GruntWorker Posted July 14, 2015 ID:976289 Share Posted July 14, 2015 When ever i try to run mbar, i get an error saying that the effectdll.dll file has been infected and cannot be remediated because there is no backup file. Attached is the mbam-check log, FRST+Additions txtAddition.txtCheckResults.txtFRST.txt Link to post Share on other sites More sharing options...
Staff tetonbob Posted July 14, 2015 Staff ID:976292 Share Posted July 14, 2015 Hello. Please provide the system-log.txt file from the mbar folder that should be on your desktop. Also provide the MBAR scan log. It will be named like this:mbar-log-2015-xx-xx(xx-xx-xx).txt (where xx-xx(xx-xx-xx) is the date and time of the scan) Link to post Share on other sites More sharing options...
GruntWorker Posted July 15, 2015 Author ID:976364 Share Posted July 15, 2015 here I did i scan from my administrator desktop but there was no log file there. So i assumed that it saved to an old user account hard to findandmbar-log-2015-07-14 (17-22-56).txt Link to post Share on other sites More sharing options...
Staff tetonbob Posted July 15, 2015 Staff ID:976430 Share Posted July 15, 2015 Hello. Thanks for the scan log. In that same mbar folder, there should be another log file named system-log and it is that log I'd like to also see. Link to post Share on other sites More sharing options...
GruntWorker Posted July 15, 2015 Author ID:976522 Share Posted July 15, 2015 STRANGE. i posted twice yesterday and could not get the file to upload.(and neither the posts?) i will try again. then run another scan.system-log.txtmbar-log-2015-07-14 (20-05-06).txt Link to post Share on other sites More sharing options...
Staff tetonbob Posted July 15, 2015 Staff ID:976571 Share Posted July 15, 2015 Hello again. No need to run another MBAR scan. It's discarding those results. The real question is why is the file being detected. I'd like to get a look at the original file.Delete this folder if it still exists:C:\ProgramData\Malwarebytes' Anti-Malware (portable) Please download SystemLook from the link below and save it to your Desktop.http://jpshortstuff.247fixes.com/beta/SystemLook/SystemLook_x64.exehttp://downloads.malwareremoval.com/SystemLook/SystemLook_x64.exeDouble-click SystemLook_x64.exe to run it.Copy the info below and paste it into the main text field(don't miss the colon : in front of :filefind):filefindEffectDLL.dllClick the Look button to start the scan.When finished, a notepad window will open with the results of the scan.Once that is run a log will be created and presented to the monitor and saved to the desktop, attach it in your next reply.Please save using the default Notepad format. Link to post Share on other sites More sharing options...
GruntWorker Posted July 16, 2015 Author ID:976631 Share Posted July 16, 2015 was unable to delete folder. Although i am using the administrator profile, i am denied permission.SystemLook.txt Link to post Share on other sites More sharing options...
Staff tetonbob Posted July 16, 2015 Staff ID:976634 Share Posted July 16, 2015 Did you have MBAR running still, by any chance?Be sure MBAR is not running.Please disable MBAM's self-protection.Restart the computer.Try again to delete C:\ProgramData\Malwarebytes' Anti-Malware (portable) Link to post Share on other sites More sharing options...
GruntWorker Posted July 16, 2015 Author ID:976659 Share Posted July 16, 2015 No luck deleting the folder. I even disabled it from start up. Link to post Share on other sites More sharing options...
Staff tetonbob Posted July 16, 2015 Staff ID:976763 Share Posted July 16, 2015 Send me new diagnostic logs, please. FRST and mbam-check. Thanks. For FRST, please ensure there's a check in the Addition.txt box before clicking on Scan Link to post Share on other sites More sharing options...
GruntWorker Posted July 16, 2015 Author ID:976866 Share Posted July 16, 2015 also screen shots of mbam folder in program dataFRST.txtCheckResults.txtAddition.txt Link to post Share on other sites More sharing options...
Staff tetonbob Posted July 16, 2015 Staff ID:976872 Share Posted July 16, 2015 Self-protection is still enabled. Chameleon: 4 (The service is running.) EarlyStartSelfProtection: true SelfProtection: true Please **disable** self-protection as requested and then restart the computer. To disable self-protection:Go to Settings in the top navigation Go to Advanced Settings Uncheck Enable self-protection module Link to post Share on other sites More sharing options...
GruntWorker Posted July 17, 2015 Author ID:977050 Share Posted July 17, 2015 disabled mbam early start up protection and restartedFRST.txtAddition.txtAddition.txt Link to post Share on other sites More sharing options...
GruntWorker Posted July 17, 2015 Author ID:977052 Share Posted July 17, 2015 disabled mbam early start up protection and restartedCheckResults.txt Link to post Share on other sites More sharing options...
Staff tetonbob Posted July 17, 2015 Staff ID:977055 Share Posted July 17, 2015 Ok, according to the logs, self-protection is now disabled, but mbamchameleon is still running. Do this next, with MBAR •Please run Malwarebytes Anti-Rootkit (MBAR), but we need to run it a special way. Open the \mbar folder, then hold the right shift key and right click a blank space in the folder.•Select "open command window here"•In the black command prompt box, type in the following and press Enter:mbar.exe /r(note - there is a space between mbar.exe and /r)•You should see a small message box indicating the protection driver was removed. Please confirm. It's possible you may need to run mbar.exe /r more than once to complete this task. Restart your computer. Run mbam-check once more and send the new log.Thanks! Link to post Share on other sites More sharing options...
GruntWorker Posted July 17, 2015 Author ID:977060 Share Posted July 17, 2015 CheckCheckResults.txt Link to post Share on other sites More sharing options...
Staff tetonbob Posted July 17, 2015 Staff ID:977062 Share Posted July 17, 2015 OK, now I'd like you to copy a couple of those files in MBAM's programdata directory as shown in your earlier screenshot. Like these: C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\EffectDLL.dll-r.mbamC:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\effectDLL.dll-k.mbamC:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\effectDLL.dll-k.mbam-k.mbamC:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\EffectDLL.dll-u.mbam-k.mbam-r.mbam Zip them up and attach them in reply.You can delete the rest if they still exist. Also, you can now delete this folder: C:\ProgramData\Malwarebytes' Anti-Malware (portable) Link to post Share on other sites More sharing options...
GruntWorker Posted July 17, 2015 Author ID:977064 Share Posted July 17, 2015 Done and doneEffectdlls.rar Link to post Share on other sites More sharing options...
Staff tetonbob Posted July 17, 2015 Staff ID:977065 Share Posted July 17, 2015 Ok, these are copies of a file that the rootkit scanner makes sometimes during examination, in this case an ASUS file. I'm not sure why MBAM/MBAR are detecting these, and using SystemLook, we didn't find that file on your system anywhere. Let's try this once more. Run SystemLook again, using this code :filefindEffectDLL.* Double-click SystemLook_x64.exe to run it.Copy the info below and paste it into the main text field(don't miss the colon : in front of :filefind):filefindEffectDLL.*Click the Look button to start the scan.When finished, a notepad window will open with the results of the scan.Once that is run a log will be created and presented to the monitor and saved to the desktop, attach it in your next reply.Please save using the default Notepad format. Link to post Share on other sites More sharing options...
GruntWorker Posted July 17, 2015 Author ID:977068 Share Posted July 17, 2015 systemlook.txt Link to post Share on other sites More sharing options...
GruntWorker Posted July 17, 2015 Author ID:977069 Share Posted July 17, 2015 systemlook.txtSystemLook.txt Link to post Share on other sites More sharing options...
Staff tetonbob Posted July 17, 2015 Staff ID:977071 Share Posted July 17, 2015 OK, so nothing there but the Recent Windows history and the rar file you made. Try running MBAR again. Be sure to update it's database. See if the EffectDLL.dll still detected during the scan. Send the new system-log.txt after the scan is done and you've exited MBAR. Link to post Share on other sites More sharing options...
GruntWorker Posted July 17, 2015 Author ID:977079 Share Posted July 17, 2015 scan finished cleansystem-log.txt Link to post Share on other sites More sharing options...
Staff tetonbob Posted July 17, 2015 Staff ID:977093 Share Posted July 17, 2015 Well, that's a bit of a mystery, but at least you're no longer seeing that issue during a scan. You can re-enable MBAM's self-protection whenever you're ready to. Other than that, you should be all set. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now