the other virus.

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
Virus detected
« Reply #32 on: July 31, 2010, 10:57:08 PM »
Quote
yahoo has been running very slowly but everything else seems okay.

Why not use your Browsers for a couple days and come back and let us know how things are still running

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here