Jump to content

Log after scanning with Malwarebytes first quick scan

nadim

By nadim
in Resolved Malware Removal Logs

 Share

Recommended Posts

nadim

nadim

Posted
Posted

Here is my log file after quick scan

Malwarebytes' Anti-Malware 1.34

Database version: 1749

Windows 5.1.2600 Service Pack 3

3/13/2009 12:15:14 AM

mbam-log-2009-03-13 (00-14-56).txt

Scan type: Quick Scan

Objects scanned: 87894

Time elapsed: 16 minute(s), 33 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 5

Registry Values Infected: 5

Registry Data Items Infected: 0

Folders Infected: 3

Files Infected: 11

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c9c42510-9b21-41c1-9dcd-8382a2d07c61} (Trojan.Vundo.H) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{c9c42510-9b21-41c1-9dcd-8382a2d07c61} (Trojan.Vundo.H) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{6e780f0b-bcd6-40cb-b2db-7af47ab4d4a4} (Adware.Coupons) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{a138be8b-f051-4802-9a3f-a750a6d862d4} (Adware.Coupons) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{a85a5e6a-de2c-4f4e-99dc-f469df5a0eec} (Adware.Coupons) -> No action taken.

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bf (Trojan.Agent) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk (Trojan.Agent) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\iu (Trojan.Agent) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> No action taken.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

C:\Documents and Settings\family\Application Data\MalwareRemovalBot (Rogue.MalwareRemovalBot) -> No action taken.

C:\Documents and Settings\family\Application Data\MalwareRemovalBot\Log (Rogue.MalwareRemovalBot) -> No action taken.

C:\Documents and Settings\family\Application Data\MalwareRemovalBot\Settings (Rogue.MalwareRemovalBot) -> No action taken.

Files Infected:

C:\WINDOWS\SYSTEM32\iehelper.dll (Trojan.Vundo.H) -> No action taken.

C:\WINDOWS\SYSTEM32\iehelper.dll.ren (Trojan.Vundo.H) -> No action taken.

C:\Documents and Settings\family\Application Data\MalwareRemovalBot\rs.dat (Rogue.MalwareRemovalBot) -> No action taken.

C:\Documents and Settings\family\Application Data\MalwareRemovalBot\Log\2009 Mar 10 - 09_01_58 PM_921.log (Rogue.MalwareRemovalBot) -> No action taken.

C:\Documents and Settings\family\Application Data\MalwareRemovalBot\Log\2009 Mar 10 - 09_02_03 PM_734.log (Rogue.MalwareRemovalBot) -> No action taken.

C:\Documents and Settings\family\Application Data\MalwareRemovalBot\Log\2009 Mar 10 - 09_03_08 PM_703.log (Rogue.MalwareRemovalBot) -> No action taken.

C:\Documents and Settings\family\Application Data\MalwareRemovalBot\Log\2009 Mar 10 - 10_25_43 PM_390.log (Rogue.MalwareRemovalBot) -> No action taken.

C:\Documents and Settings\family\Application Data\MalwareRemovalBot\Settings\IgnoreList.stg (Rogue.MalwareRemovalBot) -> No action taken.

C:\Documents and Settings\family\Application Data\MalwareRemovalBot\Settings\ScanResults.pie (Rogue.MalwareRemovalBot) -> No action taken.

C:\WINDOWS\system32\uacinit.dll (Trojan.Agent) -> No action taken.

C:\WINDOWS\sysguard.exe (Trojan.FakeAlert) -> No action taken.

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Please update MBAM and select to FIX it, you chose not to fix it.

YOUR VERSION

Malwarebytes' Anti-Malware 1.34

Database version: 1749

CURRENT VERSION

Malwarebytes' Anti-Malware 1.34

Database version: 1842

Update and Scan with Malwarebytes' Anti-Malware

  • Start MalwareBytes AntiMalware (Vista users must Right click and choose RunAs Admin)
  • Please DO NOT run MBAM in Safe Mode unless requested to, you MUST run it in normal Windows mode.
    • Update Malwarebytes' Anti-Malware
    • Select the Update tab
    • Click Update

    [*]When the update is complete, select the Scanner tab

    [*]Select Perform quick scan, then click Scan.

    [*]When the scan is complete, click OK, then Show Results to view the results.

    [*]Be sure that everything is checked, and click Remove Selected.

    [*]When completed, a log will open in Notepad. please copy and paste the log into your next reply

    • If you accidently close it, the log file is saved here and will be named like this:
    • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Then post back the MBAM log and a new Hijackthis log.

Link to post
Share on other sites
nadim

nadim

Posted
  • Author
Posted

I quick scan my computer after the update. It clean up a lot. I can access internet via firefox only. My internet explorer is still not working. After clicking, it try to open it but after few seconds, it do nothing & cursor is back. Same thing when I tried to open my VPN connection.

Let me know what to do after looking at the log file below. Thanks

Malwarebytes' Anti-Malware 1.34

Database version: 1842

Windows 5.1.2600 Service Pack 3

2009-03-14 12:43:33

mbam-log-2009-03-14 (12-43-33).txt

Scan type: Quick Scan

Objects scanned: 92561

Time elapsed: 25 minute(s), 52 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 4

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\UAC (Rootkit.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bf (Trojan.Agent) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk (Trojan.Agent) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\iu (Trojan.Agent) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> Delete on reboot.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\SYSTEM32\authzt.dll (Trojan.Downloader) -> Delete on reboot.

Link to post
Share on other sites
nadim

nadim

Posted
  • Author
Posted

I ran again with current update version.

One more observation, When I own my printer. Computer stop with a blue screen with a message saying that it is shutting off to avoid any damage.

Here is the new log

Malwarebytes' Anti-Malware 1.34

Database version: 1848

Windows 5.1.2600 Service Pack 3

2009-03-14 14:16:13

mbam-log-2009-03-14 (14-16-13).txt

Scan type: Quick Scan

Objects scanned: 92741

Time elapsed: 23 minute(s), 38 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 2

Registry Values Infected: 4

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 3

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\UAC (Rootkit.Trace) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\AvScan (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bf (Trojan.Agent) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk (Trojan.Agent) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\iu (Trojan.Agent) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> Delete on reboot.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\syssvc.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\WINDOWS\SYSTEM32\authzt.dll (Trojan.Downloader) -> Delete on reboot.

C:\Documents and Settings\family\Local Settings\Temporary Internet Files\Content.IE5\GFYV6AS0\bok[1].gif (Trojan.Downloader) -> Quarantined and deleted successfully.

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

STEP 01

Please visit this webpage for instructions for downloading ComboFix to your
DESKTOP
:
how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

NOTE!!:

You must save and run
ComboFix.exe
on your DESKTOP and not from any other folder.

Also,
DO NOT
click the mouse or launch any other applications while this is running or it may stall the program

Additional links to download the tool:

Note:

The
Windows Recovery Console
will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  • Click
    Yes
    to allow ComboFix to continue scanning for malware.

  • When the tool is finished, it will produce a report for you.

  • Please post the
    C:\ComboFix.txt
    along with a
    new HijackThis log
    so we may continue cleaning the system.

STEP 02

    Please create a BOOTLOG
  • Restart the computer and press F8 when Windows start booting. This will bring up the startup options.
  • Select "Enable Boot Logging" option and press enter.
  • Windows prompts you to select a Windows Installation (even if there is only one windows installation)
  • This boots windows normally and creates a boot log named ntbtlog.txt and saves it to C:\Windows
    If you're already running inside Windows you can enable it the following way.
  • Click on START - RUN and type in MSCONFIG go to the BOOT.INI tab and place a check mark by /BOOTLOG
  • Click on OK and you will be prompted to RESTART Windows. Please do restart now.
  • After Windows restarts open the file C:\Windows\ntbtlog.txt with Notepad
  • From the Edit menu choose Select All then Edit, COPY and post that back on your next reply.
  • Note: Vista users can type in the Search and it will show on the menu, then Right click and choose Run as Adminsitrator
  • The tab is called BOOT on Vista. Then choose Boot log

STEP 03

Download
DDS
and save it to your desktop

Disable any script blocker if your Anti-Virus/Anti-Malware has it.

Once downloaded you can disconnect from the Internet and disable your Ant-Virus temporarily if needed.

Then double click
dds.scr
to run the tool.

When done, the
DDS.txt
will open.

Click Yes at the next prompt for Optional Scan.
    When done, DDS will open two (2) logs:

  1. DDS.txt
  2. Attach.txt

  • Save both reports to your desktop
  • Please include the following logs in your next reply:
    DDS.txt
    and
    Attach.txt

STEP 04

RootRepeal - Rootkit Detector

  • Please download the following tool:
    RootRepeal - Rootkit Detector
  • Direct download link is here:
    RootRepeal.rar

  • If you don't already have a program to open a .RAR compressed file you can download a trial version from here:
    WinRAR

  • Extract the program file to a new folder such as
    C:\RootRepeal

  • Run the program
    RootRepeal.exe
    and go to the
    REPORT
    tab and click on the
    Scan
    button

  • Select
    ALL
    of the checkboxes and then click
    OK
    and it will start scanning your system.

  • If you have multiple drives you only need to check the C: drive or the one Windows is installed on.

  • When done, click on
    Save Report

  • Save it to the same location where you ran it from, such as
    C:\RootRepeal

  • Save it as
    your_name_rootrepeal.txt
    - where your_name is your
    forum name

  • This makes it more easy to track who the log belongs to.

  • Then open that log and select all and copy/paste it back on your next reply please.

  • Quit the RootRepeal program.

Link to post
Share on other sites
nadim

nadim

Posted
  • Author
Posted

I have a problem running combfix file.

Combfix run until I saw the message writing log file & do not run any program. After that I got an error something like fail to open ----- & then I saw cursor blinking. I left it there for few hours & nothing happened. I finally restart it after 4 or 5 hours. It did start & I can see my desktop. I checked my c drive & was not able to find combfix.txt file. What should I do now??

It also gave me the message of succesful installation of recovery console.

thanks for the help

nadim

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Please try to run steps 2, 3, and 4 and also run this as well.

Download and install: Autoruns for Windows v9.39 from Microsoft.

When you first run it it will generate an extensive listing and the word "Ready" will appear in the bottom left of the sofware GUI.

At this point goto Options and place a check(tick) against Verify Code Signatures and Hide Microsoft & Windows Entries

Next press the F5 key on your keyboard or hit the refresh button.

Once the Ready status by software is gained then goto File and select "Export as" and save output file as Autoruns.txt

Can you please then copy and paste the contents of that text file into your next reply along with the other logs as well, for analysis.

Link to post
Share on other sites
  • 2 weeks later...
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Due to the lack of feedback this Topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

The fixes and advice in this thread are for this machine only. Do not apply the instructions from this thread to your own machine. Please start a new thread describing your issue and someone will be along to assist you.

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.