6 replies to this topic

[DragonMaster Jay]

Had a user recently who had potential false positives. Please analyze the log. Thanks.

Thread: http://www.geekpolice.net/virus-spyware-ma...5511.htm#100693

Malwarebytes' Anti-Malware 1.41
Database version: 3143
Windows 5.1.2600 Service Pack 3

11/11/2009 4:51:15 AM
mbam-log-2009-11-11 (04-51-15).txt

Scan type: Full Scan (C:\|)
Objects scanned: 205307
Time elapsed: 2 hour(s), 33 minute(s), 46 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 7

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\commyFix\Combo-Fix.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\commyFix11601c\Combo-Fix.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP3\A0007465.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP4\A0012818.ocx (Adware.Gdown) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\ReinstallBackups\0005\DriverFiles\i386\atapi.sys (Rootkit) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\ReinstallBackups\0013\DriverFiles\i386\atapi.sys (Rootkit) -> Quarantined and deleted successfully.
C:\WINDOWS\$NtServicePackUninstall$\atapi.sys (Rootkit) -> Quarantined and deleted successfully.

[nosirrah]

C:\WINDOWS\SYSTEM32\ReinstallBackups\0005\DriverFiles\i386\atapi.sys (Rootkit) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\ReinstallBackups\0013\DriverFiles\i386\atapi.sys (Rootkit) -> Quarantined and deleted successfully.
C:\WINDOWS\$NtServicePackUninstall$\atapi.sys (Rootkit) -> Quarantined and deleted successfully.

Already fixed

The others , I may need the files to know for sure .

[DragonMaster Jay]

I have asked the user to run MBAM in developer mode. Would that work?

[nosirrah]

update first but yes , that will work

[DragonMaster Jay]

Sorry for the delay, the user has not replied, yet.

Do you think it is too late?

[nosirrah]

I have this fixed , got the data from another source .

[DragonMaster Jay]

Thanks for letting me know.