Recurring Entry

[glonmo]

Every time I perform a full scan, the following PUP shows up despite the fact that I remove it with each scan  Should I be concerned?  Is there a way to prevent it without adversely affecting anything?

 

 

PUP.Optional. Conduit

Registry Value

 

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunBackgroundContainer

 

[AdvancedSetup]

Can you please post your log file for this.

 

Thanks

[glonmo]

I can't figure out how to copy the logs!  When I highlight and copy, there's nothing there when I click paste!

[AdvancedSetup]

You can attach the file if you like.  Please click on the "More Reply Options" button and there you can browse to the log file and attach it.

 

If you need further directions on that please let me know.

[glonmo]

As you can tell, I'm not very computer literate.  I need further directions.

[AdvancedSetup]

Open Malwarebytes Anti-Malware and then click on the LOGS tab.

Then click the Open button or double click on the log and it should open in Notepad.

 

Then you can select file Save-As to a location where you know you can find the file again.

Then here on the forum click on the button on the bottom right that says "More Reply Options"

Then you can click on the Browse button and browse to where you saved the file.  Then highlight it and click the Attach button to load it here.

 

 

 

[glonmo]

Here is the most recent.  Do you need additional?

mbam-log-2013-12-31 (04-43-51).txt

[AdvancedSetup]

No that is fine.  Let me have you run the following please.
 
Please run the following scanner and send back the logs.

Download DDS from one of the locations below and save to your Desktop
dds.scr
dds.com

Temporarily disable any script blocker if your Anti-Virus/Anti-Malware has it.
How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

Once downloaded you can disconnect from the Internet and disable your Ant-Virus temporarily if needed.
Then double click dds.scr or dds.com to run the tool.
Click the Run button if prompted with an Open File - Security Warning dialog box.
A black DOS console should open and run for a moment.

• When done, DDS will open two (2) logs:
  • DDS.txt
  • Attach.txt

• Save both reports to your desktop
• Please include the following logs in your next reply as an attachment: DDS.txt and Attach.txt
• You can ignore the note about zipping the Attach.txt file and just post it or attach it.

[glonmo]

Here are the files as attachments.

dds.txt

attach.txt

[AdvancedSetup]

Based on the Event Logs I would say the computer is infected or is having some type of software conflict issue that will require manual intervention to correct.

 

I would suggest following the advice from the topic here Available Assistance for Possibly Infected Computers and having one of the Experts assist you with looking into your issue.

 

==== Event Viewer Messages From Past Week ========.12/28/2013 10:09:08 PM, Error: Schannel [36888]  - The following fatal alert was generated: 43. The internal error state is 252.12/27/2013 6:56:19 AM, Error: Service Control Manager [7031]  - The WD Backup service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 0 milliseconds: Restart the service.1/2/2014 8:20:00 AM, Error: Microsoft-Windows-DistributedCOM [10016]  - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID  {D3DCB472-7261-43CE-924B-0704BD730D5F}  and APPID  {D3DCB472-7261-43CE-924B-0704BD730D5F}  to the user DellDesktop\Glonmo SID (S-1-5-21-2411255247-3608738926-2590239677-1000) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.1/2/2014 8:20:00 AM, Error: Microsoft-Windows-DistributedCOM [10016]  - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID  {145B4335-FE2A-4927-A040-7C35AD3180EF}  and APPID  {145B4335-FE2A-4927-A040-7C35AD3180EF}  to the user DellDesktop\Glonmo SID (S-1-5-21-2411255247-3608738926-2590239677-1000) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.1/2/2014 8:06:28 AM, Error: Schannel [36888]  - The following fatal alert was generated: 40. The internal error state is 107.1/2/2014 8:06:28 AM, Error: Schannel [36874]  - An SSL 3.0 connection request was received from a remote client application, but none of the cipher suites supported by the client application are supported by the server. The SSL connection request has failed.1/2/2014 7:07:27 AM, Error: Service Control Manager [7026]  - The following boot-start or system-start driver(s) failed to load:  PxHelp201/2/2014 7:06:57 AM, Error: Service Control Manager [7000]  - The SessionLauncher service failed to start due to the following error:  The system cannot find the file specified.1/1/2014 10:41:42 AM, Error: Service Control Manager [7034]  - The Intel(R) Rapid Storage Technology service terminated unexpectedly.  It has done this 1 time(s)..==== End Of File ===========================