Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

malware [pup] infection..


  • Please log in to reply
5 replies to this topic

#1 Farlith

Farlith

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:47 PM

Posted 12 May 2014 - 09:16 AM

Hello,here am I again with the (after)effects of a malware infection..

 

Hardware: ASUS laptop,core I5, geforce GT 635M, windows 8.1 (pre-installed)

internet access: wifi (working at owner's place) (no wifi here; just cable)

 

info found:

"The Settings Manager program is a part of the “Search Protect” program, and is developed by Aztec Media Inc, a company known for their malicious programs.
Settings Manager is typically added when you install another free software (video recording/streaming, download-managers or PDF creators) that had bundled into their installation this program."

 

Seems that there are still problems so I could use some help checking/cleaning/repairing the system.. ;)

 

thank you,

Far

-------

 

 

-------------------------------------------------------------------------------------------------------------

-- part of malwarebytes 1.75 log (2.x could not be installed because of install errors):

Memory Processes Detected: 3
C:\Program Files (x86)\Settings Manager\systemk\SystemkService.exe (PUP.Optional.SettingsManager.A) -> 1388 -> No action taken.
C:\Program Files (x86)\Settings Manager\systemk\SystemkService.exe (PUP.Optional.SettingsManager.A) -> 1692 -> No action taken.
C:\Program Files (x86)\Settings Manager\systemk\systemku.exe (PUP.Optional.SettingsManager.A) -> 244 -> No action taken.
Memory Modules Detected: 3
C:\Program Files (x86)\Settings Manager\systemk\sysapcrt.dll (PUP.Optional.SettingsManager.A) -> No action taken.
C:\Program Files (x86)\Settings Manager\systemk\syskldr.dll (PUP.Optional.SettingsManager.A) -> No action taken.
C:\Program Files (x86)\Settings Manager\systemk\systemk.dll (PUP.Optional.SettingsManager.A) -> No action taken.
Registry Keys Detected: 11
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{4D9101D6-5BA0-4048-BDDE-7E2DF54C8C47} (PUP.Optional.Linkey.A) -> No action taken.
HKCU\Software\Softonic\Universal Downloader (PUP.Optional.Softonic.A) -> No action taken.

 

(note: No action taken is not correct; owner has removed files)

------------------------------------------------------------------------------


Edited by Farlith, 12 May 2014 - 09:49 AM.


BC AdBot (Login to Remove)

 


#2 Alex&Vanko

Alex&Vanko

  • Banned
  • 1,394 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:47 PM

Posted 12 May 2014 - 09:55 AM

Hallo Farlith and :welcome:

Do nothing,refuse action.

We will use newer version of Malwarebytes later on.Is your version free or paid one?

 

Download Screen317 Security Check HERE and save it to your Desktop.
* Double-click SecurityCheck.exe
* Follow the onscreen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt
* Please post the contents of that document.
Note:: If any security program requests permission to access the Internet, allow it to do so

Please download MiniToolBox HERE to your desktop to run it.
Checkmark the following boxes:
* List content of Hosts
* Flush DNS
* Report IE Proxy Settings
* Reset IE Proxy Settings
* Report FF Proxy Settings
* Reset FF Proxy Settings
* List last 10 Event Viewer log
* List Installed Programs
* List Devices (do NOT change any settings here)
* List Users, Partitions and Memory size
Note: When using "Reset FF Proxy Settings" option Firefox should be closed.
Click Go and Copy / Paste the result. (result.txt)

 

Thank you!



#3 Farlith

Farlith
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:47 PM

Posted 12 May 2014 - 11:15 AM

Hello Alex-Vanko. Malwarebytes and Eset and sandboxie are versions that are paid for. I have run both tools,here are the outputs:

 

-----------------------------------------------------------

 Results of screen317's Security Check version 0.99.83  
   x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:``````````````
 Windows Firewall Enabled!  
ESET Smart Security 7.0   
Windows Defender          
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:`````````
 SpywareBlaster 5.0    
 Adobe Flash Player     13.0.0.206  
 Mozilla Firefox (29.0.1)
````````Process Check: objlist.exe by Laurent````````  
 ESET NOD32 Antivirus egui.exe  
 ESET NOD32 Antivirus ekrn.exe  
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C:  %
````````````````````End of Log``````````````````````

 

--------------------------------------------------------------------------------------------

MiniToolBox by Farbar  Version: 23-01-2014
Ran by Mirretje (administrator) on 12-05-2014 at 18:05:44
Running from "D:\"
Microsoft Windows 8.1  (X64)
Boot Mode: Normal
***************************************************************************

========================= Flush DNS: ===================================

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.

"Reset IE Proxy Settings": IE Proxy Settings were reset.

========================= FF Proxy Settings: ==============================


"Reset FF Proxy Settings": Firefox Proxy settings were reset.

========================= Hosts content: =================================




========================= Event log errors: ===============================

Application errors:
==================
Error: (05/12/2014 05:43:52 PM) (Source: Application Hang) (User: )
Description: The program TOTALCMD.EXE version 8.5.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: e68

Start Time: 01cf6df8c2aabe18

Termination Time: 4294967295

Application Path: C:\Totalcmd\TOTALCMD.EXE

Report Id: 3732eafe-d9ec-11e3-bed7-50465d445d21

Faulting package full name:

Faulting package-relative application ID:

Error: (05/12/2014 05:37:57 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 2765453

Error: (05/12/2014 05:37:57 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 2765453

Error: (05/12/2014 05:37:57 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (05/12/2014 01:21:04 PM) (Source: Application Error) (User: )
Description: Faulting application name: mbam.exe, version: 1.0.0.500, time stamp: 0x533d8de2
Faulting module name: MSVCR100.dll, version: 10.0.40219.325, time stamp: 0x4df2be1e
Exception code: 0x40000015
Fault offset: 0x0008d6fd
Faulting process ID: 0x13a8
Faulting application start time: 0xmbam.exe0
Faulting application path: mbam.exe1
Faulting module path: mbam.exe2
Report ID: mbam.exe3
Faulting package full name: mbam.exe4
Faulting package-relative application ID: mbam.exe5

Error: (05/12/2014 01:20:55 PM) (Source: Application Error) (User: )
Description: Faulting application name: mbam.exe, version: 1.0.0.500, time stamp: 0x533d8de2
Faulting module name: MSVCR100.dll, version: 10.0.40219.325, time stamp: 0x4df2be1e
Exception code: 0x40000015
Fault offset: 0x0008d6fd
Faulting process ID: 0xc30
Faulting application start time: 0xmbam.exe0
Faulting application path: mbam.exe1
Faulting module path: mbam.exe2
Report ID: mbam.exe3
Faulting package full name: mbam.exe4
Faulting package-relative application ID: mbam.exe5


System errors:
=============
Error: (05/12/2014 05:43:13 PM) (Source: DCOM) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)UnavailableUnavailable

Error: (05/12/2014 03:41:31 PM) (Source: Service Control Manager) (User: )
Description: The NVIDIA Update Service Daemon service failed to start due to the following error:
%%1069

Error: (05/12/2014 03:41:31 PM) (Source: Service Control Manager) (User: )
Description: The nvUpdatusService service was unable to log on as .\UpdatusUser with the currently configured password due to the following error:
%%1326

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).

Error: (05/12/2014 03:38:15 PM) (Source: DCOM) (User: NT AUTHORITY)
Description: application-specificLocalActivation{D63B10C5-BB46-4990-A94F-E40B9D520160}{9CA88EE3-ACB7-47C8-AFC4-AB702511C276}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)UnavailableUnavailable

Error: (05/12/2014 01:31:04 PM) (Source: Service Control Manager) (User: )
Description: The NVIDIA Update Service Daemon service failed to start due to the following error:
%%1069

Error: (05/12/2014 01:31:04 PM) (Source: Service Control Manager) (User: )
Description: The nvUpdatusService service was unable to log on as .\UpdatusUser with the currently configured password due to the following error:
%%1326

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).

Error: (05/12/2014 01:02:42 PM) (Source: Service Control Manager) (User: )
Description: The NVIDIA Update Service Daemon service failed to start due to the following error:
%%1069

Error: (05/12/2014 01:02:42 PM) (Source: Service Control Manager) (User: )
Description: The nvUpdatusService service was unable to log on as .\UpdatusUser with the currently configured password due to the following error:
%%1326

To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).


Microsoft Office Sessions:
=========================
Error: (05/12/2014 05:43:52 PM) (Source: Application Hang)(User: )
Description: TOTALCMD.EXE7.5.0.0e6801cf6df8c2aabe184294967295C:\Totalcmd\TOTALCMD.EXE3732eafe-d9ec-11e3-bed7-50465d445d21

Error: (05/12/2014 05:37:57 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 2765453

Error: (05/12/2014 05:37:57 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 2765453

Error: (05/12/2014 05:37:57 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (05/12/2014 01:21:04 PM) (Source: Application Error)(User: )
Description: mbam.exe1.0.0.500533d8de2MSVCR100.dll10.0.40219.3254df2be1e400000150008d6fd13a801cf6dd4434419cbC:\Program Files (x86)\Malwarebytes\mbam.exeC:\Program Files (x86)\Malwarebytes\MSVCR100.dll8101564a-d9c7-11e3-bed5-50465d445d21

Error: (05/12/2014 01:20:55 PM) (Source: Application Error)(User: )
Description: mbam.exe1.0.0.500533d8de2MSVCR100.dll10.0.40219.3254df2be1e400000150008d6fdc3001cf6dd43d7dc556C:\Program Files (x86)\Malwarebytes\mbam.exeC:\Program Files (x86)\Malwarebytes\MSVCR100.dll7b97fe85-d9c7-11e3-bed5-50465d445d21


CodeIntegrity Errors:
===================================
  Date: 2014-05-11 15:44:21.492
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\services.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Settings Manager\systemk\x64\sysapcrt.dll that did not meet the Windows signing level requirements.

  Date: 2014-05-11 15:44:21.430
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\services.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Settings Manager\systemk\sysapcrt.dll that did not meet the Windows signing level requirements.

  Date: 2014-05-11 14:39:29.279
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\services.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Settings Manager\systemk\x64\sysapcrt.dll that did not meet the Windows signing level requirements.

  Date: 2014-05-11 14:39:29.232
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\services.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Settings Manager\systemk\sysapcrt.dll that did not meet the Windows signing level requirements.

  Date: 2014-05-11 14:13:34.026
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\services.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Settings Manager\systemk\x64\sysapcrt.dll that did not meet the Windows signing level requirements.

  Date: 2014-05-11 14:13:33.964
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\services.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Settings Manager\systemk\sysapcrt.dll that did not meet the Windows signing level requirements.

  Date: 2014-05-11 13:42:16.882
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\services.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Settings Manager\systemk\x64\sysapcrt.dll that did not meet the Windows signing level requirements.

  Date: 2014-05-11 13:42:16.835
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\services.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Settings Manager\systemk\sysapcrt.dll that did not meet the Windows signing level requirements.

  Date: 2014-05-10 23:02:58.071
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\services.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Settings Manager\systemk\x64\sysapcrt.dll that did not meet the Windows signing level requirements.

  Date: 2014-05-10 23:02:58.009
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\services.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Settings Manager\systemk\sysapcrt.dll that did not meet the Windows signing level requirements.


=========================== Installed Programs ============================

Aangifte inkomstenbelasting 2013
Adobe Flash Player 13 Plugin (Version: 13.0.0.206)
AIMP3 (Version: v3.55.1324, 15.11.2013)
Alcor Micro USB Card Reader (Version: 3.9.142.62248)
Apple Application Support (Version: 3.0.1)
Apple Mobile Device Support (Version: 7.1.1.3)
Apple Software Update (Version: 2.1.3.127)
ASUS Instant Connect (Version: 1.2.8)
ASUS Instant Key (Version: 1.0.5)
ASUS InstantOn (Version: 3.0.4)
ASUS LifeFrame3 (Version: 3.1.9)
ASUS Live Update (Version: 3.1.9)
ASUS N Series Demo (Version: 1.0.0002)
ASUS Power4Gear Hybrid (Version: 2.0.4)
ASUS Product Demo Movie  (Version: 1.0.3)
ASUS Smart Gesture (Version: 1.0.35)
ASUS Splendid Video Enhancement Technology (Version: 1.03.0004)
ASUS Tutor (Version: 1.0.7)
ASUS USB Charger Plus (Version: 2.1.5)
ASUS Video Magic (Version: 6.0.4712)
ASUS WebStorage Sync Agent (Version: 1.1.9.120)
ASUSDVD (Version: 10.0.4126.52)
Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver (Version: 2.1.0.7)
ATK Package (Version: 1.0.0023)
Audacity 2.0.3 (Version: 2.0.3)
Battle.net
Blender (Version: 2.69)
Bonjour (Version: 3.0.0.10)
CCleaner (Version: 4.13)
CommandosAmmo Pack
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
Defraggler (Version: 2.17)
DHTML Editing Component (Version: 6.02.0001)
ESET Smart Security (Version: 7.0.302.26)
FastStone Capture 7.3 (Version: 7.3)
GemistDownloader (Version: 2.8.1.4)
Grand Theft Auto V - The Manual (Version: 1.0.0)
Hearthstone
Intel® Management Engine Components (Version: 8.1.0.1252)
Intel® Processor Graphics (Version: 10.18.10.3308)
Intel® SDK for OpenCL - CPU Only Runtime Package (Version: 2.0.0.37149)
Intel® Trusted Connect Service Client (Version: 1.24.388.1)
IrfanView (remove only) (Version: 4.35)
iTunes (Version: 11.1.5.5)
Microsoft Office Access MUI (Dutch) 2010 (Version: 14.0.7015.1000)
Microsoft Office Excel MUI (Dutch) 2010 (Version: 14.0.7015.1000)
Microsoft Office Groove MUI (Dutch) 2010 (Version: 14.0.7015.1000)
Microsoft Office InfoPath MUI (Dutch) 2010 (Version: 14.0.7015.1000)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000)
Microsoft Office OneNote MUI (Dutch) 2010 (Version: 14.0.7015.1000)
Microsoft Office Outlook MUI (Dutch) 2010 (Version: 14.0.7015.1000)
Microsoft Office PowerPoint MUI (Dutch) 2010 (Version: 14.0.7015.1000)
Microsoft Office Professional Plus 2010 (Version: 14.0.7015.1000)
Microsoft Office Proof (Dutch) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proof (English) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proof (French) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proof (German) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proofing (Dutch) 2010 (Version: 14.0.7015.1000)
Microsoft Office Publisher MUI (Dutch) 2010 (Version: 14.0.7015.1000)
Microsoft Office Shared 64-bit MUI (Dutch) 2010 (Version: 14.0.7015.1000)
Microsoft Office Shared MUI (Dutch) 2010 (Version: 14.0.7015.1000)
Microsoft Office Word MUI (Dutch) 2010 (Version: 14.0.7015.1000)
Microsoft Silverlight (Version: 5.1.30214.0)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft_VC80_CRT_x86 (Version: 8.0.50727.4053)
Microsoft_VC90_CRT_x86 (Version: 1.00.0000)
Mozilla Firefox 29.0.1 (x86 nl) (Version: 29.0.1)
Mozilla Maintenance Service (Version: 28.0)
NVIDIA 3D Vision Driver 327.02 (Version: 327.02)
NVIDIA Control Panel 327.02 (Version: 327.02)
NVIDIA Graphics Driver 327.02 (Version: 327.02)
NVIDIA HD Audio Driver 1.3.18.0 (Version: 1.3.18.0)
NVIDIA Install Application (Version: 2.1002.133.889)
NVIDIA Optimus 1.11.3 (Version: 1.11.3)
NVIDIA PhysX (Version: 9.12.0613)
NVIDIA PhysX System Software 9.12.0613 (Version: 9.12.0613)
NVIDIA Stereoscopic 3D Driver (Version: 7.17.13.2702)
NVIDIA Update 1.11.3 (Version: 1.11.3)
NVIDIA Update Components (Version: 1.11.3)
Qualcomm Atheros Bluetooth Suite (64) (Version: 8.0.0.212)
Qualcomm Atheros Client Installation Program (Version: 10.0)
Realtek High Definition Audio Driver (Version: 6.0.1.6710)
Sandboxie 4.08 (64-bit) (Version: 4.08)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition
Shared C Run-time for x64 (Version: 10.0.0)
Skype™ 6.11 (Version: 6.11.102)
SpywareBlaster 5.0 (Version: 5.0.0)
STDU Viewer version 1.6.307.0 (Version: 1.6.307.0)
Total Commander 64-bit (Remove or Repair) (Version: 8.51a)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition
Update for Microsoft Filter Pack 2.0 (KB2837594) 32-Bit Edition
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition
Update for Microsoft InfoPath 2010 (KB2817396) 32-Bit Edition
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition
Update for Microsoft Office 2010 (KB2863818) 32-Bit Edition
Update for Microsoft Office 2010 (KB2878225) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition
Update for Microsoft Visio 2010 (KB2553444) 32-Bit Edition
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition
VLC media player 2.1.2 (Version: 2.1.2)
VMware View Client (Version: 5.2.1.937772)
Warcraft III
Windows Driver Package - ASUS (ATP) Mouse  (10/29/2012 1.0.0.148) (Version: 10/29/2012 1.0.0.148)
WinFlash (Version: 2.41.1)
WinRAR 4.20 (64-bit) (Version: 4.20.0)
WinSCP 5.1.7 (Version: 5.1.7)
X-Edit (Version: 2.7.1.1)

========================= Memory info: ===================================

Percentage of memory in use: 31%
Total physical RAM: 3981.5 MB
Available physical RAM: 2707.56 MB
Total Pagefile: 8077.5 MB
Available Pagefile: 6700.37 MB
Total Virtual: 4095.88 MB
Available Virtual: 3961.3 MB

========================= Partitions: =====================================

1 Drive c: (OS) (Fixed) (Total:185.96 GB) (Free:131.49 GB) NTFS
2 Drive d: (Data) (Fixed) (Total:258.15 GB) (Free:231.47 GB) NTFS
4 Drive f: () (Removable) (Total:31.23 GB) (Free:31.21 GB) FAT32

========================= Users: ========================================

User accounts for \\MIRJAM

Administrator            Guest                    Mirretje                 
UpdatusUser              


**** End of log ****
 



#4 Alex&Vanko

Alex&Vanko

  • Banned
  • 1,394 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:47 PM

Posted 12 May 2014 - 11:55 AM

Something is wrong with Malwarebytes and Total Commander.How did you configure Sandboxie?

Disable Windows Firewall as ESET has one.

Is Spywareblaster active?

So it is paid version of Malwarebytes so keep it,because I don`t know if the license is valid for the new version.

Thank you!



#5 Farlith

Farlith
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:47 PM

Posted 12 May 2014 - 03:33 PM

Something is wrong with Malwarebytes and Total Commander.How did you configure Sandboxie?

Disable Windows Firewall as ESET has one.

Is Spywareblaster active?

So it is paid version of Malwarebytes so keep it,because I don`t know if the license is valid for the new version.

Thank you!

 

After some more manual checks/tuning I have managed to remove/reinstall total commander (own registration). Malwarebytes removed/reinstalled and went for 

update. This malwarebytes has lifetime license. Eset smart security takes over the windows firewall by design; working as intended. Sandboxie is running two

sandboxes with different exclusions/access to files/folders and internet. One of the boxes is running the browsers forced now to keep the system from potential

exploits/malware.

 

For now all problems seem to be gone so you can consider this as 'solved'. :)

 

Thank you.


Edited by Farlith, 12 May 2014 - 03:34 PM.


#6 Alex&Vanko

Alex&Vanko

  • Banned
  • 1,394 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:47 PM

Posted 12 May 2014 - 03:46 PM

Hallo Farlith!

I mean if Malwarebytes contains inside Sandboxie.ESET and Malwarebytes are very good together.

Spywareblaster is not good.

May we turn off Sandboxie?

Please download AdwCleaner by Xplode HERE onto your desktop.

    Close all open programs and internet browsers.
    Double click on AdwCleaner.exe to run the tool.
    Click on Scan.
    After the scan is complete click on "Clean"
    Confirm each time with Ok.
    Your computer will be rebooted automatically. A text file will open after the restart.
    Please post the content of that logfile with your next answer.
    You can find the logfile at C:\AdwCleaner[S1].txt as well.

 

After that:

Please download Junkware Removal Tool HERE to your desktop.

    Shut down your protection software now to avoid potential conflicts.
    Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
    The tool will open and start scanning your system.
    Please be patient as this can take a while to complete depending on your system's specifications.
    On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    Post the contents of JRT.txt into your next message.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users