[Resolved] Is this computer clean?

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8aded19a-4ceb-11dc-ae91-806d6172696f}]
\Shell\AutoRun\command - H:\setup.exe

Is H: your external HDD?

There is a infector that usually comes in through your removable drives - flash drives, cds, memory cards, usb disks.

You'll need to plug in the external drive.

download & run this file - Flash_Disinfector.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8aded19a-4ceb-11dc-ae91-806d6172696f}]
\Shell\AutoRun\command - H:\setup.exe

Is H: your external HDD?

No, it's the cardreader of the printer. It has no card in it, so if you open it, it will ask you to put in a device.

There is a infector that usually comes in through your removable drives - flash drives, cds, memory cards, usb disks.

You'll need to plug in the external drive.

download & run this file - Flash_Disinfector.exe

done

We can try a different online scan.

http://www.eset.eu/online-scanner
Go here to run an online scannner from ESET.
Note: You will need to use Internet explorer for this scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats is unticked, and the option Scan unwanted applications is checked
Click Scan
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic.

Here it is. I believe you have stated you point of the computer being clean But if you are open for more investigating, I'm always ready # version=4 # OnlineScanner.ocx=1.0.0.56 # OnlineScannerDLLA.dll=1, 0, 0, 51 # OnlineScannerDLLW.dll=1, 0, 0, 51 # OnlineScannerUninstaller.exe=1, 0, 0, 49 # vers_standard_module=2639 (20071105) # vers_arch_module=1.058 (20070906) # vers_adv_heur_module=1.066 (20070917) # EOSSerial=3a3584db3c1c004b9ad11818e908c7d7 # end=finished # remove_checked=false # unwanted_checked=true # utc_time=2007-11-06 09:01:50 # local_time=2007-11-06 10:01:50 (+0100, Vest-Europa (normaltid)) # country="Norway" # osver=5.1.2600 NT Service Pack 2 # scanned=816406 # found=0 # scan_time=5471

download AVG Anti-Rootkit to your desktop.

Double-click the installation file
Just click Next, let it go with default settings.
Once the installation is ready, reboot.
Run AVG Anti-Rootkit Beta.exe.
Click Search for rootkits.
When finished, click Save result to file.
Post back with the results. (Not sure where they are located, either in C:\Program Files\GRISOFT\AVG Anti-Rootkit Beta\ folder or on your desktop.)

Hi LDTate, I did not find any BETA version, but here's the log from the non-beta: Path: C:\WINDOWS\System32\Drivers\aw3fvjdt.SYS Description: Hidden driver filePath: C:\WINDOWS\System32\Drivers\aw3fvjdt.SYS Description: Hidden driver file It seems that there stil is something left after all

Please go to http://virusscan.jotti.org , click on Browse, and upload the following file for analysis:

C:\WINDOWS\System32\Drivers\aw3fvjdt.SYS

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.


If Jotti is too busy you can try these.

http://www.kaspersky.com/scanforvirus.html


http://www.virustotal.com/en/indexf.html

Please go to http://virusscan.jotti.org , click on Browse, and upload the following file for analysis:

C:\WINDOWS\System32\Drivers\aw3fvjdt.SYS

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.


If Jotti is too busy you can try these.

http://www.kaspersky.com/scanforvirus.html


http://www.virustotal.com/en/indexf.html

The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file

I cannot find the file

C:\WINDOWS\System32\Drivers\aw3fvjdt.SYS <–I would delete it.

C:\WINDOWS\System32\Drivers\aw3fvjdt.SYS <–I would delete it.

Ok so then I'll delete it through avg anti-rootkit


EDIT: DONE

Description: Hidden driver filePath: C:\WINDOWS\System32\Drivers\aogmgme5.SYS Description: Hidden driver file Here's another hidden driver file, I couldn't find it either, so jotti won't do. Shal I delete it too?

Yes. I would delete it.

Well I've deleted it, but I think its some sort of program making random names for it. Just as I deleted it and rebooted, a new one showed up. This time named ansym6ae.SYS

Do you still have combofix?

Download ComboFix from Here to your Desktop.

• Double click combofix.exe and follow the prompts.
• When finished, it shall produce a log for you, combofix.txt. Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick while its running. That may cause it to stall