Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


A bit confused and need some help I think [Moved]

  • Please log in to reply
3 replies to this topic

#1 R0cketer


  • Members
  • 6 posts
  • Local time:06:28 PM

Posted 25 June 2009 - 09:01 AM

Work in the field, normally handle things pretty well, but this has me kind of perplexed. Not sure if something snuck up on me and I missed it or what.

Computer doesn't seem to be behaving too badly. It has trend-micro internet security on it and it stays updated. It also has superantispyware, which is updated regularly as well as anti-malware. Windows is kept updated too.

Ran the trend micro scan, with no problems, showed no issues but cookies.
Tried to run the other 2 (superantispyware and malwarebytes), they start, and normally kill themselves, fairly quicklly. I think superantispware normally gets thru the registry and malwarebytes may do about the same, then the programs just self-terminate. Their entire processes die. I've tried to run them, update them, remove them, reinstall them and keep getting duplicate behavior. At one point, they caught something, some bit of Vundo, I stopped it and supposedly removed them, thinking whatever it was, it might have been causing the programs to be killed. Haven't lucked up with them staying active long enough to catch anything since.

I also ran combofix, and it cleaned up like one setup.exe one time (pretty much before the first phase), and then another time some other .exe file in the same location but nothing since. I tried to even go into safe mode to see if it would find more or anything but so far nothing. I did note that like in phase 31 I believe it was that combofix ran for a long time and never found anything.

Any other leads? I'm trying to remote into it from work now and run Superanti and malwarebytes and both are fully fresh installed after the combofix in safe mode, and doing exactly the same thing.

Thanks for any suggestions

BC AdBot (Login to Remove)


#2 Orange Blossom

Orange Blossom

    OBleepin Investigator

  • Moderator
  • 37,011 posts
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:06:28 PM

Posted 25 June 2009 - 10:10 PM

As no logs have been posted, I am shifting this topic from the specialized HiJack This forum to the Am I Infected forum.

==>PLEASE DO NOT NOW POST LOGS<== unless a log is specifically requested.

I also ran combofix

For everyone reading this topic, please note that ComboFix is an extremely powerful tool which should only be used when instructed to do so by someone who has been properly trained. ComboFix is intended by its creator to be "used under the guidance and supervision of an expert." It is NOT for private use. Please read Combofix's Disclaimer. Using this tool incorrectly could lead to disastrous problems with your operating system such as preventing it from ever starting again.

Running ComboFix by yourself is like performing open heart surgery on yourself--the scalpel and other surgical tools that is ComboFix is meant to be wielded by a highly trained surgeon only in emergencies or dire circumstances. When the surgeon is thru s/he leaves the room. So combofix should be removed from a system once it has accomplished its job, unlike an AV that is there to protect you from future infections.

. . . CF does make some alterations to your system if you run it. Even if you had no malware removed and run the uninstall command, some things may be different now on your system. I can tell you that one thing is that all your restore points will be flushed out and a new one created. There is a good reason to do that when you have a severe infection--but if you aren't infected you might need those restore points.

Read and abide by the disclaimer people. It's there for a reason. Stick to running and protecting yourself with a good AV and firewall and an anti-malware scanner or two. If you feel you need a second opinion, try running online scans. If you feel you might need surgery, come here to BC and ask for help--that is what we're here for.

From: http://www.bleepingcomputer.com/forums/ind...t&p=1159014

Computer doesn't seem to be behaving too badly

But what is it doing that isn't right?

Orange Blossom :thumbsup:

Edited by Orange Blossom, 25 June 2009 - 10:11 PM.
Fix BB Code. ~ OB

Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#3 garmanma


    Computer Masochist

  • Members
  • 27,809 posts
  • Gender:Male
  • Location:Cleveland, Ohio
  • Local time:06:28 PM

Posted 26 June 2009 - 08:30 PM

Try running Mbam in safe mode and see if it will complete

Give Dr Web CureIt a try:

Please download Dr.Web CureIt, the free version & save it to your desktop. DO NOT perform a scan yet.

Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with Dr.Web CureIt as follows:
  • Double-click on launch.exe to open the program and click Start. (There is no need to update if you just downloaded the most current version
  • Read the Virus check by DrWeb scanner prompt and click Ok where asked to Start scan now? Allow the setup.exe to load if asked by any of your security programs.
  • The Express scan will automatically begin.
    (This is a short scan of files currently running in memory, boot sectors, and targeted folders).
  • If prompted to dowload the Full version Free Trial, ignore and click the X to close the window.
  • If an infected object is found, you will be prompted to move anything that cannot be cured. Click Yes to All.
  • When complete, click Select All, then choose Cure > Move incurable.
    (This will move any detected files to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if they can't be cured)
  • Now put a check next to Complete scan to scan all local disks and removable media.
  • In the top menu, click Settings > Change settings, and UNcheck "Heuristic analysis" under the "Scanning" tab, then click Ok.
  • Back at the main window, click the green arrow "Start Scanning" button on the right under the Dr.Web logo.
  • When the scan is complete, a message will be displayed at the bottom indicating if any viruses were found.
  • Click "Yes to all" if asked to cure or move the file(s) and select "Move incurable".
  • In the top menu, click file and choose save report list.
  • Save the DrWeb.csv report to your desktop.
  • Exit Dr.Web Cureit when done.
  • Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
  • After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)

Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#4 R0cketer

  • Topic Starter

  • Members
  • 6 posts
  • Local time:06:28 PM

Posted 26 June 2009 - 11:36 PM

Didn't mean to cause a panic with the combofix part, I've used it probably 50 times. As stated, work in the field and pretty versed, just was at the end of a rough few weeks and was running out of brain cells.

After I relaxed, I decided to look and see what else I could find. It appears that the new version of anti-malware has a different footprint and that Trend Micro, even though it allows it to start, kills it. You had to add about 8 things to the allowed list, as Trend Micro hasn't updated their allowance, basically treating anti-malware as spyware or virus. I managed to get superantispyware working but it was due to a complete uninstall, registry clean, then reinstall and it was still acting like it was being killed, so I did generally the same thing to trend micro with its executeables and so far, so good.

Thanks for the help and I will actually try the suggested program, since I am not familiar with it right off.

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users