GlennK Posted September 4, 2009 ID:120240 Share Posted September 4, 2009 This appears to be an old issue that has resurfaced. Any simple way to remove it? Malwarebytes' Anti-Malware 1.40Database version: 2738Windows 5.1.2600 Service Pack 303/09/2009 8:21:03 PMmbam-log-2009-09-03 (20-21-03).txtScan type: Quick ScanObjects scanned: 103917Time elapsed: 11 minute(s), 6 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 1Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\kbiwkmrnmnenkr (Rootkit.TDSS) -> Quarantined and deleted successfully.Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected)Two scans were done. It still shows infected. Malwarebytes' Anti-Malware 1.40Database version: 2738Windows 5.1.2600 Service Pack 303/09/2009 7:52:26 PMmbam-log-2009-09-03 (19-52-26).txtScan type: Quick ScanObjects scanned: 103859Time elapsed: 11 minute(s), 36 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 1Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\kbiwkmrnmnenkr (Rootkit.TDSS) -> Quarantined and deleted successfully.Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected) Link to post Share on other sites More sharing options...
Staff miekiemoes Posted September 5, 2009 Staff ID:121079 Share Posted September 5, 2009 Hi,The malware you are dealing with locks mbams detection and removal, but next version of mbam should be able to bypass this and deal with this one. In a meanwhile, to deal with it, * Please visit this webpage for instructions for downloading and running ComboFix:http://www.bleepingcomputer.com/combofix/how-to-use-combofixPost the log from ComboFix in your next reply.Please make sure you disable ALL of your Antivirus/Antispyware/Firewall before running ComboFix..This because Security Software may see some components ComboFix uses (prep.com for example) as suspicious and blocks the tool, or even deletes it. Please visit HERE if you don't know how. Link to post Share on other sites More sharing options...
GlennK Posted September 5, 2009 Author ID:121107 Share Posted September 5, 2009 Hi, Thanks for taking a look at this. I was able to disable all spyware / antivirus but had trouble with AVG. The log is attached as per your requests. Again thanks!Regards,GlennHi,The malware you are dealing with locks mbams detection and removal, but next version of mbam should be able to bypass this and deal with this one. In a meanwhile, to deal with it, * Please visit this webpage for instructions for downloading and running ComboFix:http://www.bleepingcomputer.com/combofix/how-to-use-combofixPost the log from ComboFix in your next reply.Please make sure you disable ALL of your Antivirus/Antispyware/Firewall before running ComboFix..This because Security Software may see some components ComboFix uses (prep.com for example) as suspicious and blocks the tool, or even deletes it. Please visit HERE if you don't know how.log.txt Link to post Share on other sites More sharing options...
Staff miekiemoes Posted September 5, 2009 Staff ID:121113 Share Posted September 5, 2009 Hi,I already see now why that key in the registry was not deleted before. You are running Teatimer and Adwatch which both monitor registry changes. Mbam detected the malicious leftover in the registry and either Teatimer or Adwatch probably reversed the deletion again since they may see it as a malicious attempt. This happens all the time with removal tools if you have Teatimer or Adwatch running in the background.Anyway, Combofix bypasses Teatimer/adwatch, so the key in the registry got deleted now.* Go to start > run and copy and paste next command in the field:ComboFix /uMake sure there's a space between Combofix and /Then hit enter.This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.Let me know in your next reply how things are now. Link to post Share on other sites More sharing options...
GlennK Posted September 6, 2009 Author ID:121625 Share Posted September 6, 2009 I can't thank you enough for your help. The issue is now resolved and you can close this log. Awesome support man!!!Million Thanks,GlennHi, Thanks for taking a look at this. I was able to disable all spyware / antivirus but had trouble with AVG. The log is attached as per your requests. Again thanks!Regards,Glenn Link to post Share on other sites More sharing options...
Staff miekiemoes Posted September 6, 2009 Staff ID:121949 Share Posted September 6, 2009 Glad I could help. Please read my Prevention page with lots of info and tips how to prevent this in the future.And if you want to improve speed/system performance after malware removal, take a look here.Extra note: Make sure your programs are up to date - because older versions may contain Security Leaks. To find out what programs need to be updated, please run the Secunia Software Inspector Scan.Happy Surfing again! Link to post Share on other sites More sharing options...
Staff miekiemoes Posted September 8, 2009 Staff ID:122770 Share Posted September 8, 2009 Since this issue appears resolved ... this Topic is closed.If you need this topic reopened for continuations of existing problems, please request this by sending me a PM with the address of the thread. This applies only to the original topic starter.Everyone else please begin a New Topic. Link to post Share on other sites More sharing options...
Recommended Posts