What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Help Analyzing Combo-Fix Log

2 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
ComboFix 11-07-20.02 - Computer 07/20/2011 11:27:13.2.2 - x86 Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.2046.1401 [GMT -7:00] Running from: c:\users\[removed]\Desktop\Combo-Fix.exe AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160} SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((( Files Created from 2011-06-20 to 2011-07-20 ))))))))))))))))))))))))))))))) . . 2011-07-20 18:34 . 2011-07-20 18:34 ——– d—–w- c:\users\Default\AppData\Local\temp 2011-07-20 18:18 . 2011-07-20 18:18 28752 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{232561FC-3220-4F2C-81CB-0339428A47CA}\MpKslc8994783.sys 2011-07-20 18:08 . 2011-06-07 15:55 7074640 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{232561FC-3220-4F2C-81CB-0339428A47CA}\mpengine.dll 2011-07-20 17:51 . 2011-07-20 18:05 ——– d—–w- C:\Combo-Fix 2011-07-20 17:15 . 2011-07-20 17:15 ——– d—–w- c:\users\Computer\AppData\Local\Apple 2011-07-20 17:14 . 2011-07-20 17:14 ——– d—–w- c:\users\Computer\AppData\Local\Apple Computer 2011-07-20 02:22 . 2011-07-20 02:22 ——– d—–w- c:\program files\ESET 2011-07-19 17:31 . 2011-07-19 17:31 ——– d—–w- c:\program files\iPod 2011-07-19 17:31 . 2011-07-19 17:32 ——– d—–w- c:\program files\iTunes 2011-07-19 17:24 . 2011-07-19 17:24 ——– d—–w- c:\program files\Apple Software Update 2011-07-16 00:26 . 2011-03-25 02:57 43008 —-a-w- c:\windows\system32\drivers\usbehci.sys 2011-07-16 00:26 . 2011-03-25 02:58 258560 —-a-w- c:\windows\system32\drivers\usbhub.sys 2011-07-16 00:26 . 2011-03-25 02:58 284672 —-a-w- c:\windows\system32\drivers\usbport.sys 2011-07-16 00:26 . 2011-03-25 02:57 24064 —-a-w- c:\windows\system32\drivers\usbuhci.sys 2011-07-16 00:26 . 2011-03-25 02:57 5888 —-a-w- c:\windows\system32\drivers\usbd.sys 2011-07-16 00:26 . 2011-03-25 02:58 75776 —-a-w- c:\windows\system32\drivers\usbccgp.sys 2011-07-16 00:21 . 2011-06-11 02:29 2334208 —-a-w- c:\windows\system32\win32k.sys 2011-07-02 21:34 . 2011-07-02 21:34 ——– d—–w- c:\users\Default\AppData\Roaming\Trusteer 2011-06-29 15:53 . 2011-06-29 15:53 229224 —-a-w- c:\windows\system32\drivers\VMM.sys 2011-06-29 15:53 . 2011-04-22 23:25 2382848 —-a-w- c:\windows\system32\mshtml.tlb 2011-06-29 15:53 . 2011-04-25 15:29 141104 —-a-w- c:\program files\Internet Explorer\sqmapi.dll 2011-06-29 15:53 . 2011-04-22 23:35 1797632 —-a-w- c:\windows\system32\jscript9.dll 2011-06-29 15:49 . 2011-05-24 10:44 293376 —-a-w- c:\windows\system32\umpnpmgr.dll 2011-06-29 15:49 . 2011-02-25 05:34 571904 —-a-w- c:\windows\system32\oleaut32.dll 2011-06-29 15:49 . 2011-05-03 04:30 741376 —-a-w- c:\windows\system32\inetcomm.dll 2011-06-29 15:49 . 2011-04-22 19:14 27008 —-a-w- c:\windows\system32\drivers\Diskdump.sys 2011-06-29 15:49 . 2011-04-09 06:02 3967872 —-a-w- c:\windows\system32\ntkrnlpa.exe 2011-06-29 15:49 . 2011-04-09 06:02 3912576 —-a-w- c:\windows\system32\ntoskrnl.exe 2011-06-27 23:50 . 2011-06-27 23:50 ——– d—–w- c:\users\Computer\AppData\Local\Diagnostics 2011-06-23 01:01 . 2011-06-23 01:01 53816 —-a-w- c:\windows\system32\drivers\RapportKELL.sys 2011-06-20 23:08 . 2011-06-20 23:08 ——– d—–w- c:\program files\Common Files\Adobe . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-07-07 02:52 . 2011-04-30 02:42 41272 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-07-07 02:52 . 2011-04-30 02:42 22712 —-a-w- c:\windows\system32\drivers\mbam.sys 2011-06-19 02:00 . 2011-05-25 01:10 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-06-18 19:30 . 2011-06-18 19:26 164880 —ha-w- c:\users\Computer\AppData\Roaming\Microsoft\Virtual PC\VPCKeyboard.dll 2011-06-07 15:55 . 2011-05-29 20:01 7074640 —-a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2011-05-04 11:52 . 2011-05-26 00:10 472808 —-a-w- c:\windows\system32\deployJava1.dll 2011-05-03 16:08 . 2011-05-25 01:21 4756216 —-a-w- c:\windows\system32\GameMon.des 2011-04-30 03:15 . 2009-07-14 02:05 152576 —-a-w- c:\windows\system32\msclmd.dll 2011-04-30 02:56 . 2011-04-30 02:56 74752 —-a-w- c:\windows\system32\RegisterIEPKEYs.exe 2011-04-30 02:56 . 2011-04-30 02:56 161792 —-a-w- c:\windows\system32\msls31.dll 2011-04-30 02:56 . 2011-04-30 02:56 1126912 —-a-w- c:\windows\system32\wininet.dll 2011-04-30 02:56 . 2011-04-30 02:56 110592 —-a-w- c:\windows\system32\IEAdvpack.dll 2011-04-30 02:56 . 2011-04-30 02:56 86528 —-a-w- c:\windows\system32\iesysprep.dll 2011-04-30 02:56 . 2011-04-30 02:56 76800 —-a-w- c:\windows\system32\SetIEInstalledDate.exe 2011-04-30 02:56 . 2011-04-30 02:56 74752 —-a-w- c:\windows\system32\iesetup.dll 2011-04-30 02:56 . 2011-04-30 02:56 63488 —-a-w- c:\windows\system32\tdc.ocx 2011-04-30 02:56 . 2011-04-30 02:56 48640 —-a-w- c:\windows\system32\mshtmler.dll 2011-04-30 02:56 . 2011-04-30 02:56 367104 —-a-w- c:\windows\system32\html.iec 2011-04-30 02:56 . 2011-04-30 02:56 420864 —-a-w- c:\windows\system32\vbscript.dll 2011-04-30 02:56 . 2011-04-30 02:56 23552 —-a-w- c:\windows\system32\licmgr10.dll 2011-04-30 02:56 . 2011-04-30 02:56 152064 —-a-w- c:\windows\system32\wextract.exe 2011-04-30 02:56 . 2011-04-30 02:56 150528 —-a-w- c:\windows\system32\iexpress.exe 2011-04-30 02:56 . 2011-04-30 02:56 142848 —-a-w- c:\windows\system32\ieUnatt.exe 2011-04-30 02:56 . 2011-04-30 02:56 1427456 —-a-w- c:\windows\system32\inetcpl.cpl 2011-04-30 02:56 . 2011-04-30 02:56 11776 —-a-w- c:\windows\system32\mshta.exe 2011-04-30 02:56 . 2011-04-30 02:56 101888 —-a-w- c:\windows\system32\admparse.dll 2011-04-30 02:56 . 2011-04-30 02:56 35840 —-a-w- c:\windows\system32\imgutil.dll 2011-04-30 02:13 . 2010-06-24 18:33 18328 —-a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2011-06-16 04:17 . 2011-07-02 04:31 142296 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-30 421888] "ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-28 207424] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-06-08 421160] "Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-07-07 449584] . c:\users\Computer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . R1 MpKsl5226b7f5;MpKsl5226b7f5;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5DEBC353-3374-4E8C-B9F3-CE861A267D18}\MpKsl5226b7f5.sys [x] R1 MpKsl6b4ad54e;MpKsl6b4ad54e;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CAA1D684-A3DF-47E9-9C41-107891E0346E}\MpKsl6b4ad54e.sys [x] R1 MpKsl8fc3ebe6;MpKsl8fc3ebe6;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{15BBC93F-3A67-4770-B3AE-4B2615F57285}\MpKsl8fc3ebe6.sys [x] R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 iPodDrv;iPodDrv;c:\windows\system32\drivers\iPodDrv.sys [x] R3 EagleXNt;EagleXNt;c:\windows\system32\drivers\EagleXNt.sys [x] R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-10-25 43392] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2010-10-25 54144] R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 206360] R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2011-05-03 4756216] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872] R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224] R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x] R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-04-30 1343400] S0 RapportKELL;RapportKELL;c:\windows\System32\Drivers\RapportKELL.sys [2011-06-23 53816] S1 MpKslc8994783;MpKslc8994783;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{232561FC-3220-4F2C-81CB-0339428A47CA}\MpKslc8994783.sys [2011-07-20 28752] S1 RapportCerberus_26762;RapportCerberus_26762;c:\programdata\Trusteer\Rapport\store\exts\RapportCerberus\26762\RapportCerberus_26762.sys [2011-06-14 57144] S1 RapportEI;RapportEI;c:\program files\Trusteer\Rapport\bin\RapportEI.sys [2011-06-23 66360] S1 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys [2011-06-23 158904] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952] S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-07 366640] S2 RapportMgmtService;Rapport Management Service;c:\program files\Trusteer\Rapport\bin\RapportMgmtService.exe [2011-06-23 870200] S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-07-07 22712] S3 qic157;qic157;c:\windows\system32\DRIVERS\qic157.sys [2009-07-13 8192] . . — Other Services/Drivers In Memory — . *NewlyCreated* - MPKSLC8994783 . . ——- Supplementary Scan ——- . uInternet Settings,ProxyOverride = *.local TCP: DhcpNameServer = 192.168.0.1 192.168.0.1 FF - ProfilePath - c:\users\Computer\AppData\Roaming\Mozilla\Firefox\Profiles\24mz2ulb.default\ . . [HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2011-07-20 11:38:17 ComboFix-quarantined-files.txt 2011-07-20 18:38 ComboFix2.txt 2011-07-20 18:05 . Pre-Run: 205,865,074,688 bytes free Post-Run: 205,805,924,352 bytes free . - - End Of File - - A1E550E659309B8CEC077E2FC87E8FAD I feel somethings going on with my system.
Post #2
Hi Baboo,

:welcome:

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

  • Please go here then click on: [external image: Posted Image]

    Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
    All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

  • Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Now click on: [external image: Posted Image]
  • The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on: [external image: Posted Image]
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI