Hi CatByte,
Sorry for late post. While was running GMER, windows screen became blue (showed something like dumped memory…) I restarted the computer and again ran GMER.
I could not save first log as I had to restart windows due to that error.
here is 2nd log report
GMER 1.0.15.15281 -
http://www.gmer.net
Rootkit scan 2010-02-01 06:24:32
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\arora4\LOCALS~1\Temp\awtdruoc.sys
—- System - GMER 1.0.15 —-
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateKey [0xF8628E52]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcess [0xF8609CDE]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcessEx [0xF8609ED0]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwDeleteKey [0xF8629640]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwDeleteValueKey [0xF86298F4]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwOpenKey [0xF8627B44]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwRenameKey [0xF8629D60]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwSetValueKey [0xF8629112]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwTerminateProcess [0xF8609984]
Code 716EFFFB NtTestAlert
Code 716EFFFB ZwTestAlert
—- Devices - GMER 1.0.15 —-
AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Ip mfetdik.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp mfetdik.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)
Device \Driver\PCTSDInjDriver32 \Device\PCTSDInjDriver32 PCTSDInj32.sys
AttachedDevice \Driver\Tcpip \Device\Udp mfetdik.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\RawIp mfetdik.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)
—- Threads - GMER 1.0.15 —-
Thread System [4:1564] F433A6E0
Thread System [4:1432] F40A7B27
Thread System [4:1492] F40A7B36
Thread System [4:1496] F40A7B36
Thread System [4:1500] F40A7B36
Thread System [4:1504] F40A7B36
Thread System [4:1508] F40A7B36
Thread System [4:3964] F25B1FF0
Thread System [4:2128] F25B60C0
Thread System [4:408] F25AED80
—- EOF - GMER 1.0.15 —-
Do I need to run it again? Antivirus malware is still there as before. Please suggest what to do.
Thanks
Bond
