Help - trying to remove BraveSentry etc

[StckFigure]

- No instances of ASPI113210 found
- No instances of CMDService found
- 2086 instances of Core found (see next post)
- 6930 instances of Driver found (see next post)
- No instances of NETWORK_MONITOR found
- No instances of NEW_DRV found
- No instances of WINCOM32 found
- No instances of Network Monitor found
- No instances of new_drv found
- No instances of RpcApi found
- 18 instances of windbg48 found

I'm assuming this is a good sign, since Core and Driver are so common, unless you expected it to find one of these and it's hidden. As before, if we can later do something to hide the posts with the results if there's any identifying info in them, since I'm not sure what's available from registry keys, that'd be fantastic.

[PhilliePhan]

I'm assuming this is a good sign, since Core and Driver are so common, unless you expected it to find one of these and it's hidden. As before, if we can later do something to hide the posts with the results if there's any identifying info in them, since I'm not sure what's available from registry keys, that'd be fantastic.

I'm leaning with you in this instance - Not finding all those others is good. I have seen instances where they have been a rea b!tch to remove. ('course this was a few months ago - looks like Combofix has been updated to nail a lot of those... )
sUBs and OldTimer and all the rest in the anti-malware community who put their time and effort into the creation of these free tools are to be commended!
I wrote a similar on to remove a few of the threats you had on your compy, but combofix puts my efforts to shame!

But I digress....

I figured Core and Driver would produce a lot of entries to be sifted through, but based on the results for the others, I'd wager that combofix removed them all. So probably no worries there.

-- As you may have surmised, I am not up to date on the latest baddies. With the weather improving plus other responsibilities, I have had to put fighting malware on the back burner for a bit
-- WINDBG48 looks like some sort of rootkit driver.... Definitely reeks of malware to me.

If you know how to backup those keys with regedit, I suggest you do that and then Delete them (or try to).
Otherwise, I can put together a "one click" registry merge to do it for you when I get home later tonight.

Judy can probably help as well.

After this batch, I suggest running Combofix again and post a new log and then we'll attack whatever remains.

Cheers
PP