Trojan Propogator.

[evilfantasy]

I only want the quarantined items log if it is there. Can you save it as a text file or in some other format and (if needed) upload it to www.filedropper.com and post the link to it back here.

Dr Web did find three trojans as I indicated before, but crashed before it finished and hence no log

Finding something... We need to see file paths. It could be something that isn't actually a threat.

[Soulmonger]

Hi Evilfantasy.

I couldn't find any way of copying the quarantine log either to a text file, notepad or otherwise. I had to use screenshots in jpg format and Filedropper as suggested.
Iv'e adjusted the screen to enable you to see as much detail as possible of the file paths, to the detriment of the date column and the "event" column, (Move to or delete from Quarantine). Hope this is ok. I had to do it in three parts as you can appreciate.
Relevant urls:
http://www.filedropper.com/asquaredshot1
http://www.filedropper.com/asquaredshot2
http://www.filedropper.com/asquaredshot3

Sorry about the format.

Regards
Brian

[evilfantasy]

Does your printer still work?

[Soulmonger]

The printer works fine, but the scanner has a problem.
This however may be my fault as I tried to uninstall the software after the malware was found in its files. It wouldn't uninstall so I deleted some of the files. Stupid now I think about it.

[evilfantasy]

The only thing I saw that might be a problem is the printer software. What kind of printer is it?

[Soulmonger]

It's an HP Photosmart 3210 all in one.

[evilfantasy]

HP Photosmart 3210 All-in-One Printer  >  Microsoft Windows XP http://h10025.www1.hp.com/ewfrf/wc/softwareList?os=228&lc=en&dlc=en&cc=us&lang=en&product=439488

Go to that page and download then install the HP Photosmart Full Feature Software and Drivers. (Third from the top under the Driver category)

That should replace any files/folders that may have been accidentally deleted.

[Soulmonger]

Thanks I'll try that.
I do have the original installation disc which is how I reinstalled the software as I posted earlier. I then updated from the HP website. How would a trojan have become resident in the printer software, when reinstalled from a disc?

[evilfantasy]

I'm thinking it's a false positive. If you haven't already, I would uninstall it completely and then use the disk to install it new.

[Soulmonger]

I haven't tried uninstalling it since I started posting on this thread, so I'll give it another go.

Do you consider that all or most of the reported trojans by "a squared"were false positives then, or that it removed them to start with and then reported false positives subsequent to that? It scared the *censored* out of me.

[Soulmonger]

Your censorship filters are very sensitive, no offence.

[evilfantasy]

Most of it was not a threat. Some I'm not sure of but nothing jumped out to me as being malicious.

[Soulmonger]

I uninstalled the printer software and prior to reinstalling the software ran a malwarebytes scan. I've attached the log for you. I haven't done anything with the infections as yet.
Thanks
Brian.

[Saving space, attachment deleted by admin]

[evilfantasy]

Those aren't actually infections and can be taken care of easily with resetting System Restore.

Disable/Enable the System Restore Utility to flush old infected restore points

1) Right click the My Computer icon on the Desktop and click on Properties.
2) Click on the System Restore tab.
3) Put a check mark next to Turn off System Restore on All Drives
4) Click the OK button.
5) You will be prompted to restart the computer. Click the Yes button.

Now re-enable System Restore

To re-enable the System Restore Utility, follow steps one to five and on step three remove the check mark next to 'Turn off System Restore on All Drives'.

1) Right click the My Computer icon on the Desktop and click on Properties.
2) Click on the System Restore tab.
3) Remove the check mark next to Turn off System Restore on All Drives
4) Click the OK button.

[Soulmonger]

Do I need to remove them with Malwarebytes first (I haven't shut it down yet), and where have they appeared from? The PC has been on today but I only updated Malwarebytes and removed the printer software. Avast has been running the whole time.

Thanks

Brian.