Toseeka, FindStuff, CouponMountain

Welcome to Major Geeks!

Somehing did not work quite right with MGtools. One of the logs named newfiles.txt in the MGlogs.zip file is incomplete. Please do the below.

Please click Start, Run, and enter cmd and click OK. This will open a command prompt window. Enter the below commands at the command prompt each followed by the enter key. The bold black are commands. The purple is merely informational.

cd \MGtools <-- this changes to the MGtools folder and the prompt should change to C:\MGtools>

ShowNew <-- this will try to run all another scan from ShowNew.bat Tell me what error messages, if any, you see. You can just close the notepad window that pops up with the newfiles.txt log in it.


Now attach the new C:\MGlogs.zip file which will have a new log added to it.

 

Also do you know what the below are that showed up on 1/19/2009? Did you install or update any hardware? It this when your problems began?

Code:

2009-01-19 10:49 . 2009-01-19 10:49 <DIR>   c:\program files\Common Files\CAD
2009-01-19 10:46 . 2009-01-19 10:46 79,742  C:\splkInstall_6.1.3.3.dbg
2009-01-19 10:46 . 2009-01-19 10:41 407     C:\splkInstall_Obj_6.1.3.3.dbg
2009-01-19 10:41 . 2009-01-19 10:46 <DIR>   C:\Temp
2009-01-19 10:13 . 2002-11-25 16:05 111,486 c:\windows\SYSTEM32\DRIVERS\Cp215.sys
2009-01-19 10:13 . 2001-12-05 16:18 76,136  c:\windows\SYSTEM32\DRIVERS\Mp910.sys

 

These are fixed in the new version of MGtools. This was a problem related to something within Windows that only occurs on some PCs. I found a work around and added it into MGtools.

Now this does not make sense since we have tested this on probably more than 100 PCs by now and yours is the only one to have a problem with using grep at that point in the program. However it does not matter since the new version of MGtools has also has made changes that made those lines of code unnecessary.

 

Not true. Take a look at your first ComboFix log and you will see that it pointed out the below:

Code:

--- Other Services/Drivers In Memory ---
*Deregistered* - famyqax_srp

Yes it is a new one. They come out everyday.

Is the below registry entry also something you or your company added?

Your logs are looking clean other than what you just removed on your own; however I would appreciate it if you would download and run the new version of MGtools just to make sure it runs properly on your PC since something is a little different about your PC. You can get the new version here: MGtools.exe This link will work until the next update. So as long as you don't take to long to come back it will work. Otherwise you will need to download it from the link embedded here: Using MGtools

After downloading and running this version, please attach the new C:\MGlogs.zip file.


Are you still having any malware problems?