Hi goldedger,

I do a lot of help here for the forum, you're going to need a Malware removal forum to assist you in getting your machine clean and free of malware. I have included some information on the infection you have, and a link to a Malware removal forum

TrojanDownloader:Win32/Ponmocup.A is a trojan that silently downloads and installs other programs without consent. This could include the installation of additional malware or malware components to an affected machine.

TrojanDownloader:Win32/Ponmocup.A modifies the Windows Hosts file. The local Hosts file overrides the DNS resolution of a web site URL to a particular IP address. Malicious software may make modifications to the Hosts file in order to redirect specified URLs to different IP addresses. Malware often modifies an affected machine's Hosts file in order to stop users from accessing websites associated with particular security-related applications (such as antivirus for example).

Here is a link that might be useful: landzdown

This post was edited by zep516 on Mon, Jan 7, 13 at 22:49

Do I repost this information over on that forum? Can I use the infected computer to post?

Thanks

You're welcome :)

You can use the infected computer to post, just provide a link to this post / thread so they know where you're coming from, There's a set of instructions before you post and some things you will need to download, i have included a link too for that part of the forum as well.

Joe

Here is a link that might be useful: malware-removal/log-posting-instructions/

This post was edited by zep516 on Mon, Jan 7, 13 at 23:32

Okay, I've read the list of instructions and think I can follow them. I'll have to wait though - I've got Microsoft Safety Scanner running a full scan on the infected computer right now (it's been going for over 95 minutes so far).
Thanks Joe. It's so nice of you and the other experts on this forum to help with our computer woes.

the scan probably won't run properly, so you can cancel it.
once you post your own thread at LzD please follow only the directions that are given to you, do not use other directions so there is no confusion. Please don't do any scans or add or remove anything except what you are instructed to do.
If you have any questions or problems I and Joe are both there too.
I would not use the infected computer for anything important or financial.

Hi Raven and Joe

I was going to cancel the MS Safety Scanner but it had already completed with the following info: [The scan completed successfully & no viruses, spyware & other potentially unwanted software were detected.] In preparation to post at Landzdown I restarted my laptop as per their instructions - that took quite awhile as it said it was checking my disc for consistency, file system FAT 32 (or something like that). Anyways when it finished and my laptop restarted, an info box came up saying MS Security Essentials was stopped and needed to be started, pressed START and it started up. I updated it and it seems fine. Did the restart clear the malware? Should I run another Eset Scan? Should I continue over to the Lanzdown forum? I don't want to waste your time or theirs but I do want to make sure this trojan is gone. Please advise.

I did run the Eset Online Scanner again - it found & cleaned 1 infected file here's the 1st and 2nd log file ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=8
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6844
# api_version=3.0.2
# EOSSerial=cc4844785a672746b9e71f03e28e7041
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2013-01-08 12:21:10
# local_time=2013-01-07 07:21:10 (-0500, Eastern Standard Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=5892 16777213 88 94 9185604 60484558 0 0
# scanned=99109
# found=2
# cleaned=1
# scan_time=4185
C:\WINDOWS\system32\MP4SDMODO.dll a variant of Win32/Ponmocup.FT trojan (cleaned by deleting - quarantined) FAFC8956CADBAC1E13DDF087F7566E26CA58C01A C
$(Memory) probably a variant of Win32/Ponmocup.AA trojan 0000000000000000000000000000000000000000 I
esets_scanner_update returned -1 esets_gle=53251
# version=8
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6844
# api_version=3.0.2
# EOSSerial=cc4844785a672746b9e71f03e28e7041
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-01-08 09:09:38
# local_time=2013-01-08 04:09:38 (-0500, Eastern Standard Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=5892 16777213 88 94 9217312 60519866 0 0
# scanned=99127
# found=1
# cleaned=1
# scan_time=4802
C:\System Volume Information\_restore(840F8D40-D2B2-4CA1-A56C-AE9B7E3B083F)\RP4\A0000165.dll a variant of Win32/Ponmocup.FT trojan (cleaned by deleting - quarantined) FAFC8956CADBAC1E13DDF087F7566E26CA58C01A C

I'm sorry if I should have posted this over at Landzdown - I haven't gone there yet as I'm thinking that the malware has been removed. Is that the case????
It's 4:30 am and I'm going to bed now.
June

please continue at LzD where you can have direct instructions, these infections quite often disable or cause improper results in scans.
No believe me this infection did not just go away.

I don't see you registered at LzD? Be sure to post your own thread in the malware removal area.

Okay Raven

I just registered at LzD and am in the process of creating the various logs required for the first post.
See you there.

June