[Resolved] Hijack This log file

So I decided to finally use Hijack This, but because I'm no expert, I am requesting assistance with the deletion of files from my registry. I know how to do all this fortunately, but I don't know which ones are malicious. That's where you come in. I started having problems about a week ago, I realized that my dual monitors weren't working. I unplugged the one, leaving just a single monitor. After a reboot, that one didn't work, but when I changed the port it was on in my GPU, it worked fine, and vice-versa. I could unplug either one of my monitors and run only one, and depending on the status of the reboot as to which port I was running off of. Then I started getting system crashes while playing a popular MMO. I'd be in the middle of playing the game and the client would shut down. All this and random restarts in the middle of the night had me thinking my computer was possessed and needs an exorcism. Enclosed is my log file.

Hi,

Your issues may not be related to malware as there isn't anything obvious showing in your log…but lets run a couple of scans just to make sure.

Please do the following:


Please download ATF Cleaner by Atribune.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.
  
  • If you use Firefox browser
  • Click Firefox at the top and choose: Select All
• Click the Empty Selected button.

NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
It's normal after running ATF cleaner that the PC will be slower to boot the first time.

NEXT

Please download Malwarebytes' Anti-Malware

• Double Click mbam-setup.exe to install the application.
• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish, so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected. <– very important
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.


NOTE: please do not attach your logs unless specifically requested to do so, please just copy/paste into the thread

I was already in the process of running the Anti-Malware scan, and here are the results. Just one Trojan, which was taken care of.

Hi

Please do the following: Please do not attach your logs unless specifically requested to do so, just copy/paste them into the thread, thanks

NOTE: This scan can take several hours to complete:

For Vista Users

The scan must be run in Internet Explorer as an Administrator.
To run Internet Explorer as an Administrator you must go to Start and in the Search box type in iexplore.exe.
When it finds iexplore.exe you must right click on it and select Run as Administrator.
After you do that you'll get the User Account Control prompt box and you must select Allow.

Go to Kaspersky website and perform an online antivirus scan.

• Read through the requirements and privacy statement and click on Accept button.
• It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
• When the downloads have finished, click on Settings.
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  • Spyware, Adware, Dialers, and other potentially dangerous programs
    Archives
    Mail databases
• Click on My Computer under Scan.
• Once the scan is complete, it will display the results. Click on View Scan Report.
• You will see a list of infected items there. Click on Save Report As….
• Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  
• post the copy of that report in your next reply

Sorry for the attachement, here's the contents: Malwarebytes' Anti-Malware 1.35 Database version: 1940 Windows 6.0.6001 Service Pack 1 4/13/2009 4:10:54 PM mbam-log-2009-04-13 (16-10-49).txt Scan type: Full Scan (A:\|C:\|D:\|E:\|) Objects scanned: 144752 Time elapsed: 1 hour(s), 9 minute(s), 58 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\{NSINAME} (Trojan.Agent) -> No action taken. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

Sorry for the attachement

Not a problem, it's just a little harder for me to read that way

HKEY_CURRENT_USER\SOFTWARE\{NSINAME} (Trojan.Agent) -> No action taken.

The log says "no action taken" did you copy the log before you deleted the malware? If not run another scan and make sure you remove what Malewarebytes finds.

Have you had a chance to run the Kaspersky scan yet (link at the bottom of my last post)

Note - this scan can take several hours to complete

Please include a fresh HJT log with the Kaspersky report

Hi,
Just one file to get rid of that Kaspersky found that wasn't already in quarantine so please do the following:

Please download OTMoveIt3 by OldTimer.

• Save it to your desktop.
• Please click OTMoveIt3 and then click >> run.
• Copy the lines inside the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes
explorer.exe

:Services

:Reg

:Files
C:\Users\Purgatory\Documents\My Completed Downloads\Garbage\freeripmp3.exe 

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

• Return to OTMoveIt3, right click in the "Paste Instructions for items to be Moved" window (under the yellow bar) and choose Paste.
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTMoveIt3

Note: If an item cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.



Call me paranoid, but I'd like to see a log from Malwarebytes with everything removed…if you could open the program…select the logs tab, open the most recent log and copy/paste the log into your next reply with the OTMoveIt3 log.

If the log doesn't show any items being removed, then run the program again and allow it to remove what it finds…post the resulting log here for me to look at.Thanks

Please also describe how your computer is running and if you have any other issues…..

Here's the latest from OTMoveIt3: ========== PROCESSES ========== Process explorer.exe killed successfully. ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== ========== FILES ========== C:\Users\Purgatory\Documents\My Completed Downloads\Garbage\freeripmp3.exe moved successfully. ========== COMMANDS ========== File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\Arj.ppl scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\avlib.ppl scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\Avp1.ppl scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\AvpMgr.ppl scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\CAB.ppl scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\dmap.ppl scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\dtreg.ppl scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\FsDrvPlg.ppl scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\FSSync.dll scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\HashCont.ppl scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\HashMD5.PPL scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\HCCMP.ppl scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\ichk2.ppl scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\iChkSA.ppl scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\IWGen.ppl scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\kave.dll scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\kosglue-7.0.26.0.dll scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\lha.ppl scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\L_llio.ppl scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\mdb.ppl scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\minizip.ppl scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\MKavIO.ppl scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\msoe.ppl scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\nfio.ppl scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\prKernel.ppl scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\prLoader.dll scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\PrUtil.ppl scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\rar.ppl scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\ScanningProcess.exe scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\sfdb.PPL scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\TempFile.ppl scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\thpimpl.ppl scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\UniArc.ppl scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\WDiskIO.ppl scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\hsperfdata_Purgatory\4024 scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\hsperfdata_Purgatory\4084 scheduled to be deleted on reboot. File delete failed. C:\Users\PURGAT~1\AppData\Local\Temp\etilqs_D6ZZyVZZcJho7S5U3OOs scheduled to be deleted on reboot. User's Temp folder emptied. User's Internet Explorer cache folder emptied. Windows Temp folder emptied. File delete failed. C:\Users\Purgatory\AppData\Local\Mozilla\Firefox\Profiles\k52kc2c4.default\Cache\_CACHE_001_ scheduled to be deleted on reboot. File delete failed. C:\Users\Purgatory\AppData\Local\Mozilla\Firefox\Profiles\k52kc2c4.default\Cache\_CACHE_002_ scheduled to be deleted on reboot. File delete failed. C:\Users\Purgatory\AppData\Local\Mozilla\Firefox\Profiles\k52kc2c4.default\Cache\_CACHE_003_ scheduled to be deleted on reboot. File delete failed. C:\Users\Purgatory\AppData\Local\Mozilla\Firefox\Profiles\k52kc2c4.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot. File delete failed. C:\Users\Purgatory\AppData\Local\Mozilla\Firefox\Profiles\k52kc2c4.default\urlclassifier3.sqlite scheduled to be deleted on reboot. File delete failed. C:\Users\Purgatory\AppData\Local\Mozilla\Firefox\Profiles\k52kc2c4.default\XUL.mfl scheduled to be deleted on reboot. FireFox cache emptied. Temp folders emptied. Explorer started successfully OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 04152009_141252 Files moved on Reboot… C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\Arj.ppl moved successfully. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\avlib.ppl moved successfully. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\Avp1.ppl moved successfully. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\AvpMgr.ppl moved successfully. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\CAB.ppl moved successfully. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\dmap.ppl moved successfully. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\dtreg.ppl moved successfully. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\FsDrvPlg.ppl moved successfully. DllUnregisterServer procedure not found in C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\FSSync.dll C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\FSSync.dll NOT unregistered. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\FSSync.dll moved successfully. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\HashCont.ppl moved successfully. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\HashMD5.PPL moved successfully. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\HCCMP.ppl moved successfully. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\ichk2.ppl moved successfully. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\iChkSA.ppl moved successfully. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\IWGen.ppl moved successfully. DllUnregisterServer procedure not found in C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\kave.dll C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\kave.dll NOT unregistered. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\kave.dll moved successfully. DllUnregisterServer procedure not found in C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\kosglue-7.0.26.0.dll C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\kosglue-7.0.26.0.dll NOT unregistered. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\kosglue-7.0.26.0.dll moved successfully. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\lha.ppl moved successfully. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\L_llio.ppl moved successfully. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\mdb.ppl moved successfully. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\minizip.ppl moved successfully. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\MKavIO.ppl moved successfully. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\msoe.ppl moved successfully. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\nfio.ppl moved successfully. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\prKernel.ppl moved successfully. DllUnregisterServer procedure not found in C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\prLoader.dll C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\prLoader.dll NOT unregistered. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\prLoader.dll moved successfully. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\PrUtil.ppl moved successfully. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\rar.ppl moved successfully. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\ScanningProcess.exe moved successfully. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\sfdb.PPL moved successfully. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\TempFile.ppl moved successfully. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\thpimpl.ppl moved successfully. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\UniArc.ppl moved successfully. C:\Users\PURGAT~1\AppData\Local\Temp\jkos-Purgatory\binaries\WDiskIO.ppl moved successfully. File C:\Users\PURGAT~1\AppData\Local\Temp\hsperfdata_Purgatory\4024 not found! File C:\Users\PURGAT~1\AppData\Local\Temp\hsperfdata_Purgatory\4084 not found! File C:\Users\PURGAT~1\AppData\Local\Temp\etilqs_D6ZZyVZZcJho7S5U3OOs not found! C:\Users\Purgatory\AppData\Local\Mozilla\Firefox\Profiles\k52kc2c4.default\Cache\_CACHE_001_ moved successfully. C:\Users\Purgatory\AppData\Local\Mozilla\Firefox\Profiles\k52kc2c4.default\Cache\_CACHE_002_ moved successfully. C:\Users\Purgatory\AppData\Local\Mozilla\Firefox\Profiles\k52kc2c4.default\Cache\_CACHE_003_ moved successfully. C:\Users\Purgatory\AppData\Local\Mozilla\Firefox\Profiles\k52kc2c4.default\Cache\_CACHE_MAP_ moved successfully. C:\Users\Purgatory\AppData\Local\Mozilla\Firefox\Profiles\k52kc2c4.default\urlclassifier3.sqlite moved successfully. C:\Users\Purgatory\AppData\Local\Mozilla\Firefox\Profiles\k52kc2c4.default\XUL.mfl moved successfully. The latest from Anti-Malware stated no deficiencies.

Hi

Please do the following

Download Rooter.exe to your desktop

• Doubleclick it to start the tool
• A Notepad file containing the report will open, also found at %systemdrive%\Rooter.txt (Where %systemdrive% is usually C: or the drive that you have installed Windows).
• Post that in your next reply.

Please advise how your computer is running now and if there are any other issues with it

Microsoft Windows Vista Professional (6.0.6001) Service Pack 1 A:\ [Removable] (Total:0 Mo/Free:0 Mo) C:\ [Fixed] - NTFS - (Total:143086 Mo/Free:1819 Mo) D:\ [Fixed] - NTFS - (Total:70606 Mo/Free:649 Mo) E:\ [CD-Rom] (Total:0 Mo/Free:0 Mo) Wed 04/15/2009|17:57 ———————-\\ Processes.. –Locked– [System Process] –Locked– System ———- \SystemRoot\System32\smss.exe ———- C:\Windows\system32\csrss.exe ———- C:\Windows\system32\csrss.exe ———- C:\Windows\system32\wininit.exe ———- C:\Windows\system32\services.exe ———- C:\Windows\system32\lsass.exe ———- C:\Windows\system32\lsm.exe ———- C:\Windows\system32\winlogon.exe ———- C:\Windows\system32\svchost.exe ———- C:\Windows\system32\nvvsvc.exe ———- C:\Windows\system32\svchost.exe ———- C:\Windows\System32\svchost.exe ———- C:\Windows\System32\svchost.exe ———- C:\Windows\System32\svchost.exe ———- C:\Windows\system32\svchost.exe –Locked– audiodg.exe ———- C:\Windows\system32\svchost.exe ———- C:\Windows\system32\SLsvc.exe ———- C:\Windows\system32\svchost.exe ———- C:\Windows\system32\rundll32.exe ———- C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe ———- C:\Windows\system32\svchost.exe ———- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe ———- C:\Windows\System32\spoolsv.exe ———- C:\Windows\system32\svchost.exe ———- C:\Windows\system32\Dwm.exe ———- C:\Windows\system32\taskeng.exe ———- C:\Windows\Explorer.EXE ———- C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe ———- C:\Windows\system32\taskeng.exe ———- C:\Program Files\Digidesign\Drivers\MMERefresh.exe ———- C:\Windows\system32\svchost.exe ———- C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe ———- C:\Windows\system32\svchost.exe ———- C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe ———- C:\Windows\System32\svchost.exe ———- C:\Windows\system32\SearchIndexer.exe ———- C:\Program Files\Windows Defender\MSASCui.exe ———- C:\Windows\System32\rundll32.exe ———- C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe ———- C:\Program Files\Common Files\Symantec Shared\ccApp.exe ———- C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe ———- C:\Windows\WindowsMobile\wmdSync.exe ———- C:\Program Files\Java\jre6\bin\jusched.exe ———- C:\Program Files\Windows Media Player\wmpnscfg.exe ———- C:\Windows\system32\svchost.exe ———- C:\Program Files\Windows Media Player\wmpnetwk.exe ———- C:\Program Files\Mozilla Firefox\firefox.exe ———- C:\Program Files\MediaMonkey\MediaMonkey.exe ———- C:\Windows\system32\SearchProtocolHost.exe ———- C:\Windows\system32\SearchFilterHost.exe ———- C:\Windows\system32\cmd.exe ———- C:\Rooter$\RK.exe ———————-\\ Search.. ———————-\\ ROOTKIT !! 1 - "C:\Rooter$\Rooter_1.txt" - Wed 04/15/2009|17:58 ———————-\\ Scan completed at 17:58 My computer seems to be working okay with the exception of some "Serious Error" crashes. They don't ever happen when I'm logged on and using the computer, but whenever it's idle. Windows resported the "solution" to the problem as being a driver error with my Nvidia Network drivers, so I went to the Nvidia website, downloaded and installed the latest drivers to no avail. This is a tricky one! I'm really trying my hardest to avoid doing a clean wipe but it looks as though that might be my only option…

Hi,

Your logs are clean of Malware.

This may be an issue that our expert tech gurus can assist you with if you post a new topic in our hardware forum…include a link to this topic so they can see you are clean of Malware.

In the meantime we'll do some clean up:

Please do the following:

Download ToolsCleaner2 to your desktop and run it ( by de A.Rothstein & Dj Quiou )

• Click the Pt. Restauration button and press OK to the prompts.
• Click the Corbeille button and press OK to the prompt.
• Click the Fichiers temp button and press OK to the prompt.
• Click the Recherche button and let it run ( it may look like it freezes but let it continue )
• Once it is done click the Suppression button and let it remove anything it finds.
• Close the program

NEXT

Now we need to set a new system restore point

• Close and save any documents that you may have open.
• Open up the Start Menu and right-click on "Computer", and then select "Properties"
• This will take you into the System area of Control Panel. Click on the "Advanced system settings" on the left hand side.
• Now select the "System Protection" tab to get to the System Restore section.
• Click the "Create" button to create a new restore point. You'll be prompted for a name, and you might want to give it a useful name that you'll be able to easily identify later.
• Click the Create button, and then the system will create the restore point.
• When it's all finished, you'll get a message saying it's completed successfully.
• You will now have a new restore point

Then remove all previous Restore Points

• Click Start Menu > Run > copy and paste
• cleanmgr into the run box
• At the top, click on the More Options tab, under System Restore and Shadow Copies group,
• Click the Clean up button,
• Vista will ask you if you’re sure, click on Yes button.
• When finished, click on Cancel button to exit.

NEXT

Below I have included a number of recommendations for how to protect your computer against malware infections.

• Keep Windows updated by regularly checking their website at :
  http://windowsupdate.microsoft.com/
  This will ensure your computer has always the latest security updates available installed on your computer.
  
  
• SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.
  
  
• SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.
  
  
• Make Internet Explorer more secure
  
  • Click Start > Run
  • Type Inetcpl.cpl & click OK
  • Click on the Security tab
  • Click Reset all zones to default level
  • Make sure the Internet Zone is selected & Click Custom level
  • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
  • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
• ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
  
  
• MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
  
  
• ForFirefox, I highly recommend these add-ons to keep your PC even more secure.
  
  • NoScript - for blocking ads and other potential website attacks
  • McAfee SiteAdvisor - this tells you whether the sites you are about to visit are safe or not. A must if you do a lot of Googling
  
  
• Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  
  
• ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
  
  
• Recovery Console - Recent trends appear to indicate that future infections will include attacks to the boot sector of the computer. The installation of the Recovery Console in the computer will be our only defense against this threat. For more information and steps to install the Recovery Console see This Article. Should you need assistance in installing the Recovery Console, please do not hesitate to ask.
  
  
• Please read the guide by Rorschach112 on how to prevent malware and about safe computing here

Thank you for your patience, and performing all of the procedures requested.

No, I owe you guys the thanks! You've been ever helpful and your guidance has pointed me in the right direction. Thank you so much, and you guys are doing a great thing for offering your services only on donation basis.

You are more than welcome…. our service cannot even begin to compare with yours I hope you follow up with our tech forum so you can completely resolve your issues. stay safe CB

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.