What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hidden Desktop

21 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hi amitemurray,

Which antivirus program did you install?

Download aswMBR.exe to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan
[external image: Posted Image]

On completion of the scan click save log, save it to your desktop and post in your next reply
[external image: Posted Image]

There shall also be a file on your desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) folder. Please attach that zipped file in your next reply.
Post #17
Hi oldman960, I have PC Tools AntiVirus Free installed. The aswMBR had some red on its on-screen report. Here is aswMBR.txt: aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software Run date: 2011-09-07 20:03:11 —————————– 20:03:11.944 OS Version: Windows 5.1.2600 Service Pack 3 20:03:11.944 Number of processors: 1 586 0xD08 20:03:11.944 ComputerName: DCCB7L91 UserName: 20:03:15.116 Initialize success 20:03:46.678 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 20:03:46.678 Disk 0 Vendor: Hitachi_HTS541040G9AT00 MB2OA61A Size: 38154MB BusType: 3 20:03:48.725 Disk 0 MBR read successfully 20:03:48.725 Disk 0 MBR scan 20:03:48.725 Disk 0 TDL4@MBR code has been found 20:03:48.725 Disk 0 MBR hidden 20:03:48.725 Disk 0 MBR [TDL4] **ROOTKIT** 20:03:48.725 Disk 0 trace - called modules: 20:03:48.725 ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8298df16]<< 20:03:48.725 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x82939ab8] 20:03:48.725 3 CLASSPNP.SYS[f84e4fd7] -> nt!IofCallDriver -> [0x82985920] 20:03:48.725 \Driver\PCTCore[0x82959a08] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> 0x8298df16 20:03:48.725 Scan finished successfully 20:04:03.194 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Murray Quin\Desktop\MBR.dat" 20:04:03.194 The log file has been saved successfully to "C:\Documents and Settings\Murray Quin\Desktop\aswMBR.txt"

Attachments:

Post #18
Hi amitemurray,

Re-Run aswMBR

Click Scan

On completion of the scan

Click the FixButton



[external image: Posted Image]

Reboot your computer when prompted.

Save the log as before and post in your next reply.
Post #19
Hi oldman960, Here is the new log. I also attached the new MBR.dat. aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software Run date: 2011-09-07 20:03:11 —————————– 20:03:11.944 OS Version: Windows 5.1.2600 Service Pack 3 20:03:11.944 Number of processors: 1 586 0xD08 20:03:11.944 ComputerName: DCCB7L91 UserName: 20:03:15.116 Initialize success 20:03:46.678 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 20:03:46.678 Disk 0 Vendor: Hitachi_HTS541040G9AT00 MB2OA61A Size: 38154MB BusType: 3 20:03:48.725 Disk 0 MBR read successfully 20:03:48.725 Disk 0 MBR scan 20:03:48.725 Disk 0 TDL4@MBR code has been found 20:03:48.725 Disk 0 MBR hidden 20:03:48.725 Disk 0 MBR [TDL4] **ROOTKIT** 20:03:48.725 Disk 0 trace - called modules: 20:03:48.725 ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8298df16]<< 20:03:48.725 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x82939ab8] 20:03:48.725 3 CLASSPNP.SYS[f84e4fd7] -> nt!IofCallDriver -> [0x82985920] 20:03:48.725 \Driver\PCTCore[0x82959a08] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> 0x8298df16 20:03:48.725 Scan finished successfully 20:04:03.194 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Murray Quin\Desktop\MBR.dat" 20:04:03.194 The log file has been saved successfully to "C:\Documents and Settings\Murray Quin\Desktop\aswMBR.txt" aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software Run date: 2011-09-08 05:59:51 —————————– 05:59:51.218 OS Version: Windows 5.1.2600 Service Pack 3 05:59:51.218 Number of processors: 1 586 0xD08 05:59:51.218 ComputerName: DCCB7L91 UserName: 05:59:51.828 Initialize success 06:00:13.125 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 06:00:13.125 Disk 0 Vendor: Hitachi_HTS541040G9AT00 MB2OA61A Size: 38154MB BusType: 3 06:00:15.156 Disk 0 MBR read successfully 06:00:15.156 Disk 0 MBR scan 06:00:15.156 Disk 0 TDL4@MBR code has been found 06:00:15.156 Disk 0 MBR hidden 06:00:15.156 Disk 0 MBR [TDL4] **ROOTKIT** 06:00:15.156 Disk 0 trace - called modules: 06:00:15.156 ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8298df16]<< 06:00:15.156 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x82939ab8] 06:00:15.156 3 CLASSPNP.SYS[f84e4fd7] -> nt!IofCallDriver -> [0x82985920] 06:00:15.156 \Driver\PCTCore[0x82959a08] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> 0x8298df16 06:00:15.156 Scan finished successfully 06:00:32.187 Disk 0 MBR read successfully 06:00:32.531 Disk 0 TDL4@MBR code has been found 06:00:32.531 Disk 0 fixing MBR … 06:00:42.546 Disk 0 MBR restored successfully 06:00:42.546 Verifying disinfection 06:00:54.609 Infection fixed successfully - please reboot ASAP 06:01:10.031 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Murray Quin\Desktop\MBR.dat" 06:01:10.062 The log file has been saved successfully to "C:\Documents and Settings\Murray Quin\Desktop\aswMBR.txt"

Attachments:

Post #20
Here are the results of a scan after re-booting: aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software Run date: 2011-09-08 06:11:58 —————————– 06:11:58.609 OS Version: Windows 5.1.2600 Service Pack 3 06:11:58.609 Number of processors: 1 586 0xD08 06:11:58.609 ComputerName: DCCB7L91 UserName: 06:11:59.578 Initialize success 06:12:07.062 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 06:12:07.062 Disk 0 Vendor: Hitachi_HTS541040G9AT00 MB2OA61A Size: 38154MB BusType: 3 06:12:09.109 Disk 0 MBR read successfully 06:12:09.109 Disk 0 MBR scan 06:12:09.109 Disk 0 unknown MBR code 06:12:09.109 Disk 0 scanning sectors +78124095 06:12:09.265 Disk 0 scanning C:\WINDOWS\system32\drivers 06:12:26.171 Service scanning 06:12:27.968 Modules scanning 06:12:47.812 Disk 0 trace - called modules: 06:12:47.828 ntkrnlpa.exe CLASSPNP.SYS disk.sys PCTCore.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS 06:12:47.828 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x82947ab8] 06:12:47.828 3 CLASSPNP.SYS[f84e4fd7] -> nt!IofCallDriver -> [0x82966920] 06:12:47.828 5 PCTCore.sys[f82856a9] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x8295a940] 06:12:48.156 Scan finished successfully 06:13:20.578 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Murray Quin\Desktop\MBR.dat" 06:13:20.906 The log file has been saved successfully to "C:\Documents and Settings\Murray Quin\Desktop\aswMBR.txt"
Post #21 last edited
Hi amitemurray,

That looks better. Let's see if it brought some freinds.

Please read through these instructions to familarize yourself with what to expect when this tool runs

Please locate the copy of combofix you have. Right click it and select delete.

Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.


Please post the combofix log.

How's the computer?

Thanks
Post #22
Hi oldman960,
Computer seems to be running okay. Here is the ComboFix log:

ComboFix 11-09-08.03 - Murray Quin 09/08/2011 20:50:59.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.304 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: PC Tools AntiVirus Free *Disabled/Updated* {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator\Local Settings\Application Data\ApplicationHistory
c:\documents and settings\Administrator\Local Settings\Application Data\ApplicationHistory\htmlEdit.exe.27a5b164.ini
c:\documents and settings\Administrator\Local Settings\Application Data\ApplicationHistory\MCInstaller.exe.b623dd6.ini
c:\documents and settings\Administrator\Local Settings\Application Data\ApplicationHistory\ngen.exe.2c05686e.ini
c:\documents and settings\Administrator\Local Settings\Application Data\ApplicationHistory\OOBEINIT.exe.1824c240.ini
c:\documents and settings\Administrator\Local Settings\Application Data\ApplicationHistory\RegAsm.exe.ca35bcc8.ini
c:\documents and settings\Administrator\Local Settings\Application Data\ApplicationHistory\RegisterMCEApp.exe.19d07aaf.ini
c:\documents and settings\Administrator\Local Settings\Application Data\ApplicationHistory\SL4F.tmp.b1f8031b.ini
c:\documents and settings\Administrator\Local Settings\Application Data\ApplicationHistory\SLF5.tmp.664d238.ini
c:\documents and settings\drivers\System
c:\documents and settings\drivers\System\INFCACHE.1
c:\documents and settings\drivers\System\onboard\915.cat
c:\documents and settings\drivers\System\onboard\915.inf
c:\documents and settings\drivers\System\onboard\915.PNF
c:\documents and settings\drivers\System\onboard\915M.cat
c:\documents and settings\drivers\System\onboard\915M.inf
c:\documents and settings\drivers\System\onboard\915M.PNF
c:\documents and settings\drivers\System\onboard\ich6core.cat
c:\documents and settings\drivers\System\onboard\ich6core.inf
c:\documents and settings\drivers\System\onboard\ich6core.PNF
c:\documents and settings\drivers\System\onboard\ich6ide.cat
c:\documents and settings\drivers\System\onboard\ich6ide.inf
c:\documents and settings\drivers\System\onboard\ich6ide.PNF
c:\documents and settings\drivers\System\onboard\ich6usb.cat
c:\documents and settings\drivers\System\onboard\ich6usb.inf
c:\documents and settings\drivers\System\onboard\ich6usb.PNF
c:\documents and settings\drivers\System\onboard\INFAnswr.txt
c:\documents and settings\drivers\System\onboard\INFCACHE.1
c:\documents and settings\Margaret Quin\Local Settings\Application Data\ApplicationHistory
c:\documents and settings\Margaret Quin\Local Settings\Application Data\ApplicationHistory\ehshell.exe.a87fcbb.ini
c:\documents and settings\Margaret Quin\Local Settings\Application Data\ApplicationHistory\htmlEdit.exe.27a5b164.ini
c:\documents and settings\Margaret Quin\Local Settings\Application Data\ApplicationHistory\MCInstaller.exe.b623dd6.ini
c:\documents and settings\Margaret Quin\Local Settings\Application Data\ApplicationHistory\ngen.exe.2c05686e.ini
c:\documents and settings\Margaret Quin\Local Settings\Application Data\ApplicationHistory\OOBEINIT.exe.1824c240.ini
c:\documents and settings\Margaret Quin\Local Settings\Application Data\ApplicationHistory\RegAsm.exe.ca35bcc8.ini
c:\documents and settings\Margaret Quin\Local Settings\Application Data\ApplicationHistory\RegisterMCEApp.exe.19d07aaf.ini
c:\documents and settings\Margaret Quin\Local Settings\Application Data\ApplicationHistory\SL4F.tmp.b1f8031b.ini
c:\documents and settings\Margaret Quin\Local Settings\Application Data\ApplicationHistory\SLF5.tmp.664d238.ini
c:\documents and settings\Margaret Quin\Local Settings\Application Data\ApplicationHistory\TransferAgent.exe.91f03f4d.ini.inuse
c:\documents and settings\Murray Quin\Local Settings\Application Data\ApplicationHistory
c:\documents and settings\Murray Quin\Local Settings\Application Data\ApplicationHistory\DMX.exe.d0259252.ini
c:\documents and settings\Murray Quin\Local Settings\Application Data\ApplicationHistory\ehExtHost.exe.fa7bea74.ini.inuse
c:\documents and settings\Murray Quin\Local Settings\Application Data\ApplicationHistory\ehshell.exe.a87fcbb.ini
c:\documents and settings\Murray Quin\Local Settings\Application Data\ApplicationHistory\FolderSizeCalc.exe.bd79202f.ini.inuse
c:\documents and settings\Murray Quin\Local Settings\Application Data\ApplicationHistory\htmlEdit.exe.27a5b164.ini
c:\documents and settings\Murray Quin\Local Settings\Application Data\ApplicationHistory\InstallFilters.exe.141eff7e.ini
c:\documents and settings\Murray Quin\Local Settings\Application Data\ApplicationHistory\MCInstaller.exe.b623dd6.ini
c:\documents and settings\Murray Quin\Local Settings\Application Data\ApplicationHistory\ngen.exe.2c05686e.ini
c:\documents and settings\Murray Quin\Local Settings\Application Data\ApplicationHistory\OOBEINIT.exe.1824c240.ini
c:\documents and settings\Murray Quin\Local Settings\Application Data\ApplicationHistory\PhotoVidShow.exe.a7837cba.ini
c:\documents and settings\Murray Quin\Local Settings\Application Data\ApplicationHistory\RegAsm.exe.ca35bcc8.ini
c:\documents and settings\Murray Quin\Local Settings\Application Data\ApplicationHistory\RegisterMCEApp.exe.19d07aaf.ini
c:\documents and settings\Murray Quin\Local Settings\Application Data\ApplicationHistory\SL4F.tmp.b1f8031b.ini
c:\documents and settings\Murray Quin\Local Settings\Application Data\ApplicationHistory\SLF5.tmp.664d238.ini
c:\documents and settings\Murray Quin\Local Settings\Application Data\ApplicationHistory\ToDo.exe.26b2eea0.ini
c:\documents and settings\Murray Quin\WINDOWS
c:\documents and settings\Patrick Quin\Local Settings\Application Data\ApplicationHistory
c:\documents and settings\Patrick Quin\Local Settings\Application Data\ApplicationHistory\DMX.exe.d0259252.ini
c:\documents and settings\Patrick Quin\Local Settings\Application Data\ApplicationHistory\ehExtHost.exe.fa7bea74.ini.inuse
c:\documents and settings\Patrick Quin\Local Settings\Application Data\ApplicationHistory\ehshell.exe.a87fcbb.ini.inuse
c:\documents and settings\Patrick Quin\Local Settings\Application Data\ApplicationHistory\htmlEdit.exe.27a5b164.ini
c:\documents and settings\Patrick Quin\Local Settings\Application Data\ApplicationHistory\MCInstaller.exe.b623dd6.ini
c:\documents and settings\Patrick Quin\Local Settings\Application Data\ApplicationHistory\ngen.exe.2c05686e.ini
c:\documents and settings\Patrick Quin\Local Settings\Application Data\ApplicationHistory\OOBEINIT.exe.1824c240.ini
c:\documents and settings\Patrick Quin\Local Settings\Application Data\ApplicationHistory\RegAsm.exe.ca35bcc8.ini
c:\documents and settings\Patrick Quin\Local Settings\Application Data\ApplicationHistory\RegisterMCEApp.exe.19d07aaf.ini
c:\documents and settings\Patrick Quin\Local Settings\Application Data\ApplicationHistory\RegisterMCEApp.exe.19d07aaf.ini.inuse
c:\documents and settings\Patrick Quin\Local Settings\Application Data\ApplicationHistory\SL4F.tmp.b1f8031b.ini
c:\documents and settings\Patrick Quin\Local Settings\Application Data\ApplicationHistory\SLF5.tmp.664d238.ini
c:\documents and settings\Patrick Quin\Local Settings\Application Data\ApplicationHistory\TransferAgent.exe.91f03f4d.ini
c:\documents and settings\Patrick Quin\WINDOWS
c:\windows\system32\config\systemprofile\Local Settings\Application Data\ApplicationHistory
c:\windows\system32\config\systemprofile\Local Settings\Application Data\ApplicationHistory\htmlEdit.exe.27a5b164.ini
c:\windows\system32\config\systemprofile\Local Settings\Application Data\ApplicationHistory\MCInstaller.exe.b623dd6.ini
c:\windows\system32\config\systemprofile\Local Settings\Application Data\ApplicationHistory\ngen.exe.2c05686e.ini
c:\windows\system32\config\systemprofile\Local Settings\Application Data\ApplicationHistory\OOBEINIT.exe.1824c240.ini
c:\windows\system32\config\systemprofile\Local Settings\Application Data\ApplicationHistory\RegAsm.exe.ca35bcc8.ini
c:\windows\system32\config\systemprofile\Local Settings\Application Data\ApplicationHistory\RegisterMCEApp.exe.19d07aaf.ini
c:\windows\system32\config\systemprofile\Local Settings\Application Data\ApplicationHistory\SL4F.tmp.b1f8031b.ini
c:\windows\system32\config\systemprofile\Local Settings\Application Data\ApplicationHistory\SLF5.tmp.664d238.ini
.
.
((((((((((((((((((((((((( Files Created from 2011-08-09 to 2011-09-09 )))))))))))))))))))))))))))))))
.
.
2011-09-07 01:31 . 2011-09-07 01:31 ——– d—–w- C:\_OTL
2011-09-03 17:29 . 2011-07-01 20:36 767952 —-a-w- c:\windows\BDTSupport.dll
2011-09-03 17:29 . 2011-07-01 20:36 149456 —-a-w- c:\windows\SGDetectionTool.dll
2011-09-03 17:29 . 2011-07-01 20:36 2029520 —-a-w- c:\windows\PCTBDCore.dll
2011-09-03 17:29 . 2011-07-01 20:36 1533904 —-a-w- c:\windows\PCTBDRes.dll
2011-09-03 17:24 . 2010-07-16 19:59 656320 —-a-w- c:\windows\system32\drivers\pctEFA.sys
2011-09-03 17:24 . 2010-07-16 19:59 338880 —-a-w- c:\windows\system32\drivers\pctDS.sys
2011-09-03 17:24 . 2011-07-11 14:05 253096 —-a-w- c:\windows\system32\drivers\pctgntdi.sys
2011-09-03 17:23 . 2011-07-11 17:06 160576 —-a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2011-09-03 17:23 . 2011-07-11 17:02 263888 —-a-w- c:\windows\system32\drivers\PCTCore.sys
2011-09-03 17:23 . 2011-03-10 14:08 233976 —-a-w- c:\windows\system32\drivers\PCTSD.sys
2011-09-03 17:23 . 2011-07-11 14:07 70664 —-a-w- c:\windows\system32\drivers\pctplsg.sys
2011-09-03 17:23 . 2011-09-09 01:33 ——– d—–w- c:\program files\PC Tools Security
2011-09-03 17:23 . 2011-09-03 23:27 ——– d—–w- c:\program files\Common Files\PC Tools
2011-09-01 22:16 . 2011-09-01 22:16 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-07 00:52 . 2010-11-07 01:59 41272 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-07 00:52 . 2010-11-07 01:59 22712 —-a-w- c:\windows\system32\drivers\mbam(2).sys
2011-06-28 11:57 . 2011-06-28 11:57 404640 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2006-11-23 03:04 . 2005-06-19 00:47 231258 —-a-w- c:\program files\pikachu.exe
2011-09-07 10:44 . 2011-05-04 11:04 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2005-10-07 176128]
"PCTools FGuard"="c:\program files\PC Tools Security\BDT\FGuard.exe" [2011-07-01 247760]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
c:\documents and settings\Murray Quin\Start Menu\Programs\Startup\
Moo0 Magnifier 1.10.lnk - c:\program files\Moo0\Magnifier 1.10\Magnifier.exe [2011-2-23 1556480]
Shortcut to WinDates.exe.lnk - c:\program files\WinDates\WinDates.exe [2007-6-29 1589248]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
backup=c:\windows\pss\America Online 9.0 Tray Icon.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-21 18:37 932288 —-a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-09-24 09:15 40368 —-a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
2005-08-06 03:05 344064 —-a-w- c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
2006-11-01 17:48 1392640 —-a-w- c:\windows\system32\WLTRAY.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 —-a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
2005-09-08 11:20 122940 —-a-w- c:\windows\system32\DLA\DLACTRLW.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 —-a-w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 23:38 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 16:43 248040 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\rundisabled]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" -start
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"Dell Wireless Manager UI"=c:\windows\system32\WLTRAY
"SunJavaUpdateSched"=c:\program files\Java\jre1.5.0_03\bin\jusched.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
.
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [9/3/2011 12:23 PM 263888]
R0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS.sys [9/3/2011 12:24 PM 338880]
R0 pctEFA;PC Tools Extended File Attributes;c:\windows\system32\drivers\pctEFA.sys [9/3/2011 12:24 PM 656320]
R1 PCTSD;PC Tools Spyware Doctor Driver;c:\windows\system32\drivers\PCTSD.sys [9/3/2011 12:23 PM 233976]
R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\PC Tools Security\BDT\BDTUpdateService.exe [9/3/2011 12:29 PM 337872]
S2 gupdate1c999ed12312ca2;Google Update Service (gupdate1c999ed12312ca2);c:\program files\Google\Update\GoogleUpdate.exe [2/28/2009 4:39 PM 133104]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2/28/2009 4:39 PM 133104]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\PC Tools Security\pctsAuxs.exe [9/3/2011 12:23 PM 371472]
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]
.
2011-09-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-28 21:39]
.
2011-09-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-28 21:39]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
Trusted Zone: motive.com\pattta.att
Trusted Zone: motive.com\patttbc.att
TCP: DhcpNameServer = 192.168.2.1
DPF: {0FAA926E-2AF4-11D3-9995-00A0CC3A27A9} - hxxp://tcapps.selu.edu/timecentre/Common/pvcombo.cab
DPF: {7823A620-9DD9-11CF-A662-00AA00C066D2} - hxxp://tcapps.selu.edu/timecentre/Common/iemenu.cab
FF - ProfilePath - c:\documents and settings\Murray Quin\Application Data\Mozilla\Firefox\Profiles\xjnvebmq.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-09-08 21:04
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(884)
c:\windows\system32\Ati2evxx.dll
c:\windows\System32\BCMLogon.dll
.
- - - - - - - > 'lsass.exe'(940)
c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
.
Completion time: 2011-09-08 21:09:17
ComboFix-quarantined-files.txt 2011-09-09 02:09
ComboFix2.txt 2011-09-02 00:08
.
Pre-Run: 12,241,248,256 bytes free
Post-Run: 12,231,983,104 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect
.
- - End Of File - - 6F3630A3CDEEA6753630364E21E36121
Post #24
Hi oldman960, Unfortunately, MBAM will not start. I get this message: "An error has occurred. Please report this error to our support team. PROGRAM_ERROR_LOAD_DATABASE (0, 13, CreateSDK)". Also, I have not yet run the online scanner ESET. Thanks.
Post #25
Hi amitemurray,

  • First uninstall Malwarebytes' Anti-Malware using Add/Remove Programs in the Control Panel.
  • Restart the computer.
  • Download the mbam-clean.exe (MBAM Cleanup Utility) and save it to your Desktop.
  • Double-click on mbamclean.exe to start the utility.
  • When the cleanup routine has finished, it will ask to reboot your computer. Please allow the reboot.
  • After the computer restarts, download and install the latest version of Malwarebytes' Anti-Malware from here.
Post #26
Hi oldman960, Your instructions got the MBAM working again. Here is the Quick Scan log. There were no results to view. Malwarebytes' Anti-Malware 1.51.1.1800 www.malwarebytes.org Database version: 7686 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.11 9/9/2011 4:02:01 PM mbam-log-2011-09-09 (16-02-01).txt Scan type: Quick scan Objects scanned: 222734 Time elapsed: 6 minute(s), 43 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)
Post #28
Hi oldman960, Here is the ESET log. ESETSmartInstaller@High as CAB hook log: OnlineScanner.ocx - registred OK # version=7 # iexplore.exe=7.00.6000.17098 (vista_gdr.110420-1745) # OnlineScanner.ocx=1.0.0.6528 # api_version=3.0.2 # EOSSerial=a13efd186af9f64498f034dd050fd3fb # end=finished # remove_checked=false # archives_checked=false # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-09-10 10:22:06 # local_time=2011-09-10 05:22:06 (-0600, Central Daylight Time) # country="United States" # lang=9 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=512 16777215 100 0 75398441 75398441 0 0 # compatibility_mode=770 16774142 0 100 688801 91477774 0 0 # compatibility_mode=1024 16777215 100 0 28777217 28777217 0 0 # compatibility_mode=2560 16777175 100 0 0 0 0 0 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # scanned=96969 # found=0 # cleaned=0 # scan_time=3824
Post #29 last edited
Hi again oldman960, Whenever I disable PC Tools AntiVirus Free to run one of the scans, then re-enable it, it always finds threats and infections. Are they genuine malware? Thanks.
Post #30
Hi amitemurray, The Eset scan logs good. Does PC Tools AntiVirus Free peovide a log that you can post? With out knowing what it is finding and where I can not really say much about it.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI