tanner775 Posted December 23, 2009 ID:174328 Share Posted December 23, 2009 Hello -Malwarebytes program will not start, I think I have a malware defense infected on my PC.Can I please get help?Thanks Link to post Share on other sites More sharing options...
tanner775 Posted December 23, 2009 Author ID:174347 Share Posted December 23, 2009 I found out it is a Rootkit.TDSS.I need help identifying the CLB driver, I attached a rootrepeal report.Thanks,Tannerrootrepeal_report.txt Link to post Share on other sites More sharing options...
tanner775 Posted December 23, 2009 Author ID:174350 Share Posted December 23, 2009 ROOTREPEAL © AD, 2007-2009==================================================Scan Start Time: 2009/12/22 20:46Program Version: Version 1.3.5.0Windows Version: Windows XP Media Center Edition SP3==================================================Hidden/Locked Files-------------------Path: C:\hiberfil.sysStatus: Locked to the Windows API!Path: C:\WINDOWS\Temp\H8SRTae51.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\system32\H8SRTbyqvrorkex.dllStatus: Invisible to the Windows API!Path: C:\WINDOWS\system32\H8SRTfaoylgmyqv.dllStatus: Invisible to the Windows API!Path: C:\WINDOWS\system32\H8SRTjixbejgflx.datStatus: Invisible to the Windows API!Path: C:\Documents and Settings\Owner\Cookies\indexCA88N4E4.htmStatus: Locked to the Windows API!Path: C:\WINDOWS\system32\drivers\H8SRTbwwowiltlw.sysStatus: Invisible to the Windows API!Path: C:\Documents and Settings\Owner\Local Settings\Temp\H8SRT4ac8.tmpStatus: Invisible to the Windows API!Path: C:\Documents and Settings\Owner\Local Settings\Temp\jar_cache7290791842294637896.tmpStatus: Locked to the Windows API!==EOF== Link to post Share on other sites More sharing options...
Staff screen317 Posted December 27, 2009 Staff ID:175642 Share Posted December 27, 2009 Hello and welcome to Malwarebytes.please visit this webpage for instructions for running ComboFix: http://www.bleepingcomputer.com/combofix/how-to-use-combofixWhen the tool is finished, it will produce a report for you.Please post the C:\ComboFix.txt along with a new HijackThis log so we may continue cleaning the system.-screen317 Link to post Share on other sites More sharing options...
Staff screen317 Posted January 20, 2010 Staff ID:186731 Share Posted January 20, 2010 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts