deathtospyware Posted March 11, 2009 ID:63433 Share Posted March 11, 2009 Malwarebytes' Anti-Malware 1.34Database version: 1833Windows 5.1.2600 Service Pack 33/10/2009 10:59:28 PMmbam-log-2009-03-10 (22-59-12).txtScan type: Quick ScanObjects scanned: 77025Time elapsed: 5 minute(s), 24 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 1Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:C:\WINDOWS\system32\config\AppEvent.Evt (Rootkit.Agent.H) -> No action taken.And I'm pretty sure it belongs there. Of course I could be wrong, have been before. Scan with Avira came up clean so I'm wondering what is going on. If need be I can post a HJT log in the appropriate forum. Thanks guys. Link to post Share on other sites More sharing options...
Fatdcuk Posted March 11, 2009 ID:63435 Share Posted March 11, 2009 Hi,The flag by MBAM is heuristic(.h) for the Rootkit Nulprot/Saturn.Please upload your copy of this file to Virustotal for 39 second opinions http://www.virustotal.com/Please post back a link yo the scan result page.Thanks in advance Link to post Share on other sites More sharing options...
deathtospyware Posted March 11, 2009 Author ID:63575 Share Posted March 11, 2009 Well I tried to do that but the file wouldn't upload. Tried to copy it to a USB drive to upload on different PC, received CRC error. Maybe time to CHKDSK, the originial infection determined and cleaned by MBAM was the Zlob trojan. By the time I received the PC the user had managed to mangle several other programs while trying to clean their PC. If I can get the file to copy I'll try again to upload. Link to post Share on other sites More sharing options...
deathtospyware Posted March 11, 2009 Author ID:63580 Share Posted March 11, 2009 Looks like I may not get that file. CHKDSK has had to do major fixes, including on that file. Could it be the file corruption caused the flagging? Anyway I think it is nothing to be concerned about at this time. Thanks for the help and I'll add that site above to my favorites for future use. Link to post Share on other sites More sharing options...
Fatdcuk Posted March 11, 2009 ID:63582 Share Posted March 11, 2009 Ok thanks for the update,Please post back again if MBAM still makes the same flag on the same file again Link to post Share on other sites More sharing options...
deathtospyware Posted March 11, 2009 Author ID:63586 Share Posted March 11, 2009 Will do, may not be today as I have to leave for a while. Again thanks for the help and the site info. One thing that bothers me though is CHKDSK also found errors on certain .ini and .bat files that I have seen flagged by MBAM before. Once CHKDSK finished I'm going to scan again with MBAM just to be safe. Link to post Share on other sites More sharing options...
deathtospyware Posted March 11, 2009 Author ID:63604 Share Posted March 11, 2009 Final results after CHKDSK run, system clean. No infections found by MBAM. So I'm guessing it was the corruption that caused the flagging. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now