%$&@ recomended for you pop up !

MrCharlie · May 28, 2012

OK, let me know.....MrC

carolinanewbe · May 28, 2012

MrC

still same thing on combofix

MrCharlie · May 28, 2012

You tried it in safe mode and with the switches killall and nombr?

What anti-virus or malware programs are installed now?

MrC

carolinanewbe · May 29, 2012

MrC

super anti spy ware free

malware bytes anti malware

TdssKiller

viprerescue

all 4 have been deleated fron hard drive

and real time protection has ben turned off on microsoft securtiy essentials

please give me a list of programs you want to run and there settings ( no abbrivations please )

MrCharlie · May 29, 2012

Scan for rootkits with GMER Rootkit Scanner

Download GMER Rootkit Scanner from HERE to your desktop.

Double click the .exe file (it will be named some random characters). If asked to allow gmer.sys driver to load, please consent .

If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO.

Click the image to enlarge it

In the right panel, you will see several boxes that have been checked. Uncheck the following ...

Sections
IAT/EAT
Drives/Partition other than Systemdrive (typically C:\)
Show All (don't miss this one)

Then click the Scan button & wait for it to finish.

Once done click on the [save..] button, and in the File name area, type in Gmer.txt or it will save as a .log file which cannot be uploaded to your post.

Save it where you can easily find it, such as your desktop, and post it in your reply.

**Caution**

Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries

NOTE:

If you cannot run GMER as indicated above, please save a scan from the initial startup scan.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double click the gmer.exe file.

The program will begin to run, and perform an initial scan. If possible rootkit activity is found, you will be asked if you would like to perform a full scan. Click No.

After the "initial scan" is complete, click on the Save button, and save the log file to your desktop, and post it in your reply

MrC

carolinanewbe · May 29, 2012

MrC

more bad news GMER will not run the computer locks up

I even tryed downloading directly from there website as a zip file and after unzipping I renamed the GMER.exe to TEST.exe and still will not run.

MSSE active was turned off durring the process

Will try to run GMER in safe mode now

also ever sence I removed all 4 of the malware detecting programs I have been getting a request to load drivers for new found hardware ??

see the 2 attachments

carolinanewbe · May 29, 2012

first pic the right edge did not show

carolinanewbe · May 29, 2012

MrC

no luck in safe mode

MrCharlie · May 29, 2012

Let the wizard connect to Windows Update and see if it finds the drivers it's looking for.

---------------------------------------

Lets try this to get ComboFix running, it worked for another person:

Delete any ComboFix you have now.

Dowanload a fresh copy.

Copy and paste ComboFix.exe in Malwarebytes Chameleon folder:

C:\Program Files\Malwarebytes' Anti-Malware\Chameleon

Install the Chameleon driver by doing the following:

Press the Windows key + R and in the Run box, copy and paste the following command then press Enter.

"%programfiles%\Malwarebytes' Anti-Malware\Chameleon/mbam-chameleon.com" /o

A black DOS prompt will appear with a prompt to press any key to continue, please do.

Execute ComboFix.exe by doubleclicking on it

Let me know, MrC

carolinanewbe · May 29, 2012

MrC

Combofix still will not run in regular or safe mode

Also I cant locate the driver for the new hardware found

the computers says it is an UNKNOWN hardware ???

See attachment

MrCharlie · May 30, 2012

Will worry about the hardware later.

Did you run it from the Chameleon folder as outlined??

MrC

carolinanewbe · May 30, 2012

MrC

i copy and pasted to chameleon folder

was i supposed to click on the combofix icon on the desktop or the combofix icon in the chameleon folder ?

MrCharlie · May 30, 2012

In the In the Chameleon folder, you should only have one copy of ComboFix on the computer and it should be in the Chameleon folder.

Use Cut and Paste, not Copy and Paste. (sorry my mistake)

----------------------------

Here's the instructions again:

Delete any ComboFix you have now.

Download a fresh copy to your desktop

Cut and paste ComboFix.exe into Malwarebytes Chameleon folder:

C:\Program Files\Malwarebytes' Anti-Malware\Chameleon

Install the Chameleon driver by doing the following:

Press the Windows key + R and in the Run box, copy and paste the following command then press Enter.

"%programfiles%\Malwarebytes' Anti-Malware\Chameleon/mbam-chameleon.com" /o

A black DOS prompt will appear with a prompt to press any key to continue, please do until the Dos prompt disappears.

Execute ComboFix.exe by doubleclicking on it in the Chameleon folder.

See if it runs.

Let me know, MrC

carolinanewbe · May 30, 2012

MrC

the last sentence in the first directions was to just click on the icon so I assumed it ment the desktop one

Gonna try it from the chameleon folder and will update you then

Bobby

carolinanewbe · May 30, 2012

MrC

still a no go from safe mode or regular mode

and I ran it from chameleon folder

MrCharlie · May 30, 2012

How far does it get and what does it do?? MrC

carolinanewbe · May 30, 2012

MrC

It does the make a restore pointand it will run for approx 1 minute the HD indicator light stop blinking and thats it

If you like I can record it with my cellphone and send it to you ?

carolinanewbe · May 30, 2012

MrC

Here is a video from my cellphone

MrCharlie · May 30, 2012

OK, that was very good. Let me see what I can find out from the creator of ComboFix.

MrC

MrCharlie · May 31, 2012

Please do this:

Delete any copies of ComboFix that's on the computer.

Download a fresh copy of ComboFix to your desktop

Go to Start > Run > copy and paste this in and click OK:

"%userprofile%\desktop\combofix.exe" /nombr

See if ComboFix runs, MrC

carolinanewbe · May 31, 2012

MrC

SUCCESS !!!!!!!!!!!!!!!!!

ComboFix 12-05-31.02 - bobby 05/31/2012 11:25:35.1.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1537 [GMT -4:00]

Running from: c:\documents and settings\bobby\desktop\combofix.exe

Command switches used :: /nombr

AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

AV: PC Cleaners *Disabled/Updated* {737A8864-C2D9-4337-B49A-B5E35815B9BB}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\TEMP

c:\documents and settings\All Users\Application Data\TEMP\{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}\PostBuild.exe

c:\documents and settings\All Users\Application Data\TEMP\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}\PostBuild.exe

c:\documents and settings\bobby\Application Data\Remote

c:\documents and settings\bobby\Application Data\Remote\kkjt

c:\documents and settings\bobby\ntuser.tmp

c:\documents and settings\bobby\Recent\Thumbs.db

c:\documents and settings\bobby\torangcomz_query_list.txt

c:\documents and settings\bobby\WINDOWS

c:\program files\Downloaded Installers

c:\program files\Keyword Search

c:\program files\Keyword Search\uninstall.exe

c:\program files\Search Toolbar

c:\program files\Search Toolbar\icon.ico

c:\program files\Search Toolbar\Thumbs.db

C:\Thumbs.db

c:\windows\EventSystem.log

c:\windows\iun6002.exe

c:\windows\system32\config\systemprofile\torangcomz_query_list.txt

c:\windows\system32\dllcache\dlimport.exe

c:\windows\system32\drivers\etc\hosts.txt

c:\windows\system32\regobj.dll

c:\windows\system32\setup.ini

c:\windows\system32\system

c:\windows\system32\Thumbs.db

.

((((((((((((((((((((((((( Files Created from 2012-04-28 to 2012-05-31 )))))))))))))))))))))))))))))))

.

2012-05-31 15:22 . 2012-05-31 15:22 56200 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{020BAC29-2B09-42E7-A4CF-6AD7A06A7553}\offreg.dll

2012-05-31 14:59 . 2012-05-31 14:59 29904 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{020BAC29-2B09-42E7-A4CF-6AD7A06A7553}\MpKsle9a53fbc.sys

2012-05-31 11:48 . 2012-05-08 16:40 6737808 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{020BAC29-2B09-42E7-A4CF-6AD7A06A7553}\mpengine.dll

2012-05-30 15:37 . 2012-05-08 16:40 6737808 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2012-05-29 19:44 . 2012-05-29 19:44 32072 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys

2012-05-29 19:32 . 2012-05-29 19:32 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2012-05-29 19:32 . 2012-04-04 19:56 22344 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-05-28 16:11 . 2012-05-28 16:11 -------- d-----w- C:\_OTL

2012-05-28 13:40 . 2012-05-28 13:40 -------- d-----w- c:\program files\Mozilla Maintenance Service

2012-05-27 20:52 . 2012-05-27 20:52 -------- d-----w- C:\!KillBox

2012-05-27 18:11 . 2012-05-27 18:11 -------- d-----w- c:\program files\Common Files\Software Update Utility

2012-05-27 18:11 . 2012-05-27 18:11 -------- d-----w- c:\program files\VirusTotalUploader2

2012-05-27 16:46 . 2012-05-27 16:46 -------- d-----w- c:\windows\system32\wbem\Repository

2012-05-26 10:58 . 2012-05-26 10:58 -------- d-----w- c:\documents and settings\bobby\Local Settings\Application Data\fontconfig

2012-05-26 10:58 . 2012-05-30 10:05 -------- d-----w- c:\documents and settings\bobby\.gimp-2.8

2012-05-26 10:58 . 2012-05-26 10:58 -------- d-----w- c:\documents and settings\bobby\Local Settings\Application Data\gegl-0.2

2012-05-26 10:46 . 2012-05-26 10:48 -------- d-----w- c:\program files\GIMP 2

2012-05-22 06:26 . 2012-05-22 06:26 -------- d-----w- c:\windows\system32\BWKDLogs

2012-05-22 06:17 . 2012-05-22 14:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Kodak

2012-05-22 02:58 . 2012-05-22 02:58 -------- d-----w- c:\program files\ESET

2012-05-20 15:12 . 2012-05-20 15:12 388096 ----a-r- c:\documents and settings\bobby\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2012-05-20 05:39 . 2012-05-20 05:39 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Adobe

2012-05-20 05:30 . 2012-05-20 05:30 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla

2012-05-19 21:19 . 2012-05-19 21:20 -------- d-----w- c:\program files\ERUNT

2012-05-19 07:35 . 2012-05-20 15:12 -------- d-----w- c:\program files\trend micro

2012-05-19 07:35 . 2012-05-19 07:41 -------- d-----w- C:\rsit

2012-05-12 01:03 . 2012-05-12 01:04 5405696 ----a-w- C:\CraigsPal_FREE_v4.7.7_win.msi

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-05-05 18:52 . 2012-04-10 10:27 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-05-05 18:52 . 2011-07-20 13:38 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-04-11 13:12 . 2004-08-04 12:00 1862272 ----a-w- c:\windows\system32\win32k.sys

2012-04-11 13:10 . 2004-08-04 12:00 2192640 ----a-w- c:\windows\system32\ntoskrnl.exe

2012-04-11 12:35 . 2004-08-03 22:59 2069120 ----a-w- c:\windows\system32\ntkrnlpa.exe

2012-03-21 00:44 . 2010-10-25 01:25 171064 ----a-w- c:\windows\system32\drivers\MpFilter.sys

2012-04-21 01:19 . 2012-05-28 13:40 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Search Protection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-23 111856]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-12-27 39408]

"Akamai NetSession Interface"="c:\documents and settings\bobby\Local Settings\Application Data\Akamai\netsession_win.exe" [2012-05-08 3331872]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-23 111856]

"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-02-11 61440]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]

"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-1-21 65588]

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKLM\~\startupfolder\C:^Documents and Settings^bobby^Start Menu^Programs^Startup^ERUNT AutoBackup.lnk]

path=c:\documents and settings\bobby\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk

backup=c:\windows\pss\ERUNT AutoBackup.lnkStartup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X1100 Series]

2003-08-19 15:43 57344 ----a-w- c:\program files\Lexmark X1100 Series\lxbkbmgr.exe

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\ATCS Monitor\\atcsmon.exe"=

"c:\\Program Files\\EA GAMES\\Battlefield 2 Demo\\BF2.exe"=

"c:\\WINDOWS\\system32\\LEXPPS.EXE"=

"c:\\Documents and Settings\\bobby\\Local Settings\\Application Data\\Akamai\\netsession_win.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"1043:TCP"= 1043:TCP:Akamai NetSession Interface

"5000:UDP"= 5000:UDP:Akamai NetSession Interface

.

R0 49653952;49653952 Boot Guard Driver;c:\windows\system32\drivers\49653952.sys [10/26/2010 12:57 AM 37392]

R0 85656582;85656582 Boot Guard Driver;c:\windows\system32\drivers\85656582.sys [11/2/2010 3:45 AM 37392]

R1 49653951;49653951;c:\windows\system32\drivers\49653951.sys [10/26/2010 12:57 AM 128016]

R1 85656581;85656581;c:\windows\system32\drivers\85656581.sys [11/2/2010 3:45 AM 128016]

R1 MpKsle9a53fbc;MpKsle9a53fbc;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{020BAC29-2B09-42E7-A4CF-6AD7A06A7553}\MpKsle9a53fbc.sys [5/31/2012 10:59 AM 29904]

R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [10/23/2010 10:42 AM 98392]

R2 nlsX86cc;NLS Service;c:\windows\system32\NLSSRV32.EXE [3/21/2011 11:17 AM 68928]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 2:16 PM 130384]

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [12/27/2009 4:44 PM 135664]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [4/10/2012 6:27 AM 257696]

S3 CoordinatorServiceHost;SW Distributed TS Coordinator Service;"c:\program files\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe" --> c:\program files\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe [?]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [12/27/2009 4:44 PM 135664]

S3 iteio;iteio;c:\windows\system32\drivers\ITEIO.SYS [12/20/2009 11:55 PM 3680]

S3 itsernum;itsernum Filter ÅX°Êµ{¦¡;c:\windows\system32\drivers\itsernum.sys [12/20/2009 11:55 PM 20133]

S3 KMWDKUSB;KM-WDK USB;c:\windows\system32\drivers\KMWDKUSB.sys [3/23/2010 9:20 PM 41667]

S3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys [5/29/2012 3:44 PM 32072]

S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [8/21/2008 11:49 PM 18688]

S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [8/21/2008 11:49 PM 8320]

S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [6/18/2007 8:18 PM 23680]

S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [5/28/2012 9:40 AM 129976]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 2:16 PM 753504]

S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [9/23/2005 7:01 AM 2799808]

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - MPKSLE9A53FBC

*Deregistered* - uphcleanhlp

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

Akamai REG_MULTI_SZ Akamai

.

Contents of the 'Scheduled Tasks' folder

.

2012-05-31 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-10 18:52]

.

2012-04-27 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 16:34]

.

2012-05-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-27 20:44]

.

2012-05-31 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-12-27 20:44]

.

2012-05-31 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job

- c:\program files\Microsoft Security Client\MpCmdRun.exe [2012-03-26 21:03]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.aol.com/?mtmhp=hyplogusaolp00000005

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

mSearch Bar = hxxp://www.google.com/ie

uInternet Settings,ProxyOverride = <local>

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

TCP: DhcpNameServer = 192.168.1.1

FF - ProfilePath - c:\documents and settings\bobby\Application Data\Mozilla\Firefox\Profiles\dc8h00v4.default\

.

- - - - ORPHANS REMOVED - - - -

.

HKCU-Run-ATI Launchpad - c:\program files\ATI Multimedia\main\launchpd.exe

MSConfigStartUp-SUPERAntiSpyware - c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe

AddRemove-jv16 PowerTools 2010 - c:\program files\jv16 PowerTools 2010\Uninstall\uninstall.exe

AddRemove-Keyword Search - c:\program files\Keyword Search\uninstall.exe

AddRemove-KLiteCodecPack_is1 - c:\program files\K-Lite Codec Pack\unins000.exe

AddRemove-Nvidia Omega Drivers for Windows 2k-XPv1.4523a - c:\windows\iun6002.exe

AddRemove-PlayItAll media player - c:\program files\PlayItAll\uninstall.exe

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2012-05-31 11:33

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\S-1-5-21-1935655697-412668190-682003330-1003\Software\Microsoft\SystemCertificates\AddressBook*]

@Allowed: (Read) (RestrictedCode)

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Reinstall\ÓtÐ¶þ* ]

"DisplayName"=""

"DeviceDesc"=""

"ProviderName"=""

"MFG"="?????"

"ReinstallString"="??\01"

"DeviceInstanceIds"=multi:"09236.inf\00"

.

[HKEY_LOCAL_MACHINE\System\ControlSet003\Enum\KMWDKUSB\KyoceraFS-1920\6&22a94af6&0&KMWDKUSB]

@Denied: (C D) (Everyone)

"DeviceDesc"="Kyocera FS-1920"

"LocationInformation"="KMUSB001"

"Capabilities"=dword:000000c0

"ConfigFlags"=dword:00000000

"HardwareID"=multi:"KMWDKUSB\\KyoceraFS-1920AF68\00\00"

"CompatibleIDs"=multi:"KyoceraFS-1920AF68\00\00"

"Class"="Printer"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(656)

c:\windows\system32\Ati2evxx.dll

.

Completion time: 2012-05-31 11:35:54

ComboFix-quarantined-files.txt 2012-05-31 15:35

.

Pre-Run: 10,821,713,920 bytes free

Post-Run: 10,766,057,472 bytes free

.

- - End Of File - - 6ECF67693626EAD670E445FA2D4D0B82

MrCharlie · May 31, 2012

Great

ComboFix log looks OK....

Please Update and run a Quick Scan with MBAM, post the report.

Make sure that everything is checked, and click Remove Selected.

Please let me know how it is, MrC

carolinanewbe · May 31, 2012

MrC

Wonder what was causing combofix not to run ?

MBAM scan

Malwarebytes Anti-Malware 1.61.0.1400

www.malwarebytes.org

Database version: v2012.05.31.04

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 6.0.2900.5512

bobby :: HOTROD [administrator]

5/31/2012 12:56:26 PM

mbam-log-2012-05-31 (12-56-26).txt

Scan type: Quick scan

Scan options disabled: P2P

Objects scanned: 248121

Time elapsed: 6 minute(s), 44 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

MrCharlie · May 31, 2012

It didn't like your master boot record, we ran it so ComboFix wouldn't check it:

Command switches used :: /nombr

How is the computer running now??

MrC

carolinanewbe · May 31, 2012

MrC

Computer is running fine no more recommended popups

its still trying to upload driver for new found unknown hardware but I believe it is coming from a Kodak easy share camera printer dock

that I attached 1 time then deleted it .

%$&@ recomended for you pop up !

Recommended Posts

Link to post

Share on other sites

Top Posters In This Topic

Popular Days

Top Posters In This Topic

Popular Days

Posted Images

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information