Microsoft Security Essentials Alert - Unknown Win32/Trojan

Viruses and worms
1

I tried searching this but haven’t found anything that combines all of my issues yet. Last week I received a Microsoft Security Essentials Alert–I have never actively done anything with MSE so I’m not sure where it came from–detecting the following: Unknown Win32/Trojan, Alert Level Severe, Recommendation to Remove and Status as Suspended.

Though I can open document files, my internet immediately shut down, and I can’t re-open using any browser.

I’ve run mbam and Avast scans (quick scan and full system scans for each), but neither has turned up any infected files. I’m wondering if the next thing I should try is to do a boot time scan via Avast? Also, should I turn off my system restore or leave it on before going any further?

Thank you for any insight or help you may be able to give! Asyn just helped me last week with another issue, for which I am so grateful. :slight_smile: As a matter of fact, I’m already wondering if this isn’t related to last week’s issue of a corrupt USB cable; at least it being a common link. I was using the same cable on both computers and hadn’t had any trouble before that. Of course that matter is probably moot at this point anyway.

Again, thank you in advance!

2
I've run mbam and Avast scans (quick scan and full system scans for each), but neither has turned up any infected files.
did you update Malwarebytes before you run it ?

Latest program is 1.50 and database when i post is 5313

3

Seems to be ThinkPoint (Rogue antimalware)

Removal guide
http://www.bleepingcomputer.com/virus-removal/remove-thinkpoint

4

Llanziel, I started following the instructions at the site that you linked, but I can’t even get my task manager to come up. It shows/flashes quickly and then disappears right away. I also did a hard close (unable to do a normal close) and restarted in safe mode and, where safe mode with networking allowed me to troubleshoot with my issue last week, the MSE Alert Potential Threats Box (with the aforementioned Win32/Trojan information) is still dominating the page. Again, in this mode, task manager will not come up.

Pondus, unfortunately I don’t have an updated version at the moment. I have to get a new jump drive to transfer it over. That’s my next step tomorrow. Does it sound like it may be my last best hope?

Thank you both very much!

5

Hi lets try this first, if it fails go to Plan B

Note: If using Firefox right-click on any download links and choose Save As

Please download OTH to your desktop
Please download OTL to your desktop
Please download the attached file Scan.txt to your desktop

Double click the OTH file to run it and click Kill All Processes, your desktop will go blank.

http://oldtimer.geekstogo.com/OTH/OTH_Main.gif

Then select Start OTL. OTL will now run

[*]Double-click on the Custom Scans box and a message box will popup asking if you want to load a custom scan from a file
Select Scan.txt that you downloaded

[*]Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

[*]When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

[*]Click the Internet Explorer button, post these logs in your Virus Removal topic.

Plan B

Download Rkill from here : there are several flavours to choose from, if one does not work then try the next

* rkill.com
* rkill.scr
* rkill.pif

Once it is downloaded, double-click on rkill in order to automatically attempt to stop any processes associated with Security Central and other Rogue programs. Please be patient while the program looks for various malware programs and ends them. When it has finished, the black window will automatically close and you can continue with the next step. If you get a message that rkill is an infection, do not be concerned. This message is just a fake warning given by Security Central when it terminates programs that may potentially remove it. If you run into these infections warnings that close Rkill, a trick is to leave the warning on the screen and then run Rkill again. By not closing the warning, this typically will allow you to bypass the malware trying to protect itself so that rkill can terminate Security Central . So, please try running Rkill until malware is no longer running. You will then be able to proceed with the rest of my instructions.

Do not reboot your computer after running rkill as the malware programs will start again.

Then run OTL as above