Jump to content

imbart

Honorary Members
 View Profile  See their activity

  • Posts

    51

  • Joined

  • Last visited

 Content Type 

Posts posted by imbart

    Ignore List Disappears

    in Malwarebytes for Windows Support Forum

    Posted

    I have Win XP SP3 and the free version of Malwarebytes 1.60. I had initial trouble like a lot of people when installing 1.60 over the previous version and used the mbam-clean reboot download and reinstall solution which seemed to work fine. The first scan heuristically discovered two registry items which I was well aware of i.e HKLM\SOFTWARE\Microsoft\Security Center\Firewall\DisableNotify Bad(1)Good(0) and HKLM\SOFTWARE\Microsoft\Security Center\Antivirus\DisableNotify Bad(1)Good(0).

    I know these are disabled by my Norton Internet Security which has taken over those functions from Windows Security and have had them in My Ignore List for many years. I put them in the Ignore List as before although it seemed a bit complicated this time as tabs seemed to seize up except for an option of returning to the main menu which I clicked as there seemed no further progress otherwise and got a message telling me my scan log would be lost if I continued which I didn't understand the reason for. However I did continue to the main menu when all tabs worked and the items appeared in full as above in my ignore list although there was no result log as I was warned - bit baffling to me - do you know why this awkward complication is included?

    Today I updated with v2011.12.31.02 and quick scanned which discovered the same two items again. It seems they had disappeared from my ignore List and gone back into the mix and I had to re-ignore them with the same stuff about losing the scan log as before and the items appeared in my Ignore List but with the "Bad(1) Good(0)"missing from the end.

    At the moment all seems OK but I said that before in a previous post on 28th Dec about the initial 1.60 problems I was having. Nevertheless I would appreciate advice and information on all this if anyone knows what is happening.

    New MBAM 1.60 on XP

    in Malwarebytes for Windows Support Forum

    Posted

    I seem to have got it going now - lots of people having trouble I notice. I used the advice on another post to run mbam-clean and then download and reinstall. It worked but even then I got all sorts of little warning boxes re runtime errors and read-only as it was uninstalling and one of them telling me "unable to quit" or something like that was a worry but it answered to the restart in spite of all that.

    At the moment all seems OK.

    New MBAM 1.60 on XP

    in Malwarebytes for Windows Support Forum

    Posted

    I have just downloaded and installed the new MBAM 1.60 version over the old one on my Win XP SP3 and all I get now when I try to open it is the MBAM has encountered a problem and has to close and apologies for the inconvenience message. If it helps the error signature is shown as:

    App Name: mbam.exe

    App Ver: 1.60.0.59

    Mod Name: mbamcore.dll

    Mod Ver: 1.60.0.52

    Offset: 00060ae0

    What do I do about it please?

    New MBAM 1.50 difference

    in Malwarebytes for Windows Support Forum

    Posted

    I have upgraded from 1.46 to 1.50 today (free versions). I have done one or two quick scans and notice that whereas v. 1.46 scanned registry entries the new version doesn't appear to do so - the sequence I have is first of all "enumerating registry objects prior to scan" when nothing seems to happen then it scans memory, autorun and filesystem objects and lastly the additional heuristic scan. Is this correct - what happens with registry objects in the new version?

    MBAM (free) not updating

    in Malwarebytes for Windows Support Forum

    Posted

    Post script re above posting - I did a full scan with my newly reinstalled NIS 2011 which found nothing then tried the MBAM update again which burst into life and updated me to 5144. Fingers crossed its sorted itself out - no idea how. I must have tried about 5 or 6 times with 1 or 2 restarts etc before that. Seems solved - hope I don't have to come back on this.

    MBAM (free) not updating

    in Malwarebytes for Windows Support Forum

    Posted

    I system restored my Win XP SP3 computer which I have done previously many times with MBAM (free) installed and usually find the database version has backdated too which I bring up to date again with the update facility. I system restored to 10th November today and MBAM showed old database 5085. However when I checked for updates I was told that I already had the latest update when I know we were at least up to database 5143 from my last log. I have restarted etc which makes no difference. I also have NIS 2011 installed recently which I have never previously system restored with and NIS 2011was thrown out of configuration to the extent I had to reinstall it. Could that have affected MBAM - Any ideas on this ?

    Ignore List buttons

    in Malwarebytes for Windows Support Forum

    Posted

    Just to expand on my above posting in case my query isn't clear and to bring it to the top again - I have the free MBAM v. 1.46. The About->Help tab tells me that to remove any items from the Ignore I should use the "Remove" or "Remove All" buttons. I don't have these buttons on my Ignore List - I have "Delete" and Delete All" instead and I wondered why this is different. Can any kind person please enlighten me?

    Ignore List buttons

    in Malwarebytes for Windows Support Forum

    Posted

    I have two items in my ignore list with only two option buttons "delete" and "delete all". I just noticed that according to the help instructions that I have the buttons should be "remove" and "remove all". I take it that "remove" puts the item back into the mix to be found again by a scan but I am concerned about "delete" which I have Does this "delete" button clear the item altogether from my computer or just clear it from the Ignore List to be found again as "remove".

    Strange error message

    in Malwarebytes for Windows Support Forum

    Posted

    On 30th April 2010 MBAM (free) updated to v.1.46 through normal manual update. All seems well since. However today I have just noticed a text file dated 30th April 2010 on my hard drive:

    "An error has occurred. Please report this error code to our support team.

    MBAM_ERROR_NOT_REGISTERED (0, 0)"

    This didn't come up with MBAM at the time. Is this a glitch or does it mean anything? During the installation on 30th April which took some time I acccidently clicked again on MBAM and it seemed to go through the same process (my fault) - could that be it - because "0,0" doesn't seem to be an error code.

    Malware.Trace Removal

    in Malwarebytes for Windows Support Forum

    Posted

    @ imbart - DCross - iroc9555 - et al -

    You are chasing your own tail - The posting has been answered above and in the other areas you mentioned -

    They refer to here and then here refers to there - No sense to follow it -

    You should not post this further unless you wish to have your system checked in the HiJack This Section of the forum -

    Apologies - I was trying to collate the various answers as many pertinent to this thread are on the other thread and might have been missed.

    Me too, autorun.inf

    in File Detections

    Posted

    Many thanks AdvancedSetup for your explanation here and on the other thread. My only query now is that when autorun.inf is removed from sysyem2 and quarantined it requires restart after which an MBAM entry arrives in the startup list and also in HijackThis in the 04 section as:

    04- HKLM\..\Run [Malwarebytes Anti-Malware (reboot)] "C\Program Files\Malwarebytes' Anti-Malware\mbam.exe\ runcleanupscript

    and stays there - do you know why?

    Malware.Trace Removal

    in Malwarebytes for Windows Support Forum

    Posted

    Just an update. We've got two threads running on this as you probably know - the other is in the link on tudor's post immediately above this. The latest from the other thread is that nosirrah of MBAM has "pulled" this item as a suspicious object while the claim that the file is an HP installation is looked into so at the moment a scan will not pick it up. I am no expert but I have read through the text in my autorun.inf file and most of it refers to my HP printer and ancillary programs such as HP solutions and HP photo programs. If anything is buried in there it seems to me HP put it there - but I say again I am no expert just my opinion until I hear different. Just one more question to MBAM - when I initially quarantined this file (now restored and in my ignore list) and was directed to restart to do this why thereafter did MBAM's registry entry concerning the "runcleanupscript" appear permanently in my startuplist as I explained in the very first posting in this thread? I hope nosirrah of MBAM is reading this thread too and I thank him for his assistance so far.

    Malware.Trace Removal

    in Malwarebytes for Windows Support Forum

    Posted

    Thanks for all the interest. I thought this was the wrong forum so I posted again on the Malwarebytes HijackThis forum as suggested in one of the posts above before I saw any replies. However some answers seem to be here now. I have looked further into this. A full Norton scan brings up nothing on autorun.inf neither does a scan by Norton or by Malwarebytes on autorun.inf on its own. I restored autorun.inf from quarantine and put it in "ignore" because Googling gave me the impression that it was a required system file and I "system restored" my computer back a few days. This got rid of the HijackThis and startup list Malwarebytes "runcleanupscript" entries. I looked at my autorun.inf file properties which showed that it was created 15/5/2007- modified 15/5/2007 and accessed 3/12/2009. So its been there 2 and a half years without Malwarebytes taking any notice and suddenly today the heuristic bit of the scan picked it out. The main scan before the heuristic did not. I also opened autorun.inf with Notepad and a lot of it seems connected with my all-in-one HP printer although a lot was also gobbledegook. Quarantining it takes it out altogether but I think it may recreate on boot which is why the "runcleanupscript " bit runs at boot up. Before I saw some of the answers here I was treating it as a false positive. Is this a required system file or not - does anyone know?

    Malware.Trace Found

    in Resolved Malware Removal Logs

    Posted

    I originally posted this on the wrong forum -sorry about that.

    My Malwarebytes Quick Scan turned up "Malware.Trace" in "C/windows/ system32/autorun.inf" during the heuristics part of the scan. I removed it on reboot as directed and it is now in "Quarantine". Since doing that I checked in "system32" and I don't appear to have an "autorun.inf" file there -is the actual malware that file or is the file infected and only part should be removed. Has MBAM removed the whole file. I ran Qiuick Scan again and Malware.Trace was not picked up again. However my HijackThis program shows an additional entry:

    04- HKLM\..\Run [Malwarebytes Anti-Malware (reboot) "C\Program Files\Malwarebytes' Anti-Malware\mbam.exe\ runcleanupscript

    Does that keep coming up now or can I remove it? I'm a bit green about all this. I have now done a Full Scan -all clear but why have I still got the above "runcleanupscript" registry entry and also in my startup list now? here are my logs:

    Malwarebytes' Anti-Malware 1.41

    Database version: 3283

    Windows 5.1.2600 Service Pack 3

    03/12/2009 05:20:41

    mbam-log-2009-12-03 (05-20-41).txt

    Scan type: Quick Scan

    Objects scanned: 104759

    Time elapsed: 5 minute(s), 51 second(s)

    Memory Processes Infected: 0

    Memory Modules Infected: 0

    Registry Keys Infected: 0

    Registry Values Infected: 0

    Registry Data Items Infected: 0

    Folders Infected: 0

    Files Infected: 1

    Memory Processes Infected:

    (No malicious items detected)

    Memory Modules Infected:

    (No malicious items detected)

    Registry Keys Infected:

    (No malicious items detected)

    Registry Values Infected:

    (No malicious items detected)

    Registry Data Items Infected:

    (No malicious items detected)

    Folders Infected:

    (No malicious items detected)

    Files Infected:

    C:\WINDOWS\system32\autorun.inf (Malware.Trace) -> Quarantined and deleted successfully.

    Logfile of HijackThis v1.99.1

    Scan saved at 09:31:14, on 03/12/2009

    Platform: Windows XP SP3 (WinNT 5.01.2600)

    MSIE: Internet Explorer v7.00 (7.00.6000.16915)

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\WINDOWS\Explorer.EXE

    C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe

    C:\WINDOWS\system32\svchost.exe

    C:\Program Files\Java\jre6\bin\jqs.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Program Files\Norton Internet Security\Engine\16.7.2.10\ccSvcHst.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\slserv.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\system32\wuauclt.exe

    C:\Program Files\Norton Internet Security\Engine\16.7.2.10\ccSvcHst.exe

    C:\WINDOWS\system32\igfxtray.exe

    C:\WINDOWS\system32\hkcmd.exe

    C:\WINDOWS\SOUNDMAN.EXE

    C:\Apps\Powercinema\PCMService.exe

    C:\apps\ABoard\ABoard.exe

    C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe

    C:\WINDOWS\SM1BG.EXE

    C:\apps\ABoard\AOSD.exe

    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Program Files\Java\jre6\bin\jusched.exe

    C:\Program Files\Messenger\msmsgs.exe

    C:\Program Files\Webroot\Washer\wwDisp.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\Program Files\GetRight\getright.exe

    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

    C:\Program Files\GetRight\getright.exe

    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

    C:\Program Files\hijackthis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://format.packardbell.com/cgi-bin/redi...&key=SEARCH

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

    O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll

    O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.7.2.10\coIEPlg.dll

    O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.7.2.10\IPSBHO.DLL

    O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

    O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.7.2.10\coIEPlg.dll

    O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

    O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

    O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

    O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"

    O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe

    O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"

    O4 - HKLM\..\Run: [sM1BG] C:\WINDOWS\SM1BG.EXE

    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

    O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

    O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

    O4 - HKCU\..\Run: [Window Washer] C:\Program Files\Webroot\Washer\wwDisp.exe

    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

    O4 - Global Startup: GetRight - Tray Icon.lnk = C:\Program Files\GetRight\getright.exe

    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

    O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm

    O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm

    O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL

    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O11 - Options group: [iNTERNATIONAL] International*

    O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\uk.htm

    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

    O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqaio/downloads/sysinfo.cab

    O16 - DPF: {EBF85371-A38F-485B-B28F-0B4C82D25937} (CUpdateCtl Object) - http://update.hpphoto.com/download/HPSWUpdate.ocx

    O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Engine\16.7.2.10\coIEPlg.dll

    O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)

    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll

    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

    O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe

    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)

    O23 - Service: Norton Internet Security - Unknown owner - C:\Program Files\Norton Internet Security\Engine\16.7.2.10\ccSvcHst.exe" /s "Norton Internet Security" /m "C:\Program Files\Norton Internet Security\Engine\16.7.2.10\diMaster.dll" /prefetch:1 (file missing)

    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

    Malware.Trace Removal

    in Malwarebytes for Windows Support Forum

    Posted

    My Matwarebytes Quick Scan turned up "Malware.Trace" in "C/windows/ system32/autorun.inf" during the heuristics part of the scan. I removed it on reboot as directed and it is now in "Quarantine". Since doing that I checked in "system32" and I don't appear to have an "autorun.inf" file there -is the actual malware that file or is the file infected and only part should be removed. Has MBAM removed the whole file. I ran Qiuick Scan again and Malware.Trace was not picked up again. However my HijackThis program shows an additional entry:

    04- HKLM\..\Run [Malwarebytes Anti-Malware (reboot) "C\Program Files\Malwarebytes' Anti-Malware\mbam.exe\ runcleanscript

    Does that keep coming up now or can I remove it? I'm a bit green about all this.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.