Printable View
Hello again, I have once again been infected with malware. It occurred when I was downloading a torrent. Upon installation of my download, suddenly "antimalware doctor" began giving me many popups.
This was followed by google redirects (using Mozilla) to random search and shop pages, followed by "internet explorer script error" warnings, error: access denied, code 0, url:...ctv.ca/greys-anatomy/season6/.....
do you wish to continue running scripts on this page?
I would appreciate your advice.
We'll gladly help you out on two conditions.
1. You won't let me hanging out there in the middle of cleaning process, like you did here: http://discussions.virtualdr.com/sho...d.php?t=245745
If it happens again, you won't be never able to receive any more help in malware forum, ever.
2. You had two malware forum topics before, so you should know, what we require in order to help you out: http://discussions.virtualdr.com/sho...d.php?t=167915
Thanks- the other computer was my parents which I do not have access to, but when I return to it I will complete the rest of the cleaning process. Didn't mean to leave the process unfinished intentionally.
I will follow the instructions and post the appropriate logs asap.
You should have just told me, but...let's forget about that case and focus on this one.
I ran MBAM without issue, then on computer restart I got two error messages:
"Visual C# command line compiler has stopped working"
and
"Error loading ...\AppData\Local\oguyepiyijw.dll"
I then tried to run GMER, but was unable to. It simply froze requiring hard reboot. On reboot, I received some windows warnings and CHKDSK ran a lengthy check program. I tried to run GMER again and computer froze again.
I restarted and ran DDS, I post its logs.
I have just tried to load windows explorer and computer froze, will try to repost after reboot.
That error is caused by a malware. Don't worry about it.
GMER may stall sometimes.
In our manual, we list couple of different ways for running GMER.
I continue to try GMER without success. This time the scan runs but freezes part way through, and entire computer becomes unresponsive.
I also cannot find my MBAM log file from yesterday, so I ran another today. then I realized I needed to update so I did so and ran another scan. Although few were found today, yesterday more than 100 were found and removed.
MBAM:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Database version: 4525
Windows 6.0.6000
Internet Explorer 7.0.6000.17037
01/09/2010 9:08:36 PM
mbam-log-2010-09-01 (21-08-36).txt
Scan type: Quick scan
Objects scanned: 137930
Time elapsed: 11 minute(s), 22 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 11
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\Users\sneha\AppData\Local\Windows\winhelp.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
C:\Users\sneha\AppData\Local\Temp\jvmxb.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\sneha\AppData\Local\Temp\lqrog.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\sneha\AppData\Local\Temp\wtpvaae.exe (Adware.AdRotator) -> Quarantined and deleted successfully.
C:\Users\sneha\AppData\Local\Temp\xh9kxdl.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Users\sneha\AppData\Local\Temp\xjoqojgw.exe (Trojan.Agent.HL) -> Quarantined and deleted successfully.
C:\Users\sneha\AppData\Local\Temp\emxsarwcon.exe (Rootkit.Dropper) -> Quarantined and deleted successfully.
C:\Users\sneha\downloads\keygen.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully.
C:\Users\sneha\AppData\Local\Temp\skaioejiesfjoee.tmp (Malware.Trace) -> Quarantined and deleted successfully.
C:\Users\sneha\Local Settings\Application Data\Windows Server\admin.txt (Malware.Trace) -> Quarantined and deleted successfully.
C:\Users\sneha\Templates\memory.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
DDS:
DDS (Ver_10-03-17.01) - NTFSx86
Run by sneha at 22:39:43.62 on 31/08/2010
Internet Explorer: 7.0.6000.17037 BrowserJavaVersion: 1.6.0_11
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.2.1033.18.2038.1051 [GMT -4:00]
AV: Norton Internet Security *On-access scanning enabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
SP: Norton Internet Security *enabled* (Outdated) {CBB7EE13-8244-4DAB-8B55-D5C7AA91E59A}
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
============== Running Processes ===============
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\sneha\Desktop\dds.scr
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe
============== Pseudo HJT Report ===============
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_CA&c=73&bd=Pavilion&pf=laptop
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_CA&c=73&bd=Pavilion&pf=laptop
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_CA&c=73&bd=Pavilion&pf=laptop
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_CA&c=73&bd=Pavilion&pf=laptop
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: {1e8a6170-7264-4d0f-beae-d42a53123c75} - c:\program files\common files\symantec shared\coshared\browser\1.5\NppBho.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Show Norton Toolbar: {90222687-f593-4738-b738-fbee9c7b26df} - c:\program files\common files\symantec shared\coshared\browser\1.5\UIBHO.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [HPAdvisor] c:\program files\hewlett-packard\hp advisor\HPAdvisor.exe autoRun
uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background
uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [skypexxxxx.exe] c:\skypexxxxx.exe\skypexxxxx.exe
uRun: [Dvezuhifucizepuf] rundll32.exe "c:\users\sneha\appdata\local\oguyepiyijiw.dll",Startup
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [IS CfgWiz] "c:\program files\common files\symantec shared\opc\{31011d49-d90c-4da0-878b-78d28ad507af}\cltUIStb.exe" /MODULE CfgWiz /GUID {BC8D3EAF-F864-4d4b-AB4D-B3D0C32E2840} /MODE CfgWiz /CMDLINE "REBOOT"
mRun: [QPService] "c:\program files\hp\quickplay\QPService.exe"
mRun: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
mRun: [HP Health Check Scheduler] c:\program files\hewlett-packard\hp health check\HPHC_Scheduler.exe
mRun: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
mRun: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [WinampAgent] "c:\program files\winamp\winampa.exe"
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
StartupFolder: c:\users\sneha\appdata\local\windows\winhelp.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Notify: igfxcui - igfxdev.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
================= FIREFOX ===================
FF - ProfilePath - c:\users\sneha\appdata\roaming\mozilla\firefox\profiles\flbqlwud.default\
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\veetle\player\npvlc.dll
FF - plugin: c:\program files\veetle\plugins\npVeetle.dll
FF - plugin: c:\program files\veetle\vlcbroadcast\npvbp.dll
FF - plugin: c:\users\sneha\appdata\roaming\facebook\npfbplugin_1_0_3.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
============= SERVICES / DRIVERS ===============
S3 IDSvix86;Symantec Intrusion Prevention Driver;c:\progra~2\symantec\defini~1\symcdata\idsdefs\20070108.003\IDSvix86.sys [2007-8-21 212280]
S3 Symantec Core LC;Symantec Core LC;c:\program files\common files\symantec shared\ccpd-lc\symlcsvc.exe [2007-8-21 1174664]
=============== Created Last 30 ================
2010-08-26 02:31:14 0 d-----w- C:\_temp
2010-08-26 01:07:54 0 d-----w- c:\users\sneha\appdata\roaming\DCF643561188472D4B335BF8483C0CD0
2010-08-26 00:57:31 0 d-----w- c:\program files\CHM To PDF Converter PRO
2010-08-23 18:12:46 0 d-----w- c:\program files\iPod
2010-08-23 18:12:37 0 d-----w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-08-23 18:12:37 0 d-----w- c:\program files\iTunes
2010-08-23 18:01:36 0 d-----w- c:\program files\Bonjour
2010-08-19 21:28:40 116736 ----a-w- c:\windows\system32\drivers\mcdbus.sys
2010-08-19 21:28:39 0 d-----w- c:\program files\MagicDisc
2010-08-10 09:15:58 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-08-10 09:15:58 69632 ----a-w- c:\windows\system32\QuickTime.qts
==================== Find3M ====================
2010-08-23 18:04:35 86016 ----a-w- c:\windows\inf\infstor.dat
2010-08-23 18:04:35 51200 ----a-w- c:\windows\inf\infpub.dat
2010-08-23 18:04:35 143360 ----a-w- c:\windows\inf\infstrng.dat
2008-12-15 17:10:55 174 --sha-w- c:\program files\desktop.ini
2008-06-12 06:25:57 665600 ----a-w- c:\windows\inf\drvindex.dat
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
============= FINISH: 22:41:33.30 ==============
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_10-03-17.01)
Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 08/03/2008 9:11:51 AM
System Uptime: 31/08/2010 10:31:31 PM (0 hours ago)
Motherboard: Quanta | | 30CC
Processor: Intel(R) Core(TM)2 Duo CPU T5450 @ 1.66GHz | U2E1 | 1000/667mhz
==== Disk Partitions =========================
C: is FIXED (NTFS) - 104 GiB total, 5.319 GiB free.
D: is FIXED (NTFS) - 75 GiB total, 66.747 GiB free.
E: is FIXED (NTFS) - 8 GiB total, 1.816 GiB free.
F: is CDROM (UDF)
G: is CDROM ()
H: is CDROM (CDFS)
I: is CDROM ()
J: is Removable
==== Disabled Device Manager Items =============
==== System Restore Points ===================
==== Installed Programs ======================
AC3Filter (remove only)
Activation Assistant for the 2007 Microsoft Office suites
ActiveCheck component for HP Active Support Library
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Flash Player 9 ActiveX
Adobe Reader 8.1.3
AppCore
Apple Application Support
Apple Mobile Device Support
Apple Software Update
µTorrent
AV
Bonjour
ccCommon
DHTML Editing Component
DirectVobSub (remove only)
DivX Converter
DivX Plus DirectShow Filters
DivX Setup
DivX Version Checker
ESU for Microsoft Vista
Facebook Plug-In
Free Photo Converter
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Active Support Library
HP Active Support Library 32 bit components
HP Doc Viewer
HP Help and Support
HP Quick Launch Buttons 6.20 B1
HP QuickPlay 3.2
HP Total Care Advisor
HP Update
HP User Guides 0086
HP Wireless Assistant
HPAsset component for HP Active Support Library
HPNetworkAssistant
ImgBurn
Intel Matrix Storage Manager
Intel(R) Graphics Media Accelerator Driver
iTunes
Java(TM) 6 Update 11
Java(TM) SE Runtime Environment 6
LightScribe 1.4.136.1
LiveUpdate 3.2 (Symantec Corporation)
MagicDisc 2.7.106
Malwarebytes' Anti-Malware
Microsoft .NET Framework 3.5 SP1
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
Mozilla Firefox (3.5.11)
MSCU for Microsoft Vista
MSRedist
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
My HP Games
Norton AntiVirus
Norton Confidential Browser Component
Norton Confidential Web Protection Component
Norton Internet Security
Norton Internet Security (Symantec Corporation)
Norton Protection Center
QuickTime
Realtek High Definition Audio Driver
Rhapsody
Rhapsody Player Engine
Roxio Activation Module
Roxio Creator Audio
Roxio Creator Basic v9
Roxio Creator Copy
Roxio Creator Data
Roxio Creator EasyArchive
Roxio Creator Tools
Roxio Express Labeler 3
Safari
Security Update for 2007 Microsoft Office System (KB2277947)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB976321)
Security Update for 2007 Microsoft Office System (KB982312)
Security Update for 2007 Microsoft Office System (KB982331)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft Office Access 2007 (KB979440)
Security Update for Microsoft Office Excel 2007 (KB982308)
Security Update for Microsoft Office InfoPath 2007 (KB979441)
Security Update for Microsoft Office Outlook 2007 (KB980376)
Security Update for Microsoft Office PowerPoint 2007 (KB982158)
Security Update for Microsoft Office Publisher 2007 (KB982124)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB2251419)
SPBBC 32bit
Symantec Real Time Storage Protection Component
SymNet
Synaptics Pointing Device Driver
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office OneNote 2007 (KB980729)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Update for Outlook 2007 Junk Email Filter (kb2279264)
VC80CRTRedist - 8.0.50727.4053
Veetle TV 0.9.17
Winamp
Windows Live installer
Windows Live Messenger
Windows Media Player Firefox Plugin
WinRAR archiver
==== End Of File ===========================
Good :)
Download MBRCheck to your desktop
Double click MBRCheck.exe to run (Vista and Windows 7 users, right click and select Run as Administrator).
It will show a black screen with some data on it.
A report called MBRcheckxxxx.txt will be on your desktop
Open this report and post its content in your next reply.
==============================================================
Please download ComboFix from Here or Here to your Desktop.
**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
- Please, never rename Combofix unless instructed.
- Close any open browsers.
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.
- Close any open browsers.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
- Double click on combofix.exe & follow the prompts.
- When finished, it will produce a report for you.
- Please post the "C:\ComboFix.txt"
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**
Make sure, you re-enable your security programs, when you're done with Combofix.
DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
Hi Broni, I will follow those instructions but won't be at that computer until approx. next Tuesday. I will post everything then. thank you.
No problem :)
Hi, i just ran mbr check and combo fix. The computer just restarted and combofid made its log. However both internet explorer and firefox are not functioning. When I open firefox, there is a warning "illegal operation attempted on a registry key that has been marked for deletion." double clicking on ie does nothing.
I am posting from my iPad.
I have both both logs saved.
I rebooted the computer, it took much longer than usual but finally restarted normally. Firefox appears to be running normally.
MBR check log:
MBRCheck, version 1.2.3
(c) 2010, AD
Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: (build 6000), 32-bit
Base Board Manufacturer: Quanta
BIOS Manufacturer: Hewlett-Packard
System Manufacturer: Hewlett-Packard
System Product Name: HP Pavilion dx6500 Notebook PC
Logical Drives Mask: 0x000001fc
Kernel Drivers (total 155):
0x81C00000 \SystemRoot\system32\ntkrnlpa.exe
0x81FA1000 \SystemRoot\system32\hal.dll
0x802C6000 \SystemRoot\system32\kdcom.dll
0x80266000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x8025D000 \SystemRoot\system32\PSHED.dll
0x80255000 \SystemRoot\system32\BOOTVID.dll
0x8021A000 \SystemRoot\system32\CLFS.SYS
0x8051F000 \SystemRoot\system32\CI.dll
0x804A4000 \SystemRoot\system32\drivers\Wdf01000.sys
0x8020D000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x80461000 \SystemRoot\system32\drivers\acpi.sys
0x80204000 \SystemRoot\system32\drivers\WMILIB.SYS
0x80459000 \SystemRoot\system32\drivers\msisadrv.sys
0x80434000 \SystemRoot\system32\drivers\pci.sys
0x80425000 \SystemRoot\system32\drivers\volmgr.sys
0x80201000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x8041B000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x8040B000 \SystemRoot\System32\drivers\mountmgr.sys
0x80404000 \SystemRoot\system32\DRIVERS\pciide.sys
0x807F2000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x807A8000 \SystemRoot\System32\drivers\volmgrx.sys
0x806EA000 \SystemRoot\system32\DRIVERS\iaStor.sys
0x806E2000 \SystemRoot\system32\drivers\atapi.sys
0x806C4000 \SystemRoot\system32\drivers\ataport.SYS
0x80693000 \SystemRoot\system32\drivers\fltmgr.sys
0x80683000 \SystemRoot\system32\drivers\fileinfo.sys
0x8067A000 \SystemRoot\System32\Drivers\PxHelp20.sys
0x876FC000 \SystemRoot\system32\drivers\ndis.sys
0x8064F000 \SystemRoot\system32\drivers\msrpc.sys
0x80616000 \SystemRoot\system32\drivers\NETIO.SYS
0x878F8000 \SystemRoot\System32\Drivers\Ntfs.sys
0x87692000 \SystemRoot\System32\Drivers\ksecdd.sys
0x8765C000 \SystemRoot\system32\drivers\volsnap.sys
0x8060E000 \SystemRoot\System32\Drivers\spldr.sys
0x8764D000 \SystemRoot\System32\drivers\partmgr.sys
0x8763E000 \SystemRoot\System32\Drivers\mup.sys
0x87619000 \SystemRoot\System32\drivers\ecache.sys
0x87608000 \SystemRoot\system32\drivers\disk.sys
0x878D7000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x80605000 \SystemRoot\system32\drivers\crcdisk.sys
0x8B045000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x87842000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x88690000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x8B970000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x8B037000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x8BA1A000 \SystemRoot\system32\DRIVERS\igdkmd32.sys
0x8B815000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8B02A000 \SystemRoot\System32\drivers\watchdog.sys
0x8B01F000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x8B9DD000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8B011000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8B803000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8C1D9000 \SystemRoot\system32\DRIVERS\NETw4v32.sys
0x8B9C6000 \SystemRoot\system32\DRIVERS\Rtlh86.sys
0x887E0000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x8B003000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x8C1C1000 \SystemRoot\system32\DRIVERS\sdbus.sys
0x87833000 \SystemRoot\system32\DRIVERS\rimmptsk.sys
0x8B9B2000 \SystemRoot\system32\DRIVERS\rimsptsk.sys
0x8C070000 \SystemRoot\system32\DRIVERS\rixdptsk.sys
0x88623000 \SystemRoot\system32\DRIVERS\cpqbttn.sys
0x887D0000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x8B1AC000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x8C05D000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x8C052000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x8C027000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x88662000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x8C01C000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x8C004000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8B072000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x8C196000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8C156000 \SystemRoot\system32\DRIVERS\storport.sys
0x8C14B000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8C134000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x8C129000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x8C106000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x8C0F7000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x8C0E4000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x8C5F1000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8C5D4000 \SystemRoot\system32\DRIVERS\mcdbus.sys
0x8C5AE000 \SystemRoot\system32\DRIVERS\SCSIPORT.SYS
0x88676000 \SystemRoot\system32\DRIVERS\swenum.sys
0x8C584000 \SystemRoot\system32\DRIVERS\ks.sys
0x88650000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8C0CC000 \SystemRoot\system32\DRIVERS\umbus.sys
0x8C480000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x8B982000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x887C0000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x8CA56000 \SystemRoot\system32\drivers\RTKVHDA.sys
0x8CA29000 \SystemRoot\system32\drivers\portcls.sys
0x8CA04000 \SystemRoot\system32\drivers\drmk.sys
0x8EABE000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x8EA9D000 \SystemRoot\System32\Drivers\usbvideo.sys
0x8B994000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x8B1D6000 \SystemRoot\System32\Drivers\Null.SYS
0x8B1DD000 \SystemRoot\System32\Drivers\Beep.SYS
0x8EA91000 \SystemRoot\System32\drivers\vga.sys
0x8EA70000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8EB76000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8EB7E000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8C0D9000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8C422000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8B99D000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x8FB2B000 \SystemRoot\System32\drivers\tcpip.sys
0x8EA37000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8EA22000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8EA0E000 \SystemRoot\system32\DRIVERS\smb.sys
0x8F679000 \SystemRoot\system32\drivers\afd.sys
0x8F647000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8F631000 \SystemRoot\system32\DRIVERS\pacer.sys
0x8EA00000 \SystemRoot\system32\DRIVERS\netbios.sys
0x88214000 \SystemRoot\system32\DRIVERS\eabfiltr.sys
0x8F61E000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x8F60D000 \SystemRoot\System32\Drivers\SRTSPX.SYS
0x8FAF0000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8C0C2000 \SystemRoot\system32\drivers\nsiproxy.sys
0x8FA8E000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
0x8FA77000 \SystemRoot\System32\Drivers\dfsc.sys
0x8FA0F000 \SystemRoot\System32\Drivers\fastfat.SYS
0x8B935000 \SystemRoot\system32\DRIVERS\udfs.sys
0x8B91F000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x8C4B4000 \SystemRoot\System32\Drivers\crashdmp.sys
0x90F42000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0x97600000 \SystemRoot\System32\win32k.sys
0x8B8B2000 \SystemRoot\System32\drivers\Dxapi.sys
0x96A90000 \SystemRoot\system32\DRIVERS\monitor.sys
0xA8200000 \SystemRoot\System32\TSDDD.dll
0xA8210000 \SystemRoot\System32\cdd.dll
0xA8220000 \SystemRoot\System32\ATMFD.DLL
0xA8EE5000 \SystemRoot\system32\drivers\luafv.sys
0xAAC61000 \SystemRoot\system32\drivers\spsys.sys
0x887A0000 \SystemRoot\system32\DRIVERS\lltdio.sys
0xAB3D5000 \SystemRoot\system32\DRIVERS\nwifi.sys
0xAACF9000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xA8E52000 \SystemRoot\system32\DRIVERS\rspndr.sys
0xAB717000 \SystemRoot\system32\drivers\HTTP.sys
0xA9C0C000 \SystemRoot\System32\DRIVERS\srvnet.sys
0xAAC08000 \SystemRoot\system32\DRIVERS\bowser.sys
0xA9804000 \SystemRoot\System32\drivers\mpsdrv.sys
0xAB23E000 \SystemRoot\system32\drivers\mrxdav.sys
0xAB302000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xADDC7000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0xAB22C000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0xAB69C000 \SystemRoot\System32\DRIVERS\srv2.sys
0xADD76000 \SystemRoot\System32\DRIVERS\srv.sys
0xAF922000 \SystemRoot\system32\drivers\peauth.sys
0xAAD71000 \SystemRoot\System32\Drivers\secdrv.SYS
0x8F787000 \SystemRoot\System32\drivers\tcpipreg.sys
0xB0236000 \SystemRoot\System32\Drivers\SRTSP.SYS
0xB1731000 \??\C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20070430.018\NAVEX15.SYS
0xAF800000 \??\C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20070430.018\NAVENG.SYS
0xD9E24000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xCC254000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x8F6D2000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0x76EA0000 \Windows\System32\ntdll.dll
Processes (total 80):
0 System Idle Process
4 System
460 C:\Windows\System32\smss.exe
588 csrss.exe
628 C:\Windows\System32\wininit.exe
640 csrss.exe
672 C:\Windows\System32\services.exe
684 C:\Windows\System32\lsass.exe
692 C:\Windows\System32\lsm.exe
792 C:\Windows\System32\winlogon.exe
876 C:\Windows\System32\svchost.exe
932 C:\Windows\System32\svchost.exe
968 C:\Windows\System32\svchost.exe
1028 C:\Windows\System32\svchost.exe
1092 C:\Windows\System32\svchost.exe
1112 C:\Windows\System32\svchost.exe
1236 C:\Windows\System32\audiodg.exe
1288 C:\Windows\System32\SLsvc.exe
1340 C:\Windows\System32\svchost.exe
1496 C:\Windows\System32\svchost.exe
1636 C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
1704 C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
1908 C:\Windows\System32\spoolsv.exe
1964 C:\Windows\System32\svchost.exe
1988 C:\Windows\System32\taskeng.exe
1996 C:\Windows\System32\dwm.exe
2044 C:\Windows\explorer.exe
752 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1260 C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
2064 C:\Program Files\Bonjour\mDNSResponder.exe
2084 C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
2152 C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
2204 C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
2272 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
2352 C:\Windows\System32\svchost.exe
2392 C:\Windows\System32\svchost.exe
2448 C:\Windows\System32\svchost.exe
2528 C:\Windows\System32\SearchIndexer.exe
2600 C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
2896 C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
3092 C:\Windows\System32\taskeng.exe
3380 C:\Program Files\Windows Defender\MSASCui.exe
3392 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
3432 C:\Windows\System32\igfxtray.exe
3452 C:\Windows\System32\hkcmd.exe
3468 C:\Windows\System32\igfxpers.exe
3504 C:\Windows\RtHDVCpl.exe
3512 C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
3520 C:\Program Files\Common Files\Symantec Shared\ccApp.exe
3536 C:\Program Files\HP\QuickPlay\QPService.exe
3560 C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
3580 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
3592 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
3632 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
3720 C:\Program Files\Java\jre6\bin\jusched.exe
3752 WmiPrvSE.exe
3820 C:\Program Files\Winamp\winampa.exe
3916 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
3936 C:\Program Files\DivX\DivX Update\DivXUpdate.exe
2420 C:\Program Files\iTunes\iTunesHelper.exe
1244 C:\Program Files\Windows Sidebar\sidebar.exe
900 C:\Program Files\Windows Live\Messenger\msnmsgr.exe
3180 C:\Program Files\uTorrent\uTorrent.exe
3164 C:\Program Files\Windows Media Player\wmpnscfg.exe
2944 C:\Program Files\Windows Media Player\wmpnetwk.exe
3912 C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
4472 C:\Windows\System32\wbem\unsecapp.exe
4820 C:\Program Files\iPod\bin\iPodService.exe
4920 C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
4452 C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
5164 C:\Windows\System32\wuauclt.exe
1656 C:\Program Files\Java\jre6\bin\jucheck.exe
5120 C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
5740 C:\Windows\System32\igfxsrvc.exe
4320 C:\Windows\System32\conime.exe
512 C:\Program Files\Mozilla Firefox\firefox.exe
5876 taskeng.exe
5996 dllhost.exe
540 dllhost.exe
3288 C:\Users\sneha\Desktop\MBRCheck.exe
\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (NTFS)
\\.\E: --> \\.\PhysicalDrive0 at offset 0x00000019`e1709400 (NTFS)
PhysicalDrive0 Model Number: FUJITSUMHY2120BH, Rev: 890B
PhysicalDrive1 Model Number: WDCWD800BEVS-60RST0, Rev: 04.01G04
Size Device Name MBR Status
--------------------------------------------
111 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: D94F393960D1CD66C2071F2D7260A5196DF105AC
74 GB \\.\PhysicalDrive1 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A
Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:
Options:
[1] Dump the MBR of a physical disk to file.
[2] Restore the MBR of a physical disk with a standard boot code.
[3] Exit.
Enter your choice:
ComboFix Log:
ComboFix 10-09-08.03 - sneha 09/09/2010 16:03:24.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.2.1033.18.2038.1154 [GMT -4:00]
Running from: c:\users\sneha\Desktop\ComboFix.exe
AV: Norton Internet Security *On-access scanning enabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
SP: Norton Internet Security *enabled* (Outdated) {CBB7EE13-8244-4DAB-8B55-D5C7AA91E59A}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\skypexxxxx.exe
c:\skypexxxxx.exe\config.bin
c:\skypexxxxx.exe\skypexxxxx.exe
c:\users\sneha\AppData\Local\{9F10ABB7-F265-46B1-AF38-0629B98AE180}
c:\users\sneha\AppData\Local\{9F10ABB7-F265-46B1-AF38-0629B98AE180}\chrome.manifest
c:\users\sneha\AppData\Local\{9F10ABB7-F265-46B1-AF38-0629B98AE180}\chrome\content\_cfg.js
c:\users\sneha\AppData\Local\{9F10ABB7-F265-46B1-AF38-0629B98AE180}\chrome\content\overlay.xul
c:\users\sneha\AppData\Local\{9F10ABB7-F265-46B1-AF38-0629B98AE180}\install.rdf
c:\users\sneha\AppData\Local\Windows Server
c:\users\sneha\AppData\Local\Windows Server\flags.ini
c:\users\sneha\AppData\Local\Windows Server\hlp.dat
c:\users\sneha\AppData\Local\Windows Server\server.dat
c:\users\sneha\AppData\Local\Windows Server\uses32.dat
c:\users\sneha\AppData\Roaming\DCF643561188472D4B335BF8483C0CD0
c:\users\sneha\AppData\Roaming\DCF643561188472D4B335BF8483C0CD0\enemies-names.txt
c:\users\sneha\AppData\Roaming\DCF643561188472D4B335BF8483C0CD0\local.ini
c:\users\sneha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Antimalware Doctor
c:\users\sneha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Antimalware Doctor\Antimalware Doctor.lnk
c:\users\sneha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Antimalware Doctor\Uninstall.lnk
c:\windows\system32\drivers\gbsbi.sys
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_usnjsvc
-------\Service_eeagtee
((((((((((((((((((((((((( Files Created from 2010-08-09 to 2010-09-09 )))))))))))))))))))))))))))))))
.
2010-09-09 19:59 . 2010-09-09 20:00 -------- d-----w- C:\32788R22FWJFW
2010-08-26 02:31 . 2010-08-26 02:31 -------- d-----w- C:\_temp
2010-08-26 01:07 . 2010-09-02 01:08 -------- d-----w- c:\users\sneha\AppData\Local\Windows
2010-08-26 00:57 . 2010-08-26 03:41 -------- d-----w- c:\program files\CHM To PDF Converter PRO
2010-08-23 18:20 . 2010-08-23 18:21 -------- d-----w- c:\program files\QuickTime
2010-08-23 18:17 . 2010-08-23 18:17 -------- d-----w- c:\program files\Safari
2010-08-23 18:12 . 2010-08-23 18:12 -------- d-----w- c:\program files\iPod
2010-08-23 18:12 . 2010-08-23 18:13 -------- d-----w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-08-23 18:12 . 2010-08-23 18:13 -------- d-----w- c:\program files\iTunes
2010-08-23 18:01 . 2010-08-23 18:01 -------- d-----w- c:\program files\Bonjour
2010-08-19 21:28 . 2009-02-24 22:42 116736 ----a-w- c:\windows\system32\drivers\mcdbus.sys
2010-08-19 21:28 . 2010-08-19 21:30 -------- d-----w- c:\program files\MagicDisc
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-09 20:22 . 2009-11-01 00:00 -------- d-----w- c:\users\sneha\AppData\Roaming\uTorrent
2010-09-01 01:07 . 2008-12-15 02:36 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-23 18:15 . 2010-03-03 04:08 -------- d-----w- c:\users\sneha\AppData\Roaming\Apple Computer
2010-08-23 18:12 . 2010-03-03 04:01 -------- d-----w- c:\program files\Common Files\Apple
2010-08-23 18:12 . 2010-03-03 04:04 -------- d-----w- c:\programdata\Apple Computer
2010-08-13 07:58 . 2007-08-21 08:42 -------- d-----w- c:\programdata\Microsoft Help
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-04-12 1232896]
"HPAdvisor"="c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2007-03-20 1773568]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-05-24 322352]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-04-12 1006264]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-13 827392]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-04-04 138008]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-04-04 154392]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-04-04 133912]
"RtHDVCpl"="RtHDVCpl.exe" [2007-03-09 4390912]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-02-12 174872]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 115816]
"IS CfgWiz"="c:\program files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\cltUIStb.exe" [2007-01-13 431752]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-04-24 176128]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-02-13 159744]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-03-12 50696]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-17 49152]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-15 136600]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-04-01 36352]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-08-10 421888]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-08 44128]
c:\users\sneha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2010-8-19 576000]
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
R3 IDSvix86;Symantec Intrusion Prevention Driver;c:\progra~2\Symantec\DEFINI~1\SymcData\idsdefs\20070108.003\IDSvix86.sys [2006-12-28 212280]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - COMHOST
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_CA&c=73&bd=Pavilion&pf=laptop
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_CA&c=73&bd=Pavilion&pf=laptop
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\sneha\AppData\Roaming\Mozilla\Firefox\Profiles\flbqlwud.default\
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Veetle\Player\npvlc.dll
FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll
FF - plugin: c:\program files\Veetle\VLCBroadcast\npvbp.dll
FF - plugin: c:\users\sneha\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-skypexxxxx.exe - c:\skypexxxxx.exe\skypexxxxx.exe
AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files\DivX\DivXCodecUninstall.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-09 16:26
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Symantec Shared\ccSvcHst.exe
c:\program files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
c:\program files\Common Files\Symantec Shared\ccSvcHst.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files\HP\QuickPlay\Kernel\TV\CLSched.exe
c:\windows\system32\conime.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
.
**************************************************************************
.
Completion time: 2010-09-09 16:36:25 - machine was rebooted
ComboFix-quarantined-files.txt 2010-09-09 20:36
Pre-Run: 2,324,242,432 bytes free
Post-Run: 2,967,732,224 bytes free
- - End Of File - - 9873CB34F5E4DB6431F701C7792039B7
Restarting computer should fix the issue.Quote:
"illegal operation attempted on a registry key that has been marked for deletion."
Your MBR seems to be infected.
Run MBRCheck again.
When it's done you'll see the following line:
Enter 'Y' and hit ENTER for more options, or 'N' to exit:
Press the Y key and then press Enter
When the program asks you to Enter your choice, enter 2 and press the Enter key.
Next the program will ask you to Enter the physical disk number to fix (0-99, -1 to cancel):
Enter 0 (zero) and press the Enter key.
Next the program will show Available MBR codes:, followed by a list of operating systems.
Please enter 3 for Windows Vista, and then press Enter.
Next the program will prompt for confirmation.
Type YES and hit Enter.
When it's done there should be a text file with the results on your desktop.
Please copy and paste it back here.
Then, reboot, run MBRCheck again and post new log.
Sorry for the delay.
I have run the MBR check as instructed. My computer has been off for the past several days and I ran the scan on start up today. It once again said that something was incorrect or infected, and would I like to fix. I did not fix anything this time.
logs-
BRCheck, version 1.2.3
(c) 2010, AD
Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: (build 6000), 32-bit
Base Board Manufacturer: Quanta
BIOS Manufacturer: Hewlett-Packard
System Manufacturer: Hewlett-Packard
System Product Name: HP Pavilion dx6500 Notebook PC
Logical Drives Mask: 0x000001fc
Kernel Drivers (total 156):
0x81C00000 \SystemRoot\system32\ntkrnlpa.exe
0x81FA1000 \SystemRoot\system32\hal.dll
0x802C6000 \SystemRoot\system32\kdcom.dll
0x80266000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x8025D000 \SystemRoot\system32\PSHED.dll
0x80255000 \SystemRoot\system32\BOOTVID.dll
0x8021A000 \SystemRoot\system32\CLFS.SYS
0x8051F000 \SystemRoot\system32\CI.dll
0x804A4000 \SystemRoot\system32\drivers\Wdf01000.sys
0x8020D000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x80461000 \SystemRoot\system32\drivers\acpi.sys
0x80204000 \SystemRoot\system32\drivers\WMILIB.SYS
0x80459000 \SystemRoot\system32\drivers\msisadrv.sys
0x80434000 \SystemRoot\system32\drivers\pci.sys
0x80425000 \SystemRoot\system32\drivers\volmgr.sys
0x80201000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x8041B000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x8040B000 \SystemRoot\System32\drivers\mountmgr.sys
0x80404000 \SystemRoot\system32\DRIVERS\pciide.sys
0x807F2000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x807A8000 \SystemRoot\System32\drivers\volmgrx.sys
0x806EA000 \SystemRoot\system32\DRIVERS\iaStor.sys
0x806E2000 \SystemRoot\system32\drivers\atapi.sys
0x806C4000 \SystemRoot\system32\drivers\ataport.SYS
0x80693000 \SystemRoot\system32\drivers\fltmgr.sys
0x80683000 \SystemRoot\system32\drivers\fileinfo.sys
0x8067A000 \SystemRoot\System32\Drivers\PxHelp20.sys
0x876FC000 \SystemRoot\system32\drivers\ndis.sys
0x8064F000 \SystemRoot\system32\drivers\msrpc.sys
0x80616000 \SystemRoot\system32\drivers\NETIO.SYS
0x878F8000 \SystemRoot\System32\Drivers\Ntfs.sys
0x87692000 \SystemRoot\System32\Drivers\ksecdd.sys
0x8765C000 \SystemRoot\system32\drivers\volsnap.sys
0x8060E000 \SystemRoot\System32\Drivers\spldr.sys
0x8764D000 \SystemRoot\System32\drivers\partmgr.sys
0x8763E000 \SystemRoot\System32\Drivers\mup.sys
0x87619000 \SystemRoot\System32\drivers\ecache.sys
0x87608000 \SystemRoot\system32\drivers\disk.sys
0x878D7000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x80605000 \SystemRoot\system32\drivers\crcdisk.sys
0x8820F000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x87842000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x88690000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x8B0A0000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x8860F000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x8B21A000 \SystemRoot\system32\DRIVERS\igdkmd32.sys
0x8B003000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x88602000 \SystemRoot\System32\drivers\watchdog.sys
0x88635000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x8A805000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8864A000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8B11E000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8B9D9000 \SystemRoot\system32\DRIVERS\NETw4v32.sys
0x8B107000 \SystemRoot\system32\DRIVERS\Rtlh86.sys
0x88700000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x8B0F9000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x8B0E1000 \SystemRoot\system32\DRIVERS\sdbus.sys
0x87833000 \SystemRoot\system32\DRIVERS\rimmptsk.sys
0x8B206000 \SystemRoot\system32\DRIVERS\rimsptsk.sys
0x8B898000 \SystemRoot\system32\DRIVERS\rixdptsk.sys
0x8A866000 \SystemRoot\system32\DRIVERS\cpqbttn.sys
0x88720000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x8B14C000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x8B885000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x8B87A000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x8B84F000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x88670000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x8B844000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x8B82C000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8B1BE000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x8B801000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8BDC0000 \SystemRoot\system32\DRIVERS\storport.sys
0x8BDB5000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8BD9E000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x8BD93000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x8BD70000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x8B8E9000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x8BD5D000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x8B8F8000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8BD33000 \SystemRoot\system32\DRIVERS\mcdbus.sys
0x8BD0D000 \SystemRoot\system32\DRIVERS\SCSIPORT.SYS
0x88664000 \SystemRoot\system32\DRIVERS\swenum.sys
0x8BCE3000 \SystemRoot\system32\DRIVERS\ks.sys
0x8BCD9000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8BD50000 \SystemRoot\system32\DRIVERS\umbus.sys
0x8BC95000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x8B0BB000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x88780000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x8C256000 \SystemRoot\system32\drivers\RTKVHDA.sys
0x8BC1B000 \SystemRoot\system32\drivers\portcls.sys
0x8C231000 \SystemRoot\system32\drivers\drmk.sys
0x8B0CD000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x8B168000 \SystemRoot\System32\Drivers\Null.SYS
0x8B16F000 \SystemRoot\System32\Drivers\Beep.SYS
0x8C225000 \SystemRoot\System32\drivers\vga.sys
0x8C204000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8A9F8000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x88658000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8BC00000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8C7D2000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8B0D6000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x8C66D000 \SystemRoot\System32\drivers\tcpip.sys
0x8C654000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8C9EB000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8C600000 \SystemRoot\system32\DRIVERS\smb.sys
0x8C9A4000 \SystemRoot\system32\drivers\afd.sys
0x8C972000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8C95C000 \SystemRoot\system32\DRIVERS\pacer.sys
0x8C94E000 \SystemRoot\system32\DRIVERS\netbios.sys
0x8866C000 \SystemRoot\system32\DRIVERS\eabfiltr.sys
0x8C93B000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x8C92A000 \SystemRoot\System32\Drivers\SRTSPX.SYS
0x8C8EF000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8C8E5000 \SystemRoot\system32\drivers\nsiproxy.sys
0x8C883000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
0x8C86C000 \SystemRoot\System32\Drivers\dfsc.sys
0x8C805000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x8A90F000 \SystemRoot\System32\Drivers\usbvideo.sys
0x8A8D4000 \SystemRoot\system32\DRIVERS\udfs.sys
0x8A8BE000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x8BC48000 \SystemRoot\System32\Drivers\crashdmp.sys
0x8E142000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0x8C76F000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x8A990000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x94600000 \SystemRoot\System32\win32k.sys
0x8A876000 \SystemRoot\System32\drivers\Dxapi.sys
0x8B916000 \SystemRoot\system32\DRIVERS\monitor.sys
0xA5E00000 \SystemRoot\System32\TSDDD.dll
0xA5E10000 \SystemRoot\System32\cdd.dll
0xA5E20000 \SystemRoot\System32\ATMFD.DLL
0x95285000 \SystemRoot\system32\drivers\luafv.sys
0xA9372000 \SystemRoot\system32\drivers\spsys.sys
0x95200000 \SystemRoot\system32\DRIVERS\lltdio.sys
0xA9347000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x8A8A4000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xA9334000 \SystemRoot\system32\DRIVERS\rspndr.sys
0xAAC07000 \SystemRoot\system32\drivers\HTTP.sys
0xAAE45000 \SystemRoot\System32\DRIVERS\srvnet.sys
0xAC5C7000 \SystemRoot\system32\DRIVERS\bowser.sys
0xAC5B3000 \SystemRoot\System32\drivers\mpsdrv.sys
0xAC593000 \SystemRoot\system32\drivers\mrxdav.sys
0xAC575000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xABFC7000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0xAA5E0000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0xABFA3000 \SystemRoot\System32\DRIVERS\srv2.sys
0xABF52000 \SystemRoot\System32\DRIVERS\srv.sys
0xAD922000 \SystemRoot\system32\drivers\peauth.sys
0xAAD60000 \SystemRoot\System32\Drivers\secdrv.SYS
0xAACBB000 \SystemRoot\System32\drivers\tcpipreg.sys
0xADD36000 \SystemRoot\System32\Drivers\SRTSP.SYS
0xADC67000 \??\C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20070430.018\NAVEX15.SYS
0xAA4E3000 \??\C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20070430.018\NAVENG.SYS
0x8ACDC000 \SystemRoot\System32\Drivers\fastfat.SYS
0x8C78A000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0xCAA36000 \SystemRoot\System32\Drivers\usbaapl.sys
0x77100000 \Windows\System32\ntdll.dll
Processes (total 82):
0 System Idle Process
4 System
456 C:\Windows\System32\smss.exe
588 csrss.exe
628 C:\Windows\System32\wininit.exe
640 csrss.exe
672 C:\Windows\System32\services.exe
684 C:\Windows\System32\lsass.exe
692 C:\Windows\System32\lsm.exe
796 C:\Windows\System32\winlogon.exe
888 C:\Windows\System32\svchost.exe
944 C:\Windows\System32\svchost.exe
980 C:\Windows\System32\svchost.exe
1072 C:\Windows\System32\svchost.exe
1100 C:\Windows\System32\svchost.exe
1144 C:\Windows\System32\svchost.exe
1252 C:\Windows\System32\audiodg.exe
1284 C:\Windows\System32\SLsvc.exe
1344 C:\Windows\System32\svchost.exe
1520 C:\Windows\System32\svchost.exe
1700 C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
1768 C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
1940 C:\Windows\System32\dwm.exe
1960 C:\Windows\explorer.exe
2008 C:\Windows\System32\spoolsv.exe
2024 C:\Windows\System32\taskeng.exe
2044 C:\Windows\System32\svchost.exe
1044 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
884 C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
504 C:\Program Files\Bonjour\mDNSResponder.exe
2052 C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
2108 C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
2144 C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
2164 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
2228 C:\Windows\System32\svchost.exe
2292 C:\Windows\System32\svchost.exe
2468 C:\Windows\System32\svchost.exe
2648 C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
3532 C:\Windows\System32\taskeng.exe
3908 C:\Program Files\Windows Defender\MSASCui.exe
3928 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
3944 WmiPrvSE.exe
3996 C:\Windows\System32\igfxtray.exe
4008 C:\Windows\System32\hkcmd.exe
4016 C:\Windows\System32\igfxpers.exe
4064 C:\Windows\RtHDVCpl.exe
4080 C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
2080 C:\Program Files\Common Files\Symantec Shared\ccApp.exe
1892 C:\Program Files\HP\QuickPlay\QPService.exe
2128 C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
2668 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
2856 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
1136 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
2948 C:\Program Files\Java\jre6\bin\jusched.exe
3000 C:\Program Files\Winamp\winampa.exe
2636 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
3028 C:\Program Files\DivX\DivX Update\DivXUpdate.exe
1032 C:\Program Files\iTunes\iTunesHelper.exe
2852 WmiPrvSE.exe
3116 C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
3184 C:\Program Files\Windows Sidebar\sidebar.exe
3260 C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
3056 C:\Program Files\Windows Live\Messenger\msnmsgr.exe
3092 C:\Program Files\uTorrent\uTorrent.exe
3152 C:\Program Files\Windows Media Player\wmpnscfg.exe
3660 C:\Windows\System32\wbem\unsecapp.exe
2640 C:\Program Files\Windows Media Player\wmpnetwk.exe
3124 C:\Windows\System32\igfxsrvc.exe
4188 C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
4268 C:\Program Files\iPod\bin\iPodService.exe
4504 C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
4656 C:\Windows\System32\conime.exe
4712 C:\Program Files\Hewlett-Packard\HP Advisor\SSDK04.exe
3136 C:\Program Files\Java\jre6\bin\jucheck.exe
5624 C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
5600 C:\Windows\servicing\TrustedInstaller.exe
4488 C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
4552 C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
5952 C:\Windows\System32\SearchIndexer.exe
5716 C:\Windows\System32\wuauclt.exe
4104 C:\Program Files\Mozilla Firefox\firefox.exe
1684 C:\Users\sneha\Desktop\MBRCheck.exe
\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (NTFS)
\\.\E: --> \\.\PhysicalDrive0 at offset 0x00000019`e1709400 (NTFS)
PhysicalDrive0 Model Number: FUJITSUMHY2120BH, Rev: 890B
PhysicalDrive1 Model Number: WDCWD800BEVS-60RST0, Rev: 04.01G04
Size Device Name MBR Status
--------------------------------------------
111 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: D94F393960D1CD66C2071F2D7260A5196DF105AC
74 GB \\.\PhysicalDrive1 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A
Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:
Options:
[1] Dump the MBR of a physical disk to file.
[2] Restore the MBR of a physical disk with a standard boot code.
[3] Exit.
Enter your choice: Enter the physical disk number to fix (0-99, -1 to cancel): 0Available MBR codes:
[ 0] Default (Windows Vista)
[ 1] Windows XP
[ 2] Windows Server 2003
[ 3] Windows Vista
[ 4] Windows 2008
[ 5] Windows 7
[-1] Cancel
Please select the MBR code to write to this drive: 3
Do you want to fix the MBR code? Type 'YES' and hit ENTER to continue: yes
Successfully wrote new MBR code!
Please reboot your computer to complete the fix.
Done!
Here is today's log:
MBRCheck, version 1.2.3
(c) 2010, AD
Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: (build 6000), 32-bit
Base Board Manufacturer: Quanta
BIOS Manufacturer: Hewlett-Packard
System Manufacturer: Hewlett-Packard
System Product Name: HP Pavilion dx6500 Notebook PC
Logical Drives Mask: 0x000001fc
Kernel Drivers (total 153):
0x81C00000 \SystemRoot\system32\ntkrnlpa.exe
0x81FA1000 \SystemRoot\system32\hal.dll
0x802C6000 \SystemRoot\system32\kdcom.dll
0x80266000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x8025D000 \SystemRoot\system32\PSHED.dll
0x80255000 \SystemRoot\system32\BOOTVID.dll
0x8021A000 \SystemRoot\system32\CLFS.SYS
0x8051F000 \SystemRoot\system32\CI.dll
0x804A4000 \SystemRoot\system32\drivers\Wdf01000.sys
0x8020D000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x80461000 \SystemRoot\system32\drivers\acpi.sys
0x80204000 \SystemRoot\system32\drivers\WMILIB.SYS
0x80459000 \SystemRoot\system32\drivers\msisadrv.sys
0x80434000 \SystemRoot\system32\drivers\pci.sys
0x80425000 \SystemRoot\system32\drivers\volmgr.sys
0x80201000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x8041B000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x8040B000 \SystemRoot\System32\drivers\mountmgr.sys
0x80404000 \SystemRoot\system32\DRIVERS\pciide.sys
0x807F2000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x807A8000 \SystemRoot\System32\drivers\volmgrx.sys
0x806EA000 \SystemRoot\system32\DRIVERS\iaStor.sys
0x806E2000 \SystemRoot\system32\drivers\atapi.sys
0x806C4000 \SystemRoot\system32\drivers\ataport.SYS
0x80693000 \SystemRoot\system32\drivers\fltmgr.sys
0x80683000 \SystemRoot\system32\drivers\fileinfo.sys
0x8067A000 \SystemRoot\System32\Drivers\PxHelp20.sys
0x876FC000 \SystemRoot\system32\drivers\ndis.sys
0x8064F000 \SystemRoot\system32\drivers\msrpc.sys
0x80616000 \SystemRoot\system32\drivers\NETIO.SYS
0x878F8000 \SystemRoot\System32\Drivers\Ntfs.sys
0x87692000 \SystemRoot\System32\Drivers\ksecdd.sys
0x8765C000 \SystemRoot\system32\drivers\volsnap.sys
0x8060E000 \SystemRoot\System32\Drivers\spldr.sys
0x8764D000 \SystemRoot\System32\drivers\partmgr.sys
0x8763E000 \SystemRoot\System32\Drivers\mup.sys
0x87619000 \SystemRoot\System32\drivers\ecache.sys
0x87608000 \SystemRoot\system32\drivers\disk.sys
0x878D7000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x80605000 \SystemRoot\system32\drivers\crcdisk.sys
0x88A6A000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x88B2C000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x88A33000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x88B35000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x88A7E000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x8B21A000 \SystemRoot\system32\DRIVERS\igdkmd32.sys
0x8AE15000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x88A97000 \SystemRoot\System32\drivers\watchdog.sys
0x8AE0A000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x8B9C3000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8B20C000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8B961000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8BDD9000 \SystemRoot\system32\DRIVERS\NETw4v32.sys
0x8B94A000 \SystemRoot\system32\DRIVERS\Rtlh86.sys
0x88770000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x8B8CC000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x8B8B4000 \SystemRoot\system32\DRIVERS\sdbus.sys
0x88610000 \SystemRoot\system32\DRIVERS\rimmptsk.sys
0x8B8A0000 \SystemRoot\system32\DRIVERS\rimsptsk.sys
0x8B84F000 \SystemRoot\system32\DRIVERS\rixdptsk.sys
0x8AF18000 \SystemRoot\system32\DRIVERS\cpqbttn.sys
0x88780000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x8B8E1000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x8B83C000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x8B201000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x8B811000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x88BE4000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x8B806000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x8B9AB000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8AED0000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x8BDAE000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8BD6E000 \SystemRoot\system32\DRIVERS\storport.sys
0x8B9A0000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8BD57000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x8BD4C000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x8BD29000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x8861F000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x8BD16000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x8862E000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8BCEC000 \SystemRoot\system32\DRIVERS\mcdbus.sys
0x8BCC6000 \SystemRoot\system32\DRIVERS\SCSIPORT.SYS
0x88BE0000 \SystemRoot\system32\DRIVERS\swenum.sys
0x8BC9C000 \SystemRoot\system32\DRIVERS\ks.sys
0x8AE00000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8BD09000 \SystemRoot\system32\DRIVERS\umbus.sys
0x8BC68000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x88B62000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x887D0000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x8C056000 \SystemRoot\system32\drivers\RTKVHDA.sys
0x8C029000 \SystemRoot\system32\drivers\portcls.sys
0x8C004000 \SystemRoot\system32\drivers\drmk.sys
0x88B6B000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x8B920000 \SystemRoot\System32\Drivers\Null.SYS
0x8B927000 \SystemRoot\System32\Drivers\Beep.SYS
0x8C5E4000 \SystemRoot\System32\drivers\vga.sys
0x8C5C3000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x88B0C000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x88B14000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8C598000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8BC0A000 \SystemRoot\System32\Drivers\Npfs.SYS
0x88B74000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x8C4C3000 \SystemRoot\System32\drivers\tcpip.sys
0x8C4AA000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8C495000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8C481000 \SystemRoot\system32\DRIVERS\smb.sys
0x8C43A000 \SystemRoot\system32\drivers\afd.sys
0x8C408000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8C7EA000 \SystemRoot\system32\DRIVERS\pacer.sys
0x8C7DC000 \SystemRoot\system32\DRIVERS\netbios.sys
0x88BD6000 \SystemRoot\system32\DRIVERS\eabfiltr.sys
0x8C7C9000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x8C7B8000 \SystemRoot\System32\Drivers\SRTSPX.SYS
0x8C77D000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8B996000 \SystemRoot\system32\drivers\nsiproxy.sys
0x8C63B000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
0x8C624000 \SystemRoot\System32\Drivers\dfsc.sys
0x88B59000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x88AB4000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x8D9E9000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x8D9C8000 \SystemRoot\System32\Drivers\usbvideo.sys
0x8AFC5000 \SystemRoot\system32\DRIVERS\udfs.sys
0x8AFAF000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x88A0A000 \SystemRoot\System32\Drivers\crashdmp.sys
0x8D83A000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0x94800000 \SystemRoot\System32\win32k.sys
0x8C69D000 \SystemRoot\System32\drivers\Dxapi.sys
0x8865B000 \SystemRoot\system32\DRIVERS\monitor.sys
0xA5800000 \SystemRoot\System32\TSDDD.dll
0xA5810000 \SystemRoot\System32\cdd.dll
0xA5820000 \SystemRoot\System32\ATMFD.DLL
0xA64E5000 \SystemRoot\system32\drivers\luafv.sys
0xA7F72000 \SystemRoot\system32\drivers\spsys.sys
0x887B0000 \SystemRoot\system32\DRIVERS\lltdio.sys
0xA7E35000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x8C6C5000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xA705D000 \SystemRoot\system32\DRIVERS\rspndr.sys
0xAB353000 \SystemRoot\system32\drivers\HTTP.sys
0xAA401000 \SystemRoot\System32\DRIVERS\srvnet.sys
0xAA523000 \SystemRoot\system32\DRIVERS\bowser.sys
0xAA50F000 \SystemRoot\System32\drivers\mpsdrv.sys
0xAB2F3000 \SystemRoot\system32\drivers\mrxdav.sys
0xAB2D5000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xAB29C000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0xAB28A000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0xAB266000 \SystemRoot\System32\DRIVERS\srv2.sys
0xABBAF000 \SystemRoot\System32\DRIVERS\srv.sys
0xAD122000 \SystemRoot\system32\drivers\peauth.sys
0x8C71F000 \SystemRoot\System32\Drivers\secdrv.SYS
0xA7ECE000 \SystemRoot\System32\drivers\tcpipreg.sys
0xAE0F6000 \SystemRoot\System32\Drivers\SRTSP.SYS
0xAE027000 \??\C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20070430.018\NAVEX15.SYS
0xABA09000 \??\C:\PROGRA~2\Symantec\DEFINI~1\VIRUSD~1\20070430.018\NAVENG.SYS
0x777E0000 \Windows\System32\ntdll.dll
Processes (total 82):
0 System Idle Process
4 System
456 C:\Windows\System32\smss.exe
544 csrss.exe
584 C:\Windows\System32\wininit.exe
596 csrss.exe
628 C:\Windows\System32\services.exe
640 C:\Windows\System32\lsass.exe
648 C:\Windows\System32\lsm.exe
724 C:\Windows\System32\winlogon.exe
840 C:\Windows\System32\svchost.exe
900 C:\Windows\System32\svchost.exe
936 C:\Windows\System32\svchost.exe
1024 C:\Windows\System32\svchost.exe
1048 C:\Windows\System32\svchost.exe
1068 C:\Windows\System32\svchost.exe
1132 C:\Windows\System32\audiodg.exe
1176 C:\Windows\System32\SLsvc.exe
1212 C:\Windows\System32\svchost.exe
1348 C:\Windows\System32\svchost.exe
1624 C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
1732 C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
1852 C:\Windows\System32\dwm.exe
1876 C:\Windows\explorer.exe
1940 C:\Windows\System32\spoolsv.exe
1948 C:\Windows\System32\taskeng.exe
1972 C:\Windows\System32\svchost.exe
1536 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1820 C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
1552 C:\Program Files\Bonjour\mDNSResponder.exe
1432 C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
1764 C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
2060 C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
2084 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
2212 C:\Windows\System32\svchost.exe
2288 C:\Windows\System32\svchost.exe
2364 C:\Windows\System32\svchost.exe
2400 C:\Windows\System32\SearchIndexer.exe
2540 C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
2792 WmiPrvSE.exe
2876 C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
3040 C:\Windows\System32\taskeng.exe
3312 C:\Program Files\Windows Defender\MSASCui.exe
3320 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
3356 C:\Windows\System32\igfxtray.exe
3396 C:\Windows\System32\hkcmd.exe
3452 C:\Windows\System32\igfxsrvc.exe
3468 C:\Windows\System32\igfxpers.exe
3532 C:\Windows\RtHDVCpl.exe
3544 C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
3552 C:\Program Files\Common Files\Symantec Shared\ccApp.exe
3584 C:\Program Files\HP\QuickPlay\QPService.exe
3592 C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
3620 C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
3632 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
3652 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
3660 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
3676 C:\Program Files\Java\jre6\bin\jusched.exe
3684 C:\Program Files\Winamp\winampa.exe
3692 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
3716 C:\Program Files\DivX\DivX Update\DivXUpdate.exe
3728 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
3748 C:\Program Files\iTunes\iTunesHelper.exe
3960 WmiPrvSE.exe
4036 C:\Program Files\Windows Sidebar\sidebar.exe
1824 C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
2236 C:\Program Files\Windows Live\Messenger\msnmsgr.exe
1704 C:\Program Files\uTorrent\uTorrent.exe
1860 C:\Program Files\Windows Media Player\wmpnscfg.exe
3516 C:\Windows\System32\wbem\unsecapp.exe
3244 C:\Program Files\Windows Media Player\wmpnetwk.exe
4220 C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
4228 C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
4340 C:\Program Files\iPod\bin\iPodService.exe
4532 C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
4972 C:\Program Files\Hewlett-Packard\HP Advisor\SSDK04.exe
5088 C:\Windows\System32\SearchProtocolHost.exe
5328 C:\Windows\System32\SearchFilterHost.exe
5928 dllhost.exe
5964 dllhost.exe
5992 C:\Users\sneha\Desktop\MBRCheck.exe
6004 C:\Windows\System32\conime.exe
\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (NTFS)
\\.\E: --> \\.\PhysicalDrive0 at offset 0x00000019`e1709400 (NTFS)
PhysicalDrive0 Model Number: FUJITSUMHY2120BH, Rev: 890B
PhysicalDrive1 Model Number: WDCWD800BEVS-60RST0, Rev: 04.01G04
Size Device Name MBR Status
--------------------------------------------
111 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: D94F393960D1CD66C2071F2D7260A5196DF105AC
74 GB \\.\PhysicalDrive1 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A
Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:
Options:
[1] Dump the MBR of a physical disk to file.
[2] Restore the MBR of a physical disk with a standard boot code.
[3] Exit.
Enter your choice:
Your last post was September 9th, so with this pace, it'll take a while to fix your computer and on a top of it, if you keep using it in its current state, we'll be going circles.
Please download NTBR by noahdfear and save it to your Desktop.
File size: 2.44 MB (2,565,432 bytes)
- Place a blank CD in your CD drive.
- Double click on NTBR_CD.exe file and a folder of the same name will appear.
- Open the folder and double click on BurnItCD.cmd file. If your CD drive will open, simply close it back.
- Follow the prompts to burn the CD.
- Now you will need to set the CD-Rom as first boot device if it isn't already (if you don't know how to do it, see HERE)
- If you have any questions about this step, ask before you proceed. If you enter the BIOS and are unsure if you have carried out the step correctly, there should be an option to exit without keeping changes, so you won't do any harm.
- Insert the newly created CD into your infected PC and reboot your computer.
- Once you have rebooted please press Enter when prompted to continue booting from CD - you have a whole 15 seconds to do this!
- Read the warning and then continue as prompted.
- You first need to select your keyboard layout - press Enter for English.
- Next you want to select the appropriate tool. Enter 1 to choose 1. MBRWORK
- On the following screen enter 5 to select Install Standard MBR code.
- Enter 1 to overwrite the infected MBR Code with the Standard MBR code.
- When asked to confirm please do so.
- Afterwards, please enter E to leave MBRWORK, then 6 to leave the bootable CD.
- Eject the disc and then press ctrl+alt+del to reboot the PC.
Once rebooted, run MBRCheck again and post its log.