[Kalds]

Following the previous post, http://www.geekstogo...-security-2012/

Also won't let me run MBAM

RKreport:

RogueKiller V6.2.1 [12/28/2011] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo...13-roguekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows 7 (6.1.7600 ) 64 bits version
Started in : Normal mode
User: Karwai Cheng [Admin rights]
Mode: Scan -- Date : 12/29/2011 15:25:46

¤¤¤ Bad processes: 1 ¤¤¤
[WINDOW : Win 7 Internet Security 2012] gan.exe -- C:\Users\Karwai Cheng\AppData\Local\gan.exe -> KILLED [TermProc]

¤¤¤ Registry Entries: 7 ¤¤¤
[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[FILEASSO] HKCU\[...]Software\Classes\.exe\shell\open\command : ("C:\Users\Karwai Cheng\AppData\Local\gan.exe" -a "%1" %*) -> FOUND
[FILEASSO] HKCR\[...].exe\shell\open\command : ("C:\Users\Karwai Cheng\AppData\Local\gan.exe" -a "%1" %*) -> FOUND
[FILEASSO] HKCR\.exe : (uyT) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver: [NOT LOADED] ¤¤¤

¤¤¤ Infection : Rogue.AntiSpy-AH ¤¤¤

¤¤¤ HOSTS File: ¤¤¤


¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: +++++
--- User ---
[MBR] 4b77110137fe4f542157b49680b77d4a
[BSP] 10ed711f10c2dece51a3902e594c4c11 : Windows Vista/7 MBR Code
Partition table:
0 - [XXXXXX] FAT16 [HIDDEN!] Offset (sectors): 63 | Size: 41 Mo
1 - [ACTIVE] NTFS [VISIBLE] Offset (sectors): 81920 | Size: 15728 Mo
2 - [XXXXXX] NTFS [VISIBLE] Offset (sectors): 30801920 | Size: 304301 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[1].txt >>
RKreport[1].txt

[Advertisements]

swMBR version 0.9.9.1124 Copyright© 2011 AVAST Software
Run date: 2011-12-29 15:26:46
-----------------------------
15:26:46.273 OS Version: Windows x64 6.1.7600
15:26:46.273 Number of processors: 2 586 0x602
15:26:46.274 ComputerName: KARWAICHENG-PC UserName: Karwai Cheng
15:26:49.693 Initialize success
15:27:29.564 AVAST engine defs: 11122901
15:29:40.325 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
15:29:40.332 Disk 0 Vendor: ST3320418AS CC45 Size: 305245MB BusType: 11
15:29:40.349 Disk 0 MBR read successfully
15:29:40.351 Disk 0 MBR scan
15:29:40.356 Disk 0 Windows VISTA default MBR code
15:29:40.359 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 39 MB offset 63
15:29:40.369 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 15000 MB offset 81920
15:29:40.385 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 290204 MB offset 30801920
15:29:40.391 Service scanning
15:29:42.060 Modules scanning
15:29:42.072 Disk 0 trace - called modules:
15:29:42.104 ntoskrnl.exe CLASSPNP.SYS disk.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys
15:29:42.111 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800457e440]
15:29:42.494 3 CLASSPNP.SYS[fffff8800140143f] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8004557060]
15:29:43.402 AVAST engine scan C:\Windows
15:29:45.675 AVAST engine scan C:\Windows\system32
15:31:35.384 AVAST engine scan C:\Windows\system32\drivers
15:31:45.188 AVAST engine scan C:\Users\Karwai Cheng
15:32:22.503 Disk 0 MBR has been saved successfully to "C:\Users\Karwai Cheng\Desktop\MBR.dat"
15:32:22.517 The log file has been saved successfully to "C:\Users\Karwai Cheng\Desktop\aswMBR.txt"

[Kalds]

swMBR version 0.9.9.1124 Copyright© 2011 AVAST Software
Run date: 2011-12-29 15:26:46
-----------------------------
15:26:46.273 OS Version: Windows x64 6.1.7600
15:26:46.273 Number of processors: 2 586 0x602
15:26:46.274 ComputerName: KARWAICHENG-PC UserName: Karwai Cheng
15:26:49.693 Initialize success
15:27:29.564 AVAST engine defs: 11122901
15:29:40.325 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
15:29:40.332 Disk 0 Vendor: ST3320418AS CC45 Size: 305245MB BusType: 11
15:29:40.349 Disk 0 MBR read successfully
15:29:40.351 Disk 0 MBR scan
15:29:40.356 Disk 0 Windows VISTA default MBR code
15:29:40.359 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 39 MB offset 63
15:29:40.369 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 15000 MB offset 81920
15:29:40.385 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 290204 MB offset 30801920
15:29:40.391 Service scanning
15:29:42.060 Modules scanning
15:29:42.072 Disk 0 trace - called modules:
15:29:42.104 ntoskrnl.exe CLASSPNP.SYS disk.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys
15:29:42.111 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800457e440]
15:29:42.494 3 CLASSPNP.SYS[fffff8800140143f] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa8004557060]
15:29:43.402 AVAST engine scan C:\Windows
15:29:45.675 AVAST engine scan C:\Windows\system32
15:31:35.384 AVAST engine scan C:\Windows\system32\drivers
15:31:45.188 AVAST engine scan C:\Users\Karwai Cheng
15:32:22.503 Disk 0 MBR has been saved successfully to "C:\Users\Karwai Cheng\Desktop\MBR.dat"
15:32:22.517 The log file has been saved successfully to "C:\Users\Karwai Cheng\Desktop\aswMBR.txt"