What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Anti-virus programs freeze while scanning registry

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:57:51 PM, on 22/05/2010
Platform: Windows 7 (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\dfrgui.exe
C:\Windows\system32\dfrgui.exe
C:\Windows\system32\dfrgui.exe
C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\taskeng.exe
C:\Users\Owner\Documents\Downloads\HiJackThis.exe
C:\Windows\system32\NOTEPAD.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: IGMONObj Class - {02464DDC-3187-11D8-8004-0020ED227566} - C:\Program Files\iGetter\Integration\IGMON.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [Zune Launcher] "c:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O8 - Extra context menu item: Download all with iGetter - C:\Program Files\iGetter\Integration\igetall.html
O8 - Extra context menu item: Download with iGetter - C:\Program Files\iGetter\Integration\iget.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…sreqlab_nvd.cab
O16 - DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} (Battlefield Heroes Updater) - https://www.battlefieldheroes.com/static/up…er_4.0.53.0.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flas…ent/swflash.cab
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

–
End of file - 5766 bytes
Post #2
Hello Lichtenwald and welcome to WhatTheTech. I’ll be happy to look over your log and help you with your issues. It will be very helpful if you follow these guidelines:
  • Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I’ve given you the “All clear.” Absence of symptoms does not mean your machine is clean!
  • Please do not run any scans or install/uninstall any applications without being directed to do so.
  • Please follow my instructions carefully and in the order they are posted.
  • Any underlined text in my posts indicates a clickable link.
  • You should print any instructions I give you for ease of use and reference.
  • If you have any questions at all, please stop and ask before proceeding.
🖼Click to load external image (Posted Image) Please download DDS by sUBs from one of the following links and save it to your desktop.
    • DDS.scr
    • DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.
🖼Click to load external image (Posted Image) Download GMER Rootkit Scanner from here to your desktop.
  • Double click the exe file. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.


    [external image: Posted Image]
    Click the image to enlarge it


  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)a
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and post it in reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

If you have trouble running GEMR:
  • Make sure that your security software is disabled
  • Uncheck the box next to "Files" this time also
  • If you still can't run it, try in the Safe Mode
Please include the following in your next post:
  • DDS and Attach.txt logs
  • GMER log
Post #3
DDS (Ver_10-03-17.01) - NTFSx86
Run by [removed] at 11:47:08.48 on 24/05/2010
Internet Explorer: 8.0.7600.16385
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.2.1033.18.2048.1093 [GMT -6:00]


============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\svchost.exe -k Akamai
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe
C:\Windows\system32\PnkBstrA.exe
C:\Windows\system32\PnkBstrB.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\taskhost.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\Internet Explorer\IELowutil.exe
C:\Windows\system32\sppsvc.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
\\?\C:\Windows\system32\wbem\WMIADAP.EXE
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Owner\Documents\Downloads\dds.scr
C:\Windows\system32\conhost.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.ca/
BHO: IGMONObj Class: {02464ddc-3187-11d8-8004-0020ed227566} - c:\program files\igetter\integration\IGMON.dll
BHO: &Yahoo;! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
BHO: Spybot-S&D; IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\progra~1\yahoo!\companion\installs\cpn\YTSingleInstance.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [Google Update] "c:\users\owner\appdata\local\google\update\GoogleUpdate.exe" /c
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [Messenger (Yahoo!)] "c:\progra~1\yahoo!\messenger\YahooMessenger.exe" -quiet
mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe -s
mRun: [egui] "c:\program files\eset\eset smart security\egui.exe" /hide /waitservice
mRun: [itype] "c:\program files\microsoft intellitype pro\itype.exe"
mRun: [Zune Launcher] "c:\program files\zune\ZuneLauncher.exe"
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Download all with iGetter - c:\program files\igetter\integration\igetall.html
IE: Download with iGetter - c:\program files\igetter\integration\iget.html
IE: E&xport; to Microsoft Excel - c:\progra~1\micros~4\office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~4\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} - hxxps://www.battlefieldheroes.com/static/updater/BFHUpdater_4.0.53.0.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
Hosts: 127.0.0.1 www.spywareinfo.com

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-5-22 64288]
R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2009-7-13 20992]
R2 eamonm;eamonm;c:\windows\system32\drivers\eamonm.sys [2010-2-22 133512]
R2 ekrn;ESET Service;c:\program files\eset\eset smart security\ekrn.exe [2010-2-22 810120]
R2 epfwwfp;epfwwfp;c:\windows\system32\drivers\epfwwfp.sys [2010-2-22 41312]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-2-4 1314704]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service –> c:\windows\system32\GameMon.des -service [?]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-3-26 1343400]

=============== Created Last 30 ================

2010-05-24 17:36:17 0 d—–w- C:\bintheredunthat
2010-05-24 17:29:03 0 d—–w- C:\VundoFix Backups
2010-05-24 17:16:04 0 d—–w- c:\program files\InCode Solutions
2010-05-23 08:00:31 0 d—–w- c:\programdata\Yahoo! Companion
2010-05-23 08:00:17 0 d—–w- c:\programdata\Yahoo!
2010-05-23 07:56:57 0 d—–w- c:\program files\Yahoo!
2010-05-22 22:31:06 15880 —-a-w- c:\windows\system32\lsdelete.exe
2010-05-22 21:29:21 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
2010-05-22 21:29:20 95024 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-05-22 21:23:38 0 dc-h–w- c:\programdata\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
2010-05-22 21:23:28 0 d—–w- c:\programdata\Lavasoft
2010-05-22 21:23:28 0 d—–w- c:\program files\Lavasoft
2010-05-22 18:47:22 0 d—–w- c:\program files\Trend Micro
2010-05-21 04:53:52 0 d—–w- c:\program files\Uniblue
2010-05-18 02:09:21 0 d—–w- C:\AeriaGames
2010-05-18 00:18:46 0 d—–w- c:\program files\common files\Akamai
2010-05-11 23:14:03 0 d—–w- c:\users\owner\appdata\roaming\LolClient
2010-05-11 20:24:15 740864 —-a-w- c:\windows\system32\inetcomm.dll
2010-05-11 01:36:47 0 d—–w- c:\programdata\Sony
2010-05-07 19:52:46 41872 —-a-w- c:\windows\system32\xfcodec.dll
2010-05-05 21:13:52 215016 —-a-w- c:\windows\system32\PnkBstrB.xtr
2010-05-03 22:49:34 138184 —-a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-05-03 22:49:33 138056 —-a-w- c:\users\owner\appdata\roaming\PnkBstrK.sys
2010-05-03 22:47:46 215016 —-a-w- c:\windows\system32\PnkBstrB.exe
2010-05-03 22:47:45 75064 —-a-w- c:\windows\system32\PnkBstrA.exe
2010-05-03 22:47:44 2427248 —-a-w- c:\windows\system32\pbsvc_heroes.exe
2010-05-03 22:00:01 0 d—–w- c:\program files\EA Games
2010-04-27 20:25:35 194488 —-a-w- c:\windows\system32\drivers\fvevol.sys
2010-04-27 20:25:29 1037312 —-a-w- c:\windows\system32\lsasrv.dll
2010-04-27 20:25:28 133720 —-a-w- c:\windows\system32\drivers\ksecpkg.sys
2010-04-25 18:40:05 0 d—–w- c:\windows\pss
2010-04-25 02:50:35 0 d—–w- c:\program files\Movie Maker 2.6

==================== Find3M ====================

2010-05-12 17:21:16 221568 ——w- c:\windows\system32\MpSigStub.exe
2010-05-11 04:16:09 22350 —-a-w- C:\backup.reg
2010-04-29 21:39:38 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 21:39:26 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-04-20 03:18:51 691696 —-a-w- c:\windows\system32\drivers\sptd.sys
2010-04-17 04:12:18 48464 —-a-w- c:\windows\system32\sirenacm.dll
2010-04-15 21:38:14 411368 —-a-w- c:\windows\system32\deployJava1.dll
2010-04-04 02:46:46 35898 —-a-w- c:\windows\DIIUnin.dat
2010-04-04 02:44:21 21840 —-atw- c:\windows\system32\SIntfNT.dll
2010-04-04 02:44:21 17212 —-atw- c:\windows\system32\SIntf32.dll
2010-04-04 02:44:21 12067 —-atw- c:\windows\system32\SIntf16.dll
2010-04-04 02:20:16 94208 —-a-w- c:\windows\DIIUnin.exe
2010-04-04 02:20:16 2829 —-a-w- c:\windows\DIIUnin.pif
2010-04-04 00:27:00 985704 —-a-w- c:\windows\system32\nvsvc.dll
2010-04-04 00:27:00 13683816 —-a-w- c:\windows\system32\nvcpl.dll
2010-04-04 00:27:00 129640 —-a-w- c:\windows\system32\nvvsvc.exe
2010-04-04 00:27:00 110696 —-a-w- c:\windows\system32\nvmctray.dll
2010-03-29 02:02:41 69 —-a-w- c:\users\owner\jagex_runescape_preferences2.dat
2010-03-29 02:00:39 41 —-a-w- c:\users\owner\jagex_runescape_preferences.dat
2010-03-29 02:00:37 0 —-a-w- c:\users\owner\jagex__preferences3.dat
2010-03-28 21:36:30 0 —ha-w- c:\windows\system32\drivers\Msft_User_ZuneDriver_01_09_00.Wdf
2010-03-28 21:36:30 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_WinUSB_01009.Wdf
2010-03-16 06:51:59 215656 —-a-w- c:\windows\system32\nvcod1910.dll
2010-03-08 21:33:56 427520 —-a-w- c:\windows\system32\vbscript.dll
2010-02-27 12:07:48 3954568 —-a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-27 12:07:48 3899280 —-a-w- c:\windows\system32\ntoskrnl.exe
2009-07-14 04:56:42 31548 —-a-w- c:\windows\inf\perflib\0409\perfd.dat
2009-07-14 04:56:42 31548 —-a-w- c:\windows\inf\perflib\0409\perfc.dat
2009-07-14 04:56:42 291294 —-a-w- c:\windows\inf\perflib\0409\perfi.dat
2009-07-14 04:56:42 291294 —-a-w- c:\windows\inf\perflib\0409\perfh.dat
2009-07-14 04:41:57 174 –sha-w- c:\program files\desktop.ini
2009-07-14 00:34:40 291294 —-a-w- c:\windows\inf\perflib\0000\perfi.dat
2009-07-14 00:34:40 291294 —-a-w- c:\windows\inf\perflib\0000\perfh.dat
2009-07-14 00:34:38 31548 —-a-w- c:\windows\inf\perflib\0000\perfd.dat
2009-07-14 00:34:38 31548 —-a-w- c:\windows\inf\perflib\0000\perfc.dat
2009-06-10 21:26:35 9633792 –sha-r- c:\windows\fonts\StaticCache.dat
2009-07-14 01:14:45 396800 –sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe

============= FINISH: 11:47:38.89 ===============

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-05-24 12:02:15
Windows 6.1.7600
Running: ws0f6snr.exe; Driver: C:\Users\Owner\AppData\Local\Temp\kglcapow.sys


—- System - GMER 1.0.15 —-

INT 0x1F \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8303AAF8
INT 0x37 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8303A104
INT 0xC1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8303A3F4
INT 0xD1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 83022634
INT 0xD2 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 83022898
INT 0xDF \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8303A1DC
INT 0xE1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8303A958
INT 0xE3 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8303A6F8
INT 0xFD \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8303AF2C
INT 0xFE \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8303B1A8

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!ZwSaveKeyEx + 13AD 82C53599 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82C77F52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, …] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
? System32\Drivers\spgb.sys The system cannot find the path specified. !
.text USBPORT.SYS!DllUnload 8EA2CCA0 5 Bytes JMP 864C71D8
.text as1am9ko.SYS 8EB00000 12 Bytes [44, 58, 02, 83, EE, 56, 02, …]
.text as1am9ko.SYS 8EB0000D 9 Bytes [37, 02, 83, 48, 5B, 02, 83, …] {AAA ; ADD AL, [EBX-0x7cfda4b8]; ADD [EAX], AL}
.text as1am9ko.SYS 8EB00017 170 Bytes [00, DE, 57, 90, 83, E6, 55, …]
.text as1am9ko.SYS 8EB000C3 8 Bytes [00, 00, 00, 00, 00, 00, 00, …] {ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL; ADD [EAX], AL}
.text as1am9ko.SYS 8EB000CE 4 Bytes [00, 00, 00, 00] {ADD [EAX], AL; ADD [EAX], AL}
.text …
.text peauth.sys 98D6BC9D 28 Bytes [5E, 47, E0, C9, D2, B1, C7, …]
.text peauth.sys 98D6BCC1 28 Bytes [5E, 47, E0, C9, D2, B1, C7, …]
PAGE spsys.sys!?SPRevision@@3PADA + 4F90 9D4FC000 290 Bytes [8B, FF, 55, 8B, EC, 33, C0, …]
PAGE spsys.sys!?SPRevision@@3PADA + 50B3 9D4FC123 629 Bytes [75, 4F, 9D, FE, 05, 34, 75, …]
PAGE spsys.sys!?SPRevision@@3PADA + 5329 9D4FC399 101 Bytes [6A, 28, 59, A5, 5E, C6, 03, …]
PAGE spsys.sys!?SPRevision@@3PADA + 538F 9D4FC3FF 136 Bytes [18, 5D, C2, 14, 00, 8B, FF, …]
PAGE spsys.sys!?SPRevision@@3PADA + 5418 9D4FC488 11 Bytes [89, 15, 3C, 75, 4F, 9D, E9, …] {MOV [0x9d4f753c], EDX; JMP 0x240bb}
PAGE …

—- User code sections - GMER 1.0.15 —-

.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[1492] ntdll.dll!NtCreateFile + 6 77AC4A16 4 Bytes [28, 00, 06, 00]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[1492] ntdll.dll!NtCreateFile + B 77AC4A1B 1 Byte [E2]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[1492] ntdll.dll!NtOpenFile + 6 77AC5126 4 Bytes [68, 00, 06, 00]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[1492] ntdll.dll!NtOpenFile + B 77AC512B 1 Byte [E2]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[1492] ntdll.dll!NtOpenProcess + 6 77AC51D6 4 Bytes [A8, 01, 06, 00]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[1492] ntdll.dll!NtOpenProcess + B 77AC51DB 1 Byte [E2]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[1492] ntdll.dll!NtOpenProcessToken + B 77AC51EB 1 Byte [E2]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[1492] ntdll.dll!NtOpenProcessTokenEx + 6 77AC51F6 4 Bytes [A8, 02, 06, 00]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[1492] ntdll.dll!NtOpenProcessTokenEx + B 77AC51FB 1 Byte [E2]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[1492] ntdll.dll!NtOpenThread + 6 77AC5256 4 Bytes [68, 01, 06, 00]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[1492] ntdll.dll!NtOpenThread + B 77AC525B 1 Byte [E2]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[1492] ntdll.dll!NtOpenThreadToken + 6 77AC5266 4 Bytes [68, 02, 06, 00]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[1492] ntdll.dll!NtOpenThreadToken + B 77AC526B 1 Byte [E2]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[1492] ntdll.dll!NtOpenThreadTokenEx + B 77AC527B 1 Byte [E2]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[1492] ntdll.dll!NtQueryAttributesFile + 6 77AC5386 4 Bytes [A8, 00, 06, 00]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[1492] ntdll.dll!NtQueryAttributesFile + B 77AC538B 1 Byte [E2]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[1492] ntdll.dll!NtQueryFullAttributesFile + B 77AC543B 1 Byte [E2]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[1492] ntdll.dll!NtSetInformationFile + 6 77AC5A86 4 Bytes [28, 01, 06, 00]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[1492] ntdll.dll!NtSetInformationFile + B 77AC5A8B 1 Byte [E2]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[1492] ntdll.dll!NtSetInformationThread + 6 77AC5AE6 4 Bytes [28, 02, 06, 00]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[1492] ntdll.dll!NtSetInformationThread + B 77AC5AEB 1 Byte [E2]
.text C:\Program Files\ESET\ESET Smart Security\ekrn.exe[1840] kernel32.dll!SetUnhandledExceptionFilter 76823162 4 Bytes [C2, 04, 00, 00]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtCreateFile + 6 77AC4A16 4 Bytes [28, 00, 06, 00]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtCreateFile + B 77AC4A1B 1 Byte [E2]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtOpenFile + 6 77AC5126 4 Bytes [68, 00, 06, 00]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtOpenFile + B 77AC512B 1 Byte [E2]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtOpenProcess + 6 77AC51D6 4 Bytes [A8, 01, 06, 00]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtOpenProcess + B 77AC51DB 1 Byte [E2]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtOpenProcessToken + B 77AC51EB 1 Byte [E2]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtOpenProcessTokenEx + 6 77AC51F6 4 Bytes [A8, 02, 06, 00]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtOpenProcessTokenEx + B 77AC51FB 1 Byte [E2]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtOpenThread + 6 77AC5256 4 Bytes [68, 01, 06, 00]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtOpenThread + B 77AC525B 1 Byte [E2]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtOpenThreadToken + 6 77AC5266 4 Bytes [68, 02, 06, 00]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtOpenThreadToken + B 77AC526B 1 Byte [E2]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtOpenThreadTokenEx + B 77AC527B 1 Byte [E2]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtQueryAttributesFile + 6 77AC5386 4 Bytes [A8, 00, 06, 00]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtQueryAttributesFile + B 77AC538B 1 Byte [E2]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtQueryFullAttributesFile + B 77AC543B 1 Byte [E2]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtSetInformationFile + 6 77AC5A86 4 Bytes [28, 01, 06, 00]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtSetInformationFile + B 77AC5A8B 1 Byte [E2]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtSetInformationThread + 6 77AC5AE6 4 Bytes [28, 02, 06, 00]
.text C:\Users\Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3368] ntdll.dll!NtSetInformationThread + B 77AC5AEB 1 Byte [E2]

—- Devices - GMER 1.0.15 —-

Device \FileSystem\Ntfs \Ntfs 85F291F8
Device \Driver\volmgr \Device\VolMgrControl 85F231F8
Device \Driver\usbohci \Device\USBPDO-0 864C81F8
Device \Driver\usbehci \Device\USBPDO-1 864C91F8
Device \Driver\PCI_PNP6400 \Device\00000052 spgb.sys
Device \Driver\nvstor32 \Device\00000060 85F271F8

AttachedDevice \Driver\tdx \Device\Tcp Lbd.sys (Boot Driver/Lavasoft AB)

Device \Driver\USBSTOR \Device\00000070 873E9500
Device \Driver\volmgr \Device\HarddiskVolume1 85F231F8

AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

Device \Driver\USBSTOR \Device\00000071 873E9500
Device \Driver\volmgr \Device\HarddiskVolume2 85F231F8

AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 …
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x21 0xF2 0xF7 0xC5 …
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x6E 0x11 0x86 0xCE …
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xF3 0x5F 0x16 0x16 …
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 …
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x21 0xF2 0xF7 0xC5 …
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x6E 0x11 0x86 0xCE …
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xF3 0x5F 0x16 0x16 …

—- Disk sectors - GMER 1.0.15 —-

Disk \Device\Harddisk0\DR0 sector 01: copy of MBR
Disk \Device\Harddisk0\DR0 sector 02: copy of MBR
Disk \Device\Harddisk0\DR0 sector 03: copy of MBR
Disk \Device\Harddisk0\DR0 sector 04: copy of MBR
Disk \Device\Harddisk0\DR0 sector 05: copy of MBR
Disk \Device\Harddisk0\DR0 sector 06: copy of MBR
Disk \Device\Harddisk0\DR0 sector 07: copy of MBR
Disk \Device\Harddisk0\DR0 sector 08: copy of MBR
Disk \Device\Harddisk0\DR0 sector 09: copy of MBR
Disk \Device\Harddisk0\DR0 sector 10: copy of MBR
Disk \Device\Harddisk0\DR0 sector 11: copy of MBR
Disk \Device\Harddisk0\DR0 sector 12: copy of MBR
Disk \Device\Harddisk0\DR0 sector 13: copy of MBR
Disk \Device\Harddisk0\DR0 sector 14: copy of MBR
Disk \Device\Harddisk0\DR0 sector 15: copy of MBR
Disk \Device\Harddisk0\DR0 sector 16: copy of MBR
Disk \Device\Harddisk0\DR0 sector 17: copy of MBR
Disk \Device\Harddisk0\DR0 sector 18: copy of MBR
Disk \Device\Harddisk0\DR0 sector 19: copy of MBR
Disk \Device\Harddisk0\DR0 sector 20: copy of MBR
Disk \Device\Harddisk0\DR0 sector 21: copy of MBR
Disk \Device\Harddisk0\DR0 sector 22: copy of MBR
Disk \Device\Harddisk0\DR0 sector 23: copy of MBR
Disk \Device\Harddisk0\DR0 sector 24: copy of MBR
Disk \Device\Harddisk0\DR0 sector 25: copy of MBR
Disk \Device\Harddisk0\DR0 sector 26: copy of MBR
Disk \Device\Harddisk0\DR0 sector 27: copy of MBR
Disk \Device\Harddisk0\DR0 sector 28: copy of MBR
Disk \Device\Harddisk0\DR0 sector 29: copy of MBR
Disk \Device\Harddisk0\DR0 sector 30: copy of MBR
Disk \Device\Harddisk0\DR0 sector 31: copy of MBR
Disk \Device\Harddisk0\DR0 sector 32: copy of MBR
Disk \Device\Harddisk0\DR0 sector 33: copy of MBR
Disk \Device\Harddisk0\DR0 sector 34: copy of MBR
Disk \Device\Harddisk0\DR0 sector 35: copy of MBR
Disk \Device\Harddisk0\DR0 sector 36: copy of MBR
Disk \Device\Harddisk0\DR0 sector 37: copy of MBR
Disk \Device\Harddisk0\DR0 sector 38: copy of MBR
Disk \Device\Harddisk0\DR0 sector 39: copy of MBR
Disk \Device\Harddisk0\DR0 sector 40: copy of MBR
Disk \Device\Harddisk0\DR0 sector 41: copy of MBR
Disk \Device\Harddisk0\DR0 sector 42: copy of MBR
Disk \Device\Harddisk0\DR0 sector 43: copy of MBR
Disk \Device\Harddisk0\DR0 sector 44: copy of MBR
Disk \Device\Harddisk0\DR0 sector 45: copy of MBR
Disk \Device\Harddisk0\DR0 sector 46: copy of MBR
Disk \Device\Harddisk0\DR0 sector 47: copy of MBR
Disk \Device\Harddisk0\DR0 sector 48: copy of MBR
Disk \Device\Harddisk0\DR0 sector 49: copy of MBR
Disk \Device\Harddisk0\DR0 sector 50: copy of MBR
Disk \Device\Harddisk0\DR0 sector 51: copy of MBR
Disk \Device\Harddisk0\DR0 sector 52: copy of MBR
Disk \Device\Harddisk0\DR0 sector 53: copy of MBR
Disk \Device\Harddisk0\DR0 sector 54: copy of MBR
Disk \Device\Harddisk0\DR0 sector 55: copy of MBR
Disk \Device\Harddisk0\DR0 sector 56: copy of MBR
Disk \Device\Harddisk0\DR0 sector 57: copy of MBR
Disk \Device\Harddisk0\DR0 sector 58: copy of MBR
Disk \Device\Harddisk0\DR0 sector 59: copy of MBR
Disk \Device\Harddisk0\DR0 sector 60: copy of MBR
Disk \Device\Harddisk0\DR0 sector 61: copy of MBR
Disk \Device\Harddisk0\DR0 sector 62: copy of MBR
Disk \Device\Harddisk0\DR0 sector 63: copy of MBR

—- EOF - GMER 1.0.15 —-

Attachments:

Post #4
Hello,

Can you elaborate on your symptoms for me. Also, it looks like you ran VundoFix on your own. Please don't use run any more scans or use any other tools unless I direct you to; I know you're trying to help, but it complicates things for me.

🖼Click to load external image (Posted Image) Install an anti-virus program. I don't see any anti-virus software running on your computer. Choose one, (but no more) reputable AV program. If you need help chosing one, this site has good information. Avast, AVG, Avira and Microsoft all offer free AV products.

🖼Click to load external image (Posted Image) P2P - I see you have P2P software (uTorrent, BTDNA, BitTorrent, Limewire) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to malware infections. Malware authors use P2P filesharing as a major conduit to spread their wares. I would strongly recommend that you uninstall these now. You can do so via Control Panel >> Add or Remove Programs. If you choose to keep these applications, please do not use them until our fixes at WTT are complete.

🖼Click to load external image (Posted Image) Please download OTM
  • Save it to your desktop.
  • Please double-click OTM to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    :Files
C:\bintheredunthat

:Commands
[EmptyFlash]
[EmptyTemp]
  • Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTM and reboot your PC.
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

🖼Click to load external image (Posted Image) You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM
  • Click the Update tab
  • Click Check for Updates
  • If an update is found, it will download and install the latest version.
  • The program will close to update and reopen.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

🖼Click to load external image (Posted Image) Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.
3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.
  • Once the update is complete, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, adware, dialers, and other riskware
    • Archives
    • E-mail databases
  • Click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View report… at the bottom.
  • Click the Save report… button.

    [external image: Posted Image]

  • Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply
Please include the following in your next post:
  • MBAM log
  • Kaspersky log
Post #5 last edited
Some things that are happening to my computer is that when i go to Start and then click on the control Panel button my computer freezes, but sometimes it does work. MBAM froze, and i do an anti-virus, its ESET Smart Security 4. And i had ESET turned off while scanning. MBAM didn't even get through the first file. I'll post the Kaspersky log once i get off of work.
Post #7 last edited
After i did the Kaspersky scan nothing came up, no infections, no nothing. I Fixed Malwarebytes, i just reinstalled it, so here is the file. Right now my computer seems to be running fine, but i'm not sure if it really is or not. Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4140 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 24/05/2010 11:19:18 PM mbam-log-2010-05-24 (23-19-18).txt Scan type: Quick scan Objects scanned: 121030 Time elapsed: 7 minute(s), 23 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)
Post #8
Hi Lichtenwald,

OK, that's good. Other than that suspicous folder I removed your logs looked clean. This will clean up the tools we used:

🖼Click to load external image (Posted Image) Cleanup with OTM
  • Double-click OTM.exe to start the program.
  • Close all other programs apart from OTM as this step will require a reboot
  • On the OTM main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.
  • Manually delete any remaining tools or logs from our work
🖼Click to load external image (Posted Image) Finally, I'd like to make a couple of suggestions to help you stay clean in the future:
  • Restart any anti-malware programs that we disabled while we were cleaning your machine.
  • Keep your antivirus application current and updated. Also, hang on to MBAM. Scan with them at least weekly.
  • Avoid using P2P programs.
  • Consider running in a limited user account. See this post for more information.
  • Please carefully review the information in our Security - Best Practices and Prevention forum located HERE
Please post once more so I know you are all set and I can close this thread. Good luck and stay safe!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI