Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Virus in my local c drive consuming space


  • Please log in to reply

#1
Mustafa Naim

Mustafa Naim

    New Member

  • Member
  • Pip
  • 3 posts
hi guys actuallly i m a newbie to this site\..Few months before my hard disk was attacked by a virus without my notice it took atleast 17gb space of my cdrive i made a partion of 20gb in cdrive & 34 gb in Ddrive...so i used combo fix for deleting the virus...after using combo fix my laptop got reboted ..now its stuck in this "do not run any program"..so is there something that i need to do for deleting the virus from my cdrive or is it good...The virus has consumed WINDOWS folder....
  • 0

Advertisements


#2
Mustafa Naim

Mustafa Naim

    New Member

  • Topic Starter
  • Member
  • Pip
  • 3 posts
hello guys... please help me in this...my local c drive is having 0mb space bcoz a virus in my c drive took all the space..it took at least 17 gb ...i doubled checked..First:-I clicked on my local c drive..then i clicked on a folder name 'WINDOWS' & clicked on properties...i saw that the folder took 17.67 gb out of 19 gb...I was shocked..the 'windows' folder was in blue colour & other files were also in blue colour...so i used combo fix & i got a log file to share please check & say wats d prob Attached File  log.txt   14.66KB   59 downloads
  • 0

#3
Mustafa Naim

Mustafa Naim

    New Member

  • Topic Starter
  • Member
  • Pip
  • 3 posts
This is the log file i got please reply soon

ComboFix 11-08-17.03 - user1 08/18/2011 13:52:36.1.1 - x86
Running from: d:\downloads\ComboFix.exe
AV: AntiVir Desktop *Disabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\user1\usbsermpt.sys
c:\documents and settings\user1\usbsermptxp.sys
c:\program files\FunWebProducts
c:\program files\FunWebProducts\ScreenSaver\Images\006E2B7D.urr
c:\program files\FunWebProducts\ScreenSaver\Images\045E39DE.urr
c:\program files\FunWebProducts\Shared\018A9D2D.dat
c:\program files\MyWebSearch
c:\program files\MyWebSearch\bar\History\search3
c:\program files\MyWebSearch\bar\Settings\s_FeatCk.dat
c:\program files\MyWebSearch\bar\Settings\s_FeatCk.dat.bak
c:\program files\MyWebSearch\bar\Settings\s_pid.dat
c:\windows\$NARWE4234Uninstall$
c:\windows\$NARWE4234Uninstall$\punstl.exe
c:\windows\system32\1ff6869f-0bce-a64d-57da-b3efa0b13ab8.exe
c:\windows\system32\28463
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_ABEL
-------\Legacy_NPF
-------\Service_Abel
-------\Service_NPF
.
.
((((((((((((((((((((((((( Files Created from 2011-07-18 to 2011-08-18 )))))))))))))))))))))))))))))))
.
.
2011-07-24 08:56 . 2011-07-24 08:56 -------- d-----w- c:\documents and settings\user1\Application Data\ibibo
2011-07-24 08:56 . 2011-07-24 08:57 -------- d-----w- c:\documents and settings\user1\Application Data\Tencent
2011-07-24 08:55 . 2011-07-24 08:55 -------- d-----w- c:\program files\Common Files\ibibo
2011-07-23 16:48 . 2011-07-23 16:48 -------- d-----w- c:\documents and settings\All Users\Application Data\RegCure
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-12 11:26 . 2011-06-02 06:22 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-15 13:29 . 2006-03-15 12:00 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2006-03-15 12:00 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-06-24 14:10 . 2010-01-28 07:09 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-22 16:27 . 2011-06-22 16:24 22768 ----a-w- c:\windows\system32\drivers\usbsermpt.sys
2011-06-21 18:45 . 2006-03-15 12:00 832512 ----a-w- c:\windows\system32\wininet.dll
2011-06-21 18:45 . 2006-03-15 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2011-06-21 18:45 . 2006-03-15 12:00 1830912 ------w- c:\windows\system32\inetcpl.cpl
2011-06-21 18:45 . 2006-03-15 12:00 17408 ------w- c:\windows\system32\corpol.dll
2011-06-21 11:47 . 2006-03-15 12:00 389120 ----a-w- c:\windows\system32\html.iec
2011-06-20 17:44 . 2006-03-15 12:00 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-06-02 14:02 . 2006-03-15 12:00 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-05-27 06:29 . 2011-05-26 13:22 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-05-26 15:22 . 2006-03-15 12:00 218624 ----a-w- c:\windows\system32\uxtheme.dll
2011-05-26 14:35 . 2011-05-26 14:22 2856 ----a-w- c:\documents and settings\All Users\Application Data\bdinstall.bin
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2011-04-02 399736]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560]
"cdloader"="c:\documents and settings\user1\Application Data\mjusbsp\cdloader2.exe" [2010-02-26 50520]
"Messenger (Yahoo!)"="c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe" [2010-06-01 5252408]
"ares"="c:\program files\Ares\Ares.exe" [2010-01-22 1011712]
"GameTracker"="d:\movies & videos\GameTracker\GTLite.exe" [2010-10-13 4018984]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-07-19 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-07-19 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-07-19 114688]
"SigmatelSysTrayApp"="stsystra.exe" [2005-09-09 393216]
"Dell QuickSet"="c:\program files\Dell\QuickSet\Quickset.exe" [2005-12-15 839680]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-29 761947]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2005-10-07 176128]
"Adobe Reader Speed Launcher"="d:\reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"Freecorder FLV Service"="d:\cain\FLVSrvc.exe" [2010-06-26 167936]
"avgnt"="d:\cain\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"IntelZeroConfig"="c:\program files\Intel\WiFi\bin\ZCfgSvc.exe" [2009-11-03 1372160]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2009-11-03 1202448]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Matrix Screen Locker.lnk - c:\program files\BaroufaSoft\Matrix Screen Locker\matrix.exe [2006-1-29 539136]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="D:\QTTask.exe" -atboottime
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Documents and Settings\\user1\\Local Settings\\Application Data\\Google\\Chrome\\Application\\chrome.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"d:\\counter strike (c zero)\\hl.exe"=
"d:\\VLC\\vlc.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\WINDOWS\\system32\\java.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"d:\\quake\\Quake3\\quake3.exe"=
"c:\\Program Files\\Ares\\chatServer.exe"=
"c:\\Documents and Settings\\user1\\Application Data\\mjusbsp\\magicJack.exe"=
"d:\\ibibo Messenger\\Bin\\ibibomsgr.exe"=
.
R3 Avgfwdx;Avgfwdx;c:\windows\system32\DRIVERS\avgfwdx.sys [2010-07-11 30432]
R3 Avgfwfd;AVG network filter service;c:\windows\system32\DRIVERS\avgfwdx.sys [2010-07-11 30432]
R3 cyzport;Cyclades-Z Port Driver;c:\windows\system32\DRIVERS\cyzport.sys [2001-08-17 49792]
R3 motandroidusb;Mot ADB Interface Driver;c:\windows\system32\Drivers\motoandroid.sys [x]
R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys [x]
R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys [x]
R3 MotDev;Motorola Inc. USB Device;c:\windows\system32\DRIVERS\motodrv.sys [x]
R3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2010-07-26 137600]
R3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2010-07-26 8576]
R3 qcusbser;CDMA USB Device for Legacy Serial Communication;c:\windows\system32\DRIVERS\qcusbser.sys [2010-02-06 106752]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-01-28 717296]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;d:\cain\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
S2 GS In-Game Service;GS In-Game Service;d:\movies & videos\GameTracker\GSInGameService.exe [2010-10-13 1677096]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [2010-09-30 1051968]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [2009-10-14 10064]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ sysagent
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder
.
2011-08-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1957994488-413027322-682003330-1002Core.job
- c:\documents and settings\user1\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-08-03 10:19]
.
2011-08-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1957994488-413027322-682003330-1002UA.job
- c:\documents and settings\user1\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-08-03 10:19]
.
2011-08-15 c:\windows\Tasks\RegCure Program Check.job
- d:\mobile files\dxg\RegCure\RegCure.exe [2010-05-19 23:20]
.
2011-07-23 c:\windows\Tasks\RegCure.job
- d:\mobile files\dxg\RegCure\RegCure.exe [2010-05-19 23:20]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://h1.ripway.com/poojasharma/index.html
mStart Page = hxxp://www.msn.com
IE: E&xport to Microsoft Excel - d:\software\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\documents and settings\user1\Application Data\Mozilla\Firefox\Profiles\87mnnm37.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/home.php?ref=hp
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - d:\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - d:\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - d:\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - d:\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - d:\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: z: {0b69f0d7-8854-bed9-a744-f4bf3e297930} - d:\extensions\{0b69f0d7-8854-bed9-a744-f4bf3e297930}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - d:\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
FF - Ext: AutoPager: [email protected] - %profile%\extensions\[email protected]
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Conduit Engine : [email protected] - %profile%\extensions\[email protected]
FF - Ext: Freecorder Community Toolbar: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - %profile%\extensions\{1392b8d2-5c05-419f-a8f6-b9f15a596612}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: PC Sync 2 Synchronisation Extension: [email protected] - d:\ret\Nokia PC Suite 7\bkmrksync
FF - Ext: Java Quick Starter: [email protected] - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
.
------- File Associations -------
.
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{dba30aec-aca0-49aa-6d1e-df72106eac82} - (no file)
BHO-{ee3409ba-c0fe-278a-4cea-d708dc5d4ae1} - (no file)
SafeBoot-Wdf01000.sys
MSConfigStartUp-My Web Search Bar Search Scope Monitor - c:\progra~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe
MSConfigStartUp-MyWebSearch Email Plugin - c:\progra~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
MSConfigStartUp-vmware-tray - d:\vmware\vmware-tray.exe
AddRemove-$NARWE4234Uninstall$ - c:\windows\$NARWE4234Uninstall$\punstl.exe
AddRemove-1ff6869f-0bce-a64d-57da-b3efa0b13ab8 - c:\windows\system32\1ff6869f-0bce-a64d-57da-b3efa0b13ab8.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-18 14:02
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(1412)
c:\windows\system32\WININET.dll
c:\documents and settings\user1\Local Settings\Application Data\FLVService\lib\FLVSrvLib.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\netprovcredman.dll
d:\software\OFFICE11\msohev.dll
c:\windows\system32\WMVCore.DLL
c:\windows\system32\WMASF.DLL
c:\windows\system32\MSWMDM.dll
c:\windows\system32\WMDMLOG.dll
c:\windows\system32\MsPMSP.dll
c:\windows\system32\cewmdm.dll
c:\windows\system32\wpdsp.dll
c:\windows\system32\WdfApi.dll
c:\windows\system32\wpdtrace.dll
c:\windows\system32\WMDMPS.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Intel\WiFi\bin\S24EvMon.exe
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\bcmwltry.exe
d:\cain\Avira\AntiVir Desktop\avguard.exe
c:\program files\Intel\WiFi\bin\EvtEng.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\stsystra.exe
c:\progra~1\Yahoo!\Messenger\ymsgr_tray.exe
c:\windows\system32\uWDF.exe
c:\windows\system32\uWDF.exe
.
**************************************************************************
.
Completion time: 2011-08-18 14:11:59 - machine was rebooted
ComboFix-quarantined-files.txt 2011-08-18 08:41
.
Pre-Run: 247,328,768 bytes free
Post-Run: 221,237,248 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[Boot Loader]
Timeout=2
Default=c:\$win_nt$.~bt\BOOTSECT.DAT
[Operating Systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect /TUTag=HBUEPR /Kernel=TUKernel.exe
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition (TuneUp Backup)" /noexecute=optin /fastdetect /TUTag=HBUEPR-BAK
.
- - End Of File - - 17C719799091C5B25250DDAB948C9A08
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP