Constant IP blocks by MBAM

[tattoo]

After removing Sysinternals with MBAM, it shows no threats but balloons constantly popping up that MBAM is blocking IP addresses, even with IE not running. GMER keeps locking up but I was finally able to save a log file. I couldn't zip the other files so I compressed and put them in .rar files, I hope that is ok. Here are the details and thanks in advance for your help.

DDS (Ver_10-03-17.01) - NTFSx86

Run by Rat at 23:17:21.22 on Sun 07/18/2010

Internet Explorer: 8.0.6001.18904

Microsoft

ark.rar

Attach.rar

[MrCharlie]

Welcome to the forum.

Download ComboFix from one of these locations:

Link 1

Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon and choose disable. More info HERE
  They may interfere with the running of ComboFix.
  
• Double click on ComboFix.exe & follow the prompts.
  Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.
  Note: If you have SP3, use the SP2 package.
  If Vista or Windows 7, skip the Recovery Console part
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed. It's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
  

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please let me know.

4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

5.Give it atleast 20-30 minutes to finish if needed.

MrC

[tattoo]

Here is my Combofix.txt

Thanks

-----------------------

ComboFix 10-07-20.01 - Rat 07/21/2010 0:41.1.2 - x86

Microsoft

[MrCharlie]

Please do this:

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

DDS::

uInternet Settings,ProxyServer = http=127.0.0.1:5555

uInternet Settings,ProxyOverride = <local>;*.local

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

[tattoo]

Here is the new Combofix.txt

-------------------------

ComboFix 10-07-20.03 - Rat 07/21/2010 11:02:33.2.2 - x86

Microsoft

[MrCharlie]

Please delete this folder:

c:\users\Rat\AppData\Roaming\Sysinternals Antivirus

You may have to enable hidden files to see it:

http://www.bleepingcomputer.com/tutorials/tutorial130.html

------------------------------------

Now update and run a quick scan with MBAM

Post the log and let me know how it is, MrC

[tattoo]

I deleted folder and ran scan like you said and here is the log file:

----------------------------------------

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4324

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.18904

7/21/2010 3:18:31 PM

mbam-log-2010-07-21 (15-18-31).txt

Scan type: Quick scan

Objects scanned: 165602

Time elapsed: 6 minute(s), 30 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

____________________________________

Everything seems back to normal so far, and I sure do appreciate the help, because these viruses and their capabilities almost had me shopping for a Mac. And we know how that is about as cheap as buying a new car, after buying Computer, and all of the programs I like, ie. Photoshop, Illustrator, Flash, etc. If this solved my problem, what is a casual tip for this kinda thing?

[MrCharlie]

Glad we could help

Please Uninstall ComboFix:

Go to start > run and copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

Then hit enter.

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

[Tigger93]

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.