Will file tranfer infect another computer?

I was recently blocked from my school's wireless network and received an email saying they had detected Torpid Malware on my computer. I was in the processes of getting a new laptop so I just ignored it. I had planned to transfer my data and give the old laptop to my mom. So here are my questions:

1. Will transferring my data between machines possible infect my new computer? (I will only be moving music, photos, ms office docs and browser bookmarks.)
2. If I use the restore disk on my old machine, could I leave some of the malware behind and get reinfected?

If either of these is possible I'll take a shot at cleaning the machine, if not I won't even bother.

Hello and welcome to Bleeping Computer. Let's try to clean the machine and then transfer all of the documents, because you sure dont want for your mom to be stuck with problems! : )

Please subscribe to your topic so that you will be notified as soon as I post a reply, instead of you having to check the topic all of the time. This will allow you to get an email notification when I reply.

To subscribe, go to your topic, and at the top right hand corner by your first post, click the Options button and then click Track this topic. The bullet the immediate notification bubble. Then press submit.

Lets take a look with Malwarebytes

Please download Malwarebytes' Anti-Malware from here:
Malwarebytes
Please rename the file BEFORE downloading to zztoy.exe instead of mbam-setup.exe

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

Double Click zztoy.exe to install the application.
* Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select "Perform Full Scan", then click Scan.
* The scan may take some time to finish,so please be patient.
* When the scan is complete, click OK, then Show Results to view the results.
* Make sure that everything is checked, and click Remove Selected.
* When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
* The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
* Copy&Paste the entire MBAM report (even if it does not find anything) in your next reply

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.


If Malwarebytes won't install or run

Some types of malware will disable MBAM and other security tools. If MBAM will not install, try renaming it. Right-click on the mbam-setup.exe file and change the .exe extension to .bat, .com, .pif, or .scr and then double-click on it to run.

If after installation, MBAM will not run, open the Malwarebytes' Anti-Malware folder in Program Files, right-click on mbam.exe and change the .exe as noted above. Then double-click on it to run.

Malwarebytes' Anti-Malware 1.41
Database version: 2775
Windows 5.1.2600 Service Pack 2

9/20/2009 9:51:49 AM
mbam-log-2009-09-20 (09-51-49).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 247143
Time elapsed: 57 minute(s), 8 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 3
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 17

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{74fa5d99-38cd-4e3e-b765-54fad4bda166} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{74fa5d99-38cd-4e3e-b765-54fad4bda166} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\skynethsaucflm (Rootkit.TDSS) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lemowuwipe (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1cb5bba3 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\getmodule36 (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\HelpAssistant\Local Settings\Temporary Internet Files\Content.IE5\KEMPYD1B\static[1].exe (Spyware.Passwords) -> Quarantined and deleted successfully.
C:\Documents and Settings\Una\Local Settings\Temporary Internet Files\Content.IE5\KEMPYD1B\static[1].exe (Spyware.Passwords) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\dqmahrm.dll.vir (Trojan.Boaxxe) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B48FE405-03FD-46C7-990B-028FE5E93B11}\RP661\A0165284.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B48FE405-03FD-46C7-990B-028FE5E93B11}\RP661\A0165285.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B48FE405-03FD-46C7-990B-028FE5E93B11}\RP674\A0171406.exe (Spyware.Passwords) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B48FE405-03FD-46C7-990B-028FE5E93B11}\RP674\A0174126.exe (Spyware.Passwords) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B48FE405-03FD-46C7-990B-028FE5E93B11}\RP674\A0175126.exe (Spyware.Passwords) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B48FE405-03FD-46C7-990B-028FE5E93B11}\RP674\A0175851.exe (Spyware.Passwords) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B48FE405-03FD-46C7-990B-028FE5E93B11}\RP675\A0178290.exe (Spyware.Passwords) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B48FE405-03FD-46C7-990B-028FE5E93B11}\RP676\A0181154.exe (Spyware.Passwords) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B48FE405-03FD-46C7-990B-028FE5E93B11}\RP676\A0181884.exe (Spyware.Passwords) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{B48FE405-03FD-46C7-990B-028FE5E93B11}\RP676\A0183845.exe (Spyware.Passwords) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\0YW3PBCP\Z[1].exe (Trojan.PWS) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\SBO7ZXPE\install[1].exe (Trojan.Otlard) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\rdl36B.tmp.exe (Trojan.Infostealer) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\rdl36F.tmp.exe (Trojan.PWS) -> Quarantined and deleted successfully.

Can you access task manager?

Yes, I can access my task manger. I forgot to make clear that there doesn't appear to be anything wrong with the laptop. I was only made aware of my possible infection because my school blocked me from accessing their network. Everything is working fine, so it seems.

O Ok.

Unnnies,

Sorry about the distraction from Skydie : /. Please update Malwarebytes by going to the Update Tab, and then run a Quick Scan. Post back the log.

Thanks,
Computer Pro

Skydie distractions? No worries. Here's the updated quick scan:

Malwarebytes' Anti-Malware 1.41
Database version: 2830
Windows 5.1.2600 Service Pack 2

9/20/2009 11:24:53 AM
mbam-log-2009-09-20 (11-24-53).txt

Scan type: Quick Scan
Objects scanned: 125744
Time elapsed: 8 minute(s), 47 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

I was talking about the posts that "Skydie" made, as those were not mine asking you about Task Manager.

Ok, next:

Please run ATF and SAS:
Credits to Boopme

Note.. SAS doesn't open the registry hives for other user accounts on the system, so scans should be done from each user account.

Note 2: On Vista, "Windows Temp" is disabled. To empty "Windows Temp" ATF-Cleaner must be "Run as an Administrator".

From your regular user account..
Download Attribune's ATF Cleaner and then SUPERAntiSpyware, Free Home Edition

Save both to desktop ..
DO NOT run yet.
Open SUPER from icon and install and Update it
Under Scanner Options make sure the following are checked (leave all others unchecked):
Close browsers before scanning.
Scan for tracking cookies.
Terminate memory threats before quarantining.
Click the "Close" button to leave the control center screen and exit the program. DO NOT run yet.

Now reboot into Safe Mode: How to enter safe mode(XP)
Using the F8 Method
Restart your computer.
When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
Select the option for Safe Mode using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode.

Double-click ATF-Cleaner.exe to run the program.
Under Main "Select Files to Delete" choose: Select All.
Click the Empty Selected button.

If you use Firefox or Opera browser click that browser at the top and choose: Select All
Click the Empty Selected button.
If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.

NOW Scan with SUPER
Open from the desktop icon or the program Files list
On the left, make sure you check C:\Fixed Drive.
Perform a Complete scan. After scan,Verify they are all checked.
Click OK on the summary screen to quarantine all found items.
If asked if you want to reboot, click "Yes" and reboot normally.

To retrieve the removal information after reboot, launch SUPERAntispyware again.
Click Preferences, then click the Statistics/Logs tab.
Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
If there are several logs, click the current dated log and press View log.
A text file will open in your default text editor.
Please copy and paste the Scan Log results in your next reply.
Click Close to exit the program.

I went through the directions and successfully completed everything until the SUPER Scan. I have tried to run the SUPER Scan three times and my computer just shuts down. It goes from fully running to totally dead. I have had problems with over heating but never this bad. Not sure what the problem is but I'll leave my computer alone for an hour and then try again.

To avoid the overheating, have you tried to clean out the dust out of the PC, and make sure that the fans are clear and running?

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 09/21/2009 at 04:20 AM

Application Version : 4.29.1002

Core Rules Database Version : 4112
Trace Rules Database Version: 2052

Scan type : Complete Scan
Total Scan Time : 07:06:47

Memory items scanned : 235
Memory threats detected : 0
Registry items scanned : 6286
Registry threats detected : 8
File items scanned : 84064
File threats detected : 20

Adware.Tracking Cookie
C:\Documents and Settings\Una\Cookies\una@questionmarket[1].txt
C:\Documents and Settings\Una\Cookies\una@a1.interclick[1].txt
C:\Documents and Settings\Una\Cookies\una@specificclick[1].txt
C:\Documents and Settings\Una\Cookies\una@specificmedia[2].txt
C:\Documents and Settings\Una\Cookies\una@serving-sys[1].txt
C:\Documents and Settings\Una\Cookies\una@247realmedia[1].txt
C:\Documents and Settings\Una\Cookies\una@tribalfusion[1].txt
C:\Documents and Settings\Una\Cookies\una@interclick[1].txt
C:\Documents and Settings\Una\Cookies\una@ctabustracker[2].txt
C:\Documents and Settings\Una\Cookies\una@bs.serving-sys[1].txt
C:\Documents and Settings\Una\Cookies\una@ads.undertone[1].txt
C:\Documents and Settings\Una\Cookies\una@ads.pointroll[1].txt
C:\Documents and Settings\Una\Cookies\una@www.ctabustracker[2].txt

Adware.SpeedRunner
HKU\S-1-5-21-839522115-179605362-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run#SpeedRunner [ C:\Documents and Settings\Una\Application Data\SpeedRunner\SpeedRunner.exe ]
HKU\S-1-5-21-839522115-179605362-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run#SfKg6wIP [ C:\Documents and Settings\Una\Application Data\Microsoft\Windows\embkfi.exe ]

Rogue.Component/Trace
HKLM\Software\Microsoft\1CB5A92D
HKLM\Software\Microsoft\1CB5A92D#1cb5a92d
HKLM\Software\Microsoft\1CB5A92D#Version
HKLM\Software\Microsoft\1CB5A92D#1cb504ad
HKLM\Software\Microsoft\1CB5A92D#1cb56d48
HKU\S-1-5-21-839522115-179605362-725345543-1003\Software\Microsoft\FIAS4057

Trojan.Downloader-Gen/A
C:\PROGRAM FILES\MOZILLA FIREFOX\A.EXE

Trojan.Dropper/Gen-Packed
C:\QOOBOX\QUARANTINE\C\DOCUMENTS AND SETTINGS\UNA\APPLICATION DATA\SPEEDRUNNER\SRUNINSTALL.EXE.VIR

Adware.Unknown Origin
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\COMMON FILES\WIQZ\WIQZD\CLASS-BARREL.VIR
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\COMMON FILES\WIQZ\WIQZD\VOCABULARY.VIR

Unclassified.Unknown Origin/System
C:\QOOBOX\QUARANTINE\C\PROGRAM FILES\COMMON FILES\WIQZ\WIQZD\WIQZC.DLL.VIR

Adware.Vundo/Variant-MSFake
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\TJRIQLAH.DLL.VIR

Adware.TargetSavers
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\TSUNINST.EXE.VIR

Ok, is the machine running better now?

Everything on the software side seems fine. As far as the hardware goes... I can see through the vent on the bottom of the laptop that the fan is covered in dust. It constantly runs, my computer is annoyingly loud. I have tried to dust with a cotton swab but I can't quite reach everything. Looking into this I wonder if my heat sink is also coughed. It is four year old laptop. I have read conflicting advice on using compressed gas or a vacuum, but am reluctant to try either. What's your 2 cents?

What is the make and model of the laptop?