Jump to content

h2002al

Honorary Members
 View Profile  See their activity

  • Posts

    25

  • Joined

  • Last visited

 Content Type 

Posts posted by h2002al

    The same problem

    in Resolved Malware Removal Logs

    Posted

    Thanks Mieke

    I have disabled Teatimer but I don't understand what to do with Registry Mechanic of Iolo and MBAM. Which of them do the right configuration. And if I must trust MBAM how can i disable the fature of Registry Mechanic who change the configuration done with MBAM.

    Roland

    The same problem

    in Resolved Malware Removal Logs

    Posted

    Hi there.

    Could you please help me to eliminate definitevely this kind of problem with my pc. Each time I resolve this and the next scan (after two-three days) I found again the same problem.

    Thanks

    Logfile of Malwarebytes' Anti-Malware 1.41

    Malwarebytes' Anti-Malware 1.41

    Versione del database: 2960

    Windows 5.1.2600 Service Pack 3

    10/14/2009 4:25:11 PM

    mbam-log-2009-10-14 (16-25-11).txt

    Tipo di scansione: Scansione rapida

    Elementi scansionati: 98753

    Tempo trascorso: 4 minute(s), 4 second(s)

    Processi delle memoria infetti: 0

    Moduli della memoria infetti: 0

    Chiavi di registro infette: 0

    Valori di registro infetti: 0

    Elementi dato del registro infetti: 2

    Cartelle infette: 0

    File infetti: 0

    Processi delle memoria infetti:

    (Nessun elemento malevolo rilevato)

    Moduli della memoria infetti:

    (Nessun elemento malevolo rilevato)

    Chiavi di registro infette:

    (Nessun elemento malevolo rilevato)

    Valori di registro infetti:

    (Nessun elemento malevolo rilevato)

    Elementi dato del registro infetti:

    HKEY_CLASSES_ROOT\scrfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: ("%1" /S) -> Quarantined and deleted successfully.

    HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: (regedit.exe "%1") -> Quarantined and deleted successfully.

    Cartelle infette:

    (Nessun elemento malevolo rilevato)

    File infetti:

    (Nessun elemento malevolo rilevato)

    Logfile of Trend Micro HijackThis v2.0.2

    Logfile of Trend Micro HijackThis v2.0.2

    Scan saved at 5:47:46 PM, on 10/14/2009

    Platform: Windows XP SP3 (WinNT 5.01.2600)

    MSIE: Internet Explorer v8.00 (8.00.6001.18702)

    Boot mode: Normal

    Running processes:

    D:\WINDOWS\System32\smss.exe

    D:\WINDOWS\system32\winlogon.exe

    D:\WINDOWS\system32\services.exe

    D:\WINDOWS\system32\lsass.exe

    D:\WINDOWS\system32\svchost.exe

    D:\WINDOWS\System32\svchost.exe

    D:\WINDOWS\system32\spoolsv.exe

    D:\WINDOWS\Explorer.EXE

    D:\Program Files\Vtune\TBPanel.exe

    D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

    D:\WINDOWS\RTHDCPL.EXE

    D:\Program Files\McAfee.com\Agent\mcagent.exe

    D:\Program Files\HP\hpcoretech\hpcmpmgr.exe

    D:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe

    D:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

    D:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

    D:\WINDOWS\system32\ctfmon.exe

    D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

    D:\Program Files\MSGTAG Status\MSGTAGStatus.exe

    D:\Program Files\Skype\Phone\Skype.exe

    D:\Program Files\SEC\Natural Color Pro\NCProTray.exe

    D:\Program Files\Windows Desktop Search\WindowsSearch.exe

    D:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

    D:\Program Files\iolo\common\lib\ioloServiceManager.exe

    D:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

    D:\Program Files\McAfee\SiteAdvisor\McSACore.exe

    D:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

    d:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe

    d:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

    D:\Program Files\McAfee\MPF\MPFSrv.exe

    D:\Program Files\McAfee\MSK\MskSrver.exe

    D:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

    D:\WINDOWS\system32\nvsvc32.exe

    D:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

    D:\WINDOWS\system32\svchost.exe

    D:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

    D:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

    D:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

    D:\WINDOWS\system32\SearchIndexer.exe

    D:\WINDOWS\System32\svchost.exe

    D:\Program Files\Skype\Plugin Manager\skypePM.exe

    D:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

    D:\Program Files\Mozilla Firefox\firefox.exe

    D:\Program Files\Skype\Toolbars\Shared\SkypeNames.exe

    d:\PROGRA~1\mcafee\VIRUSS~1\mcvsshld.exe

    D:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE

    D:\WINDOWS\system32\NOTEPAD.EXE

    D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.clubshop.com/

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?fr=mcafee&p=%s

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

    O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - d:\PROGRA~1\mcafee\msk\mskapbho.dll

    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll

    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

    O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - D:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - D:\Program Files\McAfee\VirusScan\scriptsn.dll

    O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

    O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - d:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

    O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll

    O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - D:\Program Files\Windows Live\Toolbar\wltcore.dll

    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

    O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - d:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

    O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - D:\Program Files\Windows Live\Toolbar\wltcore.dll

    O4 - HKLM\..\Run: [Gainward] D:\Program Files\Vtune\TBPanel.exe /A

    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup

    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

    O4 - HKLM\..\Run: [GrooveMonitor] "D:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

    O4 - HKLM\..\Run: [JMB36X IDE Setup] D:\WINDOWS\RaidTool\xInsIDE.exe

    O4 - HKLM\..\Run: [36X Raid Configurer] D:\WINDOWS\system32\xRaidSetup.exe boot

    O4 - HKLM\..\Run: [mcagent_exe] "D:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey

    O4 - HKLM\..\Run: [McENUI] D:\PROGRA~1\McAfee\MHN\McENUI.exe /hide

    O4 - HKLM\..\Run: [HP Component Manager] "D:\Program Files\HP\hpcoretech\hpcmpmgr.exe"

    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] D:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe

    O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "D:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

    O4 - HKLM\..\Run: [HP Software Update] D:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

    O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "D:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

    O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe

    O4 - HKCU\..\Run: [spybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

    O4 - HKCU\..\Run: [MSGTAG] "D:\Program Files\MSGTAG Status\MSGTAGStatus.exe" /startup

    O4 - HKCU\..\Run: [skype] "D:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

    O4 - HKCU\..\Run: [Google Update] "D:\Documents and Settings\Admin\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

    O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = D:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

    O4 - Global Startup: NCProTray.lnk = ?

    O4 - Global Startup: Windows Search.lnk = D:\Program Files\Windows Desktop Search\WindowsSearch.exe

    O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://D:\WINDOWS\system32\GPhotos.scr/200

    O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

    O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

    O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - D:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll

    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll

    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe

    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe

    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1251126020343

    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll

    O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - d:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

    O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

    O23 - Service: iolo FileInfoList Service (ioloFileInfoList) - Unknown owner - D:\Program Files\iolo\common\lib\ioloServiceManager.exe

    O23 - Service: iolo System Service (ioloSystemService) - Unknown owner - D:\Program Files\iolo\common\lib\ioloServiceManager.exe

    O23 - Service: MBAMService - Malwarebytes Corporation - D:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

    O23 - Service: McAfee SiteAdvisor Service - Unknown owner - D:\Program Files\McAfee\SiteAdvisor\McSACore.exe

    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - D:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - d:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe

    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - D:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe

    O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - d:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - D:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - D:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - D:\Program Files\McAfee\MPF\MPFSrv.exe

    O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - D:\Program Files\McAfee\MSK\MskSrver.exe

    O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - D:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe

    --

    End of file - 11056 bytes

    The same problem

    in Malwarebytes for Windows Support Forum

    Posted

    Hi there.

    Could you please help me to eliminate definitevely this kind of problem with my pc. Each time I remove those and the next scan (after two-three days) I found again the same problem.

    Thanks

    Malwarebytes' Anti-Malware 1.41

    Versione del database: 2955

    Windows 5.1.2600 Service Pack 3

    10/14/2009 10:39:31 AM

    mbam-log-2009-10-14 (10-39-26).txt

    Tipo di scansione: Scansione rapida

    Elementi scansionati: 98458

    Tempo trascorso: 3 minute(s), 55 second(s)

    Processi delle memoria infetti: 0

    Moduli della memoria infetti: 0

    Chiavi di registro infette: 0

    Valori di registro infetti: 0

    Elementi dato del registro infetti: 2

    Cartelle infette: 0

    File infetti: 0

    Processi delle memoria infetti:

    (Nessun elemento malevolo rilevato)

    Moduli della memoria infetti:

    (Nessun elemento malevolo rilevato)

    Chiavi di registro infette:

    (Nessun elemento malevolo rilevato)

    Valori di registro infetti:

    (Nessun elemento malevolo rilevato)

    Elementi dato del registro infetti:

    HKEY_CLASSES_ROOT\scrfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: ("%1" /S) -> No action taken.

    HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: (regedit.exe "%1") -> No action taken.

    Cartelle infette:

    (Nessun elemento malevolo rilevato)

    File infetti:

    (Nessun elemento malevolo rilevato)

    195.110.124.133

    in Website Blocking

    Posted

    My MBAM doesn't work more. When I tried to "Start Protection" the program told me "failed to perform desired action. Error code 1072". And then "The Protection Module is already running". But this is not true. Th icon of the program isn't near the clock. And now I can access again at my work team homepage. That wasn't possible when my MBAM worked normally. I have reinstalled MBAM and the situation is the same. What can I do?

    What to do?

    in File Detections

    Posted

    A very interesting question!!

    I had the same result and I deleted this registry keys infected. Later I had restored this infection from the "Quarantine Section" of Malwarebytes' Anti-Malware and the results (after a quick/full run scan) were the same: no infection. What does it mean?

    Roland.

    Below the results:

    Before:

    Malwarebytes' Anti-Malware 1.11

    Versioni i baz

    Version 0.85

    in Malwarebytes for Windows Support Forum

    Posted

    Speed increased from version 0.84 to 0.85. Below dhe respective logfiles:

    Roland

    VERSION 0.84

    Malwarebytes' Anti-Malware Version 0.84

    Database version: 236

    Scan type: Quick Scan

    Objects scanned: 19403

    Time elapsed: 4 minute(s), 58 second(s)

    Memory Processes Infected: 0

    Memory Modules Infected: 0

    Registry Keys Infected: 0

    Registry Values Infected: 0

    Registry Data Items Infected: 0

    Folders Infected: 0

    Files Infected: 0

    VERSION 0.85

    Malwarebytes' Anti-Malware Version 0.85

    Database version: 238

    Scan type: Quick Scan

    Objects scanned: 19585

    Time elapsed: 4 minute(s), 24 second(s)

    Memory Processes Infected: 0

    Memory Modules Infected: 0

    Registry Keys Infected: 2

    Registry Values Infected: 0

    Registry Data Items Infected: 0

    Folders Infected: 0

    Files Infected: 0

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.