What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Getting Trojen Horse Auto Protect pop up with Norton!

19 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi, I have Norton Antivirus installed on my laptop with virus definitions updated. Now, I got the pop up that says Auto Protect. Action is Quarantined and risk is Trojen Horse. So, I immediately run the full scan but Norton was not able to find anything. Can anyone please help me solve this issue? I am attaching the screenshot of the pop up that I am getting. Please let me know if any more information is required. Thanks in advance.

Attachments:

Post #2

**In any case where you happen to be busy or unable to give us a reply, we would be grateful if you keep us informed in advance and we will be more than happy to wait. Failure to do so we will have your thread closed in THREE(3) days. :)


Hello there, vijay.gupta

:welcome:

I'm Conspire, I'll be glad to help you with your computer problems.

Please observe these rules while we work:
  • Read the entire procedure
  • It is important to perform ALL actions in sequence.
  • If you don't know, stop and ask! Don't keep going on.
  • Please reply to this thread. Do not start a new topic.
  • Stick with me till you're given the all clear.
  • Remember, absence of symptoms does not mean the infection is all gone.
  • Don't attempt to clean your computer with any tools other than the ones I ask you to use during the cleanup process.

IMPORTANT NOTE : Please do not delete anything unless instructed to.

—————————————————————————————————

Apart from the warning notification, is there any other symptoms that you wish to describe to me?

—————————————————————————————————
Post #3
No, there are no other symptoms but i would like to inform you that this happens only when i am connected to internet….
Post #4
Hello there,

Very well.

Please download DDS by sUBs from one of the following links and save it to your desktop.
    • DDS.scr
    • DDS.com
    • DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.
===================================================

[external image: Posted Image]
  • Please download GMER from one of the following locations, and save it to your desktop:
  • Main Mirror
    This version will download a randomly named file (Recommended)
  • Zip Mirror
    This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  • Extract the contents of the zipped file to desktop (applicable only to Zip mirror) .
  • Double click [external image: Posted Image] or [external image: Posted Image] on your desktop.
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
    [external image: Posted Image]

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

===================================================

Download Security Check by screen317 from here or here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
===================================================

On your next reply please post :
DDS log
GMER log
Checkup log

Let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!
Post #5
Thanks conspire. In weekdays, i live in different city (for work) and in weekends, i go to my native place which is in different city. This issue pertains to my laptop in my native place and now, since it is monday, i am not at my native place. I will go there again on saturday(if there is no urgent work) and will do these steps then. Please let me know if it works for you to keep this topic open for these many days without any activity.
Post #7
DDS:

.
DDS (Ver_11-03-05.01) - NTFSx86
Run by [removed] at 10:29:43.31 on 03-04-2011
Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 1.6.0_24
Microsoft Windows 7 Home Basic 6.1.7601.1.1252.91.1033.18.3039.1463 [GMT 5.5:30]
.
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\STacSV.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\system32\conhost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskhost.exe
C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\aestsrv.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
C:\Windows\system32\ChgService.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Windows\system32\dgdersvc.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\FsUsbExService.Exe
C:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\Program Files\Microsoft\BingBar\SeaPort.EXE
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\NetWorx\networx.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Symantec AntiVirus\VPTray.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\MMX300G 3G USB Manager\USB Modem.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Symantec AntiVirus\vpc32.exe
C:\Windows\explorer.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\explorer.exe
C:\Windows\explorer.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Vijay\Desktop\dds.scr
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.skip-search.com/?cfg=2-82-0-0
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_IN&c=94&bd=Presario&pf=cnnb
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_IN&c=94&bd=Presario&pf=cnnb
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_IN&c=94&bd=Presario&pf=cnnb
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - c:\program files\windows live\companion\companioncore.dll
BHO: FDMIECookiesBHO Class: {cc59e0f9-7e43-44fa-9faa-8377850bf205} - c:\program files\free download manager\iefdm2.dll
BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "c:\program files\microsoft\bingbar\BingExt.dll"
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "c:\program files\microsoft\bingbar\BingExt.dll"
uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden
uRun: [KiesTrayAgent]
mRun: [Apoint] c:\program files\apoint2k\Apoint.exe
mRun: []
mRun: [NetWorx] "c:\program files\networx\networx.exe" /auto
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [vptray] c:\progra~1\symant~1\VPTray.exe
mRun: [SysTrayApp] c:\program files\idt\wdm\sttray.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe
uPolicies-system: WallpaperStyle = 2
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
mPolicies-system: HideFastUserSwitching = 1 (0x1)
dPolicies-system: WallpaperStyle = 2
IE: Download all with Free Download Manager - file://c:\program files\free download manager\dlall.htm
IE: Download selected with Free Download Manager - file://c:\program files\free download manager\dlselected.htm
IE: Download video with Free Download Manager - file://c:\program files\free download manager\dlfvideo.htm
IE: Download with Free Download Manager - file://c:\program files\free download manager\dllink.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office12\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device… - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device… - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://capitaliq.webex.com/client/T27LC/nbr/ieatgpc1.cab
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
LSA: Notification Packages = scecli CPNP
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\vijay\appdata\roaming\mozilla\firefox\profiles\c3pzohvf.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.skip-search.com/?cfg=2-82-0-0
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?sourceid=navclient&hl=en-GB&q=
FF - component: c:\program files\free download manager\firefox\extension\components\vmsfdmff.dll
FF - component: c:\program files\nokia\nokia pc suite 7\bkmrksync\components\BkMrkExt.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60129.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npatgpc.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
.
============= SERVICES / DRIVERS ===============
.
R1 FW1;SecuRemote Miniport;c:\windows\system32\drivers\fw.sys [2007-5-24 2234800]
R1 networx;networx;c:\windows\system32\drivers\networx.sys [2011-2-12 51640]
R1 PSSDK42;PSSDK42;c:\windows\system32\drivers\pssdk42.sys [2010-10-2 38976]
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-14 48128]
R2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\driverstore\filerepository\stwrt.inf_x86_neutral_9691412ff1876250\AEstSrv.exe [2009-3-2 81920]
R2 Change Modem Device Service;Change Modem Device Service;c:\windows\system32\ChgService.exe [2010-11-6 135168]
R2 CP_OMDRV;Check Point Office Mode Module;c:\windows\system32\drivers\omdrv.sys [2007-5-24 36368]
R2 dgdersvc;Device Error Recovery Service;c:\windows\system32\dgdersvc.exe [2010-5-13 95568]
R2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2010-11-9 217088]
R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files\hewlett-packard\shared\HPDrvMntSvc.exe [2010-10-14 92216]
R2 Symantec AntiVirus;Symantec AntiVirus;c:\program files\symantec antivirus\Rtvscan.exe [2006-10-14 1956552]
R2 VNASC;Check Point Virtual Network Adapter - SecureClient;c:\windows\system32\drivers\vnasc.sys [2007-5-24 110032]
R2 VPN-1;VPN-1 Module;c:\windows\system32\drivers\vpn.sys [2007-5-24 673456]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\drivers\btwl2cap.sys [2010-10-2 29472]
R3 cmnsusbser;Mobile Connector USB Device for Legacy Serial Communication LCT2053s;c:\windows\system32\drivers\cmnsusbser.sys [2010-10-2 103424]
R3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [2010-5-13 18136]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2011-1-15 102448]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [2010-11-9 36640]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2009-6-27 66080]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2010-6-23 275048]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\drivers\ssadadb.sys [2010-12-24 30240]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]
S3 BBSvc;Bing Bar Update Service;c:\program files\microsoft\bingbar\BBSvc.EXE [2011-2-28 183560]
S3 Com4QLBEx;Com4QLBEx;c:\program files\hewlett-packard\hp quick launch buttons\Com4QLBEx.exe [2009-8-25 228408]
S3 fssfltr;fssfltr;c:\windows\system32\drivers\fssfltr.sys [2011-1-3 39272]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2010-9-23 1493352]
S3 JMCR;JMCR;c:\windows\system32\drivers\jmcr.sys [2009-7-23 116136]
S3 KiesAllShare;SAMSUNG KiesAllShare Service;c:\program files\samsung\kies\wiselinkpro\WiselinkPro.exe [2010-5-13 9241088]
S3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\netw5v32.sys [2009-6-11 4231168]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2010-2-26 137344]
S3 SavRoam;SavRoam;c:\program files\symantec antivirus\SavRoam.exe [2006-10-14 122056]
S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\drivers\VSTAZL3.SYS [2009-7-14 207360]
S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\drivers\VSTDPV3.SYS [2009-7-14 980992]
S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\drivers\VSTCNXT3.SYS [2009-7-14 661504]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\drivers\ssadbus.sys [2010-12-24 96416]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\drivers\ssadmdfl.sys [2010-12-24 12704]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\drivers\ssadmdm.sys [2010-12-24 121504]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-3-13 52224]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\drivers\vwifimp.sys [2009-7-14 14336]
S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-22 51040]
.
=============== Created Last 30 ================
.
2011-03-28 02:49:27 ——– d—–w- C:\chotu kanchadan
2011-03-26 11:11:08 ——– d—–w- c:\program files\Microsoft
2011-03-26 10:22:32 781272 —-a-w- c:\program files\mozilla firefox\mozsqlite3.dll
2011-03-26 10:22:32 1874904 —-a-w- c:\program files\mozilla firefox\mozjs.dll
2011-03-26 10:22:31 728024 —-a-w- c:\program files\mozilla firefox\libGLESv2.dll
2011-03-26 10:22:31 15832 —-a-w- c:\program files\mozilla firefox\mozalloc.dll
2011-03-26 10:22:31 142296 —-a-w- c:\program files\mozilla firefox\libEGL.dll
2011-03-26 10:22:30 1893336 —-a-w- c:\program files\mozilla firefox\d3dx9_42.dll
2011-03-26 10:22:30 142296 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2011-03-26 10:22:29 1975768 —-a-w- c:\program files\mozilla firefox\D3DCompiler_42.dll
2011-03-13 17:57:03 ——– d—–w- c:\program files\MIKSOFT
2011-03-13 06:35:26 ——– d—–w- c:\windows\system32\SPReview
2011-03-13 06:31:56 ——– d—–w- c:\windows\system32\EventProviders
2011-03-13 06:30:06 1130824 —-a-w- c:\windows\system32\dfshim.dll
2011-03-13 06:30:03 52224 —-a-w- c:\windows\system32\drivers\TsUsbFlt.sys
2011-03-13 06:30:02 3215872 —-a-w- c:\windows\system32\mstscax.dll
2011-03-13 06:30:02 11776 —-a-w- c:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2011-03-13 06:28:59 82944 —-a-w- c:\windows\system32\thumbcache.dll
2011-03-13 06:27:59 92672 —-a-w- c:\windows\system32\drivers\WUDFPf.sys
2011-03-13 06:26:39 323072 —-a-w- c:\windows\system32\drvstore.dll
2011-03-13 06:26:39 257024 —-a-w- c:\windows\system32\dpx.dll
2011-03-12 13:17:48 219136 —-a-w- c:\windows\system32\d3d10_1core.dll
2011-03-12 13:17:48 161792 —-a-w- c:\windows\system32\d3d10_1.dll
2011-03-09 09:19:23 805376 —-a-w- c:\windows\system32\FntCache.dll
2011-03-09 09:19:23 739840 —-a-w- c:\windows\system32\d2d1.dll
2011-03-09 09:19:23 1076736 —-a-w- c:\windows\system32\DWrite.dll
2011-03-09 08:46:57 642048 —-a-w- c:\windows\system32\CPFilters.dll
2011-03-09 08:46:57 534528 —-a-w- c:\windows\system32\EncDec.dll
2011-03-09 08:46:56 850944 —-a-w- c:\windows\system32\sbe.dll
2011-03-09 08:46:56 199680 —-a-w- c:\windows\system32\mpg2splt.ax
2011-03-08 08:13:51 ——– d—–w- C:\wwwwwwwww
.
==================== Find3M ====================
.
2011-03-13 06:41:46 152576 —-a-w- c:\windows\system32\msclmd.dll
2011-02-02 16:10:23 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-01-08 11:22:23 6656 —-a-w- c:\windows\system32\bcmwlrc.dll
2011-01-08 11:22:22 91448 —-a-w- c:\windows\system32\bcmwlcoi.dll
2011-01-08 11:22:22 3866624 —-a-w- c:\windows\system32\bcmihvsrv.dll
2011-01-08 11:22:22 3555328 —-a-w- c:\windows\system32\bcmihvui.dll
2011-01-07 07:46:34 870912 —-a-w- c:\windows\system32\XpsPrint.dll
2011-01-07 07:46:34 288256 —-a-w- c:\windows\system32\XpsGdiConverter.dll
2011-01-07 07:45:57 34304 —-a-w- c:\windows\system32\atmlib.dll
2011-01-07 06:01:22 1638912 —-a-w- c:\windows\system32\mshtml.tlb
2011-01-07 05:43:36 294400 —-a-w- c:\windows\system32\atmfd.dll
2011-01-05 05:55:55 428032 —-a-w- c:\windows\system32\vbscript.dll
2011-01-05 03:51:01 2330624 —-a-w- c:\windows\system32\win32k.sys
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 6.1.7601 Disk: Hitachi_HTS723232L9A360 rev.FC4OC60D -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: >>UNKNOWN [0x82E12000]<< >>UNKNOWN [0x8BA33000]<< >>UNKNOWN [0x8C41F000]<< >>UNKNOWN [0x8B8B8000]<< >>UNKNOWN [0x83224000]<< >>UNKNOWN [0x8BB44000]<< >>UNKNOWN [0x8B800000]<< >>UNKNOWN [0x8BBC7000]<<
_asm { DEC EBP; POP EDX; NOP ; ADD [EBX], AL; ADD [EAX], AL; ADD [EAX+EAX], AL; ADD [EAX], AL; }
1 ntkrnlpa!IofCallDriver[0x82E4952F] -> \Device\Harddisk0\DR0[0x869D14C0]
\Driver\Disk[0x85B9A108] -> IRP_MJ_CREATE -> 0x8BA3739F
3 [0x8BA3759E] -> ntkrnlpa!IofCallDriver[0x82E4952F] -> [0x86492328]
\Driver\ACPI[0x85B0DDB8] -> IRP_MJ_CREATE -> 0x8B8C14CC
5 [0x8B8C13D4] -> ntkrnlpa!IofCallDriver[0x82E4952F] -> \Device\Ide\IdeDeviceP0T0L0-0[0x868AB030]
\Driver\atapi[0x86874D30] -> IRP_MJ_CREATE -> 0x8BB5E8CC
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; MOV ES, AX; MOV DS, AX; MOV SI, SP; MOV DI, 0x600; MOV CX, 0x200; CLD ; REP MOVSB ; JMP FAR 0x0:0x660; }
user & kernel MBR OK
copy of MBR has been found in sector 2 !
Warning: possible TDL3 rootkit infection !
.
============= FINISH: 10:30:15.31 ===============

GMER

GMER 1.0.15.15570 - http://www.gmer.net
Rootkit scan 2011-04-03 11:11:42
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Hitachi_HTS723232L9A360 rev.FC4OC60D
Running: hfthpvn9.exe; Driver: C:\Users\Vijay\AppData\Local\Temp\fglyipob.sys


—- System - GMER 1.0.15 —-

SSDT 8704C3A8 ZwAlertResumeThread
SSDT 8704C468 ZwAlertThread
SSDT 86DACA30 ZwAllocateVirtualMemory
SSDT 86D00E08 ZwConnectPort
SSDT 86D64878 ZwCreateMutant
SSDT 8702A3A0 ZwCreateThread
SSDT 86D934D8 ZwFreeVirtualMemory
SSDT 87055348 ZwImpersonateAnonymousToken
SSDT 87055408 ZwImpersonateThread
SSDT 86BC5BF0 ZwMapViewOfSection
SSDT 86D647B8 ZwOpenEvent
SSDT 86D50C20 ZwOpenProcessToken
SSDT 86DBB380 ZwOpenThreadToken
SSDT 86D50210 ZwResumeThread
SSDT 86DBB2C0 ZwSetContextThread
SSDT 86BB0BB8 ZwSetInformationProcess
SSDT 86C9AFD0 ZwSetInformationThread
SSDT 86D646D8 ZwSuspendProcess
SSDT 86C9AE50 ZwSuspendThread
SSDT 86D32078 ZwTerminateProcess
SSDT 86C9AF10 ZwTerminateThread
SSDT 86BB0C78 ZwUnmapViewOfSection
SSDT 86DBB148 ZwWriteVirtualMemory

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!ZwSaveKey + 13C1 82E50339 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82E89D52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, …] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!KeRemoveQueueEx + 10DB 82E90DD0 6 Bytes [A8, C3, 04, 87, 68, C4]
.text ntkrnlpa.exe!KeRemoveQueueEx + 10E2 82E90DD7 1 Byte [87]
.text ntkrnlpa.exe!KeRemoveQueueEx + 10F3 82E90DE8 4 Bytes [30, CA, DA, 86]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1193 82E90E88 4 Bytes [08, 0E, D0, 86]
.text ntkrnlpa.exe!KeRemoveQueueEx + 11CF 82E90EC4 4 Bytes [78, 48, D6, 86]
.text …
? C:\Users\Vijay\AppData\Local\Temp\mbr.sys The system cannot find the file specified. !

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\Mozilla Firefox\firefox.exe[2204] ntdll.dll!LdrLoadDll 77DA22B8 5 Bytes JMP 00E31410 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[4604] USER32.dll!SetWindowLongA 76288BA3 5 Bytes JMP 67AC9777 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[4604] USER32.dll!SetWindowLongW 76294449 5 Bytes JMP 67AC9709 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[4604] USER32.dll!GetWindowInfo 76294B5E 5 Bytes JMP 678F7C37 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[4604] USER32.dll!TrackPopupMenu 762A2228 5 Bytes JMP 678F823A C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)

—- Devices - GMER 1.0.15 —-

Device Ntfs.sys (NT File System Driver/Microsoft Corporation)
Device fastfat.SYS (Fast FAT File System Driver/Microsoft Corporation)

AttachedDevice \Driver\tdx \Device\Tcp networx.sys (NetFilter SDK TDI Hook Driver (WPP)/NetFilterSDK.com)
AttachedDevice \Driver\tdx \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

Device \Driver\ACPI_HAL \Device\00000081 halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice \Driver\tdx \Device\Udp networx.sys (NetFilter SDK TDI Hook Driver (WPP)/NetFilterSDK.com)
AttachedDevice \Driver\tdx \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device \Driver\BTHUSB \Device\000000ad bthport.sys (Bluetooth Bus Driver/Microsoft Corporation)
Device \Driver\BTHUSB \Device\000000af bthport.sys (Bluetooth Bus Driver/Microsoft Corporation)

AttachedDevice fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device cdfs.sys (CD-ROM File System Driver/Microsoft Corporation)

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001a6b2af2e9
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00247eb188db
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001a6b2af2e9 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00247eb188db (not active ControlSet)

—- EOF - GMER 1.0.15 —-

Check Up:

Results of screen317's Security Check version 0.99.10
Windows 7 Service Pack 1 (UAC is disabled!)
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
Symantec AntiVirus
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
CCleaner
Java™ 6 Update 24
Adobe Flash Player 10.2.153.1
Adobe Reader X (10.0.1)
````````````````````````````````
Process Check:
objlist.exe by Laurent
Norton ccSvcHst.exe
Symantec AntiVirus DefWatch.exe
Symantec AntiVirus Rtvscan.exe
Symantec AntiVirus VPTray.exe
Symantec AntiVirus vpc32.exe
``````````End of Log````````````

Attachments:

Post #8
Please read through these instructions to familarize yourself with what to expect when this tool runs


Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs


    **********************************************
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Post #9
Thanks conspire. I will do these steps, however, i am back to work now and i think that i will not be able to go to my native place in next 15 days due to work commitments. Would it be possible to open the thread till then? Also, this issue was not happening this time before i performed these steps but was happening when i post this. Is it possible that problem is corrected itself automatically?
Post #11 last edited
Hey conspire. There is an issue happening. After combofix has done its thing, it reboots thr laptop and it is not gettting start since then. It stalls at screen where it says compaq. Now, what to do? Also, does combofix works on Windows 7 also as I am having this issue in my laptop with Windows 7 Home Basic in it?
Post #12 last edited
I think this happened because laptop become hot, that is why this was happening so I shutdown the laptop for about half an hour and then restarted it. After restarting the laptop. com bofix.txt was formed. Please let me know if anything else is required

Attachments:

Post #13
Combofix does support Windows 7.

Can you give me the screenshot where it shows the infected file directory?

While doing so, I need you to also get me the following log.

Please download MBRCheck.exe to your desktop.
  • Be sure to disable your security programs
  • Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
  • A window will open on your desktop
  • if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
  • If nothing unusual is found just press Enter
  • A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
  • Please post the contents of that file.
Post #14
I did not get this: Can you give me the screenshot where it shows the infected file directory? I am following the remining step
Post #15
These are the contents of MBR file: MBRCheck, version 1.2.3 © 2010, AD Command-line: Windows Version: Windows 7 Home Basic Edition Windows Information: Service Pack 1 (build 7601), 32-bit Base Board Manufacturer: Hewlett-Packard BIOS Manufacturer: Insyde System Manufacturer: Hewlett-Packard System Product Name: Compaq Presario CQ40 Notebook PC Logical Drives Mask: 0x0000013c Kernel Drivers (total 257): 0x82E4E000 \SystemRoot\system32\ntkrnlpa.exe 0x82E17000 \SystemRoot\system32\halmacpi.dll 0x80BCB000 \SystemRoot\system32\kdcom.dll 0x8B637000 \SystemRoot\system32\mcupdate_GenuineIntel.dll 0x8B6BC000 \SystemRoot\system32\PSHED.dll 0x8B6CD000 \SystemRoot\system32\BOOTVID.dll 0x8B6D5000 \SystemRoot\system32\CLFS.SYS 0x8B717000 \SystemRoot\system32\CI.dll 0x8B806000 \SystemRoot\system32\drivers\Wdf01000.sys 0x8B877000 \SystemRoot\system32\drivers\WDFLDR.SYS 0x8B885000 \SystemRoot\system32\drivers\ACPI.sys 0x8B8CD000 \SystemRoot\system32\drivers\WMILIB.SYS 0x8B8D6000 \SystemRoot\system32\drivers\msisadrv.sys 0x8B8DE000 \SystemRoot\system32\drivers\pci.sys 0x8B908000 \SystemRoot\system32\drivers\vdrvroot.sys 0x8B913000 \SystemRoot\system32\drivers\isapnp.sys 0x8B922000 \SystemRoot\system32\drivers\mpio.sys 0x8B946000 \SystemRoot\System32\drivers\partmgr.sys 0x8B957000 \SystemRoot\system32\DRIVERS\compbatt.sys 0x8B95F000 \SystemRoot\system32\DRIVERS\BATTC.SYS 0x8B96A000 \SystemRoot\system32\drivers\volmgr.sys 0x8B97A000 \SystemRoot\System32\drivers\volmgrx.sys 0x8B9C5000 \SystemRoot\system32\drivers\intelide.sys 0x8B9CC000 \SystemRoot\system32\drivers\PCIIDEX.SYS 0x8B9DA000 \SystemRoot\system32\drivers\pciide.sys 0x8B9E1000 \SystemRoot\system32\drivers\aliide.sys 0x8B9E8000 \SystemRoot\system32\drivers\amdide.sys 0x8B9EF000 \SystemRoot\system32\drivers\cmdide.sys 0x8B7C2000 \SystemRoot\System32\drivers\mountmgr.sys 0x8B7D8000 \SystemRoot\system32\drivers\msdsm.sys 0x8B600000 \SystemRoot\system32\drivers\nvraid.sys 0x8BA21000 \SystemRoot\system32\drivers\CLASSPNP.SYS 0x8BA46000 \SystemRoot\system32\drivers\viaide.sys 0x8BA4E000 \SystemRoot\system32\drivers\iaStorV.sys 0x8BB29000 \SystemRoot\system32\drivers\atapi.sys 0x8BB32000 \SystemRoot\system32\drivers\ataport.SYS 0x8BB55000 \SystemRoot\system32\DRIVERS\lsi_sas.sys 0x8BB6D000 \SystemRoot\system32\DRIVERS\storport.sys 0x8BBB5000 \SystemRoot\system32\drivers\msahci.sys 0x8BBBF000 \SystemRoot\system32\drivers\HpSAMD.sys 0x8BC08000 \SystemRoot\system32\DRIVERS\adp94xx.sys 0x8BC72000 \SystemRoot\system32\DRIVERS\adpahci.sys 0x8BCBE000 \SystemRoot\system32\DRIVERS\adpu320.sys 0x8BCE4000 \SystemRoot\system32\DRIVERS\djsvs.sys 0x8BCF8000 \SystemRoot\system32\DRIVERS\SCSIPORT.SYS 0x8BD1E000 \SystemRoot\system32\drivers\amdsata.sys 0x8BD35000 \SystemRoot\system32\DRIVERS\amdsbs.sys 0x8BD72000 \SystemRoot\system32\drivers\amdxata.sys 0x8BD7B000 \SystemRoot\system32\DRIVERS\arc.sys 0x8BD91000 \SystemRoot\system32\DRIVERS\arcsas.sys 0x8BE07000 \SystemRoot\system32\DRIVERS\elxstor.sys 0x8BE7A000 \SystemRoot\system32\DRIVERS\iirsp.sys 0x8BE8A000 \SystemRoot\system32\DRIVERS\lsi_fc.sys 0x8BEA4000 \SystemRoot\system32\DRIVERS\lsi_sas2.sys 0x8BEB4000 \SystemRoot\system32\DRIVERS\lsi_scsi.sys 0x8BECE000 \SystemRoot\system32\DRIVERS\megasas.sys 0x8BED9000 \SystemRoot\system32\DRIVERS\MegaSR.sys 0x8BF6B000 \SystemRoot\system32\DRIVERS\nfrd960.sys 0x8BF79000 \SystemRoot\system32\drivers\nvstor.sys 0x8C005000 \SystemRoot\system32\DRIVERS\ql2300.sys 0x8C184000 \SystemRoot\system32\DRIVERS\ql40xx.sys 0x8C1D9000 \SystemRoot\system32\DRIVERS\SiSRaid2.sys 0x8C1E6000 \SystemRoot\system32\DRIVERS\sisraid4.sys 0x8BF9E000 \SystemRoot\system32\DRIVERS\vsmraid.sys 0x8BFC3000 \SystemRoot\system32\drivers\fltmgr.sys 0x8BDA9000 \SystemRoot\system32\drivers\fileinfo.sys 0x8C22E000 \SystemRoot\System32\Drivers\Ntfs.sys 0x8C35D000 \SystemRoot\System32\Drivers\msrpc.sys 0x8C388000 \SystemRoot\System32\Drivers\ksecdd.sys 0x8C39B000 \SystemRoot\System32\Drivers\cng.sys 0x8C200000 \SystemRoot\System32\drivers\pcw.sys 0x8C20E000 \SystemRoot\System32\Drivers\Fs_Rec.sys 0x8C427000 \SystemRoot\system32\drivers\ndis.sys 0x8C4DE000 \SystemRoot\system32\drivers\NETIO.SYS 0x8C51C000 \SystemRoot\System32\Drivers\ksecpkg.sys 0x8C608000 \SystemRoot\System32\drivers\tcpip.sys 0x8C752000 \SystemRoot\System32\drivers\fwpkclnt.sys 0x8C783000 \SystemRoot\system32\DRIVERS\wd.sys 0x8C78B000 \SystemRoot\system32\drivers\volsnap.sys 0x8C7CA000 \SystemRoot\system32\DRIVERS\stexstor.sys 0x8C7D3000 \SystemRoot\System32\Drivers\spldr.sys 0x8C7DB000 \SystemRoot\system32\drivers\sbp2port.sys 0x8C541000 \SystemRoot\System32\drivers\rdyboost.sys 0x8C56E000 \SystemRoot\System32\Drivers\mup.sys 0x8C7F3000 \SystemRoot\System32\drivers\hwpolicy.sys 0x8C57E000 \SystemRoot\System32\DRIVERS\fvevol.sys 0x8C5B0000 \SystemRoot\system32\DRIVERS\disk.sys 0x8C400000 \SystemRoot\system32\drivers\cdrom.sys 0x91429000 \SystemRoot\System32\Drivers\SRTSP.SYS 0x91472000 \SystemRoot\System32\Drivers\SRTSPX.SYS 0x915CE000 \??\C:\Program Files\Symantec\SYMEVENT.SYS 0x91414000 \SystemRoot\System32\Drivers\Null.SYS 0x9141B000 \SystemRoot\System32\Drivers\Beep.SYS 0x915F0000 \SystemRoot\System32\drivers\vga.sys 0x8BDBA000 \SystemRoot\System32\drivers\VIDEOPRT.SYS 0x8C217000 \SystemRoot\System32\drivers\watchdog.sys 0x8C600000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0x8C41F000 \SystemRoot\system32\drivers\rdpencdd.sys 0x8C5F4000 \SystemRoot\system32\drivers\rdprefmp.sys 0x8BDDB000 \SystemRoot\System32\Drivers\Msfs.SYS 0x8BDE6000 \SystemRoot\System32\Drivers\Npfs.SYS 0x8BBD2000 \SystemRoot\system32\DRIVERS\tdx.sys 0x8BDF4000 \SystemRoot\system32\DRIVERS\TDI.SYS 0x8BBE9000 \SystemRoot\system32\drivers\networx.sys 0x99807000 \SystemRoot\system32\DRIVERS\fw.sys 0x99A29000 \SystemRoot\system32\drivers\afd.sys 0x99A83000 \SystemRoot\System32\DRIVERS\netbt.sys 0x99AB5000 \SystemRoot\system32\DRIVERS\wfplwf.sys 0x99ABC000 \SystemRoot\system32\DRIVERS\pacer.sys 0x99ADB000 \SystemRoot\system32\DRIVERS\vwififlt.sys 0x99AEC000 \??\C:\Windows\system32\Drivers\pssdk42.sys 0x99AF8000 \SystemRoot\system32\DRIVERS\netbios.sys 0x99B06000 \SystemRoot\system32\DRIVERS\wanarp.sys 0x99B19000 \SystemRoot\system32\drivers\termdd.sys 0x99B2A000 \SystemRoot\System32\Drivers\SYMTDI.SYS 0x99B56000 \??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys 0x99BBC000 \SystemRoot\system32\DRIVERS\rdbss.sys 0x8C224000 \SystemRoot\system32\drivers\nsiproxy.sys 0x8BBF4000 \SystemRoot\system32\drivers\mssmbios.sys 0x9903A000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys 0x99098000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys 0x990B5000 \SystemRoot\System32\drivers\discache.sys 0x990C1000 \SystemRoot\System32\Drivers\dfsc.sys 0x990D9000 \SystemRoot\system32\DRIVERS\blbdrive.sys 0x990E7000 \SystemRoot\system32\DRIVERS\tunnel.sys 0x99108000 \SystemRoot\system32\DRIVERS\intelppm.sys 0x9911A000 \SystemRoot\system32\DRIVERS\CmBatt.sys 0x9A639000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys 0x9AFAA000 \SystemRoot\system32\DRIVERS\nvBridge.kmd 0x9911E000 \SystemRoot\System32\drivers\dxgkrnl.sys 0x9AFAC000 \SystemRoot\System32\drivers\dxgmms1.sys 0x9AFE5000 \SystemRoot\system32\DRIVERS\usbuhci.sys 0x9D217000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0x9D262000 \SystemRoot\system32\DRIVERS\usbehci.sys 0x9D271000 \SystemRoot\system32\drivers\HDAudBus.sys 0x9D404000 \SystemRoot\system32\DRIVERS\bcmwl6.sys 0x9D69E000 \SystemRoot\system32\DRIVERS\vwifibus.sys 0x9D6A8000 \SystemRoot\system32\DRIVERS\Rt86win7.sys 0x9D6ED000 \SystemRoot\system32\drivers\i8042prt.sys 0x9D705000 \SystemRoot\system32\DRIVERS\HpqKbFiltr.sys 0x9D70E000 \SystemRoot\system32\drivers\kbdclass.sys 0x9D71B000 \SystemRoot\system32\DRIVERS\Apfiltr.sys 0x9D751000 \SystemRoot\system32\drivers\mouclass.sys 0x9D75E000 \SystemRoot\system32\drivers\wmiacpi.sys 0x9D767000 \SystemRoot\system32\drivers\CompositeBus.sys 0x9D774000 \SystemRoot\system32\DRIVERS\AgileVpn.sys 0x9D786000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0x9D79E000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0x9D7A9000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0x9D7CB000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0x9D7E3000 \SystemRoot\system32\DRIVERS\raspptp.sys 0x9D290000 \SystemRoot\system32\DRIVERS\rassstp.sys 0x9D2A7000 \SystemRoot\system32\DRIVERS\vnasc.sys 0x9D7FA000 \SystemRoot\system32\drivers\swenum.sys 0x9D2C2000 \SystemRoot\system32\drivers\ks.sys 0x9D2F6000 \SystemRoot\system32\drivers\umbus.sys 0x9D304000 \SystemRoot\system32\drivers\usbhub.sys 0x9D348000 \SystemRoot\System32\Drivers\NDProxy.SYS 0x9D359000 \SystemRoot\system32\DRIVERS\stwrt.sys 0x9D3C5000 \SystemRoot\system32\DRIVERS\portcls.sys 0x9A600000 \SystemRoot\system32\DRIVERS\drmk.sys 0x9D200000 \SystemRoot\system32\drivers\nvhda32v.sys 0x82970000 \SystemRoot\System32\win32k.sys 0x9D3F4000 \SystemRoot\System32\drivers\Dxapi.sys 0x9A619000 \SystemRoot\system32\drivers\usbccgp.sys 0x9D7FC000 \SystemRoot\system32\drivers\USBD.SYS 0x991D5000 \SystemRoot\System32\Drivers\usbvideo.sys 0x99000000 \SystemRoot\System32\Drivers\BTHUSB.sys 0x8DC20000 \SystemRoot\System32\Drivers\bthport.sys 0x8DC84000 \SystemRoot\system32\DRIVERS\monitor.sys 0x82BD0000 \SystemRoot\System32\TSDDD.dll 0x8DC8F000 \SystemRoot\system32\DRIVERS\rfcomm.sys 0x8DCB3000 \SystemRoot\system32\drivers\BthEnum.sys 0x8DCC0000 \SystemRoot\system32\DRIVERS\bthpan.sys 0x82800000 \SystemRoot\System32\cdd.dll 0x8DCDB000 \SystemRoot\system32\DRIVERS\bthmodem.sys 0x8DCED000 \SystemRoot\system32\drivers\modem.sys 0x8DCFA000 \SystemRoot\system32\DRIVERS\btwavdt.sys 0x8DD6D000 \SystemRoot\system32\drivers\btwaudio.sys 0x8DDEE000 \SystemRoot\system32\DRIVERS\btwl2cap.sys 0x8DDF9000 \SystemRoot\system32\DRIVERS\btwrchid.sys 0x8DC00000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS 0x8DC13000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS 0x82820000 \SystemRoot\System32\ATMFD.DLL 0x99012000 \SystemRoot\system32\drivers\luafv.sys 0x8C5C1000 \SystemRoot\system32\drivers\WudfPf.sys 0x9A630000 \SystemRoot\System32\drivers\omdrv.sys 0x9AFF0000 \SystemRoot\system32\DRIVERS\lltdio.sys 0x9A215000 \SystemRoot\system32\DRIVERS\nwifi.sys 0x9A25B000 \SystemRoot\system32\DRIVERS\ndisuio.sys 0x9A26B000 \SystemRoot\system32\DRIVERS\rspndr.sys 0x9A27E000 \SystemRoot\System32\drivers\vpn.sys 0x9A323000 \SystemRoot\system32\DRIVERS\cdfs.sys 0x9A339000 \SystemRoot\System32\Drivers\crashdmp.sys 0x9A346000 \SystemRoot\System32\Drivers\dump_dumpata.sys 0x9A351000 \SystemRoot\System32\Drivers\dump_msahci.sys 0x9A35B000 \SystemRoot\System32\Drivers\dump_dumpfve.sys 0x9A36C000 \SystemRoot\system32\DRIVERS\vwifimp.sys 0x9A375000 \SystemRoot\system32\drivers\HTTP.sys 0x8C5DB000 \SystemRoot\system32\DRIVERS\bowser.sys 0x9A200000 \SystemRoot\System32\drivers\mpsdrv.sys 0xA5608000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0xA562B000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys 0xA5666000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys 0xA5699000 \SystemRoot\system32\drivers\peauth.sys 0xA5730000 \SystemRoot\System32\Drivers\secdrv.SYS 0xA573A000 \SystemRoot\System32\DRIVERS\srvnet.sys 0xA575B000 \SystemRoot\System32\drivers\tcpipreg.sys 0xA5768000 \SystemRoot\System32\DRIVERS\srv2.sys 0xA900D000 \SystemRoot\System32\DRIVERS\srv.sys 0xA905E000 \SystemRoot\System32\drivers\dgderdrv.sys 0xA9061000 \??\C:\Windows\system32\FsUsbExDisk.SYS 0xA906A000 \SystemRoot\System32\Drivers\SYMREDRV.SYS 0xA91CF000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS 0xA91E6000 \SystemRoot\system32\DRIVERS\cmnsusbser.sys 0xA9000000 \SystemRoot\system32\DRIVERS\asyncmac.sys 0xA9070000 \??\C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20110326.002\NAVEX15.SYS 0xA91BB000 \??\C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20110326.002\NAVENG.SYS 0x77020000 \Windows\System32\ntdll.dll 0x47820000 \Windows\System32\smss.exe 0x77260000 \Windows\System32\apisetschema.dll 0x005E0000 \Windows\System32\autochk.exe 0x77240000 \Windows\System32\lpk.dll 0x771A0000 \Windows\System32\advapi32.dll 0x77160000 \Windows\System32\ws2_32.dll 0x77010000 \Windows\System32\nsi.dll 0x76F30000 \Windows\System32\kernel32.dll 0x76F10000 \Windows\System32\sechost.dll 0x76E60000 \Windows\System32\msvcrt.dll 0x76DE0000 \Windows\System32\comdlg32.dll 0x76D50000 \Windows\System32\oleaut32.dll 0x76BB0000 \Windows\System32\setupapi.dll 0x76A70000 \Windows\System32\urlmon.dll 0x76A60000 \Windows\System32\psapi.dll 0x76990000 \Windows\System32\msctf.dll 0x768F0000 \Windows\System32\usp10.dll 0x768E0000 \Windows\System32\normaliz.dll 0x76830000 \Windows\System32\rpcrt4.dll 0x767D0000 \Windows\System32\shlwapi.dll 0x76780000 \Windows\System32\gdi32.dll 0x75B30000 \Windows\System32\shell32.dll 0x75A60000 \Windows\System32\user32.dll 0x75A30000 \Windows\System32\imagehlp.dll 0x758D0000 \Windows\System32\ole32.dll 0x758B0000 \Windows\System32\imm32.dll 0x75850000 \Windows\System32\difxapi.dll 0x75750000 \Windows\System32\wininet.dll 0x75700000 \Windows\System32\Wldap32.dll 0x75500000 \Windows\System32\iertutil.dll 0x75470000 \Windows\System32\clbcatq.dll 0x75420000 \Windows\System32\KernelBase.dll 0x753F0000 \Windows\System32\cfgmgr32.dll 0x75360000 \Windows\System32\comctl32.dll 0x75340000 \Windows\System32\devobj.dll 0x75220000 \Windows\System32\crypt32.dll 0x751F0000 \Windows\System32\wintrust.dll 0x751E0000 \Windows\System32\msasn1.dll Processes (total 68): 0 System Idle Process 4 SYSTEM 276 C:\Windows\System32\smss.exe 376 csrss.exe 444 csrss.exe 452 C:\Windows\System32\wininit.exe 512 C:\Windows\System32\services.exe 520 C:\Windows\System32\lsass.exe 532 C:\Windows\System32\lsm.exe 628 C:\Windows\System32\svchost.exe 692 C:\Windows\System32\nvvsvc.exe 732 C:\Windows\System32\svchost.exe 784 C:\Windows\System32\winlogon.exe 836 C:\Windows\System32\svchost.exe 892 C:\Windows\System32\svchost.exe 940 C:\Windows\System32\svchost.exe 988 C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\stacsv.exe 1160 C:\Windows\System32\svchost.exe 1256 C:\Windows\System32\nvvsvc.exe 1332 C:\Windows\System32\svchost.exe 1428 C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe 1436 C:\Windows\System32\wlanext.exe 1444 C:\Windows\System32\conhost.exe 1708 C:\Windows\System32\spoolsv.exe 1740 C:\Windows\System32\svchost.exe 1812 C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\AEstSrv.exe 1856 C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe 1880 C:\Windows\System32\ChgService.exe 1932 C:\Program Files\Symantec AntiVirus\DefWatch.exe 1984 C:\Windows\System32\dgdersvc.exe 2024 C:\Windows\System32\FsUsbExService.Exe 296 C:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe 324 C:\Program Files\Common Files\LightScribe\LSSrvc.exe 500 C:\Program Files\CyberLink\Shared files\RichVideo.exe 584 C:\Program Files\Microsoft\BingBar\SeaPort.EXE 1224 C:\Windows\System32\svchost.exe 1548 C:\Program Files\Symantec AntiVirus\Rtvscan.exe 1896 C:\Windows\System32\taskhost.exe 2092 C:\Windows\System32\dwm.exe 2188 C:\Windows\explorer.exe 2272 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE 2364 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE 2692 WmiPrvSE.exe 2756 C:\Program Files\Apoint2K\Apoint.exe 2764 C:\Program Files\NetWorx\networx.exe 2776 C:\Program Files\Common Files\Symantec Shared\ccApp.exe 2784 C:\Program Files\Symantec AntiVirus\VPTray.exe 2792 C:\Program Files\IDT\WDM\sttray.exe 2824 C:\Program Files\Common Files\Java\Java Update\jusched.exe 2860 C:\Windows\System32\svchost.exe 3024 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe 3060 C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe 3144 C:\Program Files\Apoint2K\ApMsgFwd.exe 3328 C:\Program Files\Apoint2K\ApntEx.exe 3372 C:\Windows\System32\conhost.exe 3476 C:\Windows\System32\svchost.exe 3484 C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe 3600 C:\Windows\System32\SearchIndexer.exe 3728 C:\Program Files\MMX300G 3G USB Manager\USB Modem.exe 3416 C:\Windows\System32\svchost.exe 924 C:\Program Files\Mozilla Firefox\firefox.exe 3172 C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe 2372 C:\Program Files\Windows Media Player\wmpnetwk.exe 4228 C:\Program Files\Mozilla Firefox\plugin-container.exe 5532 C:\Windows\explorer.exe 5920 C:\Users\Vijay\Desktop\MBRCheck.exe 5928 C:\Windows\System32\conhost.exe 5948 C:\Windows\System32\dllhost.exe \\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`0c800000 (NTFS) \\.\D: –> \\.\PhysicalDrive0 at offset 0x00000023`d4a00000 (NTFS) \\.\E: –> \\.\PhysicalDrive0 at offset 0x00000047`56400000 (NTFS) PhysicalDrive0 Model Number: HitachiHTS723232L9A360, Rev: FC4OC60D Size Device Name MBR Status ——————————————– 298 GB \\.\PhysicalDrive0 Unknown MBR code SHA1: EA1E786EF81CB35F81056D31F0677A8AC1CB91D2 Found non-standard or infected MBR. Enter 'Y' and hit ENTER for more options, or 'N' to exit: Done!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI