What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Laptop being running dead slow for the past few days

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
My Laptop has being running dead slow for the past few days. I don't really know what happened as it just became dead slow overnight. Even the options for selecting windows at laptop startup lag when i press up and down. I deleted any unwanted applications to free up space in my hard drive but didn't help. I also tried cleaning the registry and also ran an anti virus scan and cleaned all the viruses. I have backed up my registry using Erunt. However i was unable to run dds as it said that it's not supported by the OS. I am just helpless right now so it would be really kind if someone from this forum could guide me step by step to resolve this problem…. This is what i got from rootrepeal. ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2009/12/17 14:44 Program Version: Version 1.3.5.0 Windows Version: Windows Vista SP0 ================================================== SSDT ——————- SYSENTER/INT2E Hooked [0x8284e300]! ==EOF==
Post #2
Hello and :welcome: Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise. This may cause a delay, but I will do my best to keep it as short as possible. I will post back shortly with instructions.
Post #3
Hi,

I will be helping you on removing malwares on your computer. Log research takes time, so please be patient and I'd be grateful if you would note the following:
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Do not install/uninstall anything on your computer unless advised.
  • Do not run any other scanning tools other than those instructed for you to use.
  • Follow the instructions on the order they are given.
  • Stay with this thread until advised when your computer is clean. Absence of symptoms does not necessarily mean a clean computer.
  • If you are being helped regarding this problem on another forum please advice us so that we can close this thread.
  • And lastly, if you have any questions, please ask before proceeding with any of the advised fixes.

_________________________________________________

  • Download OTL to your desktop.
  • Right click on the icon then choose Run as Administrator to run it.
  • Check the boxes beside LOP Check and Purity Check.
  • Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
    netsvcs
msconfig
safebootminimal
safebootnetwork
Activex
%systemroot%\System32\antiwpa.dll
%systemroot%\SYSTEM32\wpa.dll
%systemroot%\setup\scripts\biestart.exe
%systemroot%\system32\drivers\royal.sys
%systemroot%\system32\serauth1.dll
%systemroot%\system32\serauth2.dll
%systemroot%\system32\sysaudio.sys
%systemroot%\system32\wdmaud.sys
%systemroot%\system32\aeaudio.sys
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
/md5stop
%systemroot%\*. /mp /s
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
  • You may need two posts to fit them both in.
–Next–

Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Right click gmer.exe then choose Run as Administrator. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<— ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.
  • Click NO
  • In the right panel, you will see a bunch of boxes that have been checked … leave everything checked and ensure the Show all box is un-checked.
  • Now click the Scan button.
    Once the scan is complete, you may receive another notice about rootkit activity.
  • Click OK.
  • GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
  • Save it where you can easily find it, such as your desktop.
If you do not receive notice about possible rootkit activity remain on the Rootkit/Malware tab & make sure the 'Show All' button is unticked.
  • Click the Scan button and let the program do its work. GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop
To post in your next reply:
1. OTL log.
2. GMER log.
Post #4
Thank you for taking the time to help me solve my problem. :)

Here are the logs… took a long time to scan..

OTL.txt
OTL logfile created on: 12/19/2009 7:49:23 AM - Run 1
OTL by OldTimer - Version 3.1.18.0 Folder = E:\Users\Jasar Ayaz\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1.99 Gb Total Physical Memory | 1.39 Gb Available Physical Memory | 69.91% Memory free
3.98 Gb Paging File | 3.26 Gb Available in Paging File | 81.99% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = E: | %SystemRoot% = E:\Windows | %ProgramFiles% = E:\Program Files
Drive C: | 9.76 Gb Total Space | 6.81 Gb Free Space | 69.83% Space Free | Partition Type: FAT32
Drive D: | 19.52 Gb Total Space | 1.18 Gb Free Space | 6.05% Space Free | Partition Type: FAT32
Drive E: | 43.78 Gb Total Space | 3.43 Gb Free Space | 7.84% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: UNKNOWN
Current User Name: Jasar Ayaz
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2009/12/19 07:37:12 | 00,564,736 | —- | M] (OldTimer Tools) – E:\Users\Jasar Ayaz\Desktop\OTL.exe
PRC - [2009/11/13 08:59:06 | 00,198,160 | —- | M] (RealNetworks, Inc.) – E:\Program Files\Common Files\Real\Update_OB\realsched.exe
PRC - [2009/08/03 09:35:50 | 02,613,248 | —- | M] (Microsoft Corporation) – E:\Windows\explorer.exe
PRC - [2009/07/14 05:14:42 | 00,049,152 | —- | M] (Microsoft Corporation) – E:\Windows\System32\taskhost.exe
PRC - [2009/07/14 05:14:29 | 03,179,520 | —- | M] (Microsoft Corporation) – E:\Windows\System32\sppsvc.exe
PRC - [2009/07/14 05:14:24 | 00,157,184 | —- | M] (Microsoft Corporation) – e:\Program Files\Windows Defender\MpCmdRun.exe
PRC - [2009/06/16 18:45:22 | 00,252,952 | —- | M] (Intel Corporation) – E:\Windows\System32\igfxsrvc.exe
PRC - [2009/06/16 18:45:20 | 00,150,552 | —- | M] (Intel Corporation) – E:\Windows\System32\igfxpers.exe
PRC - [2009/06/16 18:45:12 | 00,173,592 | —- | M] (Intel Corporation) – E:\Windows\System32\hkcmd.exe
PRC - [2008/10/25 11:44:34 | 00,031,072 | —- | M] (Microsoft Corporation) – E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe


========== Modules (SafeList) ==========

MOD - [2009/12/19 07:37:12 | 00,564,736 | —- | M] (OldTimer Tools) – E:\Users\Jasar Ayaz\Desktop\OTL.exe
MOD - [2009/07/14 05:16:15 | 00,099,840 | —- | M] (Microsoft Corporation) – E:\Windows\System32\sspicli.dll
MOD - [2009/07/14 05:16:14 | 00,040,960 | —- | M] (Microsoft Corporation) – E:\Windows\System32\sfc_os.dll
MOD - [2009/07/14 05:16:13 | 00,092,160 | —- | M] (Microsoft Corporation) – E:\Windows\System32\sechost.dll
MOD - [2009/07/14 05:16:13 | 00,050,688 | —- | M] (Microsoft Corporation) – E:\Windows\System32\samcli.dll
MOD - [2009/07/14 05:16:12 | 00,031,744 | —- | M] (Microsoft Corporation) – E:\Windows\System32\profapi.dll
MOD - [2009/07/14 05:16:03 | 00,022,016 | —- | M] (Microsoft Corporation) – E:\Windows\System32\netutils.dll
MOD - [2009/07/14 05:15:44 | 02,340,864 | —- | M] (Microsoft Corporation) – E:\Windows\System32\msi.dll
MOD - [2009/07/14 05:15:44 | 00,015,872 | —- | M] (Microsoft Corporation) – E:\Windows\System32\msiltcfg.dll
MOD - [2009/07/14 05:15:35 | 00,288,256 | —- | M] (Microsoft Corporation) – E:\Windows\System32\KernelBase.dll
MOD - [2009/07/14 05:15:13 | 00,067,072 | —- | M] (Microsoft Corporation) – E:\Windows\System32\dwmapi.dll
MOD - [2009/07/14 05:15:11 | 00,064,512 | —- | M] (Microsoft Corporation) – E:\Windows\System32\devobj.dll
MOD - [2009/07/14 05:15:07 | 00,036,864 | —- | M] (Microsoft Corporation) – E:\Windows\System32\cryptbase.dll
MOD - [2009/07/14 05:15:02 | 00,145,920 | —- | M] (Microsoft Corporation) – E:\Windows\System32\cfgmgr32.dll
MOD - [2009/07/14 05:10:22 | 00,002,560 | —- | M] (Microsoft Corporation) – E:\Windows\System32\sfc.dll
MOD - [2009/07/14 05:03:50 | 01,680,896 | —- | M] (Microsoft Corporation) – E:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - [2009/12/18 13:40:44 | 00,321,320 | —- | M] (Valve Corporation) [On_Demand | Stopped] – E:\Program Files\Common Files\Steam\SteamService.exe – (Steam Client Service)
SRV - [2009/11/06 09:20:16 | 00,051,168 | —- | M] (NOS Microsystems Ltd.) [On_Demand | Stopped] – E:\Program Files\NOS\bin\getPlus_Helper.dll – (getPlusHelper) getPlus®
SRV - [2009/07/14 05:16:21 | 00,185,856 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – E:\Windows\System32\wwansvc.dll – (WwanSvc)
SRV - [2009/07/14 05:16:17 | 00,151,552 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – E:\Windows\System32\wbiosrvc.dll – (WbioSrvc)
SRV - [2009/07/14 05:16:17 | 00,119,808 | —- | M] (Microsoft Corporation) [Auto | Running] – E:\Windows\System32\umpo.dll – (Power)
SRV - [2009/07/14 05:16:16 | 00,037,376 | —- | M] (Microsoft Corporation) [Auto | Running] – E:\Windows\System32\themeservice.dll – (Themes)
SRV - [2009/07/14 05:16:15 | 00,053,760 | —- | M] (Microsoft Corporation) [On_Demand | Running] – E:\Windows\System32\sppuinotify.dll – (sppuinotify)
SRV - [2009/07/14 05:16:13 | 00,043,520 | —- | M] (Microsoft Corporation) [Unknown | Running] – E:\Windows\System32\RpcEpMap.dll – (RpcEptMapper)
SRV - [2009/07/14 05:16:13 | 00,025,088 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – E:\Windows\System32\sensrsvc.dll – (SensrSvc)
SRV - [2009/07/14 05:16:12 | 01,004,544 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – E:\Windows\System32\PeerDistSvc.dll – (PeerDistSvc)
SRV - [2009/07/14 05:16:12 | 00,269,824 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – E:\Windows\System32\pnrpsvc.dll – (PNRPsvc)
SRV - [2009/07/14 05:16:12 | 00,269,824 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – E:\Windows\System32\pnrpsvc.dll – (p2pimsvc)
SRV - [2009/07/14 05:16:12 | 00,165,376 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – E:\Windows\System32\provsvc.dll – (HomeGroupProvider)
SRV - [2009/07/14 05:16:12 | 00,020,480 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – E:\Windows\System32\pnrpauto.dll – (PNRPAutoReg)
SRV - [2009/07/14 05:15:41 | 00,680,960 | —- | M] (Microsoft Corporation) [Auto | Running] – E:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2009/07/14 05:15:36 | 00,194,560 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – E:\Windows\System32\ListSvc.dll – (HomeGroupListener)
SRV - [2009/07/14 05:15:21 | 00,797,696 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – E:\Windows\System32\FntCache.dll – (FontCache)
SRV - [2009/07/14 05:15:11 | 00,253,440 | —- | M] (Microsoft Corporation) [Auto | Running] – E:\Windows\System32\dhcpcore.dll – (Dhcp)
SRV - [2009/07/14 05:15:10 | 00,218,624 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – E:\Windows\System32\defragsvc.dll – (defragsvc)
SRV - [2009/07/14 05:14:59 | 00,076,800 | —- | M] (Microsoft Corporation) [Unknown | Stopped] – E:\Windows\System32\bdesvc.dll – (BDESVC)
SRV - [2009/07/14 05:14:58 | 00,088,064 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – E:\Windows\System32\AxInstSv.dll – (AxInstSV) ActiveX Installer (AxInstSV)
SRV - [2009/07/14 05:14:53 | 00,027,648 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – E:\Windows\System32\appidsvc.dll – (AppIDSvc)
SRV - [2009/07/14 05:14:29 | 03,179,520 | —- | M] (Microsoft Corporation) [Auto | Running] – E:\Windows\System32\sppsvc.exe – (sppsvc)
SRV - [2008/11/04 01:06:28 | 00,441,712 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – E:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE – (odserv)
SRV - [2008/10/25 11:44:08 | 00,065,888 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – E:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe – (Microsoft Office Groove Audit Service)
SRV - [2006/10/26 14:03:08 | 00,145,184 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – E:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE – (ose)


========== Driver Services (SafeList) ==========

DRV - [2009/07/14 05:26:21 | 00,015,952 | —- | M] (CMD Technology, Inc.) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\cmdide.sys – (cmdide)
DRV - [2009/07/14 05:26:17 | 00,297,552 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\adpahci.sys – (adpahci)
DRV - [2009/07/14 05:26:15 | 00,422,976 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\adp94xx.sys – (adp94xx)
DRV - [2009/07/14 05:26:15 | 00,159,312 | —- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\amdsbs.sys – (amdsbs)
DRV - [2009/07/14 05:26:15 | 00,146,512 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\adpu320.sys – (adpu320)
DRV - [2009/07/14 05:26:15 | 00,086,608 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\arcsas.sys – (arcsas)
DRV - [2009/07/14 05:26:15 | 00,079,952 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\amdsata.sys – (amdsata)
DRV - [2009/07/14 05:26:15 | 00,076,368 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\arc.sys – (arc)
DRV - [2009/07/14 05:26:15 | 00,023,616 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] – E:\Windows\system32\DRIVERS\amdxata.sys – (amdxata)
DRV - [2009/07/14 05:26:15 | 00,014,400 | —- | M] (Acer Laboratories Inc.) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\aliide.sys – (aliide)
DRV - [2009/07/14 05:20:44 | 00,142,416 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\nvstor.sys – (nvstor)
DRV - [2009/07/14 05:20:44 | 00,117,312 | —- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\nvraid.sys – (nvraid)
DRV - [2009/07/14 05:20:44 | 00,044,624 | —- | M] (IBM Corporation) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\nfrd960.sys – (nfrd960)
DRV - [2009/07/14 05:20:37 | 00,089,168 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\lsi_sas.sys – (LSI_SAS)
DRV - [2009/07/14 05:20:36 | 00,332,352 | —- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\iaStorV.sys – (iaStorV)
DRV - [2009/07/14 05:20:36 | 00,235,584 | —- | M] (LSI Corporation, Inc.) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\MegaSR.sys – (MegaSR)
DRV - [2009/07/14 05:20:36 | 00,133,200 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – E:\Windows\System32\Drivers\ksecpkg.sys – (KSecPkg)
DRV - [2009/07/14 05:20:36 | 00,096,848 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\lsi_scsi.sys – (LSI_SCSI)
DRV - [2009/07/14 05:20:36 | 00,095,824 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\lsi_fc.sys – (LSI_FC)
DRV - [2009/07/14 05:20:36 | 00,054,864 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\lsi_sas2.sys – (LSI_SAS2)
DRV - [2009/07/14 05:20:36 | 00,041,040 | —- | M] (Intel Corp./ICP vortex GmbH) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\iirsp.sys – (iirsp)
DRV - [2009/07/14 05:20:36 | 00,030,800 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\megasas.sys – (megasas)
DRV - [2009/07/14 05:20:36 | 00,013,904 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – E:\Windows\System32\drivers\hwpolicy.sys – (hwpolicy)
DRV - [2009/07/14 05:20:28 | 00,453,712 | —- | M] (Emulex) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\elxstor.sys – (elxstor)
DRV - [2009/07/14 05:20:28 | 00,070,720 | —- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\djsvs.sys – (aic78xx)
DRV - [2009/07/14 05:20:28 | 00,067,152 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\HpSAMD.sys – (HpSAMD)
DRV - [2009/07/14 05:20:28 | 00,046,160 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – E:\Windows\System32\drivers\fsdepends.sys – (FsDepends)
DRV - [2009/07/14 05:19:11 | 00,141,904 | —- | M] (VIA Technologies Inc.,Ltd) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\vsmraid.sys – (vsmraid)
DRV - [2009/07/14 05:19:10 | 00,175,824 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\vmbus.sys – (vmbus)
DRV - [2009/07/14 05:19:10 | 00,159,824 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\vhdmp.sys – (vhdmp)
DRV - [2009/07/14 05:19:10 | 00,040,896 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – E:\Windows\system32\DRIVERS\vmstorfl.sys – (storflt)
DRV - [2009/07/14 05:19:10 | 00,032,832 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – E:\Windows\system32\DRIVERS\vdrvroot.sys – (vdrvroot)
DRV - [2009/07/14 05:19:10 | 00,028,224 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\storvsc.sys – (storvsc)
DRV - [2009/07/14 05:19:10 | 00,019,008 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – E:\Windows\System32\drivers\wimmount.sys – (WIMMount)
DRV - [2009/07/14 05:19:10 | 00,016,976 | —- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\viaide.sys – (viaide)
DRV - [2009/07/14 05:19:04 | 01,383,488 | —- | M] (QLogic Corporation) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\ql2300.sys – (ql2300)
DRV - [2009/07/14 05:19:04 | 00,173,648 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – E:\Windows\System32\drivers\rdyboost.sys – (rdyboost)
DRV - [2009/07/14 05:19:04 | 00,106,064 | —- | M] (QLogic Corporation) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\ql40xx.sys – (ql40xx)
DRV - [2009/07/14 05:19:04 | 00,077,888 | —- | M] (Silicon Integrated Systems) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\sisraid4.sys – (SiSRaid4)
DRV - [2009/07/14 05:19:04 | 00,043,088 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – E:\Windows\System32\drivers\pcw.sys – (pcw)
DRV - [2009/07/14 05:19:04 | 00,040,016 | —- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\SiSRaid2.sys – (SiSRaid2)
DRV - [2009/07/14 05:19:04 | 00,021,072 | —- | M] (Promise Technology) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\stexstor.sys – (stexstor)
DRV - [2009/07/14 05:17:54 | 00,369,568 | —- | M] (Microsoft Corporation) [Kernel | Boot | Running] – E:\Windows\System32\Drivers\cng.sys – (CNG)
DRV - [2009/07/14 04:57:25 | 00,272,128 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – E:\Windows\System32\Drivers\Brserid.sys – (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2009/07/14 04:02:41 | 00,018,944 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – E:\Windows\System32\drivers\rdpbus.sys – (rdpbus)
DRV - [2009/07/14 04:01:41 | 00,007,168 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – E:\Windows\System32\drivers\RDPREFMP.sys – (RDPREFMP)
DRV - [2009/07/14 03:55:00 | 00,049,152 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – E:\Windows\System32\drivers\agilevpn.sys – (RasAgileVpn) WAN Miniport (IKEv2)
DRV - [2009/07/14 03:53:51 | 00,009,728 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – E:\Windows\System32\drivers\wfplwf.sys – (WfpLwf)
DRV - [2009/07/14 03:52:44 | 00,027,136 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – E:\Windows\System32\drivers\ndiscap.sys – (NdisCap)
DRV - [2009/07/14 03:52:02 | 00,019,968 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – E:\Windows\System32\drivers\vwifibus.sys – (vwifibus)
DRV - [2009/07/14 03:52:00 | 00,163,328 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – E:\Windows\System32\drivers\1394ohci.sys – (1394ohci)
DRV - [2009/07/14 03:51:35 | 00,008,192 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\umpass.sys – (UmPass)
DRV - [2009/07/14 03:51:11 | 00,034,944 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – E:\Windows\System32\drivers\winusb.sys – (WinUsb)
DRV - [2009/07/14 03:51:08 | 00,004,096 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – E:\Windows\System32\drivers\mshidkmdf.sys – (mshidkmdf)
DRV - [2009/07/14 03:46:55 | 00,012,288 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\MTConfig.sys – (MTConfig)
DRV - [2009/07/14 03:45:26 | 00,031,232 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – E:\Windows\System32\drivers\CompositeBus.sys – (CompositeBus)
DRV - [2009/07/14 03:36:52 | 00,050,176 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – E:\Windows\system32\drivers\appid.sys – (AppID)
DRV - [2009/07/14 03:33:50 | 00,026,624 | —- | M] (Microsoft Corporation) [Kernel | Unknown | Stopped] – E:\Windows\System32\drivers\scfilter.sys – (scfilter)
DRV - [2009/07/14 03:28:47 | 00,005,632 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\vms3cap.sys – (s3cap)
DRV - [2009/07/14 03:28:45 | 00,017,920 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\VMBusHID.sys – (VMBusHID)
DRV - [2009/07/14 03:24:05 | 00,032,256 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – E:\Windows\System32\drivers\discache.sys – (discache)
DRV - [2009/07/14 03:19:21 | 00,021,504 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\HidBatt.sys – (HidBatt)
DRV - [2009/07/14 03:16:36 | 00,009,728 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\acpipmi.sys – (AcpiPmi)
DRV - [2009/07/14 03:11:04 | 00,052,736 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\amdppm.sys – (AmdPPM)
DRV - [2009/07/14 02:54:14 | 00,026,624 | —- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] – E:\Windows\system32\drivers\hcw85cir.sys – (hcw85cir)
DRV - [2009/07/14 02:53:33 | 00,012,160 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – E:\Windows\System32\Drivers\BrUsbMdm.sys – (BrUsbMdm)
DRV - [2009/07/14 02:53:33 | 00,011,904 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – E:\Windows\System32\Drivers\BrUsbSer.sys – (BrUsbSer)
DRV - [2009/07/14 02:53:32 | 00,062,336 | —- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] – E:\Windows\System32\Drivers\BrSerWdm.sys – (BrSerWdm)
DRV - [2009/07/14 02:53:28 | 00,013,568 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\BrFiltLo.sys – (BrFiltLo)
DRV - [2009/07/14 02:53:28 | 00,005,248 | —- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\BrFiltUp.sys – (BrFiltUp)
DRV - [2009/07/14 02:13:46 | 00,980,992 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – E:\Windows\System32\drivers\VSTDPV3.SYS – (SrvHsfV92)
DRV - [2009/07/14 02:13:45 | 00,661,504 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – E:\Windows\System32\drivers\VSTCNXT3.SYS – (SrvHsfWinac)
DRV - [2009/07/14 02:13:45 | 00,207,360 | —- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] – E:\Windows\System32\drivers\VSTAZL3.SYS – (SrvHsfHDA)
DRV - [2009/07/14 02:02:51 | 04,231,168 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – E:\Windows\System32\drivers\netw5v32.sys – (netw5v32) Intel®
DRV - [2009/07/14 02:02:49 | 00,229,888 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – E:\Windows\System32\drivers\b57nd60x.sys – (b57nd60x)
DRV - [2009/07/14 02:02:49 | 00,046,080 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] – E:\Windows\System32\drivers\bcm4sbxp.sys – (bcm4sbxp)
DRV - [2009/07/14 02:02:48 | 03,100,160 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\evbdx.sys – (ebdrv)
DRV - [2009/07/14 02:02:48 | 00,430,080 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – E:\Windows\system32\DRIVERS\bxvbdx.sys – (b06bdrv)
DRV - [2009/07/14 00:50:20 | 00,020,480 | —- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [Kernel | Auto | Running] – E:\Windows\System32\drivers\secdrv.sys – (secdrv)
DRV - [2009/06/16 18:28:22 | 04,756,992 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – E:\Windows\System32\drivers\igdkmd32.sys – (igfx)
DRV - [2006/11/14 17:35:20 | 00,037,376 | —- | M] (REDC) [Kernel | Auto | Running] – E:\Windows\System32\drivers\rixdptsk.sys – (rismxdp)
DRV - [2005/12/22 17:02:22 | 00,051,840 | —- | M] (REDC) [Kernel | On_Demand | Running] – E:\Windows\System32\drivers\rimsptsk.sys – (rimsptsk)
DRV - [2005/11/16 20:28:32 | 00,028,928 | —- | M] (REDC) [Kernel | On_Demand | Running] – E:\Windows\System32\drivers\rimmptsk.sys – (rimmptsk)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B8 E2 07 87 54 6F CA 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Wikipedia (en)"
FF - prefs.js..browser.startup.homepage: "http://www.google.com"
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1
FF - prefs.js..extensions.enabledItems: 6
FF - prefs.js..extensions.enabledItems: 2
FF - prefs.js..extensions.enabledItems: 49
FF - prefs.js..extensions.enabledItems: [removed]:1.5
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..network.proxy.backup.ftp: "[removed]"
FF - prefs.js..network.proxy.backup.ftp_port: 3128
FF - prefs.js..network.proxy.backup.gopher: "[removed]"
FF - prefs.js..network.proxy.backup.gopher_port: 3128
FF - prefs.js..network.proxy.backup.socks: "[removed]"
FF - prefs.js..network.proxy.backup.socks_port: 3128
FF - prefs.js..network.proxy.backup.ssl: "[removed]"
FF - prefs.js..network.proxy.backup.ssl_port: 3128
FF - prefs.js..network.proxy.ftp: "[removed]"
FF - prefs.js..network.proxy.ftp_port: 3128
FF - prefs.js..network.proxy.gopher: "[removed]"
FF - prefs.js..network.proxy.gopher_port: 3128
FF - prefs.js..network.proxy.http: "[removed]"
FF - prefs.js..network.proxy.http_port: 3128
FF - prefs.js..network.proxy.no_proxies_on: "[removed]"
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "[removed]"
FF - prefs.js..network.proxy.socks_port: 3128
FF - prefs.js..network.proxy.ssl: "204.8.65.218"
FF - prefs.js..network.proxy.ssl_port: 3128

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Components: E:\Program Files\Mozilla Firefox\components [2009/11/13 08:59:27 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Plugins: E:\Program Files\Mozilla Firefox\plugins [2009/11/15 08:10:27 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\[removed]: E:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird

[2009/11/12 23:40:08 | 00,000,000 | —D | M] – E:\Users\Jasar Ayaz\AppData\Roaming\Mozilla\Extensions
[2009/12/19 01:15:56 | 00,000,000 | —D | M] – E:\Users\Jasar Ayaz\AppData\Roaming\Mozilla\Firefox\Profiles\9rarjbiv.default\extensions
[2009/11/13 14:33:40 | 00,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – E:\Users\Jasar Ayaz\AppData\Roaming\Mozilla\Firefox\Profiles\9rarjbiv.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2009/11/29 10:51:09 | 00,000,000 | —D | M] – E:\Users\Jasar Ayaz\AppData\Roaming\Mozilla\Firefox\Profiles\9rarjbiv.default\extensions\[removed]
[2009/11/12 23:39:40 | 00,000,000 | —D | M] – E:\Program Files\Mozilla Firefox\extensions
[2009/11/03 05:42:02 | 00,001,538 | —- | M] () – E:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2009/11/03 05:42:02 | 00,000,947 | —- | M] () – E:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2009/11/03 05:42:02 | 00,000,769 | —- | M] () – E:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2009/11/03 05:42:02 | 00,000,831 | —- | M] () – E:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: (824 bytes) - E:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - E:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O4 - HKLM..\Run: [Adobe ARM] E:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] E:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [GrooveMonitor] E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
O4 - HKLM..\Run: [HotKeysCmds] E:\Windows\System32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [IgfxTray] E:\Windows\System32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] E:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Persistence] E:\Windows\System32\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [TkBellExe] E:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [Google Update] E:\Users\Jasar Ayaz\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - HKCU..\Run: [Steam] E:\Program Files\Steam\Steam.exe (Valve Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8 - Extra context menu item: E&xport; to Microsoft Excel - E:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed] [removed]
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - E:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - E:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - E:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - E:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - E:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - E:\Windows\System32\igfxdev.dll (Intel Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - E:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (pku2u) - E:\Windows\System32\pku2u.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/11/12 16:56:46 | 00,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ FAT32 ]
O32 - AutoRun File - [2009/06/11 01:42:20 | 00,000,024 | —- | M] () - E:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2009/05/04 16:40:17 | 00,000,000 | —D | M] - E:\autorun.inf – [ NTFS ]
O33 - MountPoints2\{5b73364f-d53d-11de-8e79-0015c5a3e4fc}\Shell - "" = AutoRun
O33 - MountPoints2\{5b73364f-d53d-11de-8e79-0015c5a3e4fc}\Shell\AutoRun\command - "" = G:\LaunchU3.exe – File not found
O33 - MountPoints2\{7c86e7f9-d1d6-11de-8082-0015c5a3e4fc}\Shell - "" = AutoRun
O33 - MountPoints2\{7c86e7f9-d1d6-11de-8082-0015c5a3e4fc}\Shell\AutoRun\command - "" = H:\LaunchU3.exe – File not found
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\LaunchU3.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - E:\Windows\System32\ias [2009/07/14 06:37:08 | 00,000,000 | —D | M]
NetSvcs: Irmon - E:\Windows\System32\irmon.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - E:\Windows\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
NetSvcs: Themes - E:\Windows\System32\themeservice.dll (Microsoft Corporation)
NetSvcs: BDESVC - E:\Windows\System32\bdesvc.dll (Microsoft Corporation)


SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS - File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Power - E:\Windows\System32\umpo.dll (Microsoft Corporation)
SafeBootMin: Primary disk - Driver Group
SafeBootMin: RpcEptMapper - E:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: WinDefend - E:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: Dhcp - E:\Windows\System32\dhcpcore.dll (Microsoft Corporation)
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: ndiscap - E:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation)
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS - File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Power - E:\Windows\System32\umpo.dll (Microsoft Corporation)
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: RpcEptMapper - E:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WinDefend - E:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Web Folders
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - E:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - E:\Windows\system32\Rundll32.exe E:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - E:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "E:\Windows\System32\rundll32.exe" "E:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

========== Files/Folders - Created Within 30 Days ==========

[2009/12/19 07:43:33 | 00,564,736 | —- | C] (OldTimer Tools) – E:\Users\Jasar Ayaz\Desktop\OTL.exe
[2009/12/18 23:37:59 | 00,000,000 | —D | C] – E:\ProgramData\Spybot - Search & Destroy
[2009/12/18 23:37:59 | 00,000,000 | —D | C] – E:\Program Files\Spybot - Search & Destroy
[2009/12/18 22:00:42 | 00,000,000 | —D | C] – E:\Users\Jasar Ayaz\AppData\Roaming\Malwarebytes
[2009/12/18 21:57:46 | 00,038,224 | —- | C] (Malwarebytes Corporation) – E:\Windows\System32\drivers\mbamswissarmy.sys
[2009/12/18 21:57:13 | 00,000,000 | —D | C] – E:\ProgramData\Malwarebytes
[2009/12/18 21:56:59 | 00,019,160 | —- | C] (Malwarebytes Corporation) – E:\Windows\System32\drivers\mbam.sys
[2009/12/18 21:56:58 | 00,000,000 | —D | C] – E:\Program Files\Malwarebytes' Anti-Malware
[2009/12/18 21:50:38 | 16,409,960 | —- | C] (Safer Networking Limited ) – E:\Users\Jasar Ayaz\Desktop\spybotsd162.exe
[2009/12/18 21:50:37 | 04,844,264 | —- | C] (Malwarebytes Corporation ) – E:\Users\Jasar Ayaz\Desktop\mbam-setup.exe
[2009/12/17 14:34:24 | 00,000,000 | —D | C] – E:\Windows\ERDNT
[2009/12/17 14:33:14 | 00,000,000 | —D | C] – E:\Program Files\ERUNT
[2009/12/17 14:19:24 | 00,791,393 | —- | C] (Lars Hederer ) – E:\Users\Jasar Ayaz\Desktop\erunt_setup.exe
[2009/12/17 14:19:24 | 00,472,064 | —- | C] ( ) – E:\Users\Jasar Ayaz\Desktop\RootRepeal.exe
[2009/12/14 17:42:10 | 00,000,000 | —D | C] – E:\Program Files\HD Tune
[2009/12/11 14:16:15 | 00,000,000 | —D | C] – E:\Users\Jasar Ayaz\Documents\My Chat Logs
[2009/12/11 11:16:19 | 00,000,000 | —D | C] – E:\ProgramData\Messenger Plus!
[2009/12/11 00:11:02 | 00,000,000 | —D | C] – E:\Program Files\Messenger Plus! Live
[2009/12/11 00:10:45 | 00,000,000 | —D | C] – E:\Program Files\DirectVobSub
[2009/12/06 23:27:15 | 00,000,000 | —D | C] – E:\Windows\System32\appmgmt
[2009/11/29 22:14:03 | 00,000,000 | —D | C] – E:\Users\Jasar Ayaz\AppData\Local\ESET
[2009/11/25 22:21:23 | 00,000,000 | —D | C] – E:\Users\Jasar Ayaz\AppData\Local\Microsoft Games
[2009/11/21 22:35:30 | 00,000,000 | —D | C] – E:\Program Files\CCleaner

========== Files - Modified Within 30 Days ==========

[2009/12/19 08:08:39 | 03,932,160 | -HS- | M] () – E:\Users\Jasar Ayaz\ntuser.dat
[2009/12/19 07:42:30 | 00,000,928 | —- | M] () – E:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1413770439-2942384449-4071594559-1000UA.job
[2009/12/19 07:37:12 | 00,564,736 | —- | M] (OldTimer Tools) – E:\Users\Jasar Ayaz\Desktop\OTL.exe
[2009/12/19 07:27:16 | 00,009,584 | -H– | M] () – E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2009/12/19 07:27:16 | 00,009,584 | -H– | M] () – E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2009/12/18 23:42:05 | 00,000,876 | —- | M] () – E:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1413770439-2942384449-4071594559-1000Core.job
[2009/12/18 23:40:16 | 00,001,220 | —- | M] () – E:\Users\Jasar Ayaz\Desktop\Spybot - Search & Destroy.lnk
[2009/12/18 23:21:26 | 00,000,006 | -H– | M] () – E:\Windows\tasks\SA.DAT
[2009/12/18 23:20:47 | 00,067,584 | –S- | M] () – E:\Windows\bootstat.dat
[2009/12/18 23:20:18 | 16,030,92480 | -HS- | M] () – E:\hiberfil.sys
[2009/12/18 23:17:17 | 02,648,708 | -H– | M] () – E:\Users\Jasar Ayaz\AppData\Local\IconCache.db
[2009/12/18 22:06:35 | 00,409,752 | —- | M] () – E:\Windows\System32\FNTCACHE.DAT
[2009/12/18 21:57:58 | 00,000,983 | —- | M] () – E:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/12/18 21:53:35 | 00,002,242 | —- | M] () – E:\Users\Jasar Ayaz\Desktop\Google Chrome.lnk
[2009/12/18 18:56:26 | 16,409,960 | —- | M] (Safer Networking Limited ) – E:\Users\Jasar Ayaz\Desktop\spybotsd162.exe
[2009/12/18 18:49:08 | 04,844,264 | —- | M] (Malwarebytes Corporation ) – E:\Users\Jasar Ayaz\Desktop\mbam-setup.exe
[2009/12/18 18:43:38 | 00,284,915 | —- | M] () – E:\Users\Jasar Ayaz\Desktop\gmer.zip
[2009/12/17 14:38:13 | 00,000,000 | —- | M] () – E:\Users\Jasar Ayaz\Desktop\settings.dat
[2009/12/17 14:33:23 | 00,000,898 | —- | M] () – E:\Users\Jasar Ayaz\Desktop\NTREGOPT.lnk
[2009/12/17 14:33:23 | 00,000,879 | —- | M] () – E:\Users\Jasar Ayaz\Desktop\ERUNT.lnk
[2009/12/17 14:19:48 | 00,619,642 | —- | M] () – E:\Windows\System32\perfh009.dat
[2009/12/17 14:19:48 | 00,107,792 | —- | M] () – E:\Windows\System32\perfc009.dat
[2009/12/17 14:19:47 | 00,713,888 | —- | M] () – E:\Windows\System32\PerfStringBackup.INI
[2009/12/17 13:11:52 | 00,791,393 | —- | M] (Lars Hederer ) – E:\Users\Jasar Ayaz\Desktop\erunt_setup.exe
[2009/12/17 13:11:32 | 00,359,929 | —- | M] () – E:\Users\Jasar Ayaz\Desktop\dds.scr
[2009/12/17 13:11:04 | 00,472,064 | —- | M] ( ) – E:\Users\Jasar Ayaz\Desktop\RootRepeal.exe
[2009/12/15 11:24:48 | 00,293,376 | —- | M] () – E:\Users\Jasar Ayaz\Desktop\gmer.exe
[2009/12/14 15:15:15 | 00,039,170 | —- | M] () – E:\Users\Jasar Ayaz\Documents\cc_20091214_151342.reg
[2009/12/14 14:55:03 | 00,000,017 | —- | M] () – E:\Users\Jasar Ayaz\AppData\Local\resmon.resmoncfg
[2009/12/09 23:48:14 | 00,668,603 | —- | M] () – E:\Users\Jasar Ayaz\Desktop\By Jasar Ayaz 11B1.docx
[2009/12/03 16:14:06 | 00,038,224 | —- | M] (Malwarebytes Corporation) – E:\Windows\System32\drivers\mbamswissarmy.sys
[2009/12/03 16:13:56 | 00,019,160 | —- | M] (Malwarebytes Corporation) – E:\Windows\System32\drivers\mbam.sys
[2009/11/21 22:35:31 | 00,001,835 | —- | M] () – E:\Users\Jasar Ayaz\Desktop\CCleaner.lnk
[2009/11/21 22:35:10 | 00,000,820 | RHS- | M] () – E:\Users\Jasar Ayaz\ntuser.pol

========== Files Created - No Company Name ==========

[2009/12/18 23:40:16 | 00,001,220 | —- | C] () – E:\Users\Jasar Ayaz\Desktop\Spybot - Search & Destroy.lnk
[2009/12/18 22:00:39 | 00,293,376 | —- | C] () – E:\Users\Jasar Ayaz\Desktop\gmer.exe
[2009/12/18 21:57:58 | 00,000,983 | —- | C] () – E:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/12/18 21:50:40 | 00,284,915 | —- | C] () – E:\Users\Jasar Ayaz\Desktop\gmer.zip
[2009/12/17 14:38:13 | 00,000,000 | —- | C] () – E:\Users\Jasar Ayaz\Desktop\settings.dat
[2009/12/17 14:33:23 | 00,000,898 | —- | C] () – E:\Users\Jasar Ayaz\Desktop\NTREGOPT.lnk
[2009/12/17 14:33:23 | 00,000,879 | —- | C] () – E:\Users\Jasar Ayaz\Desktop\ERUNT.lnk
[2009/12/17 14:19:24 | 00,359,929 | —- | C] () – E:\Users\Jasar Ayaz\Desktop\dds.scr
[2009/12/14 15:14:21 | 00,039,170 | —- | C] () – E:\Users\Jasar Ayaz\Documents\cc_20091214_151342.reg
[2009/12/14 14:55:03 | 00,000,017 | —- | C] () – E:\Users\Jasar Ayaz\AppData\Local\resmon.resmoncfg
[2009/12/05 22:01:02 | 00,668,603 | —- | C] () – E:\Users\Jasar Ayaz\Desktop\By Jasar Ayaz 11B1.docx
[2009/11/21 22:35:31 | 00,001,835 | —- | C] () – E:\Users\Jasar Ayaz\Desktop\CCleaner.lnk
[2009/11/14 22:02:23 | 00,000,376 | —- | C] () – E:\Windows\ODBC.INI
[2009/07/14 03:51:43 | 00,073,728 | —- | C] () – E:\Windows\System32\BthpanContextHandler.dll
[2009/07/14 03:42:10 | 00,064,000 | —- | C] () – E:\Windows\System32\BWContextHandler.dll
[2005/05/06 19:06:00 | 00,016,480 | —- | C] () – E:\Windows\System32\rixdicon.dll

========== Custom Scans ==========


< %systemroot%\System32\antiwpa.dll >

< %systemroot%\SYSTEM32\wpa.dll >

< %systemroot%\setup\scripts\biestart.exe >

< %systemroot%\system32\drivers\royal.sys >

< %systemroot%\system32\serauth1.dll >

< %systemroot%\system32\serauth2.dll >

< %systemroot%\system32\sysaudio.sys >

< %systemroot%\system32\wdmaud.sys >

< %systemroot%\system32\aeaudio.sys >

< %SYSTEMDRIVE%\*.exe >


< MD5 for: AGP440.SYS >
[2009/07/14 05:26:15 | 00,053,312 | —- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E – E:\Windows\System32\drivers\AGP440.sys
[2009/07/14 05:26:15 | 00,053,312 | —- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E – E:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys
[2009/07/14 05:26:15 | 00,053,312 | —- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E – E:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys

< MD5 for: ATAPI.SYS >
[2009/07/14 05:26:15 | 00,021,584 | —- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E – E:\Windows\System32\drivers\atapi.sys
[2009/07/14 05:26:15 | 00,021,584 | —- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E – E:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys
[2009/07/14 05:26:15 | 00,021,584 | —- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E – E:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2009/07/14 05:15:06 | 00,012,288 | —- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E – E:\Windows\System32\cngaudit.dll
[2009/07/14 05:15:06 | 00,012,288 | —- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E – E:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll

< MD5 for: IASTORV.SYS >
[2009/07/14 05:20:36 | 00,332,352 | —- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 – E:\Windows\System32\drivers\iaStorV.sys
[2009/07/14 05:20:36 | 00,332,352 | —- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 – E:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys
[2009/07/14 05:20:36 | 00,332,352 | —- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 – E:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys

< MD5 for: NETLOGON.DLL >
[2009/07/14 05:16:02 | 00,563,712 | —- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 – E:\Windows\System32\netlogon.dll
[2009/07/14 05:16:02 | 00,563,712 | —- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 – E:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll

< MD5 for: NVSTOR.SYS >
[2009/07/14 05:20:44 | 00,142,416 | —- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F – E:\Windows\System32\drivers\nvstor.sys
[2009/07/14 05:20:44 | 00,142,416 | —- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F – E:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys
[2009/07/14 05:20:44 | 00,142,416 | —- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F – E:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys

< MD5 for: SCECLI.DLL >
[2009/07/14 05:16:13 | 00,175,616 | —- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 – E:\Windows\System32\scecli.dll
[2009/07/14 05:16:13 | 00,175,616 | —- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 – E:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll

< %systemroot%\*. /mp /s >
< End of report >
Post #5
Extras.txt
OTL Extras logfile created on: 12/19/2009 7:49:23 AM - Run 1
OTL by OldTimer - Version 3.1.18.0 Folder = E:\Users\Jasar Ayaz\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1.99 Gb Total Physical Memory | 1.39 Gb Available Physical Memory | 69.91% Memory free
3.98 Gb Paging File | 3.26 Gb Available in Paging File | 81.99% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = E: | %SystemRoot% = E:\Windows | %ProgramFiles% = E:\Program Files
Drive C: | 9.76 Gb Total Space | 6.81 Gb Free Space | 69.83% Space Free | Partition Type: FAT32
Drive D: | 19.52 Gb Total Space | 1.18 Gb Free Space | 6.05% Space Free | Partition Type: FAT32
Drive E: | 43.78 Gb Total Space | 3.43 Gb Free Space | 7.84% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: UNKNOWN
Current User Name: Jasar Ayaz
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.chm [@ = chm.file] – "%SystemRoot%\hh.exe" %1
.cpl [@ = cplfile] – E:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – E:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = htmlfile] – E:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – E:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
chm.file [open] – "%SystemRoot%\hh.exe" %1
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile – "E:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] – "E:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
htmlfile [opennew] – "E:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] – "E:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] – "E:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
https [open] – "E:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] – "E:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –playlist-enqueue "%1" ()
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] – E:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] – "E:\Program Files\VideoLAN\VLC\vlc.exe" –started-from-file –no-playlist-enqueue "%1" ()
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] – "E:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] – "E:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90170409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office FrontPage 2003
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{AC76BA86-7AD7-1033-7B44-A92000000001}" = Adobe Reader 9.2
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"CCleaner" = CCleaner
"DirectVobSub" = DirectVobSub (remove only)
"ENTERPRISE" = Microsoft Office Enterprise 2007
"ERUNT_is1" = ERUNT 1.1j
"HD Tune_is1" = HD Tune 2.55
"HDMI" = Intel® Graphics Media Accelerator Driver
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Messenger Plus! Live" = Messenger Plus! Live
"Mozilla Firefox (3.5.5)" = Mozilla Firefox (3.5.5)
"RealPlayer 12.0" = RealPlayer
"uTorrent" = µTorrent
"VLC media player" = VLC media player 1.0.3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 12/17/2009 5:42:26 AM | Computer Name = UNKNOWN | Source = Google Update | ID = 20
Description =

Error - 12/17/2009 6:26:54 AM | Computer Name = UNKNOWN | Source = Application Hang | ID = 1002
Description = The program Explorer.EXE version 6.1.7600.16404 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Action Center control panel. Process ID: 7f8 Start
Time: 01ca7f00ac0aed37 Termination Time: 3526 Application Path: E:\Windows\Explorer.EXE

Report
Id:

Error - 12/17/2009 6:42:24 AM | Computer Name = UNKNOWN | Source = Google Update | ID = 20
Description =

Error - 12/17/2009 7:42:21 AM | Computer Name = UNKNOWN | Source = Google Update | ID = 20
Description =

Error - 12/17/2009 11:18:08 AM | Computer Name = UNKNOWN | Source = Google Update | ID = 20
Description =

Error - 12/18/2009 6:42:51 PM | Computer Name = UNKNOWN | Source = Google Update | ID = 20
Description =

Error - 12/18/2009 7:42:19 PM | Computer Name = UNKNOWN | Source = Google Update | ID = 20
Description =

Error - 12/18/2009 8:42:19 PM | Computer Name = UNKNOWN | Source = Google Update | ID = 20
Description =

Error - 12/18/2009 9:42:19 PM | Computer Name = UNKNOWN | Source = Google Update | ID = 20
Description =

Error - 12/18/2009 10:42:16 PM | Computer Name = UNKNOWN | Source = Google Update | ID = 20
Description =

[ System Events ]
Error - 12/17/2009 6:05:50 AM | Computer Name = UNKNOWN | Source = EventLog | ID = 6008
Description = The previous system shutdown at 13:44:09 on ?17/?12/?2009 was unexpected.

Error - 12/17/2009 6:08:21 AM | Computer Name = UNKNOWN | Source = Service Control Manager | ID = 7022
Description = The ESET Service service hung on starting.

Error - 12/17/2009 6:10:55 AM | Computer Name = UNKNOWN | Source = DCOM | ID = 10010
Description =

Error - 12/17/2009 7:04:28 AM | Computer Name = UNKNOWN | Source = Service Control Manager | ID = 7009
Description = A timeout was reached (30000 milliseconds) while waiting for the Windows
Error Reporting Service service to connect.

Error - 12/17/2009 7:04:58 AM | Computer Name = UNKNOWN | Source = Service Control Manager | ID = 7009
Description = A timeout was reached (30000 milliseconds) while waiting for the Windows
Error Reporting Service service to connect.

Error - 12/18/2009 5:43:28 AM | Computer Name = UNKNOWN | Source = Service Control Manager | ID = 7009
Description = A timeout was reached (30000 milliseconds) while waiting for the Steam
Client Service service to connect.

Error - 12/18/2009 5:43:28 AM | Computer Name = UNKNOWN | Source = Service Control Manager | ID = 7000
Description = The Steam Client Service service failed to start due to the following
error: %%1053

Error - 12/18/2009 1:32:47 PM | Computer Name = UNKNOWN | Source = volsnap | ID = 393252
Description = The shadow copies of volume E: were aborted because the shadow copy
storage could not grow due to a user imposed limit.

Error - 12/18/2009 2:06:50 PM | Computer Name = UNKNOWN | Source = EventLog | ID = 6008
Description = The previous system shutdown at 22:03:46 on ?18/?12/?2009 was unexpected.

Error - 12/18/2009 2:10:38 PM | Computer Name = UNKNOWN | Source = DCOM | ID = 10010
Description =


< End of report >
Post #6
GMER.txt
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2009-12-19 10:26:38
Windows 6.1.7600
Running: gmer.exe; Driver: E:\Users\JASARA~1\AppData\Local\Temp\uwddapog.sys

PAGE …

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!ZwSaveKeyEx + 13AD 82846579 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 8286AF52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, …] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

—- System - GMER 1.0.15 —-

INT 0xD2 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C15898
INT 0xD1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C162D8
INT 0x37 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C2D104
INT 0xDF \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C2D1DC
INT 0xC1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C2D3F4
INT 0xE3 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C2D6F8
INT 0xE1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C2D958
INT 0x1F \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C2DAF8
INT 0xFD \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C2DF2C
INT 0xFE \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82C2E1A8

—- Kernel code sections - GMER 1.0.15 —-

.text peauth.sys 95E7CC9D 28 Bytes [4F, 9D, 2B, 48, 9B, 23, A8, …]
.text peauth.sys 95E7CCC1 28 Bytes [4F, 9D, 2B, 48, 9B, 23, A8, …]
PAGE spsys.sys!?SPRevision@@3PADA + 4F90 A9A46000 290 Bytes [8B, FF, 55, 8B, EC, 33, C0, …]
PAGE spsys.sys!?SPRevision@@3PADA + 50B3 A9A46123 629 Bytes [15, A4, A9, FE, 05, 34, 15, …]
PAGE spsys.sys!?SPRevision@@3PADA + 5329 A9A46399 101 Bytes [6A, 28, 59, A5, 5E, C6, 03, …]
PAGE spsys.sys!?SPRevision@@3PADA + 538F A9A463FF 148 Bytes [18, 5D, C2, 14, 00, 8B, FF, …]
PAGE spsys.sys!?SPRevision@@3PADA + 543B A9A464AB 2228 Bytes [8B, FF, 55, 8B, EC, FF, 75, …]

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

Device \Driver\ACPI_HAL \Device\00000047 halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

—- Kernel code sections - GMER 1.0.15 —-

? System32\drivers\ncpdgf.sys The system cannot find the path specified. !

—- EOF - GMER 1.0.15 —-

Please advice me on the next step asap. And can you tell me what the source of the problem is?
Post #7
Hi,

You have µTorrent, a P2P/file sharing programs installed on your computer. P2P applications like it are the largest source of malware we see. You'll be doing yourself a favor by removing it.

P2P (File Sharing ) programs form a direct conduit onto your computer, their security measures are easily circumvented, and Malware writers are increasingly exploiting them to spread their wares onto your computer. Further to that, if your P2P program is not configured correctly you may be sharing more files than you realize. There have been cases where people's Passwords, Address Books and other personal, private, and financial details have been exposed to the file sharing network by a badly configured program.

Many of the programs come bundled with other unwanted programs, but even the ones free of any bundled software are not safe to use.

I would recommend that you uninstall µTorrent, via Control Panel -> Add or Remove Programs.

However, if you do not wish to remove this program please be advised not to use the said program during the course of cleaning your machine.

_______________________________________

Please go to the site below to scan the following files:
Virus Total

Click on Browse, and upload the following file for analysis or copy/paste the text below into the browse box:
E:\Windows\System32\drivers\ncpdgf.sys

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.
If it says already scanned – click "reanalyze now"

Please post the results in your next reply.

–Next–

Download TFC to your desktop
  • Close any open windows.
  • Right click the TFC icon then choose Run as Administrator to run the program.
  • TFC will close all open programs itself in order to run,
  • Click the Start button to begin the process.
  • Allow TFC to run uninterrupted.
  • The program should not take long to finish it's job
  • Once its finished it should automatically reboot your machine,
  • if it doesn't, manually reboot to ensure a complete clean
–Next–
  • Open Malwarebytes.
  • Click on the Update tab.
  • Click Check for Updates button.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post back the log.
To post in your next reply:
1. Virus Total log.
2. Malwarebytes' log.
Post #8
I was unable to find the file named ncpdgf.sys. Therefore I proceeded to the next steps. Ran TFC and then ran a scan using malware bytes after updating it. It could find nothing. Here's the log: Malwarebytes' Anti-Malware 1.42 Database version: 3401 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 21/12/2009 11:59:19 AM mbam-log-2009-12-21 (11-59-19).txt Scan type: Quick Scan Objects scanned: 97178 Time elapsed: 53 minute(s), 54 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)
Post #9
Hi,

As a Vista user, in order to do this scan, you will need to open your browser by right clicking and click Run as Adminstrator.

Do not use that instance of the browser for any thing else as it will have administrator rights. Once the scan has completed and the results saved, close the browser. Open one in the normal way and return to this thread and post the requested logs.

–Next–

Please do a scan with Kaspersky Online Scanner.
  • Click on the Accept button and install any components it needs.
  • The program will install and then begin downloading the latest definition files.
  • After the files have been downloaded on the left side of the page in the Scan section select My Computer.
  • This will start the program and scan your system.
  • The scan will take a while, so be patient and let it run. (At times it may appear to stall)
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
    • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
    • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Once the scan is complete, click on View scan report To obtain the report:
  • Click on: Save Report As
  • Next, in the Save as prompt, Save in area, select: Desktop
  • In the File name area, use KScan, or something similar In Save as type, click the drop arrow and select: Text file [*.txt]
  • Then, click: Save
  • Please post the Kaspersky Online Scanner Report in your reply.
–Next–

Run OTL again please:
  • Right click on the icon then choose Run as Administrator to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open a notepad window, OTL.Txt.
    Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.
To post in your next reply:
1. Kaspersky log.
2. OTL log.
3. How is your computer?
Post #10
Kaspersky scan didn't find any infected or suspicious objects so there was nothing in the report to paste here.

The computer is still like before; dead slow, freezes, takes too long for a program to open.

Here's the OTL log:

OTL logfile created on: 12/23/2009 9:41:59 AM - Run 2
OTL by OldTimer - Version 3.1.18.0 Folder = E:\Users\Jasar Ayaz\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1.99 Gb Total Physical Memory | 1.10 Gb Available Physical Memory | 55.44% Memory free
3.98 Gb Paging File | 3.07 Gb Available in Paging File | 76.99% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = E: | %SystemRoot% = E:\Windows | %ProgramFiles% = E:\Program Files
Drive C: | 9.76 Gb Total Space | 6.81 Gb Free Space | 69.83% Space Free | Partition Type: FAT32
Drive D: | 19.52 Gb Total Space | 1.18 Gb Free Space | 6.05% Space Free | Partition Type: FAT32
Drive E: | 43.78 Gb Total Space | 2.84 Gb Free Space | 6.49% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: UNKNOWN
Current User Name: Jasar Ayaz
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - E:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - E:\Users\Jasar Ayaz\Desktop\OTL.exe (OldTimer Tools)
PRC - E:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - E:\Windows\explorer.exe (Microsoft Corporation)
PRC - E:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - E:\Windows\System32\sppsvc.exe (Microsoft Corporation)
PRC - E:\Windows\System32\msfeedssync.exe (Microsoft Corporation)
PRC - E:\Windows\System32\igfxsrvc.exe (Intel Corporation)
PRC - E:\Windows\System32\igfxpers.exe (Intel Corporation)
PRC - E:\Windows\System32\hkcmd.exe (Intel Corporation)
PRC - E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - E:\Users\Jasar Ayaz\Desktop\OTL.exe (OldTimer Tools)
MOD - E:\Windows\System32\sspicli.dll (Microsoft Corporation)
MOD - E:\Windows\System32\sfc_os.dll (Microsoft Corporation)
MOD - E:\Windows\System32\sechost.dll (Microsoft Corporation)
MOD - E:\Windows\System32\samcli.dll (Microsoft Corporation)
MOD - E:\Windows\System32\profapi.dll (Microsoft Corporation)
MOD - E:\Windows\System32\netutils.dll (Microsoft Corporation)
MOD - E:\Windows\System32\msi.dll (Microsoft Corporation)
MOD - E:\Windows\System32\msiltcfg.dll (Microsoft Corporation)
MOD - E:\Windows\System32\KernelBase.dll (Microsoft Corporation)
MOD - E:\Windows\System32\dwmapi.dll (Microsoft Corporation)
MOD - E:\Windows\System32\devobj.dll (Microsoft Corporation)
MOD - E:\Windows\System32\cryptbase.dll (Microsoft Corporation)
MOD - E:\Windows\System32\cfgmgr32.dll (Microsoft Corporation)
MOD - E:\Windows\System32\sfc.dll (Microsoft Corporation)
MOD - E:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (Steam Client Service) – E:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (getPlusHelper) getPlus® – E:\Program Files\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)
SRV - (WwanSvc) – E:\Windows\System32\wwansvc.dll (Microsoft Corporation)
SRV - (WbioSrvc) – E:\Windows\System32\wbiosrvc.dll (Microsoft Corporation)
SRV - (Power) – E:\Windows\System32\umpo.dll (Microsoft Corporation)
SRV - (Themes) – E:\Windows\System32\themeservice.dll (Microsoft Corporation)
SRV - (sppuinotify) – E:\Windows\System32\sppuinotify.dll (Microsoft Corporation)
SRV - (RpcEptMapper) – E:\Windows\System32\RpcEpMap.dll (Microsoft Corporation)
SRV - (SensrSvc) – E:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) – E:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (PNRPsvc) – E:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (p2pimsvc) – E:\Windows\System32\pnrpsvc.dll (Microsoft Corporation)
SRV - (HomeGroupProvider) – E:\Windows\System32\provsvc.dll (Microsoft Corporation)
SRV - (PNRPAutoReg) – E:\Windows\System32\pnrpauto.dll (Microsoft Corporation)
SRV - (WinDefend) – E:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (HomeGroupListener) – E:\Windows\System32\ListSvc.dll (Microsoft Corporation)
SRV - (FontCache) – E:\Windows\System32\FntCache.dll (Microsoft Corporation)
SRV - (Dhcp) – E:\Windows\System32\dhcpcore.dll (Microsoft Corporation)
SRV - (defragsvc) – E:\Windows\System32\defragsvc.dll (Microsoft Corporation)
SRV - (BDESVC) – E:\Windows\System32\bdesvc.dll (Microsoft Corporation)
SRV - (AxInstSV) ActiveX Installer (AxInstSV) – E:\Windows\System32\AxInstSv.dll (Microsoft Corporation)
SRV - (AppIDSvc) – E:\Windows\System32\appidsvc.dll (Microsoft Corporation)
SRV - (sppsvc) – E:\Windows\System32\sppsvc.exe (Microsoft Corporation)
SRV - (odserv) – E:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (Microsoft Office Groove Audit Service) – E:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation)
SRV - (ose) – E:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (cmdide) – E:\Windows\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.)
DRV - (adpahci) – E:\Windows\system32\DRIVERS\adpahci.sys (Adaptec, Inc.)
DRV - (adp94xx) – E:\Windows\system32\DRIVERS\adp94xx.sys (Adaptec, Inc.)
DRV - (amdsbs) – E:\Windows\system32\DRIVERS\amdsbs.sys (AMD Technologies Inc.)
DRV - (adpu320) – E:\Windows\system32\DRIVERS\adpu320.sys (Adaptec, Inc.)
DRV - (arcsas) – E:\Windows\system32\DRIVERS\arcsas.sys (Adaptec, Inc.)
DRV - (amdsata) – E:\Windows\system32\DRIVERS\amdsata.sys (Advanced Micro Devices)
DRV - (arc) – E:\Windows\system32\DRIVERS\arc.sys (Adaptec, Inc.)
DRV - (amdxata) – E:\Windows\system32\DRIVERS\amdxata.sys (Advanced Micro Devices)
DRV - (aliide) – E:\Windows\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)
DRV - (nvstor) – E:\Windows\system32\DRIVERS\nvstor.sys (NVIDIA Corporation)
DRV - (nvraid) – E:\Windows\system32\DRIVERS\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) – E:\Windows\system32\DRIVERS\nfrd960.sys (IBM Corporation)
DRV - (LSI_SAS) – E:\Windows\system32\DRIVERS\lsi_sas.sys (LSI Corporation)
DRV - (iaStorV) – E:\Windows\system32\DRIVERS\iaStorV.sys (Intel Corporation)
DRV - (MegaSR) – E:\Windows\system32\DRIVERS\MegaSR.sys (LSI Corporation, Inc.)
DRV - (KSecPkg) – E:\Windows\System32\Drivers\ksecpkg.sys (Microsoft Corporation)
DRV - (LSI_SCSI) – E:\Windows\system32\DRIVERS\lsi_scsi.sys (LSI Corporation)
DRV - (LSI_FC) – E:\Windows\system32\DRIVERS\lsi_fc.sys (LSI Corporation)
DRV - (LSI_SAS2) – E:\Windows\system32\DRIVERS\lsi_sas2.sys (LSI Corporation)
DRV - (iirsp) – E:\Windows\system32\DRIVERS\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (megasas) – E:\Windows\system32\DRIVERS\megasas.sys (LSI Corporation)
DRV - (hwpolicy) – E:\Windows\System32\drivers\hwpolicy.sys (Microsoft Corporation)
DRV - (elxstor) – E:\Windows\system32\DRIVERS\elxstor.sys (Emulex)
DRV - (aic78xx) – E:\Windows\system32\DRIVERS\djsvs.sys (Adaptec, Inc.)
DRV - (HpSAMD) – E:\Windows\system32\DRIVERS\HpSAMD.sys (Hewlett-Packard Company)
DRV - (FsDepends) – E:\Windows\System32\drivers\fsdepends.sys (Microsoft Corporation)
DRV - (vsmraid) – E:\Windows\system32\DRIVERS\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (vmbus) – E:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation)
DRV - (vhdmp) – E:\Windows\system32\DRIVERS\vhdmp.sys (Microsoft Corporation)
DRV - (storflt) – E:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation)
DRV - (vdrvroot) – E:\Windows\system32\DRIVERS\vdrvroot.sys (Microsoft Corporation)
DRV - (storvsc) – E:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation)
DRV - (WIMMount) – E:\Windows\System32\drivers\wimmount.sys (Microsoft Corporation)
DRV - (viaide) – E:\Windows\system32\DRIVERS\viaide.sys (VIA Technologies, Inc.)
DRV - (ql2300) – E:\Windows\system32\DRIVERS\ql2300.sys (QLogic Corporation)
DRV - (rdyboost) – E:\Windows\System32\drivers\rdyboost.sys (Microsoft Corporation)
DRV - (ql40xx) – E:\Windows\system32\DRIVERS\ql40xx.sys (QLogic Corporation)
DRV - (SiSRaid4) – E:\Windows\system32\DRIVERS\sisraid4.sys (Silicon Integrated Systems)
DRV - (pcw) – E:\Windows\System32\drivers\pcw.sys (Microsoft Corporation)
DRV - (SiSRaid2) – E:\Windows\system32\DRIVERS\SiSRaid2.sys (Silicon Integrated Systems Corp.)
DRV - (stexstor) – E:\Windows\system32\DRIVERS\stexstor.sys (Promise Technology)
DRV - (CNG) – E:\Windows\System32\Drivers\cng.sys (Microsoft Corporation)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – E:\Windows\System32\Drivers\Brserid.sys (Brother Industries Ltd.)
DRV - (rdpbus) – E:\Windows\System32\drivers\rdpbus.sys (Microsoft Corporation)
DRV - (RDPREFMP) – E:\Windows\System32\drivers\RDPREFMP.sys (Microsoft Corporation)
DRV - (RasAgileVpn) WAN Miniport (IKEv2) – E:\Windows\System32\drivers\agilevpn.sys (Microsoft Corporation)
DRV - (WfpLwf) – E:\Windows\System32\drivers\wfplwf.sys (Microsoft Corporation)
DRV - (NdisCap) – E:\Windows\System32\drivers\ndiscap.sys (Microsoft Corporation)
DRV - (vwifibus) – E:\Windows\System32\drivers\vwifibus.sys (Microsoft Corporation)
DRV - (1394ohci) – E:\Windows\System32\drivers\1394ohci.sys (Microsoft Corporation)
DRV - (UmPass) – E:\Windows\system32\DRIVERS\umpass.sys (Microsoft Corporation)
DRV - (WinUsb) – E:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (mshidkmdf) – E:\Windows\System32\drivers\mshidkmdf.sys (Microsoft Corporation)
DRV - (MTConfig) – E:\Windows\system32\DRIVERS\MTConfig.sys (Microsoft Corporation)
DRV - (CompositeBus) – E:\Windows\System32\drivers\CompositeBus.sys (Microsoft Corporation)
DRV - (AppID) – E:\Windows\system32\drivers\appid.sys (Microsoft Corporation)
DRV - (scfilter) – E:\Windows\System32\drivers\scfilter.sys (Microsoft Corporation)
DRV - (s3cap) – E:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation)
DRV - (VMBusHID) – E:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation)
DRV - (discache) – E:\Windows\System32\drivers\discache.sys (Microsoft Corporation)
DRV - (HidBatt) – E:\Windows\system32\DRIVERS\HidBatt.sys (Microsoft Corporation)
DRV - (AcpiPmi) – E:\Windows\system32\DRIVERS\acpipmi.sys (Microsoft Corporation)
DRV - (AmdPPM) – E:\Windows\system32\DRIVERS\amdppm.sys (Microsoft Corporation)
DRV - (hcw85cir) – E:\Windows\system32\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (BrUsbMdm) – E:\Windows\System32\Drivers\BrUsbMdm.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – E:\Windows\System32\Drivers\BrUsbSer.sys (Brother Industries Ltd.)
DRV - (BrSerWdm) – E:\Windows\System32\Drivers\BrSerWdm.sys (Brother Industries Ltd.)
DRV - (BrFiltLo) – E:\Windows\system32\DRIVERS\BrFiltLo.sys (Brother Industries, Ltd.)
DRV - (BrFiltUp) – E:\Windows\system32\DRIVERS\BrFiltUp.sys (Brother Industries, Ltd.)
DRV - (SrvHsfV92) – E:\Windows\System32\drivers\VSTDPV3.SYS (Conexant Systems, Inc.)
DRV - (SrvHsfWinac) – E:\Windows\System32\drivers\VSTCNXT3.SYS (Conexant Systems, Inc.)
DRV - (SrvHsfHDA) – E:\Windows\System32\drivers\VSTAZL3.SYS (Conexant Systems, Inc.)
DRV - (netw5v32) Intel® – E:\Windows\System32\drivers\netw5v32.sys (Intel Corporation)
DRV - (b57nd60x) – E:\Windows\System32\drivers\b57nd60x.sys (Broadcom Corporation)
DRV - (bcm4sbxp) – E:\Windows\System32\drivers\bcm4sbxp.sys (Broadcom Corporation)
DRV - (ebdrv) – E:\Windows\system32\DRIVERS\evbdx.sys (Broadcom Corporation)
DRV - (b06bdrv) – E:\Windows\system32\DRIVERS\bxvbdx.sys (Broadcom Corporation)
DRV - (secdrv) – E:\Windows\System32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (igfx) – E:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (rismxdp) – E:\Windows\System32\drivers\rixdptsk.sys (REDC)
DRV - (rimsptsk) – E:\Windows\System32\drivers\rimsptsk.sys (REDC)
DRV - (rimmptsk) – E:\Windows\System32\drivers\rimmptsk.sys (REDC)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========



IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1413770439-2942384449-4071594559-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-1413770439-2942384449-4071594559-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKU\S-1-5-21-1413770439-2942384449-4071594559-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B8 E2 07 87 54 6F CA 01 [binary data]
IE - HKU\S-1-5-21-1413770439-2942384449-4071594559-1000\S-1-5-21-1413770439-2942384449-4071594559-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Wikipedia (en)"
FF - prefs.js..browser.startup.homepage: "http://www.google.com"
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1
FF - prefs.js..extensions.enabledItems: 6
FF - prefs.js..extensions.enabledItems: 2
FF - prefs.js..extensions.enabledItems: 49
FF - prefs.js..extensions.enabledItems: [removed]:1.5
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..network.proxy.backup.ftp: "[removed]"
FF - prefs.js..network.proxy.backup.ftp_port: 3128
FF - prefs.js..network.proxy.backup.gopher: "[removed]"
FF - prefs.js..network.proxy.backup.gopher_port: 3128
FF - prefs.js..network.proxy.backup.socks: "[removed]"
FF - prefs.js..network.proxy.backup.socks_port: 3128
FF - prefs.js..network.proxy.backup.ssl: "[removed]"
FF - prefs.js..network.proxy.backup.ssl_port: 3128
FF - prefs.js..network.proxy.ftp: "[removed]"
FF - prefs.js..network.proxy.ftp_port: 3128
FF - prefs.js..network.proxy.gopher: "[removed]"
FF - prefs.js..network.proxy.gopher_port: 3128
FF - prefs.js..network.proxy.http: "[removed]"
FF - prefs.js..network.proxy.http_port: 3128
FF - prefs.js..network.proxy.no_proxies_on: "[removed]"
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "[removed]"
FF - prefs.js..network.proxy.socks_port: 3128
FF - prefs.js..network.proxy.ssl: "204.8.65.218"
FF - prefs.js..network.proxy.ssl_port: 3128

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Components: E:\Program Files\Mozilla Firefox\components [2009/12/21 17:42:50 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Plugins: E:\Program Files\Mozilla Firefox\plugins [2009/12/22 15:23:34 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\[removed]: E:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird

[2009/11/12 23:40:08 | 00,000,000 | —D | M] – E:\Users\Jasar Ayaz\AppData\Roaming\Mozilla\Extensions
[2009/12/22 15:29:57 | 00,000,000 | —D | M] – E:\Users\Jasar Ayaz\AppData\Roaming\Mozilla\Firefox\Profiles\9rarjbiv.default\extensions
[2009/11/13 14:33:40 | 00,000,000 | —D | M] (Adobe DLM (powered by getPlus®)) – E:\Users\Jasar Ayaz\AppData\Roaming\Mozilla\Firefox\Profiles\9rarjbiv.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2009/11/29 10:51:09 | 00,000,000 | —D | M] – E:\Users\Jasar Ayaz\AppData\Roaming\Mozilla\Firefox\Profiles\9rarjbiv.default\extensions\[removed]
[2009/12/22 15:29:57 | 00,000,000 | —D | M] – E:\Program Files\Mozilla Firefox\extensions
[2009/11/03 05:42:02 | 00,001,538 | —- | M] () – E:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
[2009/11/03 05:42:02 | 00,000,947 | —- | M] () – E:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
[2009/11/03 05:42:02 | 00,000,769 | —- | M] () – E:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
[2009/11/03 05:42:02 | 00,000,831 | —- | M] () – E:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: (824 bytes) - E:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - E:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Adobe ARM] E:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] E:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [GrooveMonitor] E:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
O4 - HKLM..\Run: [HotKeysCmds] E:\Windows\System32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [IgfxTray] E:\Windows\System32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] E:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Persistence] E:\Windows\System32\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [SunJavaUpdateSched] E:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TkBellExe] E:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKU\S-1-5-21-1413770439-2942384449-4071594559-1000..\Run: [Google Update] E:\Users\Jasar Ayaz\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
O4 - HKU\S-1-5-21-1413770439-2942384449-4071594559-1000..\Run: [SpybotSD TeaTimer] E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - HKU\S-1-5-21-1413770439-2942384449-4071594559-1000..\Run: [Steam] E:\Program Files\Steam\Steam.exe (Valve Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] E:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] E:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\S-1-5-21-1413770439-2942384449-4071594559-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1413770439-2942384449-4071594559-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKU\S-1-5-21-1413770439-2942384449-4071594559-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8 - Extra context menu item: E&xport to Microsoft Excel - E:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_16)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed] [removed]
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - E:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - E:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - E:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - E:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - E:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - E:\Windows\System32\igfxdev.dll (Intel Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - E:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (pku2u) - E:\Windows\System32\pku2u.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/11/12 16:56:46 | 00,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ FAT32 ]
O32 - AutoRun File - [2009/06/11 01:42:20 | 00,000,024 | —- | M] () - E:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2009/05/04 16:40:17 | 00,000,000 | —D | M] - E:\autorun.inf – [ NTFS ]
O33 - MountPoints2\{5b73364f-d53d-11de-8e79-0015c5a3e4fc}\Shell - "" = AutoRun
O33 - MountPoints2\{5b73364f-d53d-11de-8e79-0015c5a3e4fc}\Shell\AutoRun\command - "" = G:\LaunchU3.exe – File not found
O33 - MountPoints2\{7c86e7f9-d1d6-11de-8082-0015c5a3e4fc}\Shell - "" = AutoRun
O33 - MountPoints2\{7c86e7f9-d1d6-11de-8082-0015c5a3e4fc}\Shell\AutoRun\command - "" = H:\LaunchU3.exe – File not found
O33 - MountPoints2\G\Shell - "" = AutoRun
O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\LaunchU3.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2009/12/22 15:30:38 | 00,000,000 | —D | C] – E:\Windows\Sun
[2009/12/22 15:20:08 | 00,000,000 | —D | C] – E:\Program Files\Java
[2009/12/21 10:35:03 | 00,410,624 | —- | C] (OldTimer Tools) – E:\Users\Jasar Ayaz\Desktop\TFC.exe
[2009/12/19 07:43:33 | 00,564,736 | —- | C] (OldTimer Tools) – E:\Users\Jasar Ayaz\Desktop\OTL.exe
[2009/12/18 23:37:59 | 00,000,000 | —D | C] – E:\ProgramData\Spybot - Search & Destroy
[2009/12/18 23:37:59 | 00,000,000 | —D | C] – E:\Program Files\Spybot - Search & Destroy
[2009/12/18 22:00:42 | 00,000,000 | —D | C] – E:\Users\Jasar Ayaz\AppData\Roaming\Malwarebytes
[2009/12/18 21:57:46 | 00,038,224 | —- | C] (Malwarebytes Corporation) – E:\Windows\System32\drivers\mbamswissarmy.sys
[2009/12/18 21:57:13 | 00,000,000 | —D | C] – E:\ProgramData\Malwarebytes
[2009/12/18 21:56:59 | 00,019,160 | —- | C] (Malwarebytes Corporation) – E:\Windows\System32\drivers\mbam.sys
[2009/12/18 21:56:58 | 00,000,000 | —D | C] – E:\Program Files\Malwarebytes' Anti-Malware
[2009/12/18 21:50:38 | 16,409,960 | —- | C] (Safer Networking Limited ) – E:\Users\Jasar Ayaz\Desktop\spybotsd162.exe
[2009/12/18 21:50:37 | 04,844,264 | —- | C] (Malwarebytes Corporation ) – E:\Users\Jasar Ayaz\Desktop\mbam-setup.exe
[2009/12/17 14:34:24 | 00,000,000 | —D | C] – E:\Windows\ERDNT
[2009/12/17 14:33:14 | 00,000,000 | —D | C] – E:\Program Files\ERUNT
[2009/12/17 14:19:24 | 00,791,393 | —- | C] (Lars Hederer ) – E:\Users\Jasar Ayaz\Desktop\erunt_setup.exe
[2009/12/17 14:19:24 | 00,472,064 | —- | C] ( ) – E:\Users\Jasar Ayaz\Desktop\RootRepeal.exe
[2009/12/14 17:42:10 | 00,000,000 | —D | C] – E:\Program Files\HD Tune
[2009/12/11 14:16:15 | 00,000,000 | —D | C] – E:\Users\Jasar Ayaz\Documents\My Chat Logs
[2009/12/11 11:16:19 | 00,000,000 | —D | C] – E:\ProgramData\Messenger Plus!
[2009/12/11 00:11:02 | 00,000,000 | —D | C] – E:\Program Files\Messenger Plus! Live
[2009/12/11 00:10:45 | 00,000,000 | —D | C] – E:\Program Files\DirectVobSub
[2009/12/06 23:27:15 | 00,000,000 | —D | C] – E:\Windows\System32\appmgmt
[2009/11/29 22:14:03 | 00,000,000 | —D | C] – E:\Users\Jasar Ayaz\AppData\Local\ESET
[2009/11/25 22:21:23 | 00,000,000 | —D | C] – E:\Users\Jasar Ayaz\AppData\Local\Microsoft Games

========== Files - Modified Within 30 Days ==========

[2009/12/23 10:01:01 | 03,932,160 | -HS- | M] () – E:\Users\Jasar Ayaz\ntuser.dat
[2009/12/23 09:52:29 | 00,009,584 | -H– | M] () – E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2009/12/23 09:52:29 | 00,009,584 | -H– | M] () – E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2009/12/23 09:42:13 | 00,000,928 | —- | M] () – E:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1413770439-2942384449-4071594559-1000UA.job
[2009/12/22 23:42:04 | 00,000,876 | —- | M] () – E:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1413770439-2942384449-4071594559-1000Core.job
[2009/12/22 14:43:18 | 00,000,006 | -H– | M] () – E:\Windows\tasks\SA.DAT
[2009/12/22 14:42:37 | 00,409,752 | —- | M] () – E:\Windows\System32\FNTCACHE.DAT
[2009/12/22 14:42:20 | 00,067,584 | –S- | M] () – E:\Windows\bootstat.dat
[2009/12/22 14:41:01 | 16,030,92480 | -HS- | M] () – E:\hiberfil.sys
[2009/12/21 18:21:49 | 02,651,321 | -H– | M] () – E:\Users\Jasar Ayaz\AppData\Local\IconCache.db
[2009/12/21 09:46:56 | 00,410,624 | —- | M] (OldTimer Tools) – E:\Users\Jasar Ayaz\Desktop\TFC.exe
[2009/12/19 07:37:12 | 00,564,736 | —- | M] (OldTimer Tools) – E:\Users\Jasar Ayaz\Desktop\OTL.exe
[2009/12/18 23:40:16 | 00,001,220 | —- | M] () – E:\Users\Jasar Ayaz\Desktop\Spybot - Search & Destroy.lnk
[2009/12/18 21:57:58 | 00,000,983 | —- | M] () – E:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/12/18 21:53:35 | 00,002,242 | —- | M] () – E:\Users\Jasar Ayaz\Desktop\Google Chrome.lnk
[2009/12/18 18:56:26 | 16,409,960 | —- | M] (Safer Networking Limited ) – E:\Users\Jasar Ayaz\Desktop\spybotsd162.exe
[2009/12/18 18:49:08 | 04,844,264 | —- | M] (Malwarebytes Corporation ) – E:\Users\Jasar Ayaz\Desktop\mbam-setup.exe
[2009/12/18 18:43:38 | 00,284,915 | —- | M] () – E:\Users\Jasar Ayaz\Desktop\gmer.zip
[2009/12/17 14:38:13 | 00,000,000 | —- | M] () – E:\Users\Jasar Ayaz\Desktop\settings.dat
[2009/12/17 14:33:23 | 00,000,898 | —- | M] () – E:\Users\Jasar Ayaz\Desktop\NTREGOPT.lnk
[2009/12/17 14:33:23 | 00,000,879 | —- | M] () – E:\Users\Jasar Ayaz\Desktop\ERUNT.lnk
[2009/12/17 14:19:48 | 00,619,642 | —- | M] () – E:\Windows\System32\perfh009.dat
[2009/12/17 14:19:48 | 00,107,792 | —- | M] () – E:\Windows\System32\perfc009.dat
[2009/12/17 14:19:47 | 00,713,888 | —- | M] () – E:\Windows\System32\PerfStringBackup.INI
[2009/12/17 13:11:52 | 00,791,393 | —- | M] (Lars Hederer ) – E:\Users\Jasar Ayaz\Desktop\erunt_setup.exe
[2009/12/17 13:11:32 | 00,359,929 | —- | M] () – E:\Users\Jasar Ayaz\Desktop\dds.scr
[2009/12/17 13:11:04 | 00,472,064 | —- | M] ( ) – E:\Users\Jasar Ayaz\Desktop\RootRepeal.exe
[2009/12/15 11:24:48 | 00,293,376 | —- | M] () – E:\Users\Jasar Ayaz\Desktop\gmer.exe
[2009/12/14 15:15:15 | 00,039,170 | —- | M] () – E:\Users\Jasar Ayaz\Documents\cc_20091214_151342.reg
[2009/12/14 14:55:03 | 00,000,017 | —- | M] () – E:\Users\Jasar Ayaz\AppData\Local\resmon.resmoncfg
[2009/12/09 23:48:14 | 00,668,603 | —- | M] () – E:\Users\Jasar Ayaz\Desktop\By Jasar Ayaz 11B1.docx
[2009/12/03 16:14:06 | 00,038,224 | —- | M] (Malwarebytes Corporation) – E:\Windows\System32\drivers\mbamswissarmy.sys
[2009/12/03 16:13:56 | 00,019,160 | —- | M] (Malwarebytes Corporation) – E:\Windows\System32\drivers\mbam.sys

========== Files Created - No Company Name ==========

[2009/12/18 23:40:16 | 00,001,220 | —- | C] () – E:\Users\Jasar Ayaz\Desktop\Spybot - Search & Destroy.lnk
[2009/12/18 22:00:39 | 00,293,376 | —- | C] () – E:\Users\Jasar Ayaz\Desktop\gmer.exe
[2009/12/18 21:57:58 | 00,000,983 | —- | C] () – E:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/12/18 21:50:40 | 00,284,915 | —- | C] () – E:\Users\Jasar Ayaz\Desktop\gmer.zip
[2009/12/17 14:38:13 | 00,000,000 | —- | C] () – E:\Users\Jasar Ayaz\Desktop\settings.dat
[2009/12/17 14:33:23 | 00,000,898 | —- | C] () – E:\Users\Jasar Ayaz\Desktop\NTREGOPT.lnk
[2009/12/17 14:33:23 | 00,000,879 | —- | C] () – E:\Users\Jasar Ayaz\Desktop\ERUNT.lnk
[2009/12/17 14:19:24 | 00,359,929 | —- | C] () – E:\Users\Jasar Ayaz\Desktop\dds.scr
[2009/12/14 15:14:21 | 00,039,170 | —- | C] () – E:\Users\Jasar Ayaz\Documents\cc_20091214_151342.reg
[2009/12/14 14:55:03 | 00,000,017 | —- | C] () – E:\Users\Jasar Ayaz\AppData\Local\resmon.resmoncfg
[2009/12/05 22:01:02 | 00,668,603 | —- | C] () – E:\Users\Jasar Ayaz\Desktop\By Jasar Ayaz 11B1.docx
[2009/11/14 22:02:23 | 00,000,376 | —- | C] () – E:\Windows\ODBC.INI
[2009/07/14 03:51:43 | 00,073,728 | —- | C] () – E:\Windows\System32\BthpanContextHandler.dll
[2009/07/14 03:42:10 | 00,064,000 | —- | C] () – E:\Windows\System32\BWContextHandler.dll
[2005/05/06 19:06:00 | 00,016,480 | —- | C] () – E:\Windows\System32\rixdicon.dll
< End of report >
Post #11
Hi,

In post #8:

I was unable to find the file named ncpdgf.sys.


Have you tried copy/pasting instead of browsing for the file?

If not, then please go to the site below to scan the following file:
Virus Total

Click on Browse, and upload the following file for analysis or copy/paste the text below into the browse box:
E:\Windows\System32\drivers\ncpdgf.sys

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.
If it says already scanned – click "reanalyze now"

Please post the results in your next reply.
Post #12
yea, i did copy paste but it was unable to find the file. Then I searched it manually, then even i couldn't find it. I guess there's probably no such file in my laptop =p
Post #13
Hi,

Am not seeing any malware in your computer. Perhaps the Tech Team will be of better help with you in this area.
Please read here then create a new topic here.
When you create a new topic, please include a link back here so that the Tech Team can view your logs.

Let's do a little clean up before you go.

Please delete RootRepeal, GMER and all the logs we've created.

–Next–

Clean up with OTL:
  • Right click OTL.exe then choose Run as Administrator to start the program.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.
–Next–

You can keep TFC and use it to clean your computer of some junk atleast once a week. You can also keep Malwarebytes, it is an excellent malware removal tool. Update atleast once a week then run a complete scan.

–Next–

  • Click on the Start button.
  • Click on the Control Panel menu option.
  • When the control panel opens you can either be in Classic View or Control Panel Home view:
    If you are in the Classic View do the following:
    • Double-click on the Folder Options icon.
    • Click on the View tab.
    • Go to step 4.
    If you are in the Control Panel Home view do the following:
    • Click on the Appearance and Personalization link .
    • Click on Show Hidden Files or Folders.
    • Go to step 4.
  • Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
  • Be sure that a check mark is placed before Hide extensions for known file types.
  • Be sure that a check mark is placed before Hide protected operating system files.
  • Press the Apply button and then the OK button and shutdown My Computer.

–Next–

To keep your operating system up to date visit
  • Secunia Software inspector to check your program update status.
  • Microsoft Windows Update .

Here are some tips to reduce the potential for spyware infection in the future:

1. Make your Internet Explorer More Secure
  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab.
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.

    • Change the Download signed ActiveX controls to Prompt.
    • Change the Download unsigned ActiveX controls to Disable.
    • Change the Initialise and script ActiveX controls not marked as safe to Disable.
    • Change the Installation of desktop items to Prompt.
    • Change the Launching programs and files in an IFRAME to Prompt.
    • Change the Navigate sub-frames across different domains to Prompt.
    • When all these settings have been made, click on the OK button.
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.
2. Update your Anti-Virus Software - I can not overemphasize the need for you to update your Anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

3. Make sure you keep your Windows OS current by visiting Windows update regularly to download and install any critical updates and service packs. Without these you are leaving the back door open.

4. Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

5. Download and install the free version of WinPatrol. This program protects your computer in a variety of ways and will work well with your existing security software. Have a look at this tutorial to help you get started with the program.

6. SpywareBlaster - Download and install SpywareBlaster. This program prevents the installation of ActiveX-based spyware and other potentially unwanted programs.

7. Protect your computer from internet threats with SandboxIE. This program isolates Internet Explorer from the rest of your operating system, 'sandboxing' it away - so malicious websites can't do damage to the rest of your system. There is a Getting Started guide on their website.

8. Some excellent free firewalls. Note: Use only one firewall at a time.
Agnitum Outpost Firewall
Comodo Firewall - If you are installing this and already have an anti spyware then please do not install Comodo's anti spyware program.
Online Armor Personal Firewall

9. And finally, please read these excellent articles:
Malware: Help prevent the Infection by Sandi Hardmeier,
Preventing Malware - Tools and Practices for Safe Computing

For more safe computing tips please read the guide by Rorschach112 on how to prevent malware and about safe computing here.



Goodluck, happy computing and stay clean! ^_^
Post #14
Thanks for helping me out mate. I really appreciate the efforts you made and the time you spent helping me to get rid of the malware.:) Though the laptop is still slow like before, I have surely learned alot and got rid of some malware as well :D Thanks again mate, happy new year ^_^ I have just made a new thread in the windows cetegory so I hope someone would help me resolve with this problem ;)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI