Help please!
A PC has recently started to misbehave in unpredictable ways, and so although Trend Micro Internet Security 2009 has been installed & running for many months, (and 2008 version before that) I suspect malware may be the cause. Consequently, I downloaded and ran Malwarebytes, ComboFix and HijackThis in that order.
I have attached the three logs and would be very grateful for your comment. I can see that ComboFix has taken some actions in deleting 2 files, but there may well be other offenders lurking.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Combofix log looks clean.
Letting MalwareBytes take care of those threats found may have fixed the problem.
By the way, what exactly is the pc's misbehaviour?
You could also run an online scan to check if Combofix missed something.. e.g. Kaspersky online scan, it will not rmeove any threats found so you would need to save the log.
http://www.kaspersky.c
Thanks - yes the stated nasties were deleted. The mbam scans are now clean. The Atf cleaner was run as well as Hitman which found nothing.
The Kaspersky on-line scanner is currently unavailable.
The misbehavior referred to freequent freezes of IE and some sites (including a bank!) which would either freeze, not accept input or IE would be shut down. Since starting with mbam etc. the PC is now much better (no freezes of IE so far) and correct pages are displaying, but I can not uninstall windows messenger using the "add/remove" link in control panel. Unchecking the box starts the process but when file copying needs to be done from i386 on the hard drive or an XP Pro CD, of files such as zclientx.dl_ the PC reports that files can not be found using the Browse button - even tho I'm looking at 'em!
I am therefore currently a suspicious of "windows messenger". De-activating and uninstalling this would be nice.
You mean Windows Messenger right? not the MSN or Windows Live.
Try these steps on "How to Remove Windows Messenger on Windows XP"
http://www.pchell.com/supp
Or this below:
Click on Start > Run > type in or copy and then paste the below command:
RunDll32 advpack.dll,LaunchINFSecti
Pr
Thanks - your "run" instruction above did the business. But WM still appears with a check mark by it in Add/remove progs in control panel. And I cannot install it nor uninstall it. Other odd things also happen - sometimes "fax" has a check mark by it and sometimes not. Similar things happen to other entries.
I think I'll call time on this and reinstall the system from scratch - even though you may well have solved the malware issue - so again thanks for your help.
Business Accounts
Answer for Membership
by: optomaPosted on 2009-10-30 at 14:17:04ID: 25706867
Hijackthis looks ok.
In Mbam did you remove what Mbam found- the log says that "no action was taken"?
Not one to review combofix's logfile :(
Hopefully somebody else can :)
Run Atf cleaner to clear up temp files http://www.atribune.org/in
After that run Hitman pro cloud scanner http://www.surfright.nl/en