Antivirus Live Platinum

[mwhater]

Hi, I'd like more experienced folks than I to take a look at my story and my logs and tell me what my next steps are, and the likelihood of continuing infection.

Yesterday, a friend brought over her laptop for me to look at (being her pc geek), saying that she'd thought she was infected. (things like no access to add/remove progs, properties, etc.)

I started it up in safemode and tried to install mbam. It wouldn't take, complaining of errors like, code 2, 700 and 703 or 707. I figured to rename the executable, and copied over the updated program files mbam folder from a good pc. Still didn't work. I was able to run system restore, and found a restore point from last month (didn't realize that that wasn't an accepted practice). Still couldn't run it. I ran rkill, and the only thing it showed was it's own exe. (TBH, I don't recall the order of all the steps I took and variations i tried.) Finally I dled the randomly named exe and placed it in the program files folder... and then I was able to run mbam. It was able to remove about 33 infections, iirc. Then I ran HJT, and cleared out 3 items ided by hijackthis.de's tool. I reran mbam again, to see the effect. It showed no infections.

I noticed that her AV program was Antivirus Live Platinum, which I hadn't heard of and was suspicious about. She says she thinks she bought it (sigh). I think this is a rogue spyware program (99% sure.) Can you confirm? And if so, can you tell me if it's safe to run its uninstaller, or else how I should castrate and remove it?

Also, no offense, but I don't believe MBAM when it says it's clean now. Generally, I'd tell her to reformat and reinstall to be sure of a clean pc (and then use a real AV program.)

But just in case, I've followed the recommended general instructions and will post results of the tools shown.

Defogger has disabled any drive emulations

DDS found the following (and attached):

DDS (Ver_09-12-01.01) - NTFSx86

Run by Becca at 23:34:09.37 on Thu 02/11/2010

Internet Explorer: 6.0.2900.5512

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.702.389 [GMT -8:00]

AV: Antivirus Live *On-access scanning enabled* (Outdated) {B316C67E-09F1-44c7-85E0-94F6DA8A4AA1}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\acs.exe

svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

C:\WINDOWS\system32\DVDRAMSV.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

c:\TOSHIBA\IVP\swupdate\swupdtmr.exe

C:\Program Files\Canon\CAL\CALMAIN.exe

C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe

C:\PROGRA~1\SBCLIG~1\SMARTB~1\MotiveSB.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\V0470Mon.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Documents and Settings\Becca\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.hotmail.com/

uSearch Bar = hxxp://www.google.com/ie

uSearch Page = hxxp://www.google.com

mDefault_Page_URL = hxxp://www.toshibadirect.com/dpdstart

mDefault_Search_URL = hxxp://www.google.com/ie

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

mSearchAssistant = hxxp://www.google.com/ie

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: {A26503FE-B3B8-4910-A9DC-9CBD25C6B8D6} - No File

EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background

uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe

uRun: [Creative Live! Cam Manager] "c:\program files\creative\creative live! cam\live! cam manager\CTLCMgr.exe"

mRun: [CFSServ.exe] CFSServ.exe -NoClient

mRun: [Motive SmartBridge] c:\progra~1\sbclig~1\smartb~1\MotiveSB.exe

mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [V0470Mon.exe] c:\windows\V0470Mon.exe

StartupFolder: c:\docume~1\becca\startm~1\programs\startup\produc~1.lnk - c:\program files\common files\logishrd\ereg\setpoint\eReg.exe

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL

IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll

DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab

DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab

DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} - hxxps://webdl.symantec.com/activex/symdlmgr.cab

DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15110/CTPID.cab

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Notify: AtiExtEvent - Ati2evxx.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

============= SERVICES / DRIVERS ===============

R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [2005-3-31 211200]

S3 VF0470Vid;Live! Cam Notebook (VF0470);c:\windows\system32\drivers\V0470Vid.sys [2009-12-14 146720]

=============== Created Last 30 ================

2010-02-12 07:30:22 0 ----a-w- c:\documents and settings\becca\defogger_reenable

2010-02-11 08:26:19 0 d-----w- c:\docume~1\becca\applic~1\Malwarebytes

2010-02-11 08:26:15 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-02-11 08:26:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-02-11 08:26:13 0 d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-02-11 08:07:25 0 d-----w- c:\program files\Trend Micro

2010-02-11 07:54:37 116224 -c--a-w- c:\windows\system32\dllcache\xrxwiadr.dll

2010-02-11 07:54:32 23040 -c--a-w- c:\windows\system32\dllcache\xrxwbtmp.dll

2010-02-11 07:54:30 18944 -c--a-w- c:\windows\system32\dllcache\xrxscnui.dll

2010-02-11 07:54:25 27648 -c--a-w- c:\windows\system32\dllcache\xrxftplt.exe

2010-02-11 07:54:20 4608 -c--a-w- c:\windows\system32\dllcache\xrxflnch.exe

2010-02-11 07:54:14 99865 -c--a-w- c:\windows\system32\dllcache\xlog.exe

2010-02-11 07:54:09 16970 -c--a-w- c:\windows\system32\dllcache\xem336n5.sys

2010-02-11 07:54:07 19455 -c--a-w- c:\windows\system32\dllcache\wvchntxx.sys

2010-02-11 07:54:04 12063 -c--a-w- c:\windows\system32\dllcache\wsiintxx.sys

2010-02-11 07:54:02 8192 -c--a-w- c:\windows\system32\dllcache\wshirda.dll

2010-02-11 07:52:56 16925 -c--a-w- c:\windows\system32\dllcache\w940nd.sys

2010-02-11 07:52:51 19016 -c--a-w- c:\windows\system32\dllcache\w926nd.sys

2010-02-11 07:52:46 48256 -c--a-w- c:\windows\system32\dllcache\w32.dll

2010-02-11 07:52:46 19528 -c--a-w- c:\windows\system32\dllcache\w840nd.sys

2010-02-11 07:52:41 64605 -c--a-w- c:\windows\system32\dllcache\vvoice.sys

2010-02-11 07:52:36 397502 -c--a-w- c:\windows\system32\dllcache\vpctcom.sys

2010-02-11 07:52:31 604253 -c--a-w- c:\windows\system32\dllcache\vmodem.sys

2010-02-11 07:52:26 249402 -c--a-w- c:\windows\system32\dllcache\vinwm.sys

2010-02-11 07:52:21 24576 -c--a-w- c:\windows\system32\dllcache\viairda.sys

2010-02-11 07:52:19 5376 -c--a-w- c:\windows\system32\dllcache\viaide.sys

2010-02-11 07:52:13 687999 -c--a-w- c:\windows\system32\dllcache\usrwdxjs.sys

2010-02-11 07:52:08 765884 -c--a-w- c:\windows\system32\dllcache\usrti.sys

2010-02-11 07:52:03 113762 -c--a-w- c:\windows\system32\dllcache\usrpda.sys

2010-02-11 07:50:59 50176 -c--a-w- c:\windows\system32\dllcache\umaxp60.dll

2010-02-11 07:49:56 42496 -c--a-w- c:\windows\system32\dllcache\tp4res.dll

2010-02-11 07:48:58 30464 -c--a-w- c:\windows\system32\dllcache\tbatm155.sys

2010-02-11 07:48:52 7040 -c--a-w- c:\windows\system32\dllcache\tandqic.sys

2010-02-11 07:48:48 36640 -c--a-w- c:\windows\system32\dllcache\t2r4mini.sys

2010-02-11 07:48:44 172768 -c--a-w- c:\windows\system32\dllcache\t2r4disp.dll

2010-02-11 07:48:38 32640 -c--a-w- c:\windows\system32\dllcache\symc8xx.sys

2010-02-11 07:48:34 16256 -c--a-w- c:\windows\system32\dllcache\symc810.sys

2010-02-11 07:48:29 30688 -c--a-w- c:\windows\system32\dllcache\sym_u3.sys

2010-02-11 07:48:25 28384 -c--a-w- c:\windows\system32\dllcache\sym_hi.sys

2010-02-11 07:48:21 94293 -c--a-w- c:\windows\system32\dllcache\sxports.dll

2010-02-11 07:48:16 103936 -c--a-w- c:\windows\system32\dllcache\sx.sys

2010-02-11 07:48:12 3968 -c--a-w- c:\windows\system32\dllcache\swusbflt.sys

2010-02-11 07:48:08 10240 -c--a-w- c:\windows\system32\dllcache\swpidflt.dll

2010-02-11 07:48:04 10240 -c--a-w- c:\windows\system32\dllcache\swpdflt2.dll

2010-02-11 07:46:57 37040 -c--a-w- c:\windows\system32\dllcache\sonypi.sys

2010-02-11 07:45:55 33792 -c--a-w- c:\windows\system32\dllcache\smb0w.dll

2010-02-11 07:44:57 18944 -c--a-w- c:\windows\system32\dllcache\simptcp.dll

2010-02-11 07:43:58 23936 -c--a-w- c:\windows\system32\dllcache\sccmusbm.sys

2010-02-11 07:42:57 65664 -c--a-w- c:\windows\system32\dllcache\s3legacy.sys

2010-02-11 07:41:57 899146 -c--a-w- c:\windows\system32\dllcache\r2mdkxga.sys

2010-02-11 07:40:57 16128 -c--a-w- c:\windows\system32\dllcache\pscr.sys

2010-02-11 07:39:58 86016 -c--a-w- c:\windows\system32\dllcache\pctspk.exe

2010-02-11 07:38:57 48000 -c--a-w- c:\windows\system32\dllcache\ovcam2.sys

2010-02-11 07:37:55 32840 -c--a-w- c:\windows\system32\dllcache\ngrpci.sys

2010-02-11 07:36:59 7168 -c--a-w- c:\windows\system32\dllcache\mxport.dll

2010-02-11 07:35:57 16128 -c--a-w- c:\windows\system32\dllcache\modemcsa.sys

2010-02-11 07:34:58 606684 -c--a-w- c:\windows\system32\dllcache\ltmdmnt.sys

2010-02-11 07:33:58 23552 -c--a-w- c:\windows\system32\dllcache\irmk7.sys

2010-02-11 07:32:59 38528 -c--a-w- c:\windows\system32\dllcache\ibmvcap.sys

2010-02-11 07:31:59 115807 -c--a-w- c:\windows\system32\dllcache\hsf_fsks.sys

2010-02-11 07:30:59 83968 -c--a-w- c:\windows\system32\dllcache\hpgt21.dll

2010-02-11 07:29:57 27165 -c--a-w- c:\windows\system32\dllcache\fetnd5.sys

2010-02-11 07:28:58 51200 -c--a-w- c:\windows\system32\dllcache\eqnlogr.exe

2010-02-11 07:27:57 28062 -c--a-w- c:\windows\system32\dllcache\dp83820.sys

2010-02-11 07:26:59 86016 -c--a-w- c:\windows\system32\dllcache\dc240usd.dll

2010-02-11 07:25:56 272640 -c--a-w- c:\windows\system32\dllcache\cinemclc.sys

2010-02-11 07:24:59 2944 -c--a-w- c:\windows\system32\dllcache\brfilt.sys

2010-02-11 07:23:43 66048 -c--a-w- c:\windows\system32\dllcache\s3legacy.dll

2010-02-11 06:31:00 0 d-----w- c:\windows\system32\wbem\Repository

2010-02-11 05:54:30 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes

2010-02-10 01:36:53 0 d-----w- c:\program files\schtml

2010-02-10 01:24:02 56 ----a-w- c:\program files\wp4.dat

2010-02-10 01:24:02 36 ----a-w- c:\program files\skynet.dat

2010-02-10 01:24:02 3 ----a-w- c:\program files\wp3.dat

2010-01-19 04:06:40 0 d-----w- c:\program files\Antivirus Live Platinum

2010-01-19 04:06:40 0 d-----w- C:\avlog

==================== Find3M ====================

2009-12-14 19:15:14 2146304 ----a-w- c:\windows\system32\GPhotos.scr

2009-11-22 21:19:50 411368 ----a-w- c:\windows\system32\deploytk.dll

============= FINISH: 23:34:43.39 ===============

GMER is Running now. I'll post back with those results and another MBAM and HJT log later.

Again, recall that she has this antivirus live platinum installed, and I'd like to know how to uninstall it.

MBAM results from previous test (this AM):

Malwarebytes' Anti-Malware 1.44

Database version: 3458

Windows 5.1.2600 Service Pack 3

Internet Explorer 6.0.2900.5512

2/11/2010 6:42:36 AM

mbam-log-2010-02-11 (06-42-32).txt

Scan type: Full Scan (C:\|E:\|)

Objects scanned: 204772

Time elapsed: 43 minute(s), 43 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 22

Registry Values Infected: 1

Registry Data Items Infected: 1

Folders Infected: 0

Files Infected: 9

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CLASSES_ROOT\solution.solution (Trojan.BHO) -> No action taken.

HKEY_CLASSES_ROOT\solution.solution.1 (Trojan.BHO) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{892b2785-b0d0-4aa2-ae6a-0ed60b00a979} (Trojan.BHO) -> No action taken.

HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> No action taken.

HKEY_CLASSES_ROOT\AppID\{e81cf86b-f683-422a-b742-3f2427ea9d6a} (Trojan.BHO) -> No action taken.

HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> No action taken.

HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> No action taken.

HKEY_CLASSES_ROOT\Typelib\{00476c87-a276-49bf-86bc-ff005732430b} (Trojan.BHO) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6fd31ed6-7c94-4bbc-8e95-f927f4d3a949} (Adware.180Solutions) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{99c6d1bb-7555-474c-91da-d8fb62a9cc75} (Trojan.BHO) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\AvScan (Trojan.FakeAlert) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> No action taken.

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{90b8b761-df2b-48ac-bbe0-bcc03a819b3b} (Adware.Zango) -> No action taken.

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Documents and Settings\Becca\Local Settings\Temporary Internet Files\Content.IE5\F9LORT73\PC_protect[1].exe (Rogue.WindowsPolicePro) -> No action taken.

C:\Documents and Settings\Becca\Local Settings\Temporary Internet Files\Content.IE5\GVDFQ2F5\htmlayout[1].dat (Spyware.OnlineGames) -> No action taken.

C:\Program Files\Antivirus Live Platinum\htmlayout.dll (Spyware.OnlineGames) -> No action taken.

C:\System Volume Information\_restore{F6221601-BABC-4B69-922D-F7E899FB13E9}\RP275\A0045936.exe (Rogue.WindowsPolicePro) -> No action taken.

C:\System Volume Information\_restore{F6221601-BABC-4B69-922D-F7E899FB13E9}\RP275\A0045942.dll (Rogue.ASCAntiSpyware) -> No action taken.

C:\System Volume Information\_restore{F6221601-BABC-4B69-922D-F7E899FB13E9}\RP276\A0046048.dll (Rogue.ASCAntiSpyware) -> No action taken.

C:\System Volume Information\_restore{F6221601-BABC-4B69-922D-F7E899FB13E9}\RP276\A0046059.exe (Rogue.WindowsPolicePro) -> No action taken.

C:\WINDOWS\system32\01Ol76ak.exe.a_a (Trojan.Agent) -> No action taken.

C:\WINDOWS\system32\2U8F5VcA.exe.a_a (Trojan.Agent) -> No action taken.

I'm not sure why it shows no action taken, but it was early and I was tired so I might have mistakenly done nothing.

Til later, TIA.

Attach.txt

[screen317]

Hi and welcome to Malwarebytes.

Do you still need help?

[screen317]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!