Windows Malicious Software Removal removed a Backdoor program.
I ran a Full Scan on MBAM, but it got shut down almost immediately. I ran a Quick Scan instead, and it picked up four of the little *******s without getting stopped. Once they were gone, my computer's speed picked right back up. I then ran a full scan but found nothing.
ComboFix still doesn't get past the scanning screen, but I'll try your file extension trick.
MBAM Quick Scan
Malwarebytes' Anti-Malware 1.41
Database version: 3251
Windows 5.1.2600 Service Pack 3
11/28/2009 12:54:16 PM
mbam-log-2009-11-28 (12-54-16).txt
Scan type: Quick Scan
Objects scanned: 115233
Time elapsed: 6 minute(s), 44 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 3
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Contro l\Session Manager\AppCertDlls\appsecdll (Spyware.Passwords) -> Quarantined and deleted successfully.
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\WINDOWS\system32\rdolib.dll (Spyware.Passwords) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mscert.dll (Spyware.Passwords) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\str.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
MBAM Full Scan
Malwarebytes' Anti-Malware 1.41
Database version: 3251
Windows 5.1.2600 Service Pack 3
11/28/2009 3:01:03 PM
mbam-log-2009-11-28 (15-01-02).txt
Scan type: Full Scan (C:\|)
Objects scanned: 185144
Time elapsed: 2 hour(s), 2 minute(s), 46 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
Reply With Quote
Originally Posted by jholland1964
