What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

tidserv activity 2 [Solved]

17 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I saw a response from one of your techs and followed the instructions to remove this and i think it worked. I attached my output files from tdsskiller and combofix. Thank you in advance. I tried so many things to rid myself of this virus or rootkit?? thank you, thank you, thank you.

Attachments:

Post #2
Hi and Welcome!! :) My name is Jeff. I would be more than happy to take a look at your malware results logs and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:
  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • Please subscribe to this topic, if you haven't already. You can subscribe by clicking the Watch Topic button to the right of your topic title and then choosing the notification method ( Recommended: Inmediate Notification)
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

IMPORTANT NOTE : Please do not delete anything unless instructed to.
DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.
Doing so could make your system inoperable and could require a full reinstall of your OS losing all your programs and data.

Vista and Windows 7 users:
These tools MUST be run from the executable (.exe) every time you run them
with Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.
———-
Post #3
Hi,

I see that you already ran ComboFix. I should tell you that ComboFix is not a tool to be used without a trained helper to work with you. It can render your computer inoperable if used incorrectly. I see where you posted the logs created by ComboFix but not the log that you said you ran from TDSSKiller. If you have that please post it.
———

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt

Attach.txt
———-

GMER

Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries.
———-

In your next reply please post both of the logs created by DDS and the log created by GMER. Also if you have the log that was created by TDSSKiller post that as well. :)
Post #5
Hi tymwanr,

Please download aswMBR to your desktop.

  • Right click and Run as Administrator the aswMBR icon to run it.
  • Click the Scan button to start scan.
  • When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

[external image: Posted Image]
Click the image to enlarge it
———-

Please download MBRCheck.exe to your desktop.
  • Be sure to disable your security programs
  • Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
  • A window will open on your desktop
  • if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
  • If nothing unusual is found just press Enter
  • A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
  • Please post the contents of that file.

In your next reply please post the logs created by aswMBR and MBRCheck. :)
Post #7
Hi tymwanr,

Please read through these instructions to familarize yourself with what to expect when this tool runs

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
———-
Post #9
Hi tymwanr,

Please download TDSSKiller.zip
  • Extract it to your desktop
  • Double click TDSSKiller.exe
  • Press Start Scan
    • Only if Malicious objects are found then ensure Cure is selected
    • Then click Continue > Reboot now
  • Copy and paste the log in your next reply
    • A copy of the log will be saved automatically to the root of the drive (typically C:\)
———-
Post #11
Hi tymwanr,

In your future replies could you please copy/paste the logs that are created into your replies instead of attaching them? It helps me to read them more easily. Thanks. :)
———-

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
    DDS::
uInternet Settings,ProxyOverride = ;*.local
uURLSearchHooks: H - No File
TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File

File::
c:\windows\system32\drivers\eohrwvos.sys
c:\windows\system32\drivers\nlotr.sys
c:\docume~1\user\locals~1\temp\fx81n6mf.tmp\tidhook.sys

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"=-
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Updater Service for StartNow Toolbar"=-

Driver::
tgxcsxoy
vprfb
TIDHOOK
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
———-
Post #12
ComboFix 11-12-29.04 - User 12/29/2011 15:42:45.3.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3323.2265 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\User\Desktop\CFScript.txt
AV: Norton Security Suite *Disabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Security Suite *Enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.
FILE ::
"c:\docume~1\user\locals~1\temp\fx81n6mf.tmp\tidhook.sys"
"c:\windows\system32\drivers\eohrwvos.sys"
"c:\windows\system32\drivers\nlotr.sys"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\User\Application Data\vso_ts_preview.xml
c:\windows\system32\msvcsv60.dll
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
——-\Service_tgxcsxoy
——-\Service_TIDHOOK
——-\Service_vprfb
.
.
((((((((((((((((((((((((( Files Created from 2011-11-28 to 2011-12-29 )))))))))))))))))))))))))))))))
.
.
2011-12-27 20:29 . 2011-12-27 20:49 ——– dc—-w- c:\program files\ATX2011
2011-12-27 20:24 . 2011-12-27 20:24 ——– dc—-w- c:\program files\Microsoft.NET
2011-12-27 20:03 . 2011-12-27 20:03 ——– dc—-w- c:\documents and settings\User\Application Data\MozillaControl
2011-12-27 20:01 . 2011-12-27 20:01 ——– dc—-w- c:\documents and settings\All Users\Application Data\Wolters Kluwer
2011-12-27 19:59 . 2011-12-27 20:47 ——– dc—-w- c:\program files\ATX2010
2011-12-27 19:22 . 2011-12-17 17:15 91720 -c–a-w- c:\program files\Mozilla Firefox\IdVaultCore.XmlSerializers.dll
2011-12-27 19:22 . 2011-12-17 17:15 1642056 -c–a-w- c:\program files\Mozilla Firefox\IdVaultCore.dll
2011-12-27 19:22 . 2011-12-17 17:15 133192 -c–a-w- c:\program files\Mozilla Firefox\CommonDotNET.dll
2011-12-27 19:22 . 2011-12-17 17:13 8007680 -c–a-w- c:\program files\Mozilla Firefox\Microsoft.mshtml.dll
2011-12-27 19:21 . 2011-07-05 15:24 25232 -c—-w- c:\windows\system32\drivers\gidv2.sys
2011-12-27 19:21 . 2011-12-27 19:21 ——– dc—-w- c:\documents and settings\All Users\GID
2011-12-27 19:21 . 2011-12-27 19:21 ——– dc—-w- c:\program files\SFT
2011-12-27 16:12 . 2008-04-13 19:18 52480 -c–a-w- c:\windows\system32\drivers\i8042prt.sys
2011-12-27 16:12 . 2008-04-13 19:18 52480 -c–a-w- c:\windows\system32\dllcache\i8042prt.sys
2011-12-27 01:47 . 2010-07-16 19:59 656320 -c–a-w- c:\windows\system32\drivers\pctEFA.sys
2011-12-27 01:47 . 2010-07-16 19:59 338880 -c–a-w- c:\windows\system32\drivers\pctDS.sys
2011-12-27 01:47 . 2011-01-17 14:10 251560 -c–a-w- c:\windows\system32\drivers\pctgntdi.sys
2011-12-27 01:47 . 2010-12-10 21:57 160448 -c–a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2011-12-27 01:47 . 2010-12-10 18:24 239168 -c–a-w- c:\windows\system32\drivers\PCTCore.sys
2011-12-27 01:47 . 2010-12-16 13:46 70536 -c–a-w- c:\windows\system32\drivers\pctplsg.sys
2011-12-27 01:47 . 2011-12-27 02:01 ——– dc—-w- c:\program files\Common Files\PC Tools
2011-12-27 01:47 . 2011-12-27 01:47 ——– dc—-w- c:\documents and settings\User\Application Data\PC Tools
2011-12-27 01:46 . 2011-12-27 01:47 ——– dc—-w- c:\documents and settings\All Users\Application Data\PC Tools
2011-12-26 22:33 . 2011-12-26 23:00 ——– dc—-w- c:\documents and settings\User\Local Settings\Application Data\NPE
2011-12-24 19:46 . 2011-12-24 19:46 ——– dc—-w- c:\windows\system32\drivers\NBRTWizard
2011-12-24 19:46 . 2011-12-24 19:46 ——– dc—-w- c:\program files\Norton Bootable Recovery Tool Wizard
2011-12-24 17:34 . 2011-12-24 17:34 ——– dc—-w- c:\documents and settings\User\Application Data\Tific
2011-12-24 17:25 . 2011-03-31 03:04 44024 -c–a-r- c:\windows\system32\drivers\SymIM.sys
2011-12-24 17:19 . 2011-12-24 17:23 60872 -c–a-w- c:\windows\system32\S32EVNT1.DLL
2011-12-24 17:19 . 2011-12-24 17:23 126584 -c–a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2011-12-24 17:19 . 2011-12-24 17:41 ——– dc—-w- c:\windows\system32\drivers\N360
2011-12-24 17:19 . 2011-12-24 17:19 ——– dc—-w- c:\program files\Norton Security Suite
2011-12-24 17:19 . 2011-12-24 17:19 ——– dc—-w- c:\program files\Windows Sidebar
2011-12-24 16:51 . 2011-12-24 19:46 ——– dc—-w- c:\program files\NortonInstaller
2011-12-24 16:31 . 2011-12-24 16:31 ——– dc—-w- c:\program files\comcasttb
2011-12-24 16:30 . 2011-12-28 13:11 ——– dc—-w- c:\documents and settings\User\Application Data\xfin_portal
2011-12-24 16:30 . 2011-12-24 16:31 ——– dc—-w- c:\program files\xfin_portal
2011-12-24 15:44 . 2011-12-24 15:44 ——– dc—-w- c:\documents and settings\All Users\Application Data\ErrorEND
2011-12-24 15:22 . 2008-04-14 10:42 10752 -c—-w- c:\windows\system32\smtpapi.dll
2011-12-24 15:22 . 2008-04-14 10:42 9728 -c—-w- c:\windows\system32\rwnh.dll
2011-12-24 15:22 . 2008-04-14 10:41 81920 -c—-w- c:\windows\system32\ieencode.dll
2011-12-24 15:22 . 2007-04-03 05:12 1327320 -c—-w- c:\program files\MSN\MSNCoreFiles\Install\msnsusii.exe
2011-12-24 15:22 . 2007-04-03 05:09 11053008 -c—-w- c:\program files\MSN\MSNCoreFiles\Install\MSN9Components\msncli.exe
2011-12-24 15:22 . 2007-04-03 05:04 884712 -c—-w- c:\program files\MSN\MSNCoreFiles\Install\MSN9Components\digcore.exe
2011-12-24 15:22 . 2008-04-14 10:40 966656 -c—-w- c:\program files\MSN\MSNCoreFiles\OOBE\obemetal.dll
2011-12-24 15:22 . 2008-04-14 10:40 86016 -c—-w- c:\program files\MSN\MSNCoreFiles\OOBE\obepopc.dll
2011-12-24 15:22 . 2008-04-14 10:40 229376 -c—-w- c:\program files\MSN\MSNCoreFiles\OOBE\obelog.dll
2011-12-24 15:22 . 2007-04-03 05:14 77824 -c—-w- c:\program files\MSN\MSNCoreFiles\OOBE\obemtllc.dll
2011-12-24 15:20 . 2006-12-29 05:31 19569 -c–a-w- c:\windows\000001_.tmp
2011-12-24 15:10 . 2011-12-24 15:10 ——– dc—-w- c:\windows\system32\CatRoot_bak
2011-12-24 01:33 . 2011-12-24 04:02 ——– dc—-w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2011-12-18 22:11 . 2011-12-18 22:11 ——– dc—-w- c:\documents and settings\User\Application Data\PCTools
2011-12-17 16:05 . 2011-12-17 16:06 ——– dc—-w- c:\documents and settings\Administrator.WORKSTATION\Local Settings\Application Data\Adobe
2011-12-17 15:45 . 2011-12-28 21:11 7144 -c–a-w- c:\windows\system32\PerfStringBackup.TMP
2011-12-17 15:40 . 2011-12-29 20:54 ——– dc—-w- c:\windows\system32\CatRoot2
2011-12-15 22:03 . 2011-12-15 22:03 770384 -c–a-w- c:\windows\system32\msvcr100.dll
2011-12-15 22:03 . 2011-12-15 22:03 421200 -c–a-w- c:\windows\system32\msvcp100.dll
2011-12-15 22:03 . 2011-12-15 22:03 138056 -c–a-w- c:\windows\system32\atl100.dll
2011-12-13 23:41 . 2011-12-13 23:41 ——– dc—-w- c:\documents and settings\User\Local Settings\Application Data\Threat Expert
2011-12-11 15:06 . 2011-12-13 23:21 ——– dc—-w- c:\program files\PC Tools Security
2011-12-11 15:06 . 2011-12-11 15:06 ——– dcsh–w- c:\documents and settings\Administrator.WORKSTATION\IETldCache
2011-12-02 22:33 . 2011-12-02 22:33 ——– dc—-w- c:\documents and settings\User\Application Data\MathWorks
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-27 15:29 . 2004-08-04 12:00 75264 —-a-w- c:\windows\system32\drivers\ipsec.sys
2011-12-13 00:50 . 2011-06-06 22:05 414368 -c–a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-12-10 20:24 . 2010-12-19 00:05 20464 -c–a-w- c:\windows\system32\drivers\mbam.sys
2011-11-23 13:25 . 2004-08-04 12:00 1859584 -c–a-w- c:\windows\system32\win32k.sys
2011-11-04 19:20 . 2004-08-04 12:00 916992 -c–a-w- c:\windows\system32\wininet.dll
2011-11-04 19:20 . 2004-08-04 12:00 43520 -c–a-w- c:\windows\system32\licmgr10.dll
2011-11-04 19:20 . 2004-08-04 12:00 1469440 -c–a-w- c:\windows\system32\inetcpl.cpl
2011-11-04 11:23 . 2004-08-04 12:00 385024 -c–a-w- c:\windows\system32\html.iec
2011-11-01 16:07 . 2004-08-04 12:00 1288704 -c–a-w- c:\windows\system32\ole32.dll
2011-10-28 05:31 . 2004-08-04 12:00 33280 -c–a-w- c:\windows\system32\csrsrv.dll
2011-10-25 13:37 . 2004-08-04 12:00 2148864 -c–a-w- c:\windows\system32\ntoskrnl.exe
2011-10-25 12:52 . 2004-08-03 22:59 2027008 -c–a-w- c:\windows\system32\ntkrnlpa.exe
2011-10-21 16:24 . 2011-10-21 16:24 1393736 -c–a-w- c:\documents and settings\User\gotomypc_626.exe
2011-10-18 11:13 . 2004-08-04 12:00 186880 -c–a-w- c:\windows\system32\encdec.dll
2011-10-16 14:47 . 2010-08-20 22:35 409600 -c–a-w- c:\windows\system32\wrap_oal.dll
2011-10-16 14:47 . 2010-08-20 22:35 114688 -c–a-w- c:\windows\system32\OpenAL32.dll
2011-10-10 14:22 . 2008-07-11 14:28 692736 -c–a-w- c:\windows\system32\inetcomm.dll
2004-01-28 21:33 . 2008-07-22 23:09 2105420 -c–a-w- c:\program files\Common Files\soundsoap.exe
2009-09-13 04:05 . 2009-09-13 04:05 124240 -c–a-w- c:\program files\mozilla firefox\plugins\CCMSDK.dll
2009-09-13 04:06 . 2009-09-13 04:06 13136 -c–a-w- c:\program files\mozilla firefox\plugins\cgpcfg.dll
2009-09-13 04:06 . 2009-09-13 04:06 70488 -c–a-w- c:\program files\mozilla firefox\plugins\CgpCore.dll
2009-09-13 04:06 . 2009-09-13 04:06 91480 -c–a-w- c:\program files\mozilla firefox\plugins\confmgr.dll
2009-09-13 04:06 . 2009-09-13 04:06 22360 -c–a-w- c:\program files\mozilla firefox\plugins\ctxlogging.dll
2009-09-13 04:07 . 2009-09-13 04:07 255312 -c–a-w- c:\program files\mozilla firefox\plugins\ctxmui.dll
2009-09-13 04:06 . 2009-09-13 04:06 31064 -c–a-w- c:\program files\mozilla firefox\plugins\icafile.dll
2009-09-13 04:06 . 2009-09-13 04:06 40280 -c–a-w- c:\program files\mozilla firefox\plugins\icalogon.dll
2009-08-14 18:33 . 2009-08-14 18:33 652640 -c–a-w- c:\program files\mozilla firefox\plugins\sslsdk_b.dll
2009-09-13 04:06 . 2009-09-13 04:06 23896 -c–a-w- c:\program files\mozilla firefox\plugins\TcpPServ.dll
2011-12-21 07:24 . 2011-12-27 01:04 121816 -c–a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2005-07-14 18:31 27648 -csha-w- c:\windows\system32\AVSredirect.dll
.
.
((((((((((((((((((((((((((((( SnapShot_2011-12-29_14.48.45 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-12-29 20:58 . 2011-12-29 20:58 16384 c:\windows\Temp\Perflib_Perfdata_4f0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ConnectionCenter"="c:\program files\Citrix\ICA Client\concentr.exe" [2009-09-13 103768]
"Malwarebytes' Anti-Malware"="e:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-24 460872]
"CTHelper"="CTHELPER.EXE" [2008-03-20 23040]
"CTxfiHlp"="CTXFIHLP.EXE" [2008-03-20 23552]
"GIDDesktop"="c:\program files\SFT\GuardedID\gidd.exe" [2011-07-05 395528]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Constant Guard.lnk - e:\program files\Constant Guard Protection Suite\IDVault.exe [2011-12-17 4689992]
PatchMix DSP Application.lnk - e:\program files\Creative Professional\E-MU PatchMix DSP\EmuPMixDSP.exe [2010-8-20 671863]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "e:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 17:41 294912 —-a-w- e:\program files\SUPERAntiSpyware\SASWINLO.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GIDLogonXP]
2011-07-05 15:25 53528 -c–a-w- c:\windows\system32\GIDLogonXP.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2011-04-20 16:48 58656 -c–a-w- c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2011-09-27 11:22 59240 -c–a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-09-16 20:04 1164584 -c–a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2011-07-01 21:59 136176 -c–atw- c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 15:44 31072 -c–a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISTray]
2011-01-13 20:17 1589208 -c–a-w- e:\program files\PC Tools Security\pctsGui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-10-09 22:06 421736 -c–a-w- e:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
2010-10-16 17:04 13851752 -c–a-w- c:\windows\system32\nvcpl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2010-10-16 17:04 110696 -c–a-w- c:\windows\system32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2010-08-26 05:12 1753192 -c–a-w- c:\program files\NVIDIA Corporation\nView\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-07-05 22:36 421888 -c–a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Microsoft Office Groove Audit Service"=3 (0x3)
"FLEXnet Licensing Service"=3 (0x3)
"Bonjour Service"=2 (0x2)
"SavRoam"=2 (0x2)
"ose"=3 (0x3)
"WMPNetworkSvc"=3 (0x3)
"NBService"=3 (0x3)
"UleadBurningHelper"=2 (0x2)
"RichVideo"=2 (0x2)
"odserv"=3 (0x3)
"NGSERVER"=2 (0x2)
"NGDBSERV"=3 (0x3)
"Adobe LM Service"=3 (0x3)
"AcrSch2Svc"=2 (0x2)
"Capture Device Service"=2 (0x2)
"TVersityMediaServer"=2 (0x2)
"rpcapd"=3 (0x3)
"idsvc"=3 (0x3)
"M4iPodWPDService"=2 (0x2)
"AntiSpywareService"=2 (0x2)
"sprtsvc_ddoctorv2"=2 (0x2)
"HauppaugeTVServer"=3 (0x3)
"NIHardwareService"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
"wlidsvc"=2 (0x2)
"NetTcpPortSharing"=3 (0x3)
"IviRegMgr"=2 (0x2)
"SeaPort"=2 (0x2)
"iPod Service"=3 (0x3)
"NVSvc"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"NMIndexingService"=3 (0x3)
"IDVaultSvc"=2 (0x2)
"sdAuxService"=3 (0x3)
"sdCoreService"=3 (0x3)
"Browser Defender Update Service"=2 (0x2)
"ThreatFire"=3 (0x3)
"FTSvc"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"e:\\Programs\\bitlord\\BitLord.exe"=
"e:\\Program Files\\MasterWriter 2.0\\jre\\bin\\java.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\REE6ASDC.EXE"=
"e:\\Programs\\NeRO\\Nero 7\\Nero Home\\NeroHome.exe"=
"e:\\Program Files\\PerformanceTest\\pt.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"e:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
.
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [12/26/2011 8:47 PM 239168]
R0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS.sys [12/26/2011 8:47 PM 338880]
R0 pctEFA;PC Tools Extended File Attributes;c:\windows\system32\drivers\pctEFA.sys [12/26/2011 8:47 PM 656320]
R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360\0501000.01D\symds.sys [12/24/2011 12:23 PM 340088]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0501000.01D\symefa.sys [12/24/2011 12:23 PM 744568]
R1 Asapi;Asapi;c:\windows\system32\drivers\asapi.sys [7/28/2008 8:01 PM 10240]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\BASHDefs\20111221.003\BHDrvx86.sys [12/21/2011 10:50 PM 819320]
R1 GIDv2;GIDv2;c:\windows\system32\drivers\gidv2.sys [12/27/2011 2:21 PM 25232]
R1 SASDIFSV;SASDIFSV;e:\program files\SUPERAntiSpyware\sasdifsv.sys [5/28/2008 9:33 AM 8944]
R1 SASKUTIL;SASKUTIL;e:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/28/2008 9:33 AM 55024]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360\0501000.01D\ironx86.sys [12/24/2011 12:23 PM 136312]
R2 MBAMService;MBAMService;e:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [12/18/2010 7:05 PM 652872]
R2 N360;Norton Security Suite;c:\program files\Norton Security Suite\Engine\5.1.0.29\ccsvchst.exe [12/24/2011 12:22 PM 130008]
R3 COMMONFX.SYS;COMMONFX.SYS;c:\windows\system32\drivers\COMMONFX.sys [3/20/2008 5:23 PM 98328]
R3 CTEDSPIO.SYS;CTEDSPIO.SYS;c:\windows\system32\drivers\CTEDSPIO.sys [3/20/2008 5:38 PM 134168]
R3 CTEDSPSY.SYS;CTEDSPSY.SYS;c:\windows\system32\drivers\CTEDSPSY.sys [3/20/2008 5:37 PM 309784]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [12/27/2011 7:40 PM 106104]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.0.0.125\Definitions\IPSDefs\20111228.001\IDSXpx86.sys [12/28/2011 8:20 PM 356280]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [12/18/2010 7:05 PM 20464]
R3 pcouffin;VSO Software pcouffin;c:\windows\system32\drivers\pcouffin.sys [1/28/2010 7:01 PM 47360]
R3 SynasUSB;SynasUSB;c:\windows\system32\drivers\synasUSB.sys [7/20/2008 10:06 AM 23288]
S0 SMR210;Symantec SMR Utility Service 2.1.0;c:\windows\system32\drivers\SMR210.SYS –> c:\windows\system32\drivers\SMR210.SYS [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]
S3 COMMONFX;COMMONFX;c:\windows\system32\drivers\COMMONFX.sys [3/20/2008 5:23 PM 98328]
S3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\system32\drivers\CT20XUT.sys [3/20/2008 5:36 PM 171032]
S3 CT20XUT;CT20XUT;c:\windows\system32\drivers\CT20XUT.sys [3/20/2008 5:36 PM 171032]
S3 CTAUDFX.SYS;CTAUDFX.SYS;c:\windows\system32\drivers\CTAUDFX.sys [3/20/2008 5:23 PM 528920]
S3 CTAUDFX;CTAUDFX;c:\windows\system32\drivers\CTAUDFX.sys [3/20/2008 5:23 PM 528920]
S3 CTEAPSFX.SYS;CTEAPSFX.SYS;c:\windows\system32\drivers\CTEAPSFX.sys [3/20/2008 5:26 PM 163352]
S3 CTEAPSFX;CTEAPSFX;c:\windows\system32\drivers\CTEAPSFX.sys [3/20/2008 5:26 PM 163352]
S3 CTEDSPFX.SYS;CTEDSPFX.SYS;c:\windows\system32\drivers\CTEDSPFX.sys [3/20/2008 5:32 PM 259096]
S3 CTEDSPFX;CTEDSPFX;c:\windows\system32\drivers\CTEDSPFX.sys [3/20/2008 5:32 PM 259096]
S3 CTEDSPIO;CTEDSPIO;c:\windows\system32\drivers\CTEDSPIO.sys [3/20/2008 5:38 PM 134168]
S3 CTEDSPSY;CTEDSPSY;c:\windows\system32\drivers\CTEDSPSY.sys [3/20/2008 5:37 PM 309784]
S3 CTERFXFX.SYS;CTERFXFX.SYS;c:\windows\system32\drivers\CTERFXFX.sys [3/20/2008 5:36 PM 99352]
S3 CTERFXFX;CTERFXFX;c:\windows\system32\drivers\CTERFXFX.sys [3/20/2008 5:36 PM 99352]
S3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\system32\drivers\CTEXFIFX.sys [3/20/2008 5:40 PM 1324056]
S3 CTEXFIFX;CTEXFIFX;c:\windows\system32\drivers\CTEXFIFX.sys [3/20/2008 5:40 PM 1324056]
S3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\system32\drivers\CTHWIUT.sys [3/20/2008 5:37 PM 72728]
S3 CTHWIUT;CTHWIUT;c:\windows\system32\drivers\CTHWIUT.sys [3/20/2008 5:37 PM 72728]
S3 CTSBLFX.SYS;CTSBLFX.SYS;c:\windows\system32\drivers\CTSBLFX.sys [3/20/2008 5:25 PM 534040]
S3 CTSBLFX;CTSBLFX;c:\windows\system32\drivers\CTSBLFX.sys [3/20/2008 5:25 PM 534040]
S3 iComp;Hauppauge WinTV PVR2 USB2 Encoder;c:\windows\system32\drivers\HCWUSB2.sys [3/4/2008 6:37 PM 1464672]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [8/2/2005 4:10 PM 32512]
S3 SASENUM;SASENUM;e:\program files\SUPERAntiSpyware\SASENUM.SYS [5/28/2008 9:33 AM 7408]
S3 TASCAM_US122144;TASCAM USB 2.0 Audio Device driver;c:\windows\system32\drivers\tascusb2.sys [7/30/2008 8:35 AM 360448]
S3 TASCAM_US144_MIDI;TASCAM US-144 WDM MIDI Device;c:\windows\system32\drivers\tscusb2m.sys [7/30/2008 8:35 AM 18944]
S3 TASCAM_US144_WDM;TASCAM US-144 WDM;c:\windows\system32\drivers\tscusb2a.sys [7/30/2008 8:35 AM 33792]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]
S4 AntiSpywareService;Comcast AntiSpyware;c:\program files\comcasttb\ComcastSpywareScan\ComcastAntiSpyService.exe [6/17/2009 12:49 PM 616408]
S4 HauppaugeTVServer;HauppaugeTVServer;c:\progra~1\WinTV\HCWTVS~1.EXE [5/2/2010 10:42 AM 815104]
S4 IDVaultSvc;CGPS Service;e:\program files\Constant Guard Protection Suite\IDVaultSvc.exe [12/17/2011 12:13 PM 63048]
S4 NIHardwareService;NIHardwareService;c:\program files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [2/23/2009 12:38 PM 3656704]
S4 sdAuxService;PC Tools Auxiliary Service;e:\program files\PC Tools Security\pctsAuxs.exe [12/26/2011 8:47 PM 366840]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9191979D-821C-4EA8-B021-2DA1D859A7C5}-3Reg]
2011-07-05 15:26 435976 -c–a-w- c:\program files\SFT\GuardedID\GIDI.exe
.
Contents of the 'Scheduled Tasks' folder
.
2011-12-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 21:57]
.
2011-12-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-329068152-746137067-725345543-1003Core.job
- c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-07-01 21:59]
.
2011-12-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-329068152-746137067-725345543-1003UA.job
- c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-07-01 21:59]
.
2011-12-29 c:\windows\Tasks\User_Feed_Synchronization-{CC1CB082-0399-4843-A63D-49ED715CFD49}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 08:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
TCP: DhcpNameServer = [removed] [removed] [removed]
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\ip9s9xzt.default\
FF - prefs.js: browser.search.selectedEngine - Bing
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?pc=Z206&form=ZGAADF&install_date=20111227&q=
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-29 15:57
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600
.
CreateFile("\\.\PHYSICALDRIVE0"): The process cannot access the file because it is being used by another process.
device: opened successfully
user: error reading MBR
kernel: MBR read successfully
user != kernel MBR !!!
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet004\Services\N360]
"ImagePath"="\"c:\program files\Norton Security Suite\Engine\5.1.0.29\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton Security Suite\Engine\5.1.0.29\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-329068152-746137067-725345543-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(1872)
e:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
c:\windows\system32\GIDLogonXP.dll
c:\windows\system32\GIDHookLogon.dll
c:\windows\system32\GIDBIN1.dll
c:\program files\CA\PPRT\bin\CACheck.dll
c:\program files\CA\PPRT\bin\CAHook.dll
c:\program files\CA\PPRT\bin\CAServer.dll
.
- - - - - - - > 'lsass.exe'(1952)
c:\windows\system32\relog_ap.dll
.
- - - - - - - > 'explorer.exe'(880)
c:\windows\system32\WININET.dll
c:\program files\CA\PPRT\bin\CACheck.dll
c:\program files\CA\PPRT\bin\CAHook.dll
c:\program files\CA\PPRT\bin\CAServer.dll
c:\windows\system32\GIDHook.dll
c:\windows\system32\GIDBIN1.dll
c:\windows\system32\EasyHook32.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll
c:\windows\system32\ctagent.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
c:\program files\CA\PPRT\bin\ITMRTSVC.exe
c:\windows\system32\CTHELPER.EXE
c:\program files\Citrix\ICA Client\wfcrun32.exe
.
**************************************************************************
.
Completion time: 2011-12-29 16:03:24 - machine was rebooted
ComboFix-quarantined-files.txt 2011-12-29 21:03
ComboFix2.txt 2011-12-29 14:51
.
Pre-Run: 23,047,938,048 bytes free
Post-Run: 16,963,280,896 bytes free
.
- - End Of File - - 02D8765429C4D4B1A3A8713C616D8223
Post #13
Hi tymwanr,

I see that you have Malwarebytes on your system. Please open Malwarebytes, update it and then run a Quick Scan. Please save the log that is created for your next reply.
———-

ESET Online Scanner
I'd like us to scan your machine with ESET Online Scan

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.


  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the [external image: Posted Image] button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the [external image: Posted Image] icon on your desktop.
  • Check [external image: Posted Image]
  • Click the Start button.
  • Accept any security warnings from your browser.
  • Check [external image: Posted Image]
  • Make sure that the option "Remove found threats" is Unchecked
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin
    scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push [external image: Posted Image]
  • Push [external image: Posted Image], and save the file to your desktop using a unique name, such as
    ESETScan. Include the contents of this report in your next reply.
  • Push the Back button.
  • Push Finish
http://www.eset.com/onlinescan/
———-

In your next reply please post the logs made by Malwarebytes and ESET online scanner. :)
Post #14
From Malwarebytes Malwarebytes Anti-Malware (PRO) 1.60.0.1800 www.malwarebytes.org Database version: v2011.12.29.04 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 User :: WORKSTATION [limited] Protection: Enabled 12/29/2011 5:02:47 PM mbam-log-2011-12-29 (17-02-47).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P Scan options disabled: Objects scanned: 253124 Time elapsed: 4 minute(s), 28 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) From ESET C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\10\7bec11ca-7a931bbd Java/Exploit.CVE-2011-3544.F trojan deleted - quarantined C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\24\762072d8-3f43b8be Java/Exploit.CVE-2011-3544.F trojan deleted - quarantined C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\27\6584d6db-7ba11a7c Java/Agent.DY trojan deleted - quarantined C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\35\1ae8aca3-45f36fac Java/Agent.DY trojan deleted - quarantined C:\Documents and Settings\User\Application Data\Auslogics\Rescue\One Button Checkup\111212200548812.rsc a variant of Win32/Kryptik.XKR trojan deleted - quarantined C:\Documents and Settings\User\Application Data\Auslogics\Rescue\One Button Checkup\111224105430828.rsc multiple threats deleted - quarantined C:\Qoobox\Quarantine\C\Program Files\StartNow Toolbar\ReactivateIE.exe.vir a variant of Win32/Toolbar.Zugo application cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\Program Files\StartNow Toolbar\Toolbar32.dll.vir a variant of Win32/Toolbar.Zugo application cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\Program Files\StartNow Toolbar\ToolbarBroker.exe.vir a variant of Win32/Toolbar.Zugo application cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\Program Files\StartNow Toolbar\ToolbarUpdaterService.exe.vir a variant of Win32/Toolbar.Zugo application cleaned by deleting - quarantined C:\System Volume Information\_restore{357A4147-75D9-429D-8B70-E202783E0846}\RP1\A0000063.exe a variant of Win32/Toolbar.Zugo application cleaned by deleting - quarantined C:\System Volume Information\_restore{357A4147-75D9-429D-8B70-E202783E0846}\RP1\A0000065.dll a variant of Win32/Toolbar.Zugo application cleaned by deleting - quarantined C:\System Volume Information\_restore{357A4147-75D9-429D-8B70-E202783E0846}\RP1\A0000066.exe a variant of Win32/Toolbar.Zugo application cleaned by deleting - quarantined C:\System Volume Information\_restore{357A4147-75D9-429D-8B70-E202783E0846}\RP1\A0000067.exe a variant of Win32/Toolbar.Zugo application cleaned by deleting - quarantined G:\Cubase Projects\Cubase Studio 4.1.1.749 Portable\Cubase 4 Crack\Steinberg.Cubase.Studio.4.Update.and.Crack\Steinberg.Cubase.Studio.4.Update.and.Crack.rar probably a variant of Win32/TrojanDownloader.Zlob.CQR trojan deleted - quarantined G:\Cubase Projects\Cubase Studio 4.1.1.749 Portable\Cubase 4 Crack\Steinberg.Cubase.Studio.4.Update.and.Crack\Cubase Studio 4 Update Patch 4.0.1.2074\CubaseStudio4_Update_4.0.1.2074.exe probably a variant of Win32/TrojanDownloader.Zlob.CQR trojan deleted - quarantined G:\MyDocuments\My Music\Music books and lessons\pdf Tabs\All Guitar Books for 2+ years training\The Everything Rock and Blues Guitar Book.iso a variant of Win32/Alcaul.NAA virus deleted - quarantined G:\MyDocuments\My Music\PDF\Teach Me Piano Deluxe\keygen.zip probably a variant of Win32/TrojanProxy.Agent.IIIVZSY trojan deleted - quarantined G:\MyDocuments\My Music\PDF\Teach Me Piano Deluxe\voyetra.exe probably a variant of Win32/TrojanProxy.Agent.IIIVZSY trojan cleaned by deleting - quarantined G:\Software\Absynth 3 Installer + KeyGens Native Instruments\Absynth 2 KeyGen Just for Kicks.exe a variant of Win32/Keygen.AA application cleaned by deleting - quarantined G:\Software\IK.Multimedia.ARC.System.VST.RTAS.v1.0.2.Incl.Keygen-AiR\IKMUL.ARCSYS.VSRTA.1.0.2\Setup.exe Win32/VB.GYH trojan deleted - quarantined G:\Software\Sony_ACID_Music_Studio 7-over 3,000 ACIDized loops\SonyACID Music-Studio.7.rar multiple threats deleted - quarantined G:\Software\T-Racks Delux-Sonnox Oxford-Namd Blue Tube.zip\T-Racks Delux-Sonnox Oxford-Namd Blue Tube.zip.zip probably a variant of Win32/Agent.CQKCWJE trojan deleted - quarantined G:\Software\Toontrack.EZmix.VST.v1.0-ASSiGN\setup.exe Win32/TrojanDownloader.Agent.QCL trojan deleted - quarantined G:\Software\VST & DX Softsynth & Effects Mega Pack\Native Instruments Intakt v1.01 drums loops sampler vsti plugin for Cubase or Logic (H2O).rar a variant of Win32/Keygen.AA application deleted - quarantined I:\Misc Software\FreeWAVToMP3ConverterSetup.exe a variant of Win32/Agent.SZW trojan deleted - quarantined I:\Music software - OLD\Absynth 3 Installer + KeyGens Native Instruments\Absynth 2 KeyGen Just for Kicks.exe a variant of Win32/Keygen.AA application cleaned by deleting - quarantined I:\Music software - OLD\DRUM LOOPS\Native Instruments Intakt v1.01 drums loops sampler vsti plugin for Cubase or Logic (H2O)\Setup.exe a variant of Win32/Keygen.AA application deleted - quarantined I:\Music software - OLD\GrooveAgent\Steinberg.Groove.Agent.VSTi.v1.0.Crack\grvagnt.ISO probably a variant of Win32/Agent.EPQNOLH trojan deleted - quarantined I:\Music software - OLD\Testys New stuff 03-2007\Sonic Foundry Acid Pro 4.0 + Sound FORGE 7.0 + kEYGENS + MANUALS.zip a variant of Win32/Keygen.AQ application deleted - quarantined I:\Music software - OLD\ZippedUPSTUFF\Absynth 3 Installer + KeyGens Native Instruments.zip a variant of Win32/Keygen.AA application deleted - quarantined I:\Software\Spectrasonics - Trilogy\Spectrasonics - Trilogy CD 1 of 5.ISO probably a variant of Win32/Agent.MONJVIM trojan deleted - quarantined I:\Software\Twisted.Lemon.SideKick.VST.v4.3.2.Incl.Keygen-AiR { www.torrentkit.com }\a-tsk432.rar a variant of Win32/Keygen.AD application deleted - quarantined I:\Software\Twisted.Lemon.SideKick.VST.v4.3.2.Incl.Keygen-AiR { www.torrentkit.com }\a-tsk432.zip a variant of Win32/Keygen.AD application deleted - quarantined I:\Software\Twisted.Lemon.SideKick.VST.v4.3.2.Incl.Keygen-AiR { www.torrentkit.com }\keygen.exe a variant of Win32/Keygen.AD application cleaned by deleting - quarantined I:\Software\VST Instruments\D16.Group.Nepheton.VSTi.v1.1.2.Incl.Keygen-AiR\a-ne112a.zip a variant of Win32/Keygen.AD application deleted - quarantined I:\Software\VST Instruments\D16.Group.Nithonat.VSTi.v1.0.3.Incl.Keygen-AiR\a-dn103a.zip a variant of Win32/Keygen.AD application deleted - quarantined
Post #15
Hi tymwanr,

How is your system running now? :)
————-

Download CKScanner by askey127 from Here & save it to your Desktop.
  • Doubleclick CKScanner.exe then click Search For Files
  • When the cursor hourglass disappears, click Save List To File
  • A message box will verify the file saved
  • Double-click the CKFiles.txt icon on your desktop then copy/paste the contents in your next reply

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI