M
Mad Scientist Jr
Flightless Bird
I'm running xp pro sp 3 and was surfing the web using firefox 3.6.6 &
my antivirus (avira free) said it found a virus, and I had it remove
it. A couple minutes later it found something again and I had it
remove the threat.
I ran microsoft security essentials and it started to scan my pc but I
cancelled the scan and instead decided to reboot into safe mode and
run malware bytes antimalware and did a full scan of my c: drive and
it found and removed 4 threats.
While still in safe mode, XP then detected a USB device as though I
had just plugged one in (which I did not) - some kind of indexing
service (I didn't write down the name). I had 2 external seagate hard
drives:
1) FreeAgent Go, p/n 9za2ah-502 500gb
2) Expansion Portable Drive, p/n 9sd2a4-500, 500gb
that were already plugged in at bootup so I told xp not to install the
device and just rebooted into normal mode.
However now when I boot up, xp says USB device found for my external
hard drives, but when I tell it to automatically install, it can't
seem to find the drivers (says device not recognized). However the
drives work fine & are totally readable on my other XP machines. So I
am wondering what happened, Did my AV some how mess up my driver files
in removing the threats? How do you fix this?
Here is the malwarebytes log file from the removal, if it helps shed
light on anything:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Database version: 4333
Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702
7/20/2010 9
1:27 PM
mbam-log-2010-07-20 (21-31-27).txt
Scan type: Full scan (C|)
Objects scanned: 374527
Time elapsed: 59 minute(s), 25 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 3
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
\howhqeyl (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted
successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
\sijhmsek (Trojan.FakeAlert.Gen) -> Quarantined and deleted
successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
\prunnet (Trojan.Agent) -> Quarantined and deleted successfully.
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
CDocuments and Settings\User1\Local Settings\Temp\pdfupd.exe
(Trojan.Agent) -> Quarantined and deleted successfully.
my antivirus (avira free) said it found a virus, and I had it remove
it. A couple minutes later it found something again and I had it
remove the threat.
I ran microsoft security essentials and it started to scan my pc but I
cancelled the scan and instead decided to reboot into safe mode and
run malware bytes antimalware and did a full scan of my c: drive and
it found and removed 4 threats.
While still in safe mode, XP then detected a USB device as though I
had just plugged one in (which I did not) - some kind of indexing
service (I didn't write down the name). I had 2 external seagate hard
drives:
1) FreeAgent Go, p/n 9za2ah-502 500gb
2) Expansion Portable Drive, p/n 9sd2a4-500, 500gb
that were already plugged in at bootup so I told xp not to install the
device and just rebooted into normal mode.
However now when I boot up, xp says USB device found for my external
hard drives, but when I tell it to automatically install, it can't
seem to find the drivers (says device not recognized). However the
drives work fine & are totally readable on my other XP machines. So I
am wondering what happened, Did my AV some how mess up my driver files
in removing the threats? How do you fix this?
Here is the malwarebytes log file from the removal, if it helps shed
light on anything:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Database version: 4333
Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702
7/20/2010 9
1:27 PMmbam-log-2010-07-20 (21-31-27).txt
Scan type: Full scan (C
|)Objects scanned: 374527
Time elapsed: 59 minute(s), 25 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 3
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
\howhqeyl (Rogue.AntivirusSuite.Gen) -> Quarantined and deleted
successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
\sijhmsek (Trojan.FakeAlert.Gen) -> Quarantined and deleted
successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
\prunnet (Trojan.Agent) -> Quarantined and deleted successfully.
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C
Documents and Settings\User1\Local Settings\Temp\pdfupd.exe(Trojan.Agent) -> Quarantined and deleted successfully.