4 Replies Latest reply on May 27, 2011 4:41 PM by paullotion

    FakeAlert Help

      Hello.

       

      I am new to this kind board. I hope I am posting in the right place.

       

      I have followed the help I've found to get rid of a FakeAlert trojan. Using the instructions on the "Required Reading" post, I re-ran a scan that found nothing, even though previous scans found the virus. I then ran Stinger twice. Both times it said that it was found twice and deleted once. I've attached the log below.

       

      Other symptoms are that my system restore function seems to have been deleted and there is a white band at the left of my screen about 1" wide. I can click on icons under it, but I can't see them.

      What do I do now?

       

      McAfee(r) Labs Stinger(tm) Version 10.1.0.1243 built on Dec 10 2010

       

      Copyright (c) 2010 McAfee, Inc. All Rights Reserved.

       

      Virus data file v1000.0000 created on Dec 10 2010.

       

      Ready to scan for 2040 viruses, trojans and variants.

       

       

       

      Scan initiated on Sun Dec 26 16:48:32 2010

       

      C:\Users\Walter\AppData\Local\Temp\csrss.exe

       

           Found the FakeAlert!Downloader-CEW trojan !!!

       

      C:\Users\Walter\AppData\Local\Temp\csrss.exe is infected with the FakeAlert!Downloader-CEW virus !!!

       

      C:\Users\Walter\AppData\Local\Temp\csrss.exe could not be repaired.

       

      C:\Users\Walter\AppData\Local\Temp\csrss.exe

       

           Found the FakeAlert!Downloader-CEW trojan !!!

       

      C:\Users\Walter\AppData\Local\Temp\csrss.exe is infected with the FakeAlert!Downloader-CEW virus !!!

       

      C:\Users\Walter\AppData\Local\Temp\csrss.exe has been deleted.

       

        Number of clean files: 642271

       

        Number of infected files: 2

       

        Number of files cleaned: 1

       

       

       

      Scan initiated on Sun Dec 26 19:17:04 2010

       

      C:\Users\Walter\AppData\Local\Temp\csrss.exe

       

           Found the FakeAlert!Downloader-CEW trojan !!!

       

      C:\Users\Walter\AppData\Local\Temp\csrss.exe is infected with the FakeAlert!Downloader-CEW virus !!!

       

      C:\Users\Walter\AppData\Local\Temp\csrss.exe could not be repaired.

       

      C:\Users\Walter\AppData\Local\Temp\csrss.exe

       

           Found the FakeAlert!Downloader-CEW trojan !!!

       

      C:\Users\Walter\AppData\Local\Temp\csrss.exe is infected with the FakeAlert!Downloader-CEW virus !!!

       

      C:\Users\Walter\AppData\Local\Temp\csrss.exe has been deleted.

       

        Number of clean files: 642272

       

        Number of infected files: 2

       

        Number of files cleaned: 1

        • 1. Re: FakeAlert Help

          I just ran the GetSusp application from the blog entry about my problem and got this response.

           

          UNKNOWN 1655f72f635668d2b1087f7be8f7427c C:\Users\Walter\AppData\Local\Temp csrss.exe A 133,632 12/27/2010 07:35 12/27/2010 07:35 Process
          TROJAN 0f74e487346bccf19c6e2bde297f8a66 C:\Users\Walter\AppData\Local\Temp\nwkktbmnk ossfxrjlajb.exe A 323,072 12/24/2010  21:30 12/24/2010  21:29 Run-Key
          ASSUMED_DIRTY3 40b890c8723eedc7a1bee398591285d2 C:\Users\Walter\AppData\Roaming dwm.exe A 135,680 12/26/2010  13:54 12/26/2010  13:54 Process
          ASSUMED_DIRTY 76e1eb39272e77006d1c7b22a349ec78 C:\Users\Walter\AppData\Roaming\Microsoft conhost.exe A 128,000 12/23/2010  23:14 12/25/2010  13:39 Process
          UNKNOWN 6d75a14c536c407943822943faf5dfb3 C:\Program  Files\QuickTime\Plugins npqtplugin3.dll A Apple Inc.
          • 2. Re: FakeAlert Help

            I was able to resolve the problem myself using a program from MalwareBytes.org. While the files here were helpful in determining what was wrong, I could have used much more help in how to fix it. Perhaps a step by step process written for people who are not computer professionals could be generated.

            • 3. Re: FakeAlert Help

              I have this virus too.  What did you use from malwarebytes?  Can you tell me exactly what you did to fix your computer?

              • 4. Re: FakeAlert Help

                The thread is six months old. Please start your own thread as i am locking this one.