What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Computer Control

15 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hi,

Open Internet Explorer and go to Tools > Internet Options > Advanced Tab > Reset Internet Explorer Settings > Reset….it will take a few seconds for this . ….then ok your way out, close IE and then reopen it and see if it helped.




Go to your Add Remove Programs in the Control Panel and uninstall Firefox. Then download and install the latest version here.
http://www.mozilla.com/en-US/firefox/personal.html


Let me know how it went
Post #17
Hey There, Posting a reply regarding problems with IE8. Have tried to Reset default settings in Tools in IE8 but it will not let me; says something about unauthorized access?? Still having problems with slow computer performance upon start up and when opening browsers. Cheers Free
Post #18
Morning Free,

With your hard disk controller being infected and cleaned, lets check further to see if there is nothing else infected related to it. I need you to run GMER again, but this time the setting are different , here are the instructions


Download the GMER Rootkit Scanner. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.
  • Double click GMER.exe.
    [external image: Posted Image]
  • If it gives you a warning about rootkit activity and asks if you want to run a full scan…click on NO, then use the following settings for a more complete scan..
  • In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKED …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
      [external image: Posted Image]
      Click the image to enlarge it
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "ark.txt"
  • Save the log where you can easily find it, such as your desktop.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Please copy and paste the report into your Post.




Run this scan also please

Go HERE and download FileLister.
  • Save it to your Desktop
  • Rt Click ->> Extract all ->> And extract it to your Desktop
  • Additional help on extracting zip files can be found HERE
  • Open the File Lister Folder.
  • Note: Leave the FileLister.vbe file in the folder and run it from there.
[external image: Posted Image]
  • Rt Click FileLister.vbe ->>Select Open Then Open to confirm.
  • When the program is fnished it will produce a log for you C:\Files.txt
Copy and paste the contents of that log in your reply.
Post #19
Hey, replying for the GMER and FileLister Scan. Here is the Filelister Logs. GMER ddn't produce a log. Let me know how they go?? Cheers Free +++++++++++++++++++++++++++ + File Lister Version 1.1.4 + + + + By bamajim / SpywareHammer.com + +++++++++++++++++++++++++++ Report ran on —>>> 16/04/2010 10:42:03 AM ====== Running Processes ====== C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\OpenOffice.org 3\program\soffice.exe C:\Program Files\OpenOffice.org 3\program\soffice.bin C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\System32\WScript.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE ====== BHO's ====== BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll BHO: (NO NAME) - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\AVG\AVG9\avgssie.dll BHO: (NO NAME) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: (NO NAME) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll ====== System Keys (some whitelisted items will not be shown)====== Winlogon\Userinit = C:\WINDOWS\system32\userinit.exe, Winlogon\Shell = Explorer.exe ====== HKLM\~\Run Keys ====== HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Adobe Reader Speed Launcher] = "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [Adobe ARM] = "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [QuickTime Task] = "C:\Program Files\QuickTime\QTTask.exe" -atboottime [SunJavaUpdateSched] = "C:\Program Files\Common Files\Java\Java Update\jusched.exe" ====== HKCU\~\Run Keys ====== [Advanced SystemCare 3] = "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup [ctfmon.exe] = C:\WINDOWS\system32\ctfmon.exe ====== DNS Info (List may be empty) ====== NV Hostname = yeoldinn DataBasePath = %SystemRoot%\System32\drivers\etc ForwardBroadcasts = 0 IPEnableRouter = 0 Hostname = yeoldinn UseDomainNameDevolution = 1 DeadGWDetectDefault = 1 DontAddDefaultGatewayDefault = 0 DisableTaskOffload = 0 DisableDynamicUpdate = 0 TcpMaxDataRetransmissions = 5 TcpNumConnections = 100 EnablePMTUBHDetect = 0 EnablePMTUDiscovery = 1 SackOpts = 1 Tcp1323Opts = 1 TcpMaxDupAcks = 2 DefaultTTL = 64 DhcpNameServer = [removed] [removed] [removed] ====== Folders and Files from "%\" and "%\Windows" Created Last 60 Days ====== 1/04/2010 9:17:33 AM 8118412 C:\cmdcons 1/04/2010 9:17:35 AM 860672 C:\cmdcons\SYSTEM32 1/04/2010 9:06:31 AM 220002 C:\Qoobox 1/04/2010 9:13:51 AM 11263 C:\Qoobox\BackEnv 1/04/2010 9:06:31 AM 202392 C:\Qoobox\Quarantine 1/04/2010 9:19:30 AM 193024 C:\Qoobox\Quarantine\C 1/04/2010 9:20:15 AM 193024 C:\Qoobox\Quarantine\C\WINDOWS 1/04/2010 9:20:15 AM 193024 C:\Qoobox\Quarantine\C\WINDOWS\system32 1/04/2010 9:20:15 AM 193024 C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers 1/04/2010 9:06:31 AM 9368 C:\Qoobox\Quarantine\Registry_backups 1/04/2010 12:41:23 PM 227725688 C:\RECYCLER 1/04/2010 12:41:23 PM 227725688 C:\RECYCLER\S-1-5-21-842925246-1592454029-839522115-1003 26/03/2010 3:50:41 PM 516480 C:\RECYCLER\S-1-5-21-842925246-1592454029-839522115-1003\Dc2 26/03/2010 3:51:59 PM 516480 C:\RECYCLER\S-1-5-21-842925246-1592454029-839522115-1003\Dc2\Email Scanner 26/03/2010 3:50:41 PM 0 C:\RECYCLER\S-1-5-21-842925246-1592454029-839522115-1003\Dc3 26/03/2010 5:06:36 PM 0 C:\RECYCLER\S-1-5-21-842925246-1592454029-839522115-1003\Dc3\License 3/03/2010 11:09:06 AM 691999 C:\RECYCLER\S-1-5-21-842925246-1592454029-839522115-1003\Dc52 3/03/2010 11:09:06 AM 691999 C:\RECYCLER\S-1-5-21-842925246-1592454029-839522115-1003\Dc52\5_Free_Reports 16/02/2010 11:01:38 AM 0 C:\RECYCLER\S-1-5-21-842925246-1592454029-839522115-1003\Dc55 16/02/2010 11:01:38 AM 0 C:\RECYCLER\S-1-5-21-842925246-1592454029-839522115-1003\Dc55\AVG9 2/03/2010 7:12:33 PM 0 C:\RECYCLER\S-1-5-21-842925246-1592454029-839522115-1003\Dc55\AVG9\log 1/04/2010 9:46:52 AM 20889 32 C:\ComboFix.txt 6/04/2010 10:07:50 AM 754974720 38 C:\pagefile.sys 7/04/2010 5:21:27 PM 11932 32 C:\TDSSKiller.2.2.8.1_07.04.2010_17.21.27_log.txt 2/04/2010 9:51:51 AM 954570 C:\WINDOWS\$NtUninstallKB971468$ 2/04/2010 9:51:51 AM 620618 C:\WINDOWS\$NtUninstallKB971468$\spuninst 2/04/2010 9:51:00 AM 1929493 C:\WINDOWS\$NtUninstallKB975560$ 2/04/2010 9:51:00 AM 621333 C:\WINDOWS\$NtUninstallKB975560$\spuninst 2/04/2010 9:51:15 AM 4179307 C:\WINDOWS\$NtUninstallKB975561$ 2/04/2010 9:51:15 AM 620395 C:\WINDOWS\$NtUninstallKB975561$\spuninst 2/04/2010 9:51:36 AM 1568757 C:\WINDOWS\$NtUninstallKB975713$ 2/04/2010 9:51:36 AM 620533 C:\WINDOWS\$NtUninstallKB975713$\spuninst 2/04/2010 9:51:25 AM 2812484 C:\WINDOWS\$NtUninstallKB977165-v2$ 2/04/2010 9:51:25 AM 623428 C:\WINDOWS\$NtUninstallKB977165-v2$\spuninst 16/04/2010 9:21:41 AM 994430 C:\WINDOWS\$NtUninstallKB977816$ 16/04/2010 9:21:41 AM 620158 C:\WINDOWS\$NtUninstallKB977816$\spuninst 2/04/2010 9:48:32 AM 800710 C:\WINDOWS\$NtUninstallKB977914$ 2/04/2010 9:48:32 AM 623046 C:\WINDOWS\$NtUninstallKB977914$\spuninst 2/04/2010 9:51:44 AM 652741 C:\WINDOWS\$NtUninstallKB978037$ 2/04/2010 9:51:44 AM 620485 C:\WINDOWS\$NtUninstallKB978037$\spuninst 2/04/2010 9:51:08 AM 1076118 C:\WINDOWS\$NtUninstallKB978251$ 2/04/2010 9:51:08 AM 620822 C:\WINDOWS\$NtUninstallKB978251$\spuninst 2/04/2010 9:51:58 AM 3568737 C:\WINDOWS\$NtUninstallKB978262$ 2/04/2010 9:51:58 AM 619617 C:\WINDOWS\$NtUninstallKB978262$\spuninst 16/04/2010 9:22:07 AM 947351 C:\WINDOWS\$NtUninstallKB978338$ 16/04/2010 9:22:07 AM 621143 C:\WINDOWS\$NtUninstallKB978338$\spuninst 14/04/2010 11:06:34 AM 796799 C:\WINDOWS\$NtUninstallKB978601$ 14/04/2010 11:06:34 AM 620159 C:\WINDOWS\$NtUninstallKB978601$\spuninst 2/04/2010 9:48:22 AM 963191 C:\WINDOWS\$NtUninstallKB978706$ 2/04/2010 9:48:22 AM 620151 C:\WINDOWS\$NtUninstallKB978706$\spuninst 2/04/2010 9:47:49 AM 781155 C:\WINDOWS\$NtUninstallKB979306$ 2/04/2010 9:47:49 AM 636771 C:\WINDOWS\$NtUninstallKB979306$\spuninst 14/04/2010 11:06:17 AM 704584 C:\WINDOWS\$NtUninstallKB979309$ 14/04/2010 11:06:17 AM 620104 C:\WINDOWS\$NtUninstallKB979309$\spuninst 16/04/2010 9:24:16 AM 11192875 C:\WINDOWS\$NtUninstallKB979683$ 16/04/2010 9:24:16 AM 623275 C:\WINDOWS\$NtUninstallKB979683$\spuninst 16/04/2010 9:24:05 AM 1076220 C:\WINDOWS\$NtUninstallKB980232$ 16/04/2010 9:24:05 AM 620796 C:\WINDOWS\$NtUninstallKB980232$\spuninst 16/04/2010 9:22:15 AM 1050380 C:\WINDOWS\$NtUninstallKB981349$ 16/04/2010 9:22:15 AM 620300 C:\WINDOWS\$NtUninstallKB981349$\spuninst 7/04/2010 3:27:49 PM 128 C:\WINDOWS\CSC 7/04/2010 3:27:49 PM 0 C:\WINDOWS\CSC\d1 7/04/2010 3:27:49 PM 0 C:\WINDOWS\CSC\d2 7/04/2010 3:27:49 PM 0 C:\WINDOWS\CSC\d3 7/04/2010 3:27:49 PM 0 C:\WINDOWS\CSC\d4 7/04/2010 3:27:49 PM 0 C:\WINDOWS\CSC\d5 7/04/2010 3:27:49 PM 0 C:\WINDOWS\CSC\d6 7/04/2010 3:27:49 PM 0 C:\WINDOWS\CSC\d7 7/04/2010 3:27:49 PM 0 C:\WINDOWS\CSC\d8 1/04/2010 9:13:51 AM 86173664 C:\WINDOWS\ERDNT 1/04/2010 9:44:19 AM 19737840 C:\WINDOWS\ERDNT\cache 1/04/2010 9:13:51 AM 33217857 C:\WINDOWS\ERDNT\Hiv-backup 1/04/2010 9:23:41 AM 5070848 C:\WINDOWS\ERDNT\Hiv-backup\Users 1/04/2010 9:23:41 AM 229376 C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001 1/04/2010 9:23:41 AM 8192 C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002 1/04/2010 9:23:41 AM 4407296 C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003 1/04/2010 9:23:41 AM 188416 C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004 1/04/2010 9:23:42 AM 229376 C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005 1/04/2010 9:23:42 AM 8192 C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006 1/04/2010 9:20:37 AM 33217857 C:\WINDOWS\ERDNT\subs 1/04/2010 9:20:38 AM 5070848 C:\WINDOWS\ERDNT\subs\Users 1/04/2010 9:20:38 AM 229376 C:\WINDOWS\ERDNT\subs\Users\00000001 1/04/2010 9:20:38 AM 8192 C:\WINDOWS\ERDNT\subs\Users\00000002 1/04/2010 9:20:38 AM 4407296 C:\WINDOWS\ERDNT\subs\Users\00000003 1/04/2010 9:20:39 AM 188416 C:\WINDOWS\ERDNT\subs\Users\00000004 1/04/2010 9:20:39 AM 229376 C:\WINDOWS\ERDNT\subs\Users\00000005 1/04/2010 9:20:39 AM 8192 C:\WINDOWS\ERDNT\subs\Users\00000006 7/04/2010 4:43:36 PM 45000726 C:\WINDOWS\ie8 7/04/2010 4:43:36 PM 1170314 C:\WINDOWS\ie8\spuninst 7/04/2010 4:47:42 PM 26358686 C:\WINDOWS\ie8updates 7/04/2010 4:48:31 PM 25736202 C:\WINDOWS\ie8updates\KB980182-IE8 7/04/2010 4:48:31 PM 631639 C:\WINDOWS\ie8updates\KB980182-IE8\spuninst 7/04/2010 4:47:42 PM 622484 C:\WINDOWS\ie8updates\KB980302-IE8 7/04/2010 4:47:42 PM 620436 C:\WINDOWS\ie8updates\KB980302-IE8\spuninst 14/04/2010 2:31:16 PM 0 C:\WINDOWS\SxsCaPendDel 14/04/2010 3:56:42 PM 0 32 C:\WINDOWS\0.log 16/04/2010 9:21:45 AM 10252 32 C:\WINDOWS\comsetup.log 16/04/2010 9:21:44 AM 30915 32 C:\WINDOWS\FaxSetup.log 1/04/2010 9:14:07 AM 80412 32 C:\WINDOWS\grep.exe 16/04/2010 9:21:44 AM 33106 32 C:\WINDOWS\iis6.log 14/04/2010 11:06:26 AM 1374 32 C:\WINDOWS\imsins.BAK 16/04/2010 9:21:46 AM 1374 32 C:\WINDOWS\imsins.log 16/04/2010 9:21:50 AM 7653 32 C:\WINDOWS\KB956572.log 16/04/2010 9:20:16 AM 11704 32 C:\WINDOWS\KB977816.log 16/04/2010 9:20:27 AM 12190 32 C:\WINDOWS\KB978338.log 16/04/2010 9:24:12 AM 10914 32 C:\WINDOWS\KB979683.log 16/04/2010 9:24:04 AM 7217 32 C:\WINDOWS\KB980232.log 16/04/2010 9:20:31 AM 12004 32 C:\WINDOWS\KB981349.log 1/04/2010 9:14:07 AM 77312 32 C:\WINDOWS\MBR.exe 16/04/2010 9:21:46 AM 2125 32 C:\WINDOWS\MedCtrOC.log 16/04/2010 9:21:46 AM 1515 32 C:\WINDOWS\msgsocm.log 16/04/2010 9:21:45 AM 9334 32 C:\WINDOWS\msmqinst.log 30/03/2010 6:41:59 PM 69 32 C:\WINDOWS\NeroDigital.ini 16/04/2010 9:21:46 AM 5415 32 C:\WINDOWS\netfxocm.log 1/04/2010 9:14:07 AM 31232 32 C:\WINDOWS\NIRCMD.exe 14/04/2010 2:14:32 PM 46352 32 C:\WINDOWS\ntbtlog.txt 16/04/2010 9:21:45 AM 6222 32 C:\WINDOWS\ntdtcsetup.log 16/04/2010 9:21:43 AM 14780 32 C:\WINDOWS\ocgen.log 16/04/2010 9:21:46 AM 1710 32 C:\WINDOWS\ocmsn.log 1/04/2010 9:14:07 AM 261632 32 C:\WINDOWS\PEV.exe 17/03/2010 2:47:10 PM 32440 32 C:\WINDOWS\SchedLgU.Txt 1/04/2010 9:14:07 AM 98816 32 C:\WINDOWS\sed.exe 16/04/2010 9:21:45 AM 0 32 C:\WINDOWS\setupact.log 14/04/2010 3:29:02 PM 644 32 C:\WINDOWS\setupapi.log 16/04/2010 9:21:45 AM 0 32 C:\WINDOWS\setuperr.log 16/04/2010 9:22:02 AM 1505 32 C:\WINDOWS\spupdsvc.log 1/04/2010 9:14:07 AM 161792 32 C:\WINDOWS\SWREG.exe 1/04/2010 9:14:07 AM 136704 32 C:\WINDOWS\SWSC.exe 1/04/2010 9:14:07 AM 212480 32 C:\WINDOWS\SWXCACLS.exe 16/04/2010 9:21:46 AM 1555 32 C:\WINDOWS\tabletoc.log 16/04/2010 9:21:45 AM 14106 32 C:\WINDOWS\tsoc.log 16/03/2010 12:21:17 PM 1030278 32 C:\WINDOWS\WindowsUpdate.log 1/04/2010 9:14:07 AM 68096 32 C:\WINDOWS\zip.exe 26/03/2010 5:06:28 PM 0 C:\WINDOWS\system32\DRVSTORE 29/03/2010 4:28:32 PM 319512 C:\WINDOWS\system32\NtmsData 30/03/2010 5:28:31 PM 2388176 32 C:\WINDOWS\system32\d3dx9_30.dll 8/04/2010 11:00:03 AM 145184 32 C:\WINDOWS\system32\java.exe 8/04/2010 11:00:03 AM 145184 32 C:\WINDOWS\system32\javaw.exe 8/04/2010 11:00:04 AM 153376 32 C:\WINDOWS\system32\javaws.exe 14/04/2010 3:28:41 PM 2189952 32 C:\WINDOWS\system32\ntoskrnl.exe 17/03/2010 9:53:42 PM 69632 32 C:\WINDOWS\system32\QuickTime.qts 17/03/2010 9:53:42 PM 94208 32 C:\WINDOWS\system32\QuickTimeVR.qtx ====== "\Administrator & All Users\Startup" Last 60 Days====== ====== "\Program Files" Last 60 Days====== 31/03/2010 3:47:56 PM 812344 32 C:\Program Files\HJTInstall.exe 8/04/2010 11:13:20 AM 94133848 C:\Program Files\ESET 2/04/2010 9:48:04 AM 0 C:\Program Files\MSXML 4.0 30/03/2010 5:32:05 PM 1091549087 C:\Program Files\Nero 1/04/2010 12:23:20 PM 76382286 C:\Program Files\QuickTime 31/03/2010 3:48:19 PM 396288 C:\Program Files\Trend Micro ======"Drivers" Modified Last 60 Days====== 27/07/2007 10:00:00 PM 455680 32 C:\WINDOWS\system32\drivers\mrxsmb.sys 1/04/2010 12:50:50 PM 95024 32 C:\WINDOWS\system32\drivers\SBREDrv.sys ====== Files Deleted under "%Temp%" ====== 23 Files deleted ======"All Users\Application Data" Last 60 Days====== 1/04/2010 12:23:18 PM 26932224 C:\Documents and Settings\All Users\Application Data\Apple Computer 1/04/2010 12:23:18 PM 26932224 C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache 1/04/2010 12:23:18 PM 26932224 C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\QuickTime 7.66.71.0 31/03/2010 3:12:43 PM 0 C:\Documents and Settings\All Users\Application Data\Google 31/03/2010 3:12:43 PM 0 C:\Documents and Settings\All Users\Application Data\Google\Update 30/03/2010 5:31:18 PM 17645906 C:\Documents and Settings\All Users\Application Data\Nero 30/03/2010 5:35:29 PM 6196919 C:\Documents and Settings\All Users\Application Data\Nero\Nero 30/03/2010 5:35:29 PM 6196919 C:\Documents and Settings\All Users\Application Data\Nero\Nero\DrWeb 30/03/2010 5:37:28 PM 6196919 C:\Documents and Settings\All Users\Application Data\Nero\Nero 9 30/03/2010 5:37:28 PM 6196919 C:\Documents and Settings\All Users\Application Data\Nero\Nero 9\DrWeb 30/03/2010 5:33:32 PM 8634 C:\Documents and Settings\All Users\Application Data\Nero\Nero BackItUp 4 30/03/2010 5:33:32 PM 8634 C:\Documents and Settings\All Users\Application Data\Nero\Nero BackItUp 4\Cache 30/03/2010 5:31:18 PM 2104496 C:\Documents and Settings\All Users\Application Data\Nero\Nero Container 30/03/2010 5:31:18 PM 3138938 C:\Documents and Settings\All Users\Application Data\Nero\OnlineServices 30/03/2010 5:32:23 PM 1860480 C:\Documents and Settings\All Users\Application Data\Nero\OnlineServices\MetaData 30/03/2010 5:32:22 PM 54355 C:\Documents and Settings\All Users\Application Data\Nero\OnlineServices\NOSWebConfig 30/03/2010 5:32:28 PM 15385 C:\Documents and Settings\All Users\Application Data\Nero\OnlineServices\NOSWebConfig\MyNero 30/03/2010 5:32:22 PM 20836 C:\Documents and Settings\All Users\Application Data\Nero\OnlineServices\NOSWebConfig\MySpace 30/03/2010 5:32:22 PM 17773 C:\Documents and Settings\All Users\Application Data\Nero\OnlineServices\NOSWebConfig\YouTube 30/03/2010 5:32:30 PM 659045 C:\Documents and Settings\All Users\Application Data\Nero\OnlineServices\PushMarketingFeeds 30/03/2010 6:28:01 PM 0 C:\Documents and Settings\All Users\Application Data\Nero\PeakFiles ====== HKLM\~\ShellServiceObjectDelayLoad====== PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - %SystemRoot%\system32\SHELL32.dll CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - %SystemRoot%\system32\SHELL32.dll WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - %systemroot%\system32\stobject.dll WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll ====== HKLM\~\SharedTaskScheduler====== Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - %SystemRoot%\system32\browseui.dll Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - %SystemRoot%\system32\browseui.dll ======HKLM\~\msconfig\startupreg====== HKLM\Software\microsoft\shared tools\msconfig\startupreg\msnmsgr HKLM\Software\microsoft\shared tools\msconfig\startupreg\SiS Tray HKLM\Software\microsoft\shared tools\msconfig\startupreg\SiS Windows KeyHook ====== Services ( Services that are Whitelisted are not shown) ====== alcan5ln (SpeedTouch™ USB ADSL RFC1483 Networking Driver (NDIS))- C:\WINDOWS\system32\DRIVERS\alcan5ln.sys - Manual/Stopped alcaudsl (SpeedTouch ADSL Modem ATM Transport)- C:\WINDOWS\system32\DRIVERS\alcaudsl.sys - Manual/Stopped AN983 (ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter)- C:\WINDOWS\system32\DRIVERS\AN983.sys - Manual/Running SiS315 (SiS315)- C:\WINDOWS\system32\DRIVERS\sisgrp.sys - Manual/Running SiS7012 (Service for AC'97 Sample Driver (WDM))- C:\WINDOWS\system32\drivers\sis7012.sys - Manual/Running USB_RNDIS (Netgear USB Remote Ndis Cable Modem Network Device Driver)- C:\WINDOWS\system32\DRIVERS\usb8023.sys - Manual/Stopped WpdUsb (WpdUsb)- C:\WINDOWS\system32\DRIVERS\wpdusb.sys - Manual/Stopped ====== Uninstall List ====== A file named 'UNI.txt' was created and saved to FileListers default location. Post the results if requested. ======== Other Info ======== TOTAL PHYSICAL RAM: 503 MB Boot Info [boot loader] timeout=3 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect OS Type: Microsoft Windows XP Professional Build: 5.1.2600 Service Pack: 3.0 ====== Files with Hidden Attributes====== A file named 'Hidden.txt' was created and saved to FileListers default location. Post the results if requested. ==End of Report==
Post #20 last edited
Logs look ok, the issues your having may not be malware related.


Lets run one more scan to see if anything has been missed


  • Download OTL to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Under the Custom Scan box paste this in


    netsvcs
    %SYSTEMDRIVE%\*.exe
    /md5start
    eventlog.dll
    scecli.dll
    netlogon.dll
    cngaudit.dll
    sceclt.dll
    ntelogon.dll
    logevent.dll
    iaStor.sys
    nvstor.sys
    atapi.sys
    IdeChnDr.sys
    viasraid.sys
    AGP440.sys
    vaxscsi.sys
    nvatabus.sys
    viamraid.sys
    nvata.sys
    nvgts.sys
    iastorv.sys
    ViPrt.sys
    eNetHook.dll
    ahcix86.sys
    KR10N.sys
    nvstor32.sys
    ahcix86s.sys
    nvrd32.sys
    symmpi.sys
    adp3132.sys
    mv61xx.sys
    /md5stop
    %systemroot%\*. /mp /s
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\system32\drivers\*.sys /lockedfiles
    %systemroot%\System32\config\*.sav


  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
    Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI