Malwarebytes Anti Malware Has Stopped Working
On
Hi,
I've installed mbam registered version. However, I've bumped into a problem in the 'Full Scan' option.
It runs for a while and then stops working.
It should be noted that I also have Kaspersky Internet Security 2010.
Does KIS interfere with mbam?
So, i've run ComboFix and here's the log:
Running from: d:downloadsComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:$recycle.binS-1-5-21-2318613984-2589602925-404845656-1006
c:program filesCheat Enginedbk32.sys
.
((((((((((((((((((((((((( Files Created from 2010-03-23 to 2010-04-23 )))))))))))))))))))))))))))))))
.
2010-04-23 11:01 . 2010-04-23 11:01 -------- d-----w- c:usersunameAppDataLocaltemp
2010-04-23 11:01 . 2010-04-23 11:01 -------- d-----w- c:usersDefaultAppDataLocaltemp
2010-04-23 10:43 . 2010-04-23 10:44 -------- d-----w- C:32788R22FWJFW
2010-04-20 18:25 . 2010-04-20 18:25 -------- d-----w- c:program filesTimeAdjuster
2010-04-20 15:54 . 2010-04-20 15:54 -------- d-----w- c:program filesURUSoft
2010-04-14 05:43 . 2010-02-19 12:43 536576 ----a-w- c:usersunameAppDataRoamingMozillaFirefoxProfilessydh3ars.defaultextensions{22119944-ED35-4ab1-910B-E619EA06A115}componentsrfproxy_31.dll
2010-04-14 05:42 . 2010-03-29 09:54 38224 ----a-w- c:windowssystem32driversmbamswissarmy.sys
2010-04-14 05:42 . 2010-03-29 09:54 20824 ----a-w- c:windowssystem32driversmbam.sys
2010-04-14 05:42 . 2010-04-14 05:42 -------- d-----w- c:program filesMalwarebytes' Anti-Malware
2010-04-11 00:51 . 2009-12-13 09:30 641536 ----a-w- c:windowssystem32CPFilters.dll
2010-04-11 00:51 . 2009-12-13 09:30 465408 ----a-w- c:windowssystem32psisdecd.dll
2010-04-11 00:51 . 2009-12-13 09:29 417792 ----a-w- c:windowssystem32msdri.dll
2010-04-09 16:55 . 2010-04-09 16:55 -------- d-----w- c:program filesgamespeed
2010-04-09 16:55 . 2005-12-08 04:39 49152 ----a-w- c:windowssystem32mydll.dll
2010-04-09 16:55 . 2005-12-07 09:43 57344 ----a-w- c:windowssystem32HookAPINT.dll
2010-04-07 02:55 . 2010-04-07 02:55 198064 ----a-w- c:usersunameAppDataRoamingIDMidmmzcc3componentsidmmzcc.dll
2010-04-07 02:55 . 2010-04-08 15:20 -------- d-----w- c:usersunameAppDataRoamingIDM
2010-04-07 02:55 . 2010-04-10 11:05 -------- d-----w- c:usersunameAppDataRoamingDMCache
2010-04-05 16:40 . 2010-04-07 02:57 -------- d-----w- C:Pazera_Free_FLV_to_AVI_Converter
2010-04-04 16:38 . 2010-04-04 16:41 -------- d-----w- c:program filesVirtual Volumes
2010-03-31 15:23 . 2010-04-13 16:38 -------- d-----w- c:program filesWindows Live Safety Center
2010-03-31 12:26 . 2010-03-31 12:26 -------- d-----w- c:program filesDiskInternals
2010-03-29 17:12 . 2010-03-29 17:12 -------- d-----w- c:usersunameAppDataLocalApple Computer
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-23 11:00 . 2009-12-21 12:11 -------- d-----w- c:program filesCheat Engine
2010-04-23 09:44 . 2009-12-21 12:43 -------- d-----w- c:usersunameAppDataRoamingvlc
2010-04-23 02:06 . 2009-12-26 04:38 -------- d-----w- c:programdataUAB
2010-04-23 02:04 . 2009-12-21 12:12 -------- d-----w- c:program filesBitComet
2010-04-23 02:02 . 2009-12-21 12:08 -------- d-----w- c:program filesJDownloader
2010-04-23 01:54 . 2009-12-21 11:59 -------- d-----w- c:programdataKaspersky Lab
2010-04-13 14:38 . 2009-12-23 16:48 181096 ----a-w- c:usersunameAppDataRoamingMozillaFirefoxProfilessydh3ars.defaultFlashGot.exe
2010-04-13 11:38 . 2009-12-21 13:02 -------- d--h--w- c:program filesInstallShield Installation Information
2010-04-10 10:57 . 2010-01-14 06:25 -------- d-----w- c:programdataNOS
2010-04-09 14:28 . 2010-02-07 10:57 -------- d-----w- c:program filesHide My IP 2009
2010-04-06 20:59 . 2009-12-21 11:12 -------- d-----w- c:program filesCommon FilesJava
2010-04-06 20:59 . 2009-12-26 02:29 411368 ----a-w- c:windowssystem32deploytk.dll
2010-03-20 14:21 . 2010-03-20 14:21 -------- d-----w- c:usersunameAppDataRoamingMalwarebytes
2010-03-20 14:21 . 2010-03-20 14:21 -------- d-----w- c:programdataMalwarebytes
2010-03-20 14:03 . 2010-03-20 14:03 -------- d-----w- c:usersunameAppDataRoamingFDRLab
2010-03-20 14:03 . 2010-03-20 14:03 -------- d-----w- c:program filesFDRLab
2010-03-10 12:58 . 2010-01-03 05:50 -------- d-----w- c:program filesCrossLoop
2010-03-09 12:57 . 2009-12-21 12:55 108408 ----a-w- c:usersunameAppDataLocalGDIPFONTCACHEV1.DAT
2010-03-09 12:40 . 2010-03-09 12:40 -------- d-----w- c:program filesBonjour
2010-03-09 12:40 . 2009-12-21 11:00 -------- d-----w- c:program filesCommon FilesAdobe
2010-03-09 12:28 . 2010-03-09 12:28 -------- d-----w- c:program filesCommon FilesMacrovision Shared
2010-03-09 03:55 . 2009-12-21 11:10 -------- d-----w- c:program filesCCleaner
2010-03-05 07:44 . 2010-03-05 07:44 -------- d-----w- c:programdataFLEXnet
2010-02-23 07:56 . 2010-04-11 00:50 977920 ----a-w- c:windowssystem32wininet.dll
2010-02-18 00:05 . 2010-02-18 00:04 86016 ----a-w- c:programdataNOSAdobe_Downloadsarh.exe
2010-02-02 07:45 . 2010-04-11 00:50 2048 ----a-w- c:windowssystem32tzres.dll
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:windowsFontsStaticCache.dat
2009-12-21 12:06 . 2009-12-21 12:06 604140 --sha-w- c:windowsSystem32driversISwift3.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
'RoboForm'='c:program filesSiber SystemsAI RoboFormRoboTaskBarIcon.exe' [2009-12-21 160592]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
'googletalk'='c:program filesGoogleGoogle Talkgoogletalk.exe' [2007-01-01 3739648]
'AVP'='c:program filesKaspersky LabKaspersky Internet Security 2010avp.exe' [2009-07-03 303376]
'GrooveMonitor'='c:program filesMicrosoft OfficeOffice12GrooveMonitor.exe' [2008-10-25 31072]
'SynTPEnh'='c:program filesSynapticsSynTPSynTPEnh.exe' [2006-11-22 815104]
'NeroFilterCheck'='c:program filesCommon FilesAheadLibNeroCheck.exe' [2006-01-12 155648]
'IntelZeroConfig'='c:program filesIntelWirelessbinZCfgSvc.exe' [2006-02-28 667718]
'IntelWireless'='c:program filesIntelWirelessBinifrmewrk.exe' [2006-02-28 602182]
'EOUApp'='c:program filesIntelWirelessBinEOUWiz.exe' [2006-02-28 569413]
'ISUSScheduler'='c:program filesCommon FilesInstallShieldUpdateServiceissch.exe' [2005-06-10 81920]
'Adobe Reader Speed Launcher'='c:program filesAdobeReader 9.0ReaderReader_sl.exe' [2010-04-04 36272]
'Adobe ARM'='c:program filesCommon FilesAdobeARM1.0AdobeARM.exe' [2010-03-24 952768]
'ITSecMng'='c:program filesTOSHIBABluetooth Toshiba StackItSecMng.exe' [2009-07-22 83336]
'SunJavaUpdateSched'='c:program filesCommon FilesJavaJava Updatejusched.exe' [2010-02-18 248040]
'Malwarebytes' Anti-Malware'='c:program filesMalwarebytes' Anti-Malwarembamgui.exe' [2010-03-29 437584]
c:usersunameAppDataRoamingMicrosoftWindowsStart MenuProgramsStartup
OneNote 2007 Screen Clipper and Launcher.lnk - c:program filesMicrosoft OfficeOffice12ONENOTEM.EXE [2008-10-25 98696]
c:programdataMicrosoftWindowsStart MenuProgramsStartup
Bluetooth Manager.lnk - c:program filesToshibaBluetooth Toshiba StackTosBtMng1.exe [2009-8-6 439648]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]
'ConsentPromptBehaviorAdmin'= 0 (0x0)
'ConsentPromptBehaviorUser'= 3 (0x3)
'EnableLUA'= 0 (0x0)
'EnableUIADesktopToggle'= 0 (0x0)
'PromptOnSecureDesktop'= 0 (0x0)
[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwindows]
'AppInit_DLLs'=c:progra~1KASPER~1KASPER~1mzvkbd3.dll c:progra~1KASPER~1KASPER~1kloehk.dll
[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringKasperskyAntiVirus]
'DisableMonitoring'=dword:00000001
R3 RTL8167;Realtek 8167 NT Driver;c:windowssystem32DRIVERSRt86win7.sys [2009-07-13 139776]
R3 SrvHsfHDA;SrvHsfHDA;c:windowssystem32DRIVERSVSTAZL3.SYS [2009-07-13 207360]
R3 SrvHsfV92;SrvHsfV92;c:windowssystem32DRIVERSVSTDPV3.SYS [2009-07-13 980992]
R3 SrvHsfWinac;SrvHsfWinac;c:windowssystem32DRIVERSVSTCNXT3.SYS [2009-07-13 661504]
S0 klbg;Kaspersky Lab Boot Guard Driver;c:windowssystem32driversklbg.sys [2008-12-15 33808]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:windowssystem32DRIVERSklim6.sys [2009-05-15 21008]
S1 vwififlt;Virtual WiFi Filter Driver;c:windowssystem32DRIVERSvwififlt.sys [2009-07-13 48128]
S2 MBAMService;MBAMService;c:program filesMalwarebytes' Anti-Malwarembamservice.exe [2010-03-29 303952]
S2 NPF;NetGroup Packet Filter Driver;c:windowssystem32driversnpf.sys [2009-10-20 50704]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:windowssystem32DRIVERSklmouflt.sys [2009-05-16 19472]
S3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [2010-03-29 20824]
S3 WCPU;WCPU;c:program filesP4GWCPU.sys [2007-01-02 11120]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - CPUZ132
*Deregistered* - MBAMSwissArmy
.
Contents of the 'Scheduled Tasks' folder
2010-04-23 c:windowsTasksSDMsgUpdate (TE).job
- c:progra~1SMARTD~1MessagesSDNotify.exe [2009-12-21 16:21]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: &D&ownload &with BitComet - c:program filesBitCometBitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - c:program filesBitCometBitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - c:program filesBitCometBitComet.exe/AddAllLink.htm
IE: Add to Anti-Banner - c:program filesKaspersky LabKaspersky Internet Security 2010ie_banner_deny.htm
IE: Customize Menu - file://c:program filesSiber SystemsAI RoboFormRoboFormComCustomizeIEMenu.html
IE: Download FLV video content with IDM - c:program filesInternet Download ManagerIEGetVL.htm
IE: E&xport to Microsoft Excel - c:progra~1MICROS~2Office12EXCEL.EXE/3000
IE: Fill Forms - file://c:program filesSiber SystemsAI RoboFormRoboFormComFillForms.html
IE: Save Forms - file://c:program filesSiber SystemsAI RoboFormRoboFormComSavePass.html
TCP: {BF599706-BCA1-4BCB-A468-359434A19E9B} = 8.8.8.8,8.8.4.4
FF - ProfilePath - c:usersunameAppDataRoamingMozillaFirefoxProfilessydh3ars.default
FF - prefs.js: browser.startup.homepage - hxxp://m.in.yahoo.com/
FF - component: c:program filesMozilla Firefoxextensionslinkfilter@kaspersky.rucomponentsKavLinkFilter.dll
FF - component: c:usersunameAppDataRoamingMozillaFirefoxProfilessydh3ars.defaultextensions{22119944-ED35-4ab1-910B-E619EA06A115}componentsrfproxy_31.dll
FF - plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnppl3260.dll
FF - plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnprpjplug.dll
FF - plugin: c:program filesMozilla Firefoxpluginsnp-mswmp.dll
---- FIREFOX POLICIES ----
c:program filesMozilla Firefoxgreprefsall.js - pref('ui.use_native_colors', true);
c:program filesMozilla Firefoxgreprefsall.js - pref('ui.use_native_popup_windows', false);
c:program filesMozilla Firefoxgreprefsall.js - pref('browser.enable_click_image_resizing', true);
c:program filesMozilla Firefoxgreprefsall.js - pref('accessibility.browsewithcaret_shortcut.enabled', true);
c:program filesMozilla Firefoxgreprefsall.js - pref('javascript.options.mem.high_water_mark', 32);
c:program filesMozilla Firefoxgreprefsall.js - pref('javascript.options.mem.gc_frequency', 1600);
c:program filesMozilla Firefoxgreprefsall.js - pref('network.auth.force-generic-ntlm', false);
c:program filesMozilla Firefoxgreprefsall.js - pref('svg.smil.enabled', false);
c:program filesMozilla Firefoxgreprefsall.js - pref('ui.trackpoint_hack.enabled', -1);
c:program filesMozilla Firefoxgreprefsall.js - pref('browser.formfill.debug', false);
c:program filesMozilla Firefoxgreprefsall.js - pref('browser.formfill.agedWeight', 2);
c:program filesMozilla Firefoxgreprefsall.js - pref('browser.formfill.bucketSize', 1);
c:program filesMozilla Firefoxgreprefsall.js - pref('browser.formfill.maxTimeGroupings', 25);
c:program filesMozilla Firefoxgreprefsall.js - pref('browser.formfill.timeGroupingSize', 604800);
c:program filesMozilla Firefoxgreprefsall.js - pref('browser.formfill.boundaryWeight', 25);
c:program filesMozilla Firefoxgreprefsall.js - pref('browser.formfill.prefixWeight', 5);
c:program filesMozilla Firefoxgreprefsall.js - pref('html5.enable', false);
c:program filesMozilla Firefoxgreprefssecurity-prefs.js - pref('security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref', true);
c:program filesMozilla Firefoxgreprefssecurity-prefs.js - pref('security.ssl.renego_unrestricted_hosts', ');
c:program filesMozilla Firefoxgreprefssecurity-prefs.js - pref('security.ssl.treat_unsafe_negotiation_as_broken', false);
c:program filesMozilla Firefoxgreprefssecurity-prefs.js - pref('security.ssl.require_safe_negotiation', false);
c:program filesMozilla Firefoxdefaultspreffirefox-branding.js - pref('app.update.download.backgroundInterval', 600);
c:program filesMozilla Firefoxdefaultspreffirefox-branding.js - pref('app.update.url.manual', 'http://www.firefox.com');
c:program filesMozilla Firefoxdefaultspreffirefox-branding.js - pref('browser.search.param.yahoo-fr-ja', 'mozff');
c:program filesMozilla Firefoxdefaultspreffirefox.js - pref('extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name', 'chrome://browser/locale/browser.properties');
c:program filesMozilla Firefoxdefaultspreffirefox.js - pref('extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description', 'chrome://browser/locale/browser.properties');
c:program filesMozilla Firefoxdefaultspreffirefox.js - pref('xpinstall.whitelist.add', 'addons.mozilla.org');
c:program filesMozilla Firefoxdefaultspreffirefox.js - pref('xpinstall.whitelist.add.36', 'getpersonas.com');
c:program filesMozilla Firefoxdefaultspreffirefox.js - pref('lightweightThemes.update.enabled', true);
c:program filesMozilla Firefoxdefaultspreffirefox.js - pref('browser.allTabs.previews', false);
c:program filesMozilla Firefoxdefaultspreffirefox.js - pref('plugins.hide_infobar_for_outdated_plugin', false);
c:program filesMozilla Firefoxdefaultspreffirefox.js - pref('plugins.update.notifyUser', false);
c:program filesMozilla Firefoxdefaultspreffirefox.js - pref('toolbar.customization.usesheet', false);
c:program filesMozilla Firefoxdefaultspreffirefox.js - pref('browser.taskbar.previews.enable', false);
c:program filesMozilla Firefoxdefaultspreffirefox.js - pref('browser.taskbar.previews.max', 20);
c:program filesMozilla Firefoxdefaultspreffirefox.js - pref('browser.taskbar.previews.cachetime', 20);
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-ISUSPM Startup - c:program filesCommon FilesInstallShieldUpdateServiceISUSPM.exe
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}0000AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
'BlindDial'=dword:00000000
[HKEY_LOCAL_MACHINESYSTEMControlSet001ControlPCWSecurity]
@Denied: (Full) (Everyone)
.
Completion time: 2010-04-23 16:38:58
ComboFix-quarantined-files.txt 2010-04-23 11:08
Pre-Run: 10,150,641,664 bytes free
Post-Run: 10,012,000,256 bytes free
- - End Of File - - 7CE3A2376BA8C77323E57DBF437868A1
Malwarebytes Anti-Malware is an anti-malware application that can thoroughly remove even the most advanced malware. Malwarebytes products have a proven record of protecting computers by completely removing all forms of malware, including viruses, Trojans, spyware, adware and rootkits. Star wars clone trooper commanders.
I've installed mbam registered version. However, I've bumped into a problem in the 'Full Scan' option.
It runs for a while and then stops working.
It should be noted that I also have Kaspersky Internet Security 2010.
Does KIS interfere with mbam?
So, i've run ComboFix and here's the log:
Running from: d:downloadsComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:$recycle.binS-1-5-21-2318613984-2589602925-404845656-1006
c:program filesCheat Enginedbk32.sys
.
((((((((((((((((((((((((( Files Created from 2010-03-23 to 2010-04-23 )))))))))))))))))))))))))))))))
.
2010-04-23 11:01 . 2010-04-23 11:01 -------- d-----w- c:usersunameAppDataLocaltemp
2010-04-23 11:01 . 2010-04-23 11:01 -------- d-----w- c:usersDefaultAppDataLocaltemp
2010-04-23 10:43 . 2010-04-23 10:44 -------- d-----w- C:32788R22FWJFW
2010-04-20 18:25 . 2010-04-20 18:25 -------- d-----w- c:program filesTimeAdjuster
2010-04-20 15:54 . 2010-04-20 15:54 -------- d-----w- c:program filesURUSoft
2010-04-14 05:43 . 2010-02-19 12:43 536576 ----a-w- c:usersunameAppDataRoamingMozillaFirefoxProfilessydh3ars.defaultextensions{22119944-ED35-4ab1-910B-E619EA06A115}componentsrfproxy_31.dll
2010-04-14 05:42 . 2010-03-29 09:54 38224 ----a-w- c:windowssystem32driversmbamswissarmy.sys
2010-04-14 05:42 . 2010-03-29 09:54 20824 ----a-w- c:windowssystem32driversmbam.sys
2010-04-14 05:42 . 2010-04-14 05:42 -------- d-----w- c:program filesMalwarebytes' Anti-Malware
2010-04-11 00:51 . 2009-12-13 09:30 641536 ----a-w- c:windowssystem32CPFilters.dll
2010-04-11 00:51 . 2009-12-13 09:30 465408 ----a-w- c:windowssystem32psisdecd.dll
2010-04-11 00:51 . 2009-12-13 09:29 417792 ----a-w- c:windowssystem32msdri.dll
2010-04-09 16:55 . 2010-04-09 16:55 -------- d-----w- c:program filesgamespeed
2010-04-09 16:55 . 2005-12-08 04:39 49152 ----a-w- c:windowssystem32mydll.dll
2010-04-09 16:55 . 2005-12-07 09:43 57344 ----a-w- c:windowssystem32HookAPINT.dll
2010-04-07 02:55 . 2010-04-07 02:55 198064 ----a-w- c:usersunameAppDataRoamingIDMidmmzcc3componentsidmmzcc.dll
2010-04-07 02:55 . 2010-04-08 15:20 -------- d-----w- c:usersunameAppDataRoamingIDM
2010-04-07 02:55 . 2010-04-10 11:05 -------- d-----w- c:usersunameAppDataRoamingDMCache
2010-04-05 16:40 . 2010-04-07 02:57 -------- d-----w- C:Pazera_Free_FLV_to_AVI_Converter
2010-04-04 16:38 . 2010-04-04 16:41 -------- d-----w- c:program filesVirtual Volumes
2010-03-31 15:23 . 2010-04-13 16:38 -------- d-----w- c:program filesWindows Live Safety Center
2010-03-31 12:26 . 2010-03-31 12:26 -------- d-----w- c:program filesDiskInternals
2010-03-29 17:12 . 2010-03-29 17:12 -------- d-----w- c:usersunameAppDataLocalApple Computer
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-23 11:00 . 2009-12-21 12:11 -------- d-----w- c:program filesCheat Engine
2010-04-23 09:44 . 2009-12-21 12:43 -------- d-----w- c:usersunameAppDataRoamingvlc
2010-04-23 02:06 . 2009-12-26 04:38 -------- d-----w- c:programdataUAB
2010-04-23 02:04 . 2009-12-21 12:12 -------- d-----w- c:program filesBitComet
2010-04-23 02:02 . 2009-12-21 12:08 -------- d-----w- c:program filesJDownloader
2010-04-23 01:54 . 2009-12-21 11:59 -------- d-----w- c:programdataKaspersky Lab
2010-04-13 14:38 . 2009-12-23 16:48 181096 ----a-w- c:usersunameAppDataRoamingMozillaFirefoxProfilessydh3ars.defaultFlashGot.exe
2010-04-13 11:38 . 2009-12-21 13:02 -------- d--h--w- c:program filesInstallShield Installation Information
2010-04-10 10:57 . 2010-01-14 06:25 -------- d-----w- c:programdataNOS
2010-04-09 14:28 . 2010-02-07 10:57 -------- d-----w- c:program filesHide My IP 2009
2010-04-06 20:59 . 2009-12-21 11:12 -------- d-----w- c:program filesCommon FilesJava
2010-04-06 20:59 . 2009-12-26 02:29 411368 ----a-w- c:windowssystem32deploytk.dll
2010-03-20 14:21 . 2010-03-20 14:21 -------- d-----w- c:usersunameAppDataRoamingMalwarebytes
2010-03-20 14:21 . 2010-03-20 14:21 -------- d-----w- c:programdataMalwarebytes
2010-03-20 14:03 . 2010-03-20 14:03 -------- d-----w- c:usersunameAppDataRoamingFDRLab
2010-03-20 14:03 . 2010-03-20 14:03 -------- d-----w- c:program filesFDRLab
2010-03-10 12:58 . 2010-01-03 05:50 -------- d-----w- c:program filesCrossLoop
2010-03-09 12:57 . 2009-12-21 12:55 108408 ----a-w- c:usersunameAppDataLocalGDIPFONTCACHEV1.DAT
2010-03-09 12:40 . 2010-03-09 12:40 -------- d-----w- c:program filesBonjour
2010-03-09 12:40 . 2009-12-21 11:00 -------- d-----w- c:program filesCommon FilesAdobe
2010-03-09 12:28 . 2010-03-09 12:28 -------- d-----w- c:program filesCommon FilesMacrovision Shared
2010-03-09 03:55 . 2009-12-21 11:10 -------- d-----w- c:program filesCCleaner
2010-03-05 07:44 . 2010-03-05 07:44 -------- d-----w- c:programdataFLEXnet
2010-02-23 07:56 . 2010-04-11 00:50 977920 ----a-w- c:windowssystem32wininet.dll
2010-02-18 00:05 . 2010-02-18 00:04 86016 ----a-w- c:programdataNOSAdobe_Downloadsarh.exe
2010-02-02 07:45 . 2010-04-11 00:50 2048 ----a-w- c:windowssystem32tzres.dll
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:windowsFontsStaticCache.dat
2009-12-21 12:06 . 2009-12-21 12:06 604140 --sha-w- c:windowsSystem32driversISwift3.dat
Malwarebytes Anti-malware Has Stopped Working Windows 10
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:windowswinsxsx86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86cWinMail.exe.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun]
'RoboForm'='c:program filesSiber SystemsAI RoboFormRoboTaskBarIcon.exe' [2009-12-21 160592]
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
'googletalk'='c:program filesGoogleGoogle Talkgoogletalk.exe' [2007-01-01 3739648]
'AVP'='c:program filesKaspersky LabKaspersky Internet Security 2010avp.exe' [2009-07-03 303376]
'GrooveMonitor'='c:program filesMicrosoft OfficeOffice12GrooveMonitor.exe' [2008-10-25 31072]
'SynTPEnh'='c:program filesSynapticsSynTPSynTPEnh.exe' [2006-11-22 815104]
'NeroFilterCheck'='c:program filesCommon FilesAheadLibNeroCheck.exe' [2006-01-12 155648]
'IntelZeroConfig'='c:program filesIntelWirelessbinZCfgSvc.exe' [2006-02-28 667718]
'IntelWireless'='c:program filesIntelWirelessBinifrmewrk.exe' [2006-02-28 602182]
'EOUApp'='c:program filesIntelWirelessBinEOUWiz.exe' [2006-02-28 569413]
'ISUSScheduler'='c:program filesCommon FilesInstallShieldUpdateServiceissch.exe' [2005-06-10 81920]
'Adobe Reader Speed Launcher'='c:program filesAdobeReader 9.0ReaderReader_sl.exe' [2010-04-04 36272]
'Adobe ARM'='c:program filesCommon FilesAdobeARM1.0AdobeARM.exe' [2010-03-24 952768]
'ITSecMng'='c:program filesTOSHIBABluetooth Toshiba StackItSecMng.exe' [2009-07-22 83336]
'SunJavaUpdateSched'='c:program filesCommon FilesJavaJava Updatejusched.exe' [2010-02-18 248040]
'Malwarebytes' Anti-Malware'='c:program filesMalwarebytes' Anti-Malwarembamgui.exe' [2010-03-29 437584]
c:usersunameAppDataRoamingMicrosoftWindowsStart MenuProgramsStartup
OneNote 2007 Screen Clipper and Launcher.lnk - c:program filesMicrosoft OfficeOffice12ONENOTEM.EXE [2008-10-25 98696]
c:programdataMicrosoftWindowsStart MenuProgramsStartup
Bluetooth Manager.lnk - c:program filesToshibaBluetooth Toshiba StackTosBtMng1.exe [2009-8-6 439648]
[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionpoliciessystem]
'ConsentPromptBehaviorAdmin'= 0 (0x0)
'ConsentPromptBehaviorUser'= 3 (0x3)
'EnableLUA'= 0 (0x0)
'EnableUIADesktopToggle'= 0 (0x0)
'PromptOnSecureDesktop'= 0 (0x0)
[HKEY_LOCAL_MACHINEsoftwaremicrosoftwindows ntcurrentversionwindows]
'AppInit_DLLs'=c:progra~1KASPER~1KASPER~1mzvkbd3.dll c:progra~1KASPER~1KASPER~1kloehk.dll
[HKEY_LOCAL_MACHINEsoftwaremicrosoftsecurity centerMonitoringKasperskyAntiVirus]
'DisableMonitoring'=dword:00000001
R3 RTL8167;Realtek 8167 NT Driver;c:windowssystem32DRIVERSRt86win7.sys [2009-07-13 139776]
R3 SrvHsfHDA;SrvHsfHDA;c:windowssystem32DRIVERSVSTAZL3.SYS [2009-07-13 207360]
R3 SrvHsfV92;SrvHsfV92;c:windowssystem32DRIVERSVSTDPV3.SYS [2009-07-13 980992]
R3 SrvHsfWinac;SrvHsfWinac;c:windowssystem32DRIVERSVSTCNXT3.SYS [2009-07-13 661504]
S0 klbg;Kaspersky Lab Boot Guard Driver;c:windowssystem32driversklbg.sys [2008-12-15 33808]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:windowssystem32DRIVERSklim6.sys [2009-05-15 21008]
S1 vwififlt;Virtual WiFi Filter Driver;c:windowssystem32DRIVERSvwififlt.sys [2009-07-13 48128]
S2 MBAMService;MBAMService;c:program filesMalwarebytes' Anti-Malwarembamservice.exe [2010-03-29 303952]
S2 NPF;NetGroup Packet Filter Driver;c:windowssystem32driversnpf.sys [2009-10-20 50704]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:windowssystem32DRIVERSklmouflt.sys [2009-05-16 19472]
Has Stopped Working Vista
S3 MBAMProtector;MBAMProtector;c:windowssystem32driversmbam.sys [2010-03-29 20824]
S3 WCPU;WCPU;c:program filesP4GWCPU.sys [2007-01-02 11120]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - CPUZ132
*Deregistered* - MBAMSwissArmy
.
Contents of the 'Scheduled Tasks' folder
2010-04-23 c:windowsTasksSDMsgUpdate (TE).job
- c:progra~1SMARTD~1MessagesSDNotify.exe [2009-12-21 16:21]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: &D&ownload &with BitComet - c:program filesBitCometBitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - c:program filesBitCometBitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - c:program filesBitCometBitComet.exe/AddAllLink.htm
IE: Add to Anti-Banner - c:program filesKaspersky LabKaspersky Internet Security 2010ie_banner_deny.htm
IE: Customize Menu - file://c:program filesSiber SystemsAI RoboFormRoboFormComCustomizeIEMenu.html
IE: Download FLV video content with IDM - c:program filesInternet Download ManagerIEGetVL.htm
IE: E&xport to Microsoft Excel - c:progra~1MICROS~2Office12EXCEL.EXE/3000
IE: Fill Forms - file://c:program filesSiber SystemsAI RoboFormRoboFormComFillForms.html
IE: Save Forms - file://c:program filesSiber SystemsAI RoboFormRoboFormComSavePass.html
TCP: {BF599706-BCA1-4BCB-A468-359434A19E9B} = 8.8.8.8,8.8.4.4
FF - ProfilePath - c:usersunameAppDataRoamingMozillaFirefoxProfilessydh3ars.default
FF - prefs.js: browser.startup.homepage - hxxp://m.in.yahoo.com/
FF - component: c:program filesMozilla Firefoxextensionslinkfilter@kaspersky.rucomponentsKavLinkFilter.dll
FF - component: c:usersunameAppDataRoamingMozillaFirefoxProfilessydh3ars.defaultextensions{22119944-ED35-4ab1-910B-E619EA06A115}componentsrfproxy_31.dll
FF - plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnppl3260.dll
FF - plugin: c:program filesK-Lite Codec PackRealbrowserpluginsnprpjplug.dll
FF - plugin: c:program filesMozilla Firefoxpluginsnp-mswmp.dll
---- FIREFOX POLICIES ----
c:program filesMozilla Firefoxgreprefsall.js - pref('ui.use_native_colors', true);
c:program filesMozilla Firefoxgreprefsall.js - pref('ui.use_native_popup_windows', false);
c:program filesMozilla Firefoxgreprefsall.js - pref('browser.enable_click_image_resizing', true);
c:program filesMozilla Firefoxgreprefsall.js - pref('accessibility.browsewithcaret_shortcut.enabled', true);
c:program filesMozilla Firefoxgreprefsall.js - pref('javascript.options.mem.high_water_mark', 32);
c:program filesMozilla Firefoxgreprefsall.js - pref('javascript.options.mem.gc_frequency', 1600);
c:program filesMozilla Firefoxgreprefsall.js - pref('network.auth.force-generic-ntlm', false);
c:program filesMozilla Firefoxgreprefsall.js - pref('svg.smil.enabled', false);
c:program filesMozilla Firefoxgreprefsall.js - pref('ui.trackpoint_hack.enabled', -1);
c:program filesMozilla Firefoxgreprefsall.js - pref('browser.formfill.debug', false);
c:program filesMozilla Firefoxgreprefsall.js - pref('browser.formfill.agedWeight', 2);
c:program filesMozilla Firefoxgreprefsall.js - pref('browser.formfill.bucketSize', 1);
c:program filesMozilla Firefoxgreprefsall.js - pref('browser.formfill.maxTimeGroupings', 25);
c:program filesMozilla Firefoxgreprefsall.js - pref('browser.formfill.timeGroupingSize', 604800);
c:program filesMozilla Firefoxgreprefsall.js - pref('browser.formfill.boundaryWeight', 25);c:program filesMozilla Firefoxgreprefsall.js - pref('browser.formfill.prefixWeight', 5);
c:program filesMozilla Firefoxgreprefsall.js - pref('html5.enable', false);
c:program filesMozilla Firefoxgreprefssecurity-prefs.js - pref('security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref', true);
c:program filesMozilla Firefoxgreprefssecurity-prefs.js - pref('security.ssl.renego_unrestricted_hosts', ');
c:program filesMozilla Firefoxgreprefssecurity-prefs.js - pref('security.ssl.treat_unsafe_negotiation_as_broken', false);
c:program filesMozilla Firefoxgreprefssecurity-prefs.js - pref('security.ssl.require_safe_negotiation', false);
c:program filesMozilla Firefoxdefaultspreffirefox-branding.js - pref('app.update.download.backgroundInterval', 600);
c:program filesMozilla Firefoxdefaultspreffirefox-branding.js - pref('app.update.url.manual', 'http://www.firefox.com');
c:program filesMozilla Firefoxdefaultspreffirefox-branding.js - pref('browser.search.param.yahoo-fr-ja', 'mozff');
c:program filesMozilla Firefoxdefaultspreffirefox.js - pref('extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name', 'chrome://browser/locale/browser.properties');
c:program filesMozilla Firefoxdefaultspreffirefox.js - pref('extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description', 'chrome://browser/locale/browser.properties');
c:program filesMozilla Firefoxdefaultspreffirefox.js - pref('xpinstall.whitelist.add', 'addons.mozilla.org');
c:program filesMozilla Firefoxdefaultspreffirefox.js - pref('xpinstall.whitelist.add.36', 'getpersonas.com');
c:program filesMozilla Firefoxdefaultspreffirefox.js - pref('lightweightThemes.update.enabled', true);
c:program filesMozilla Firefoxdefaultspreffirefox.js - pref('browser.allTabs.previews', false);
c:program filesMozilla Firefoxdefaultspreffirefox.js - pref('plugins.hide_infobar_for_outdated_plugin', false);
c:program filesMozilla Firefoxdefaultspreffirefox.js - pref('plugins.update.notifyUser', false);
c:program filesMozilla Firefoxdefaultspreffirefox.js - pref('toolbar.customization.usesheet', false);
c:program filesMozilla Firefoxdefaultspreffirefox.js - pref('browser.taskbar.previews.enable', false);
c:program filesMozilla Firefoxdefaultspreffirefox.js - pref('browser.taskbar.previews.max', 20);
c:program filesMozilla Firefoxdefaultspreffirefox.js - pref('browser.taskbar.previews.cachetime', 20);
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-ISUSPM Startup - c:program filesCommon FilesInstallShieldUpdateServiceISUSPM.exe
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINESYSTEMControlSet001ControlClass{4D36E96D-E325-11CE-BFC1-08002BE10318}0000AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
'BlindDial'=dword:00000000
[HKEY_LOCAL_MACHINESYSTEMControlSet001ControlPCWSecurity]
@Denied: (Full) (Everyone)
.
Completion time: 2010-04-23 16:38:58
ComboFix-quarantined-files.txt 2010-04-23 11:08
Pre-Run: 10,150,641,664 bytes free
Post-Run: 10,012,000,256 bytes free
- - End Of File - - 7CE3A2376BA8C77323E57DBF437868A1
Edited by boopme, 23 April 2010 - 09:00 AM.
Moved to Virus,Trojan and Malware Removal Logs~~boopme
I've had great luck with MBAM (malwarebytes' antimalware). I recently received a message from McAfee that a trojan was blocked. So I tried to scan my computer with MBAM and received a message that MBAM can't be found. Then, I uninstalled MBAM, but when I try to reinstall it I get an error message that says 'Unable to Execute File c:program filesmalwarebytes' anti-malwarembam.exe Create Process Failed; Code 2 System Cannot find the file specified.
Any suggestions as to what happened, and how I can get MBAM working again.
Thanks
Dan