mum's mbam log

[coconutnut]

after running a quick scan on my mum's laptop, this log was produced. should i quarantine all?

she is running the free version

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4174

Windows 5.1.2600 Service Pack 2

Internet Explorer 7.0.5730.11

6/7/2010 3:02:10 PM

mbam-log-2010-06-07 (15-02-10).txt

Scan type: Quick scan

Objects scanned: 126430

Time elapsed: 7 minute(s), 17 second(s)

Memory Processes Infected: 2

Memory Modules Infected: 0

Registry Keys Infected: 3

Registry Values Infected: 0

Registry Data Items Infected: 6

Folders Infected: 0

Files Infected: 18

Memory Processes Infected:

C:\WINDOWS\AppPatch\smss.exe (Worm.AutoRun) -> No action taken. [6DDD7D5F4EF7FF5CA49A7CB3FF6DFD62]

C:\WINDOWS\Help\svchost.exe (Worm.AutoRun) -> No action taken. [F3634CDE30A9E9A5961B909C1F512D11]

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\windows recycled services (Worm.AutoRun) -> No action taken. [A8B89DCAEB381BAA3E9D0C5B2BD4E9DA]

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_Windows_RECYCLED_Services (Worm.AutoRun) -> No action taken. [A856810879FB2BCB61F3BFF63D48D39F]

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\TDSSserv.sys (Rootkit.TDSS) -> No action taken. [b65ECC86DB51F2F4C516C4F17DFD2444]

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken. [DDCE48E4F4FA04EE593E673D3DA1B2EB]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken. [82410135D61B335E0D089A7D56C1A587]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken. [CEF49A219B20AFD3DF88001F7ECBE25D]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Worm.AutoRun) -> Data: c:\windows\apppatch\lsass.exe -> No action taken. [A26C77AAB083295ADB7EF6516F08C4EE]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Worm.AutoRun) -> Data: c:\windows\apppatch\smss.exe -> No action taken. [6DDD7D5F4EF7FF5CA49A7CB3FF6DFD62]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.Userinit) -> Bad: (Userinit.exe,C:\WINDOWS\AppPatch\smss.exe,C:\WINDOWS\AppPatch\lsass.exe) Good: (Userinit.exe) -> No action taken. [441C8650A7E9A632E9D6335704E077E5]

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Program Files\Common Files\Microsoft shared\MSInfo\Recycled.scr (Worm.AutoRun) -> No action taken. [A8B89DCAEB381BAA3E9D0C5B2BD4E9DA]

C:\Program Files\RRecycled.scr (Worm.AutoRun) -> No action taken. [AC23C9E0F57F3C39C58A676E6AD30D2C]

C:\WINDOWS\AppPatch\lsass.exe (Worm.AutoRun) -> No action taken. [A26C77AAB083295ADB7EF6516F08C4EE]

C:\WINDOWS\AppPatch\smss.exe (Worm.AutoRun) -> No action taken. [6DDD7D5F4EF7FF5CA49A7CB3FF6DFD62]

C:\WINDOWS\Help\nvwcipess.hlp (Malware.Trace) -> No action taken. [5504E846C87D738088A0FE039338141D]

C:\WINDOWS\Help\svchost.exe (Worm.AutoRun) -> No action taken. [F3634CDE30A9E9A5961B909C1F512D11]

C:\WINDOWS\calc32.log (Malware.Trace) -> No action taken. [b103FFF4BCC456F4E74A148751B5957B]

C:\WINDOWS\calcs.exe (Trojan.Agent) -> No action taken. [83C6833D15100124CC84E0703A27CAB5]

C:\WINDOWS\encoder.txt (Malware.Trace) -> No action taken. [2A81A089BF10BD26C693E9E07AED9ED3]

C:\WINDOWS\sndvols.exe (Trojan.Banker) -> No action taken. [F3DAA63219BBE0940DBAECAC77FBC0A1]

C:\WINDOWS\sndvols.log (Malware.Trace) -> No action taken. [CFEA7F946BDF7BCBC8A6210FBAF9C996]

C:\WINDOWS\system32\TDSSfpmp.dll (Rootkit.TDSS) -> No action taken. [E61C4D6CF3A333CD8AAB26C26FC32AF7]

C:\WINDOWS\system32\TDSSosvn.dat (Malware.Trace) -> No action taken. [92C5C82643FE9D6031578D33CCBD51B7]

C:\WINDOWS\system32\calc32.exe (Malware.Packer.Gen) -> No action taken. [0C782E9B9F379B6595614594D7C44056]

C:\WINDOWS\system32\drivers\TDSSpaxt.sys (Rootkit.Agent) -> No action taken. [1F74202F21B0525B9E61DC1EB37EEB49]

C:\WINDOWS\system32\ieupdates.exe.tmp (Trojan.Agent) -> No action taken. [5D86067D72E1D7DB47B8B876CD73E84D]

C:\WINDOWS\system32\sndvol.exe (Malware.Packer.Gen) -> No action taken. [0C782E9B9F379B6595614594D7C44056]

C:\svc.log (Malware.Trace) -> No action taken. [94ECE845F163E7A31ACCCBC8F7FD7F50]

[noknojon]

Hi -

YES - Always click on Quarantine or delete as there are some very bad agents in there -

Run a Full Scan now and delete all similar items found -

If there is still a problem you can post back and we will let the experts go over the system -

Thank You -

[coconutnut]

C:\WINDOWS\sndvols.exe

wat bout this? isnt this the volume controller?

[noknojon]

On second thoughts , I think you should get this computer checked by the experts -

Update and run the Full Scan now and then follow these instructions to have an expert get All these items out -

Please print out, read and follow the directions here, skipping any steps you are unable to complete. Then post a NEW topic here.

One of the expert helpers there will give you one-on-one assistance when one becomes available.

After posting your new post make sure under options that you select Track this topic and choose one of the Email options so that you're alerted when someone has replied to your post - Please allow at least 48 hours for a reply as the experts can get busy at times -

Also add a brief note to the experts as to your problems -

Alternatively, as a paying customer, you can contact the help desk at support@malwarebytes.org

Always use the ADD REPLY Tab at the bottom of the page when you reply -

Thank You -

[noknojon]

sndvol.exe is part of a volume exe - It can become infected and you will lose the volume -

But there are that many rootkits and (Trojan.Banker) included in the scan it is of great concern -

These infections can lock onto many .exe files that you may lose too much of the system -

Full Scan and then Experts -

Sorry -

[YoKenny1]

coconutnut

You are letting you mum use:

Windows 5.1.2600 Service Pack 2

Internet Explorer 7.0.5730.11

SP3 has been available since May 6th 2008

Microsoft will stop support of Service Pack 2 shortly so Service Pack 3 should be installed ASAP.

Another big update is due on Patch Tuesday June 8th

[coconutnut]

for the record, the laptop is lent to her by the government. so hence sp2. and i am happy to hear that she has to send back the pc....the gov installed kaspersky for workstation 6....6 mind u...*facepalm*