I was getting a Microsoft Security Essentials Alert telling me that there were potential threats to my computer. It wanted me to install Privacy Corrector. I was able to search on Privacy Corrector and found that it was a trojan in at least one of the hits so I did not install it. I was not using MSE and it was not installed on my system. The alert appeared shortly after bring up the system, even in protected mode. Avast initially ran but did not detect anything. I down loaded Malwarebytes and tried to run it but it kept getting terminated. I tried the OTH/OTL process described in this forum but could not find the scan.txt file mentioned in the process.
I had noted somewhere in this sequence that a protect.exe process was running on my system. I determined that this might be a rogue process. I could not delete it in file manager as it was running. I was able to bring the system up in DOS mode and delete the protect.exe file. My system is running normal since. I have been able to run malware and it detected and corrected a number of potential problems.
My question is, if I had not noticed the protect.exe running, how would I have corrected this problem since none of the virus programs considered it a problem? It does show up in the log file created in the OTL run. Also, how did the protect.exe get loaded in protect mode?
I would appreciate any information that anyone might be able to provide. I also hope that this might help someone in a future infection.
It sounds like a rogue/fake security (MSE) popping up fake security alerts, trying to get you properly infected, don’t visit any site nor download any application.
The pop-ups in themselves aren’t malicious (and variants are fast moving targets), but some of the actions are suspect and it is a more specialist application which is likelt to detect them.
If you haven’t already got this software (freeware), download, install, update and run it and report the findings (it should product a log file).
MalwareBytes Anti-Malware (MBAM), On-Demand only in free version http://download.bleepingcomputer.com/malwarebytes/mbam-setup.exe, right click on the link and select Save As or Save File (As depending on your browser), save it to a location where you can find it easily later.
MBAM, formally known as RogueRemover is pretty good at finding and dealing with these rogues, so give that a try.
Before running MBAM send the protect.exe sample to avast for analysis.
Send the sample/s to avast as a Undetected Malware:
Open the chest and right click in the Chest and select Add, navigate to where you have the sample and add it to the chest (see image). Once in the chest, right click on the file and select ‘Submit to virus lab…’ complete the form and submit, the file will be uploaded during the next update.
I did not keep a copy of the protect.exe. I do have a copy of protect.exe-9F681852.pf that had the same timestamp as the exe file. Will that file be of help?
That isn’t a copy of the file, the data in the prefetch folder just contains information on the files location to speed up loading, unfortunately that is of no use as it is a completely different file. The timestamp may well be the same but the file size and MD5 would be completely different. This is why there are zero hits on the VT scan as it is a benign pre-fetch data info file.
Sorry, the exe file is gone. I should have made a copy but I am luck to remember just enough to be dangerous in DOS anymore.
As to the suggested remedies suggested in the previous post, I did at least look at them during my attempt to clear the problem. However, I was not sure they were from a trusted source. I had been reading about fakers that might only compound the problem. How can I certify that a suggested solution is real? I downloaded one thing with a free download, it ran, but then I had to purchase the fix.
We aren’t in the habit of suggesting options that aren’t genuine or that you may have to pay for. So personally I would start with MBAM that I suggested as aside from this I would keep it as a backup on-demand (free version is on-demand only) anti-malware scanner.
i have been hit by this same problem, it seems, but unlike reported supra, this MSE thing terminates IE8 as well as MBAM-on-demand, so how can i implement
i have been hit by this same problem, it seems, but unlike reported supra, this MSE thing terminates IE8 as well as MBAM-on-demand, so how can i implement
