|
|
Post by jal on Nov 25, 2013 7:52:06 GMT
CryptoLocker Prevent update 4.3.0
Done by a manual check on the update tab
|
|
|
|
Post by nob on Nov 25, 2013 9:12:28 GMT
Wouldn't a restore roll it back and get rid.  Surely it would be an .EXE file and nobody runs them from people they don't know. Do they.  |
|
|
|
Post by jal on Nov 25, 2013 9:17:21 GMT
It's Sim who should be here to answer these questions Nob
|
|
|
|
Post by nob on Nov 25, 2013 12:59:18 GMT
Did a scan with malwarebytes and it found a reg entry and labelled it as a Trojan Ransom. It will not remove it, it is in a curfile and is a .SCR file. SAS and AVG don't find it. I could remove it manually but would the screensaver pack in. |
|
|
|
Post by jal on Nov 25, 2013 14:08:32 GMT
|
|
|
|
Post by Ratae on Nov 25, 2013 14:12:22 GMT
Wouldn't a restore roll it back and get rid. Surely it would be an .EXE file and nobody runs them from people they don't know. Do they. Yes it is an executable file Nob, but apparently it often skulks inside a PDF file. Like I said, I open owt like that in Linux.  I once managed to get rid of a virus that was in a wifi dongle that Greebo had. Can't recall how it worked, but I stuck the dongle in my Linux netbook and deleted the file with the virus. I was a hero for about a day!  |
|
|
|
Post by nob on Nov 25, 2013 14:54:51 GMT
No its not that JJ, Dave its these two Registry Values Detected: 2 HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows|Load (PUM.UserWLoad) -> Data: C:\Users\******\LOCALS~1\Temp\msjqkeeq.scr -> Delete on reboot. HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows|Load (Trojan.Ransom) -> Data: C:\Users\******\LOCALS~1\Temp\msjqkeeq.scr -> Delete on reboot. Spybot S&D doesn't see them either, just MWB. I can regedit to it but do I delete the entry or not. Is it bad or a false positive. |
|
|
|
Post by Ratae on Nov 25, 2013 15:41:01 GMT
No its not that JJ, Dave its these two Registry Values Detected: 2 HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows|Load (PUM.UserWLoad) -> Data: C:\Users\******\LOCALS~1\Temp\msjqkeeq.scr -> Delete on reboot. HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows|Load (Trojan.Ransom) -> Data: C:\Users\******\LOCALS~1\Temp\msjqkeeq.scr -> Delete on reboot. Spybot S&D doesn't see them either, just MWB. I can regedit to it but do I delete the entry or not. Is it bad or a false positive. So, reading that, it seems like MBam has already set it up to delete those two files when you reboot your system. Personally, I would let MBam do it's thing. However, couldn't you set a restore point before rebooting, then if you had a problem you could restore back to pre reboot, and then decide what to do next! Just an idea! |
|
|
|
Post by Ratae on Nov 25, 2013 15:50:48 GMT
I did a scan yesterday on my desktop. MBam found a few adware thingys (the usual).... and one nasty that it flagged up as a trojan. MBAm said it must be removed. I suspected that it might have been summat to do with that 'AcePlayer' that I downloaded, 'cos that's stopped working 'cos I won't let it use ads, and it wants me to change my Hosts file back to default. But it can't have been that trojan. 'cos I ran the scan on my lappy and it came up clean, the AcePlayer has stopped working on that too, and for the same reason. Anyway, the trojan was cleaned and everything is good!  |
|
|
|
Post by nob on Nov 25, 2013 16:28:19 GMT
No its not that JJ, Dave its these two Registry Values Detected: 2 HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows|Load (PUM.UserWLoad) -> Data: C:\Users\******\LOCALS~1\Temp\msjqkeeq.scr -> Delete on reboot. HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows|Load (Trojan.Ransom) -> Data: C:\Users\******\LOCALS~1\Temp\msjqkeeq.scr -> Delete on reboot. Spybot S&D doesn't see them either, just MWB. I can regedit to it but do I delete the entry or not. Is it bad or a false positive. So, reading that, it seems like MBam has already set it up to delete those two files when you reboot your system. Personally, I would let MBam do it's thing. However, couldn't you set a restore point before rebooting, then if you had a problem you could restore back to pre reboot, and then decide what to do next! Just an idea! Did a reboot but it finds it all the time so it doesn't remove it or its installing on start up but it aint in the start tab of MSCONFIG. I could remove it manually via regedit but I cant find any info on tweb about msjqkeeq.scr. Its not causing a problem and as the other scanners aint bothered about it Ill leave well alone. |
|
|
|
Post by Ratae on Nov 25, 2013 16:36:31 GMT
Well, you could always do as you say and manually remove it from the registry just to see what happens. Then as it loads now on start up, if there's a problem, system restore. Your call of course. But myself, when I see summat like that, it feels like an itch that I just have to scratch.  BTW Nob, do you have WinPatrol on your machine? |
|
|
|
Post by nob on Nov 25, 2013 16:43:58 GMT
No Dave no winpatrol installed. Like you the itch needs scratching Ill go for it.
Update It cant delete it. Cant locate locals~1 folder either even turning hidden folders on, so im assuming the temp files have been deleted leaving the reg entry. Run as admin still cant delete the entry.
|
|
|
|
Post by arch on Nov 25, 2013 16:45:50 GMT
I have MBAM set to update daily and scan once a week. There was an option to let it Flash scan with the update, I had this checked to do so. Just had a butchers and that option seems to have been removed. |
|
|
|
Post by Ratae on Nov 25, 2013 17:13:56 GMT
No Dave no winpatrol installed. Like you the itch needs scratching Ill go for it. Update It cant delete it. Cant locate locals~1 folder either even turning hidden folders on, so im assuming the temp files have been deleted leaving the reg entry. Run as admin still cant delete the entry. In that case, my next move would be to run my registry cleaner, and have a look at what it wants to remove before actually cleaning it. |
|
|
|
Post by nob on Nov 25, 2013 17:17:50 GMT
Eusing? Is that a cleaner?
It is downloading and will see what it finds but I would think if I cant do it manually then that cant but Ill see.
Update, Nope its still there in MWB even after using the reg cleaner and that entry was the only one ticked to remove.
|
|
Surely it would be an .EXE file and nobody runs them from people they don't know. Do they. 
