What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Please Help! Caught Something in Windows

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
My computer stopped running my antivirus software, the computer started running slow, and I get error messages all over the place! I cannot seem to connect to the internet with IE or Firefox. Malwarebytes runs, but it never seems to find anything. I cannot shut the computer down without unplugging it. Please help! I was able to run DDS in safemode, so here are my two logs: ==== Installed Programs ====================== Access IBM Access IBM Message Center ACDSee Acrobat.com Adobe AIR Adobe Atmosphere Player for Acrobat and Adobe Reader Adobe Flash Player 10 ActiveX Adobe Reader 9.4.0 Adobe Shockwave Player 11 AiO_Scan_CDA Apple Mobile Device Support Apple Software Update ArcSoft Print Creations ArcSoft Print Creations - Album Page ArcSoft Print Creations - Funhouse ArcSoft Print Creations - Greeting Card ArcSoft Print Creations - Photo Book ArcSoft Print Creations - Photo Calendar ArcSoft Print Creations - Scrapbook ArcSoft Print Creations - Slimline Card Bonjour Business Contact Manager for Outlook 2003 CCScore Conexant SoftK56 Data Fax Coupon Printer for Windows ESSBrwr ESSCDBK ESScore ESSgui ESSini ESSPCD ESSPDock ESSTOOLS essvatgt Google Chrome Google Earth Google Toolbar for Internet Explorer Google Update Helper Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hotfix for Windows Internet Explorer 7 (KB947864) Hotfix for Windows XP (KB2158563) Hotfix for Windows XP (KB932716-v2) Hotfix for Windows XP (KB945060-v3) Hotfix for Windows XP (KB952287) Hotfix for Windows XP (KB954550-v5) Hotfix for Windows XP (KB961118) Hotfix for Windows XP (KB970653-v3) Hotfix for Windows XP (KB976098-v2) Hotfix for Windows XP (KB979306) Hotfix for Windows XP (KB981793) HP PSC & OfficeJet 5.3.A HP Share-to-Web IBM 32-bit Runtime Environment for Java 2, v1.4.1 IBM DLA IBM RecordNow! IBM Rescue and Recovery with Rapid Restore IBM Themes IBM ThinkVantage Technologies Welcome Message IBM Update Connector Intel® PRO Network Adapters and Drivers InterVideo WinDVD iTunes J2SE Runtime Environment 5.0 Update 10 J2SE Runtime Environment 5.0 Update 11 J2SE Runtime Environment 5.0 Update 5 J2SE Runtime Environment 5.0 Update 6 J2SE Runtime Environment 5.0 Update 9 Java Auto Updater Java™ 6 Update 2 Java™ 6 Update 22 Java™ 6 Update 3 Java™ 6 Update 5 Java™ 6 Update 7 Java™ SE Runtime Environment 6 Update 1 kgcbaby kgchday kgchlwn kgcinvt kgckids kgcmove kgcvday Kodak EasyShare software LiveUpdate 2.0 (Symantec Corporation) Logitech Webcam Software Logitech Webcam Software Driver Package Malwarebytes' Anti-Malware Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft Internationalized Domain Names Mitigation APIs Microsoft National Language Support Downlevel APIs Microsoft Office Small Business Edition 2003 Mouse Suite Move Networks Media Player for Internet Explorer Mozilla Firefox (3.6.12) MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) netbrdg Netflix Movie Viewer Nortel Networks Contivity VPN Client Norton WMI Update NVIDIA Display Driver OfotoXMI Panda ActiveScan PC-Doctor for Windows PCDADDIN PCDHELP QFolder QuickTime Scan SCRABBLE Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473) Security Update for Step By Step Interactive Training (KB898458) Security Update for Step By Step Interactive Training (KB923723) Security Update for Windows Internet Explorer 7 (KB2183461) Security Update for Windows Internet Explorer 7 (KB2360131) Security Update for Windows Internet Explorer 7 (KB928090) Security Update for Windows Internet Explorer 7 (KB929969) Security Update for Windows Internet Explorer 7 (KB931768) Security Update for Windows Internet Explorer 7 (KB933566) Security Update for Windows Internet Explorer 7 (KB937143) Security Update for Windows Internet Explorer 7 (KB938127) Security Update for Windows Internet Explorer 7 (KB939653) Security Update for Windows Internet Explorer 7 (KB942615) Security Update for Windows Internet Explorer 7 (KB944533) Security Update for Windows Internet Explorer 7 (KB950759) Security Update for Windows Internet Explorer 7 (KB953838) Security Update for Windows Internet Explorer 7 (KB956390) Security Update for Windows Internet Explorer 7 (KB958215) Security Update for Windows Internet Explorer 7 (KB960714) Security Update for Windows Internet Explorer 7 (KB961260) Security Update for Windows Internet Explorer 7 (KB963027) Security Update for Windows Internet Explorer 7 (KB969897) Security Update for Windows Internet Explorer 7 (KB972260) Security Update for Windows Internet Explorer 7 (KB974455) Security Update for Windows Internet Explorer 7 (KB976325) Security Update for Windows Internet Explorer 7 (KB978207) Security Update for Windows Internet Explorer 7 (KB982381) Security Update for Windows Media Player (KB2378111) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player (KB954155) Security Update for Windows Media Player (KB968816) Security Update for Windows Media Player (KB973540) Security Update for Windows Media Player (KB978695) Security Update for Windows Media Player (KB979402) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows Media Player 9 (KB911565) Security Update for Windows Media Player 9 (KB917734) Security Update for Windows Media Player 9 (KB936782) Security Update for Windows XP (KB2079403) Security Update for Windows XP (KB2115168) Security Update for Windows XP (KB2160329) Security Update for Windows XP (KB2229593) Security Update for Windows XP (KB2279986) Security Update for Windows XP (KB2286198) Security Update for Windows XP (KB2296011) Security Update for Windows XP (KB2360937) Security Update for Windows XP (KB2387149) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951376) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB953839) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB954459) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956744) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB956844) Security Update for Windows XP (KB957095) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB958690) Security Update for Windows XP (KB958869) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960715) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB960859) Security Update for Windows XP (KB961371) Security Update for Windows XP (KB961373) Security Update for Windows XP (KB961501) Security Update for Windows XP (KB968537) Security Update for Windows XP (KB969059) Security Update for Windows XP (KB969898) Security Update for Windows XP (KB969947) Security Update for Windows XP (KB970238) Security Update for Windows XP (KB970430) Security Update for Windows XP (KB971468) Security Update for Windows XP (KB971486) Security Update for Windows XP (KB971557) Security Update for Windows XP (KB971633) Security Update for Windows XP (KB971657) Security Update for Windows XP (KB971961) Security Update for Windows XP (KB972270) Security Update for Windows XP (KB973346) Security Update for Windows XP (KB973354) Security Update for Windows XP (KB973507) Security Update for Windows XP (KB973525) Security Update for Windows XP (KB973869) Security Update for Windows XP (KB973904) Security Update for Windows XP (KB974112) Security Update for Windows XP (KB974318) Security Update for Windows XP (KB974392) Security Update for Windows XP (KB974571) Security Update for Windows XP (KB975025) Security Update for Windows XP (KB975467) Security Update for Windows XP (KB975560) Security Update for Windows XP (KB975561) Security Update for Windows XP (KB975562) Security Update for Windows XP (KB975713) Security Update for Windows XP (KB977165) Security Update for Windows XP (KB977816) Security Update for Windows XP (KB977914) Security Update for Windows XP (KB978037) Security Update for Windows XP (KB978251) Security Update for Windows XP (KB978262) Security Update for Windows XP (KB978338) Security Update for Windows XP (KB978542) Security Update for Windows XP (KB978601) Security Update for Windows XP (KB978706) Security Update for Windows XP (KB979309) Security Update for Windows XP (KB979482) Security Update for Windows XP (KB979559) Security Update for Windows XP (KB979683) Security Update for Windows XP (KB979687) Security Update for Windows XP (KB980195) Security Update for Windows XP (KB980218) Security Update for Windows XP (KB980232) Security Update for Windows XP (KB980436) Security Update for Windows XP (KB981322) Security Update for Windows XP (KB981349) Security Update for Windows XP (KB981852) Security Update for Windows XP (KB981957) Security Update for Windows XP (KB981997) Security Update for Windows XP (KB982132) Security Update for Windows XP (KB982214) Security Update for Windows XP (KB982665) SFR SFR2 SHASTA skin0001 SKINXSDK Skypeô 4.2 Sonic Update Manager SoundMAX staticcr Symantec AntiVirus ThinkCentre Wallpaper Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Windows Internet Explorer 7 (KB976749) Update for Windows Internet Explorer 7 (KB980182) Update for Windows XP (KB2141007) Update for Windows XP (KB2345886) Update for Windows XP (KB951072-v2) Update for Windows XP (KB951978) Update for Windows XP (KB955759) Update for Windows XP (KB955839) Update for Windows XP (KB967715) Update for Windows XP (KB968389) Update for Windows XP (KB971737) Update for Windows XP (KB973687) Update for Windows XP (KB973815) Viewpoint Manager (Remove Only) VPRINTOL WebFldrs XP Windows Feature Pack for Storage (32-bit) - IMAPI update for Blu-Ray Windows Genuine Advantage Notifications (KB905474) Windows Genuine Advantage v1.3.0254.0 Windows Internet Explorer 7 Windows XP Service Pack 3 WIRELESS Yahoo! Photos Easy Upload Tool 1v6 ==== End Of File =========================== DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 20:25:08.23 on Mon 11/22/2010 Internet Explorer: 7.0.5730.11 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.767.228 [GMT -6:00] AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Google\Update\GoogleUpdate.exe svchost.exe C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe c:\sdwork\issimsvc.exe C:\Program Files\Analog Devices\SoundMAX\SMTray.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\IBM\Messages By IBM\ibmmessages.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\IBMTOOLS\UTILS\ibmprc.exe C:\WINDOWS\system32\ICO.EXE C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\WINDOWS\system32\FSRremoS.EXE C:\WINDOWS\system32\Pelmiced.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe C:\PROGRA~1\SYMANT~1\VPTray.exe C:\sdwork\w32main2.exe C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Ken\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.com/ uSearch Page = hxxp://www.google.com uSearch Bar = hxxp://www.google.com/ie uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uDefault_Search_URL = hxxp://www.google.com/ie uInternet Settings,ProxyOverride = *.local; uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s mSearchAssistant = hxxp://www.google.com/ie BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5805.1910\swg.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [ibmmessages] c:\program files\ibm\messages by ibm\ibmmessages.exe uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe" uRun: [Skype] "c:\program files\skype\\phone\Skype.exe" /nosplash /minimized mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [nwiz] nwiz.exe /install mRun: [Smapp] c:\program files\analog devices\soundmax\SMTray.exe mRun: [UC_Start] c:\program files\ibm\updater\\ucstartup.exe mRun: [UC_SMB] mRun: [] mRun: [ibmmessages] c:\program files\ibm\messages by ibm\\ibmmessages.exe mRun: [dla] c:\windows\system32\dla\tfswctrl.exe mRun: [UpdateManager] "c:\program files\common files\sonic\update manager\sgtray.exe" /r mRun: [IBMPRC] c:\ibmtools\utils\ibmprc.exe mRun: [Mouse Suite 98 Daemon] ICO.EXE mRun: [Share-to-Web Namespace Daemon] c:\program files\hewlett-packard\hp share-to-web\hpgs2wnd.exe mRun: [ISSI EZUpdate Service] "c:\sdwork\issimsvc.exe" mRun: [stgclean] c:\sdwork\w32main2.exe /cleanup mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe" mRun: [vptray] c:\progra~1\symant~1\VPTray.exe mRun: [w32msgr] c:\sdwork\w32main2.exe /log c:\sdwork\msgr.txt ospdb.pok.ibm.com mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe mRun: [LogitechQuickCamRibbon] "c:\program files\logitech\logitech webcam software\LWS.exe" /hide mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\kodake~1.lnk - c:\program files\kodak\kodak easyshare software\bin\EasyShare.exe IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: Google Sidewiki… - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204 DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - hxxp://acs.pandasoftware.com/activescan/as5free/asinst.cab DPF: {A8683C98-5341-421B-B23C-8514C05354F1} - hxxp://www.ritzpix.com/upload/FujifilmUploadClient.cab DPF: {CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/1.4.1/jinstall-141-win.cab DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_05-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {D44C75D8-C827-473E-8F68-A77E42500782} - hxxp://www.ritzpix.com/upload/WebUploadClient.cab DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} - hxxp://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326 Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Notify: NavLogon - c:\windows\system32\NavLogon.dll LSA: Notification Packages = scecli pwdmon ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\ken\applic~1\mozilla\firefox\profiles\l6npfb8s.default\ FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ —- FIREFOX POLICIES —- c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false); c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200); c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess"); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–fiqz9s", true); // Traditional c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–fiqs8s", true); // Simplified c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–j6w193g", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4a87g", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbqly7c0a67fbc", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbqly7cvafr", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–kpry57d", true); // Traditional c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–kprw13d", true); // Simplified c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24); c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096); c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", "-1"); c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45); c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); // now unused c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.delay", 50); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); ============= SERVICES / DRIVERS =============== =============== Created Last 30 ================ ==================== Find3M ==================== 2010-11-22 20:00 0 a——- c:\windows\system32\drivers\lvuvc.hs 2010-11-22 20:00 0 a——- c:\windows\system32\drivers\logiflt.iad 2010-09-18 11:23 974,848 ——– c:\windows\system32\mfc42u.dll 2010-09-18 11:23 974,848 ——– c:\windows\system32\dllcache\mfc42u.dll 2010-09-18 00:53 974,848 a——- c:\windows\system32\mfc42.dll 2010-09-18 00:53 974,848 ——– c:\windows\system32\dllcache\mfc42.dll 2010-09-18 00:53 954,368 ——– c:\windows\system32\mfc40.dll 2010-09-18 00:53 954,368 ——– c:\windows\system32\dllcache\mfc40.dll 2010-09-18 00:53 953,856 ——– c:\windows\system32\mfc40u.dll 2010-09-18 00:53 953,856 ——– c:\windows\system32\dllcache\mfc40u.dll 2010-09-15 03:50 472,808 a——- c:\windows\system32\deployJava1.dll 2010-09-08 09:57 70,656 ——– c:\windows\system32\dllcache\ie4uinit.exe 2010-09-08 09:57 13,824 ——– c:\windows\system32\dllcache\ieudinit.exe 2010-09-01 05:51 285,824 a——- c:\windows\system32\atmfd.dll 2010-09-01 05:51 285,824 ——– c:\windows\system32\dllcache\atmfd.dll 2010-08-31 07:42 1,852,800 ——– c:\windows\system32\win32k.sys 2010-08-31 07:42 1,852,800 ——– c:\windows\system32\dllcache\win32k.sys 2010-08-27 02:02 119,808 ——– c:\windows\system32\t2embed.dll 2010-08-27 02:02 119,808 ——– c:\windows\system32\dllcache\t2embed.dll 2010-08-26 23:57 99,840 ——– c:\windows\system32\srvsvc.dll 2010-08-26 23:57 99,840 ——– c:\windows\system32\dllcache\srvsvc.dll 2010-08-26 16:16 4,886,528 ——– c:\windows\system32\dllcache\wmp.dll 2010-08-26 07:39 357,248 ——– c:\windows\system32\dllcache\srv.sys 2010-08-26 06:52 5,120 a——- c:\windows\system32\xpsp4res.dll 2010-08-25 05:30 634,648 ——– c:\windows\system32\dllcache\iexplore.exe 2010-08-25 05:29 161,792 ——– c:\windows\system32\dllcache\ieakui.dll 2008-09-04 19:45 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008090420080905\index.dat ============= FINISH: 20:30:10.78 ===============
Post #2 last edited
Hi, welcome to the WTT Forums. My username is Raktor, and I would be glad to help you with your malware issues. I'd be grateful if you would note the following:

  • Absence of symptoms does not always mean the computer is clean
  • Please do not run any scans or fixes without my direction.
  • Finally, stay with this topic until I give you the final 'All clear' post.

Is this an IBM corporate machine? There is an internal helpdesk for virus issues if this is the case.
Post #3
This is not an IBM corporate machine. It is my personal computer at home. Everything runs very slowly. Malwarebytes finds and cleans the same thing each time I run it. I have been getting a lot of spam emails in outlook too since the problem began.
Post #4
Ok - it just appears that you're running internal IBM tools on your machine, and a corporate anti virus. My mistake.

You can run these tools in Safe Mode as well, if that's all that works.

1) MBRCheck
Please download MBRCheck.exe to your desktop.

  • Be sure to disable your security programs
  • Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
  • A window will open on your desktop
  • if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
  • If nothing unusual is found just press Enter
  • A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
  • Please post the contents of that file.

2) GMER
Download GMER Rootkit Scanner from here to your desktop. It will be a randomly named executable.

  • Double click the exe file.
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO, then use the following settings for a more complete scan.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Ensure the following are unchecked
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries


3) What You Will Need To Post:
  • MBRCheck log
  • GMER log
Post #5
I was able to run the MBRcheck so attached is the scan. I did have to hit 'N' because it seemed to find something. I was a bit pressed for time this evening, so I was only able to try the GMER check twice (since it takes 2 hr!). The first time I ran GMER my computer restarted. The second time I ran it, the scan did finish. There was no "rootkit" message. When I hit "save", the computer froze and I lost the log. I was not able to run the scan again this evening. Please let me know if I should run it again and I will do so. I know your forum closes threads that go 3 days without a reply. Since it is the holiday weekend, I won't be able to reply until Monday. Below is the the MBRcheck log: MBRCheck, version 1.2.3 © 2010, AD Command-line: Windows Version: Windows XP Home Edition Windows Information: Service Pack 3 (build 2600) Logical Drives Mask: 0x0000000d Kernel Drivers (total 144): 0x804D7000 \WINDOWS\system32\ntoskrnl.exe 0x806FF000 \WINDOWS\system32\hal.dll 0xF7B21000 \WINDOWS\system32\KDCOM.DLL 0xF7A31000 \WINDOWS\system32\BOOTVID.dll 0xF75D2000 ACPI.sys 0xF7B23000 \WINDOWS\System32\DRIVERS\WMILIB.SYS 0xF75C1000 pci.sys 0xF7621000 isapnp.sys 0xF7BE9000 pciide.sys 0xF78A1000 \WINDOWS\System32\DRIVERS\PCIIDEX.SYS 0xF7631000 MountMgr.sys 0xF75A2000 ftdisk.sys 0xF78A9000 PartMgr.sys 0xF7641000 VolSnap.sys 0xF758A000 atapi.sys 0xF7651000 disk.sys 0xF7661000 \WINDOWS\System32\DRIVERS\CLASSPNP.SYS 0xF756A000 fltmgr.sys 0xF7558000 sr.sys 0xF7671000 PxHelp20.sys 0xF7543000 drvmcdb.sys 0xF752C000 KSecDD.sys 0xF749F000 Ntfs.sys 0xF7472000 NDIS.sys 0xF7458000 Mup.sys 0xF7681000 agp440.sys 0xF77D1000 \SystemRoot\System32\DRIVERS\intelppm.sys 0xF7234000 \SystemRoot\System32\DRIVERS\nv4_mini.sys 0xF7220000 \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS 0xF7981000 \SystemRoot\System32\DRIVERS\usbuhci.sys 0xF71FC000 \SystemRoot\System32\DRIVERS\USBPORT.SYS 0xF7989000 \SystemRoot\System32\DRIVERS\usbehci.sys 0xF71C8000 \SystemRoot\system32\DRIVERS\HSFHWBS2.sys 0xF71A5000 \SystemRoot\system32\DRIVERS\ks.sys 0xF70A6000 \SystemRoot\system32\DRIVERS\HSF_DP.sys 0xF6FFF000 \SystemRoot\system32\DRIVERS\HSF_CNXT.sys 0xF7991000 \SystemRoot\System32\Drivers\Modem.SYS 0xF6FDB000 \SystemRoot\System32\DRIVERS\e100b325.sys 0xF77E1000 \SystemRoot\System32\DRIVERS\i8042prt.sys 0xF7999000 \SystemRoot\System32\DRIVERS\kbdclass.sys 0xF79A1000 \SystemRoot\System32\DRIVERS\fdc.sys 0xF77F1000 \SystemRoot\System32\DRIVERS\serial.sys 0xF7AD9000 \SystemRoot\System32\DRIVERS\serenum.sys 0xF6FC7000 \SystemRoot\System32\DRIVERS\parport.sys 0xF7801000 \SystemRoot\System32\DRIVERS\imapi.sys 0xF7B53000 \SystemRoot\system32\drivers\sscdbhk5.sys 0xF7811000 \SystemRoot\System32\DRIVERS\cdrom.sys 0xF7821000 \SystemRoot\System32\DRIVERS\redbook.sys 0xF7ADD000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys 0xF6F31000 \SystemRoot\system32\drivers\smwdm.sys 0xF6F0D000 \SystemRoot\system32\drivers\portcls.sys 0xF7831000 \SystemRoot\system32\drivers\drmk.sys 0xF6EF5000 \SystemRoot\system32\drivers\aeaudio.sys 0xF7CC1000 \SystemRoot\System32\DRIVERS\audstub.sys 0xF7841000 \SystemRoot\System32\DRIVERS\rasl2tp.sys 0xF7AE5000 \SystemRoot\System32\DRIVERS\ndistapi.sys 0xF6EDE000 \SystemRoot\System32\DRIVERS\ndiswan.sys 0xF7851000 \SystemRoot\System32\DRIVERS\raspppoe.sys 0xF7861000 \SystemRoot\System32\DRIVERS\raspptp.sys 0xF79A9000 \SystemRoot\System32\DRIVERS\TDI.SYS 0xF6ECD000 \SystemRoot\System32\DRIVERS\psched.sys 0xF7871000 \SystemRoot\System32\DRIVERS\msgpc.sys 0xF79B1000 \SystemRoot\System32\DRIVERS\ptilink.sys 0xF79B9000 \SystemRoot\System32\DRIVERS\raspti.sys 0xF7AF1000 \SystemRoot\system32\DRIVERS\eacfilt.sys 0xF6EB1000 \SystemRoot\system32\DRIVERS\ipsecw2k.sys 0xF7881000 \SystemRoot\System32\DRIVERS\termdd.sys 0xF79C1000 \SystemRoot\System32\DRIVERS\mouclass.sys 0xF7B55000 \SystemRoot\System32\DRIVERS\swenum.sys 0xF6E53000 \SystemRoot\System32\DRIVERS\update.sys 0xF7AF5000 \SystemRoot\System32\DRIVERS\mssmbios.sys 0xF7891000 \SystemRoot\System32\Drivers\NDProxy.SYS 0xF76B1000 \SystemRoot\System32\DRIVERS\usbhub.sys 0xF7B5D000 \SystemRoot\System32\DRIVERS\USBD.SYS 0xF79C9000 \SystemRoot\System32\DRIVERS\flpydisk.sys 0xF741B000 \SystemRoot\System32\Drivers\i2omgmt.SYS 0xF7417000 \SystemRoot\system32\DRIVERS\pelusblf.sys 0xF7413000 \SystemRoot\system32\DRIVERS\pelmouse.sys 0xF7403000 \SystemRoot\system32\DRIVERS\hidusb.sys 0xF76E1000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS 0xF79D1000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS 0xF5818000 \??\C:\Program Files\Symantec AntiVirus\savrt.sys 0xF5805000 \??\C:\Program Files\Symantec\SYMEVENT.SYS 0xF76F1000 \??\C:\Program Files\Symantec AntiVirus\Savrtpel.sys 0xF79E1000 \SystemRoot\system32\DRIVERS\usbccgp.sys 0xF7AAD000 \SystemRoot\System32\DRIVERS\mouhid.sys 0xF506C000 \SystemRoot\system32\DRIVERS\lvuvc.sys 0xF7701000 \SystemRoot\system32\drivers\usbaudio.sys 0xF502C000 \SystemRoot\system32\DRIVERS\lvrs.sys 0xF4EDE000 \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20101117.002\navex15.sys 0xF4ECA000 \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20101117.002\naveng.sys 0xF7B9B000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0xF7CC5000 \SystemRoot\System32\Drivers\Null.SYS 0xF7BAB000 \SystemRoot\System32\Drivers\Beep.SYS 0xF7919000 \SystemRoot\system32\drivers\ssrtln.sys 0xF7931000 \SystemRoot\System32\drivers\vga.sys 0xF7BB7000 \SystemRoot\System32\Drivers\mnmdd.SYS 0xF7BBF000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0xF7941000 \SystemRoot\System32\Drivers\Msfs.SYS 0xF7951000 \SystemRoot\System32\Drivers\Npfs.SYS 0xF586F000 \SystemRoot\System32\DRIVERS\rasacd.sys 0xF4E97000 \SystemRoot\System32\DRIVERS\ipsec.sys 0xF4E3E000 \SystemRoot\System32\DRIVERS\tcpip.sys 0xF4DFE000 \SystemRoot\System32\Drivers\SYMTDI.SYS 0xF4DD8000 \SystemRoot\System32\DRIVERS\ipnat.sys 0xF7791000 \SystemRoot\System32\DRIVERS\wanarp.sys 0xF4DB0000 \SystemRoot\System32\DRIVERS\netbt.sys 0xF4D8E000 \SystemRoot\System32\drivers\afd.sys 0xF77A1000 \SystemRoot\System32\DRIVERS\netbios.sys 0xF4D63000 \SystemRoot\System32\DRIVERS\rdbss.sys 0xF4CF3000 \SystemRoot\System32\DRIVERS\mrxsmb.sys 0xF77C1000 \SystemRoot\System32\Drivers\Fips.SYS 0xF4C93000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys 0xF6DF7000 \SystemRoot\System32\Drivers\Cdfs.SYS 0xF4BDB000 \SystemRoot\System32\Drivers\dump_atapi.sys 0xF7BE5000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS 0xBF800000 \SystemRoot\System32\win32k.sys 0xF7ACD000 \SystemRoot\System32\drivers\Dxapi.sys 0xF79E9000 \SystemRoot\System32\watchdog.sys 0xBF000000 \SystemRoot\System32\drivers\dxg.sys 0xF7CD8000 \SystemRoot\System32\drivers\dxgthk.sys 0xBF012000 \SystemRoot\System32\nv4_disp.dll 0xF4C73000 \SystemRoot\system32\drivers\drvnddm.sys 0xF7C98000 \SystemRoot\system32\dla\tfsndres.sys 0xF3B1E000 \SystemRoot\system32\dla\tfsnifs.sys 0xF3BAF000 \SystemRoot\system32\dla\tfsnopio.sys 0xF7B75000 \SystemRoot\system32\dla\tfsnpool.sys 0xF7A19000 \SystemRoot\system32\dla\tfsnboio.sys 0xF4C63000 \SystemRoot\system32\dla\tfsncofs.sys 0xF7C9F000 \SystemRoot\system32\dla\tfsndrct.sys 0xF3B05000 \SystemRoot\system32\dla\tfsnudf.sys 0xF3AEC000 \SystemRoot\system32\dla\tfsnudfa.sys 0xF3BB3000 \SystemRoot\System32\DRIVERS\ndisuio.sys 0xBFFA0000 \SystemRoot\System32\ATMFD.DLL 0xF2E9F000 \SystemRoot\system32\drivers\wdmaud.sys 0xF3064000 \SystemRoot\system32\drivers\sysaudio.sys 0xF2C8C000 \SystemRoot\System32\DRIVERS\mrxdav.sys 0xF6DE7000 \??\C:\WINDOWS\system32\drivers\ibmfilter.sys 0xF2A2C000 \SystemRoot\System32\DRIVERS\srv.sys 0xF2B54000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys 0xF7959000 \SystemRoot\system32\Drivers\LVPr2Mon.sys 0xF16D9000 \SystemRoot\System32\Drivers\SYMREDRV.SYS 0xF1476000 \SystemRoot\system32\drivers\kmixer.sys 0x7C900000 \WINDOWS\system32\ntdll.dll Processes (total 61): 0 System Idle Process 4 System 1276 C:\WINDOWS\system32\smss.exe 1324 csrss.exe 1348 C:\WINDOWS\system32\winlogon.exe 1392 C:\WINDOWS\system32\services.exe 1404 C:\WINDOWS\system32\lsass.exe 1608 C:\WINDOWS\system32\svchost.exe 1676 svchost.exe 2044 C:\WINDOWS\system32\svchost.exe 304 svchost.exe 580 svchost.exe 504 C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe 528 C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe 824 C:\WINDOWS\system32\spoolsv.exe 920 C:\WINDOWS\explorer.exe 1852 svchost.exe 1896 C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe 1916 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 1944 C:\Program Files\Bonjour\mDNSResponder.exe 2020 C:\Program Files\Symantec AntiVirus\DefWatch.exe 1140 C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe 1256 C:\sdwork\issimsvc.exe 1584 C:\Program Files\Java\jre6\bin\jqs.exe 1660 C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe 620 C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE 680 C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe 512 C:\Program Files\Analog Devices\SoundMAX\SMTray.exe 204 C:\WINDOWS\system32\nvsvc32.exe 1368 C:\Program Files\IBM\Messages By IBM\ibmmessages.exe 1480 C:\WINDOWS\system32\HPZipm12.exe 1980 C:\WINDOWS\system32\dla\tfswctrl.exe 1972 C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe 2008 C:\IBMTOOLS\utils\ibmprc.exe 148 C:\WINDOWS\system32\ico.exe 220 C:\WINDOWS\system32\svchost.exe 228 C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe 252 C:\WINDOWS\system32\FSRremoS.EXE 156 C:\Program Files\Common Files\Symantec Shared\ccApp.exe 324 C:\WINDOWS\system32\PELMICED.EXE 412 C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe 1448 C:\PROGRA~1\SYMANT~1\VPTray.exe 916 C:\Program Files\Symantec AntiVirus\Rtvscan.exe 1020 C:\sdwork\w32main2.exe 1772 C:\Program Files\QuickTime\QTTask.exe 2116 C:\Program Files\iTunes\iTunesHelper.exe 2152 C:\Program Files\Viewpoint\Common\ViewpointService.exe 2188 C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe 2212 C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe 2464 C:\Program Files\Common Files\Java\Java Update\jusched.exe 3012 C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe 3032 C:\WINDOWS\system32\ctfmon.exe 3064 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe 3384 C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe 3392 C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe 960 C:\Program Files\Skype\Phone\Skype.exe 2732 C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe 3968 C:\Program Files\iPod\bin\iPodService.exe 2840 alg.exe 320 C:\Program Files\Internet Explorer\iexplore.exe 2672 C:\Documents and Settings\Ken\Desktop\MBRCheck.exe \\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS) PhysicalDrive0 Model Number: Maxtor6Y080L0, Rev: YAR41BW0 Size Device Name MBR Status ——————————————– 74 GB \\.\PhysicalDrive0 Unknown MBR code SHA1: 902B1B6926D5967D367DE87F90A93B163F4202CE Found non-standard or infected MBR. Enter 'Y' and hit ENTER for more options, or 'N' to exit: Done!
Post #6
Please run the scan again when you have a chance - try it in safe mode by pressing F8 when your computer is turning on and selecting 'Safe Mode'. I'll leave this thread open, holiday weekend is no problem at all.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI