What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] i believe i have a rootkit

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello, I've been trolling all the threads and from what i read i believe i have a root kit problem, typically I'm not very computer illiterate but i just can't seem to figure out how to fix this problem. First it began with me somehow losing permissions to programs such as world of warcraft, then i lost the ability to burn CD's and DVD's. Now my desktop won't show or start. Im recieving a ton of error in my dll's due to something like this: servives.exe - bad image – globalroot/systemroot/system32/h8srtybasqgiqgo.dll is causeing programs to close. here are 2 logs, i was unable to run DDS – it just would not let me, i also used ATF-cleaner ..

exeHelper by Raktor
Build 20091220
Run at 23:38:05 on 12/29/09
Now searching…
Checking for numerical processes…
Checking for sysguard processes…
Checking for bad processes…
Checking for bad files…
Checking for bad registry entries…
Resetting filetype association for .exe
Resetting filetype association for .com
Resetting userinit and shell values…
Resetting policies…
–Finished–

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2009-12-29 23:37:18
Windows 5.1.2600 Service Pack 3
Running: svchost.exe.exe; Driver: C:\DOCUME~1\Chris\LOCALS~1\Temp\pwldyfow.sys


—- System - GMER 1.0.15 —-

Code 8A5E3AF8 ZwEnumerateKey
Code 8A5DEC38 ZwFlushInstructionCache
Code 8A5E61F6 IofCallDriver
Code 8A7B3276 IofCompleteRequest

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

—- Modules - GMER 1.0.15 —-

Module \systemroot\system32\drivers\H8SRTrvhyhmqrck.sys (*** hidden *** ) B34C1000-B34DD000 (114688 bytes)

—- Services - GMER 1.0.15 —-

Service C:\WINDOWS\system32\drivers\H8SRTrvhyhmqrck.sys (*** hidden *** ) [SYSTEM] H8SRTd.sys <– ROOTKIT !!!

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@start 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@imagepath \systemroot\system32\drivers\H8SRTrvhyhmqrck.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@group file system
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@H8SRTd \\?\globalroot\systemroot\system32\drivers\H8SRTrvhyhmqrck.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@H8SRTc \\?\globalroot\systemroot\system32\H8SRTsrrksqrjwg.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@H8SRTsrcr \\?\globalroot\systemroot\system32\H8SRTxvwfdligwk.dat
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@h8srtserf \\?\globalroot\systemroot\system32\H8SRTybasqgiqgo.dll
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys@start 1
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys@type 1
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys@imagepath \systemroot\system32\drivers\H8SRTrvhyhmqrck.sys
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys@group file system
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@H8SRTd \\?\globalroot\systemroot\system32\drivers\H8SRTrvhyhmqrck.sys
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@H8SRTc \\?\globalroot\systemroot\system32\H8SRTsrrksqrjwg.dll
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@H8SRTsrcr \\?\globalroot\systemroot\system32\H8SRTxvwfdligwk.dat
Reg HKLM\SYSTEM\ControlSet003\Services\H8SRTd.sys\modules@h8srtserf \\?\globalroot\systemroot\system32\H8SRTybasqgiqgo.dll

—- EOF - GMER 1.0.15 —-

im willing to do anything else. thanks for any help.

-Chris
Post #2
Hi there,

If you already have a copy of ComboFix, please delete it.

Please download ComboFix to your desktop from one of these locations. You must rename it before saving it. Save it to your desktop.
Link 1
Link 2
Link 3

[external image: Posted Image]

[external image: Posted Image]

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on Combo-Fix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]
  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making IE the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please advise.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Post #3
I read the "are you infected" post and was scared to try combofix because it specifically says be sure you have supervision while attempting but i think it did the trick?

ComboFix 09-12-29.06 - Chris 12/30/2009 15:25:22.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1522 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\CoboyyFix.exe
AV: Norton 360 *On-access scanning enabled* (Updated) {A5F1BC7C-EA33-4247-961C-0217208396C4}
FW: Norton 360 *enabled* {371C0A40-5A0C-4AD2-A6E5-69C02037FBF3}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Chris\Application Data\inst.exe
c:\windows\system32\drivers\H8SRTrvhyhmqrck.sys
c:\windows\system32\H8SRTsrrksqrjwg.dll
c:\windows\system32\H8SRTxvwfdligwk.dat
c:\windows\system32\H8SRTybasqgiqgo.dll
c:\windows\system32\krl32mainweq.dll
c:\windows\system32\srcr.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_H8SRTd.sys
——-\Legacy_H8SRTd.sys


((((((((((((((((((((((((( Files Created from 2009-11-28 to 2009-12-30 )))))))))))))))))))))))))))))))
.

2009-12-30 02:55 . 2009-12-30 02:56 ——– d—–w- C:\NSS
2009-12-24 18:51 . 2009-12-24 18:51 ——– d—–w- c:\windows\system32\NtmsData
2009-12-24 18:28 . 2004-08-05 20:58 65536 —-a-w- c:\windows\system32\NeroCo.dll
2009-12-24 18:28 . 2004-08-04 19:19 2031616 ——w- c:\windows\UNNeroBurnRights.exe
2009-12-09 03:43 . 2009-10-21 05:38 75776 ——w- c:\windows\system32\dllcache\strmfilt.dll
2009-12-09 03:43 . 2009-10-21 05:38 25088 ——w- c:\windows\system32\dllcache\httpapi.dll
2009-12-09 03:43 . 2009-10-20 16:20 265728 ——w- c:\windows\system32\dllcache\http.sys
2009-12-09 03:43 . 2009-10-12 13:38 149504 ——w- c:\windows\system32\dllcache\rastls.dll
2009-12-09 03:43 . 2009-10-12 13:38 79872 ——w- c:\windows\system32\dllcache\raschap.dll
2009-12-09 03:42 . 2009-10-13 10:30 270336 ——w- c:\windows\system32\dllcache\oakley.dll
2009-12-09 03:30 . 2009-12-09 03:30 184120 —-a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-12-09 03:05 . 2009-12-09 03:05 ——– d–h–w- c:\windows\PIF

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-30 20:30 . 2008-07-31 20:28 ——– d—–w- c:\program files\Common Files\Symantec Shared
2009-12-27 06:54 . 2008-12-26 22:01 ——– d—–w- c:\documents and settings\Chris\Application Data\Apple Computer
2009-12-25 05:39 . 2008-08-02 02:12 ——– d—–w- c:\documents and settings\Chris\Application Data\Azureus
2009-12-24 19:38 . 2009-07-26 08:26 ——– d—–w- c:\documents and settings\Chris\Application Data\ZoomBrowser EX
2009-12-24 19:38 . 2009-07-26 08:21 ——– d—–w- c:\documents and settings\All Users\Application Data\ZoomBrowser
2009-12-15 20:36 . 2009-01-17 19:43 256 —-a-w- c:\windows\system32\pool.bin
2009-12-09 08:02 . 2008-07-31 21:49 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-12-09 04:34 . 2008-07-31 13:44 86240 —-a-w- c:\documents and settings\Chris\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-09 02:29 . 2008-07-31 20:30 ——– d—–w- c:\documents and settings\All Users\Application Data\Symantec
2009-11-22 09:58 . 2008-10-02 18:18 ——– d—–w- c:\documents and settings\All Users\Application Data\Rosetta Stone
2009-11-15 09:15 . 2009-05-12 22:06 10686001 —-a-w- c:\documents and settings\Chris\Application Data\Azureus\plugins\azump\mplayer.exe
2009-11-12 04:29 . 2009-11-11 21:53 8 —-a-w- c:\windows\system32\nvModes.dat
2009-11-11 21:51 . 2009-11-11 21:51 ——– d—–w- c:\documents and settings\All Users\Application Data\nView_Profiles
2009-10-29 07:45 . 2007-12-31 08:28 841216 —-a-w- c:\windows\system32\wininet.dll
2009-10-29 07:45 . 2007-12-31 08:29 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-10-29 07:45 . 2007-12-31 08:29 17408 —-a-w- c:\windows\system32\corpol.dll
2009-10-26 04:04 . 2008-07-31 13:35 1161 —-a-w- c:\windows\checkip.dat
2009-10-21 05:38 . 2007-12-31 08:26 25088 —-a-w- c:\windows\system32\httpapi.dll
2009-10-21 05:38 . 2004-08-03 22:56 75776 —-a-w- c:\windows\system32\strmfilt.dll
2009-10-20 16:20 . 2007-12-31 08:26 265728 —-a-w- c:\windows\system32\drivers\http.sys
2009-10-19 00:57 . 2009-10-19 00:57 127903 —-a-w- c:\documents and settings\Chris\Application Data\Move Networks\uninstall.exe
2009-10-19 00:57 . 2009-05-27 23:29 4183416 —-a-w- c:\documents and settings\Chris\Application Data\Move Networks\plugins\npqmp071502000008.dll
2009-10-19 00:57 . 2009-10-19 00:57 1685856 —-a-w- c:\documents and settings\Chris\Application Data\Move Networks\MoveMediaPlayerWin_071502000008.exe
2009-10-13 10:30 . 2007-12-31 08:28 270336 —-a-w- c:\windows\system32\oakley.dll
2009-10-12 13:38 . 2004-08-03 22:56 149504 —-a-w- c:\windows\system32\rastls.dll
2009-10-12 13:38 . 2004-08-03 22:56 79872 —-a-w- c:\windows\system32\raschap.dll
.

——- Sigcheck ——-

[-] 2007-12-31 08:38 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\mspmsnsv.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"osCheck"="d:\program files\Norton 360\osCheck.exe" [2008-02-26 988512]
"nwiz"="c:\windows\system32\nwiz.exe" [2008-05-16 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
"CTxfiHlp"="c:\windows\system32\CTXFIHLP.EXE" [2008-07-11 19968]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"amd_dc_opt"="d:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2007-07-23 77824]
"GrooveMonitor"="d:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2009-10-29 124928]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"RestrictRun"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2008-06-12 03:43 640376 —-a-w- d:\program files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Acrobat Speed Launcher]
2008-06-12 07:25 37232 —-a-w- d:\program files\Adobe\Acrobat 9.0\Acrobat\acrobat_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater6]
2009-05-02 00:20 2521464 —-a-w- c:\program files\Common Files\Adobe\Updater6\Adobe_Updater.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BlackBerryAutoUpdate]
2009-03-26 01:32 615696 —-a-w- c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
2007-01-01 21:22 3739648 —-a-w- c:\program files\Google\Google Talk\googletalk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 15:44 31072 —-a-w- d:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-07-13 18:03 292128 —-a-w- d:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 ——w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-05-26 21:18 413696 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray]
2008-08-26 17:23 236016 —-a-w- c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher]
2008-09-12 22:46 160160 —-a-w- d:\program files\Zune\ZuneLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"d:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"d:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"d:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"d:\\Program Files\\Rosetta Stone\\Rosetta Stone V3\\support\\bin\\win\\RosettaStoneLtdServices.exe"=
"d:\\Program Files\\Rosetta Stone\\Rosetta Stone V3\\RosettaStoneVersion3.exe"=
"d:\\Program Files\\Curse\\CurseClient.exe"=
"d:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"d:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
""=

R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [2/18/2008 2:37 PM 149352]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [7/31/2008 4:27 PM 24652]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [10/13/2009 12:25 PM 102448]
S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [1/12/2008 9:32 PM 23888]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [8/11/2008 8:18 AM 79360]

— Other Services/Drivers In Memory —

*NewlyCreated* - COMHOST
.
Contents of the 'Scheduled Tasks' folder

2009-12-30 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-04-29 02:18]
.
.
——- Supplementary Scan ——-
.
uStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = http=127.0.0.1:5555
uInternet Settings,ProxyOverride =
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - d:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\u0b3ucv1.default\
FF - plugin: c:\documents and settings\Chris\Application Data\Move Networks\plugins\npqmp071502000008.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - plugin: d:\program files\Adobe\Acrobat 9.0\Acrobat\browser\nppdf32.dll
FF - plugin: d:\program files\iTunes\Mozilla Plugins\npitunes.dll
FF - plugin: d:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-Malware Defense - c:\program files\Malware Defense\mdefense.exe
MSConfigStartUp-richtx64 - c:\docume~1\Chris\LOCALS~1\Temp\richtx64.exe
MSConfigStartUp-SpySweeper - d:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe
MSConfigStartUp-tquvvyfh - c:\documents and settings\Chris\Local Settings\Application Data\yfcdvj\vhkksysguard.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-30 15:31
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(1268)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Creative\Shared Files\CTAudSvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\RUNDLL32.EXE
c:\windows\system32\ZuneBusEnum.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2009-12-30 15:32:09 - machine was rebooted
ComboFix-quarantined-files.txt 2009-12-30 20:31

Pre-Run: 9,505,214,464 bytes free
Post-Run: 10,848,473,088 bytes free

- - End Of File - - 9047FF81AFDE44211F74F99FBB116440


-chris
Post #4
Correct, you shouldn't just run ComboFix without knowing what's on the system first. GMER showed us the Rootkit that was presents so we could proceed with ComboFix. How's it running, any more problems?
Post #5
no, i can't seem to find any more problems, programs running smooth not taking up anymore resources then normal, internet seems to be running efficiently, i don't know how i can thank you and these forums, thank you so much. so happy i don't have to reformat and re-install everything i have on this PC, being in college that would be a huge annoyance, take care jpshortstuff and thank you and thank you whatthetech team
Post #6
One more thing before I let you go (this will only take a moment). Click Start >> Run and copy/paste this command to uninstall ComboFix:
ComboFix /Uninstall

Glad we could help :thumbup:
Post #7
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI