Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Possible malwear problems [Solved]


  • This topic is locked This topic is locked

#1
tonyjh

tonyjh

    Member

  • Member
  • PipPip
  • 18 posts
Hi i am trying to fix my friends computer as he is having alot of problems with it.
I can fix some things but this seems over my head. he told me he had zeroaccess virus, but ran alot of different programs to remove the virus.
Anyways this what is happening at the moment.

1)Internet options, advanced tab, is blank has no entries.

2)Internet options, security, custom is blank aswell.

3)Error messages with activex controls as follows.

Your security settings do not allow web sites to use activex controls installed on your computer. This page may not display correctly. click here for options....

The only message you get is the information help bar there are no options to adjust activex controls.

Edit:
it seems that trying to add any page to favourites causes a catastrophic error in internet explorer.

Here is OTL log

OTL logfile created on: 1/10/2012 7:15:42 AM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Owner.OWNER-41B21B8CE\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.46 Gb Available Physical Memory | 73.18% Memory free
3.85 Gb Paging File | 3.46 Gb Available in Paging File | 89.93% Paging File free
Paging file location(s): c:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 465.75 Gb Total Space | 405.88 Gb Free Space | 87.15% Space Free | Partition Type: NTFS
Drive D: | 0.38 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: OWNER-41B21B8CE | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/01/10 07:14:37 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner.OWNER-41B21B8CE\Desktop\OTL.exe
PRC - [2011/11/28 10:01:24 | 003,744,552 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2011/11/28 10:01:23 | 000,044,768 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2011/10/07 20:50:00 | 002,253,120 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
PRC - [2008/04/14 04:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


========== Modules (No Company Name) ==========

MOD - [2012/01/09 11:13:09 | 001,666,560 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\defs\12010901\algo.dll


========== Win32 Services (SafeList) ==========

SRV - [2011/11/28 10:01:23 | 000,044,768 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2011/10/07 20:50:00 | 002,253,120 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)


========== Driver Services (SafeList) ==========

DRV - [2011/11/28 09:53:53 | 000,435,032 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2011/11/28 09:53:35 | 000,314,456 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2011/11/28 09:52:19 | 000,034,392 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2011/11/28 09:52:16 | 000,052,952 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2011/11/28 09:52:02 | 000,111,320 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2011/11/28 09:51:50 | 000,020,568 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2011/11/28 09:48:49 | 000,030,808 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2009/03/04 01:58:34 | 005,045,760 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2009/01/22 00:25:26 | 000,120,064 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2008/08/05 04:10:12 | 001,684,736 | ---- | M] (Creative) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt)
DRV - [2006/01/03 23:41:48 | 001,389,056 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt)
DRV - [2001/08/17 12:51:32 | 000,018,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\irsir.sys -- (irsir)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com.au/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0




O1 HOSTS File: ([2012/01/09 16:11:20 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\nvmctray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nview\nwiz.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A1EB144C-4C75-4513-B96A-C38FC9339D3D}: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Owner.OWNER-41B21B8CE\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner.OWNER-41B21B8CE\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/08/15 11:49:32 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2009/04/29 01:02:01 | 000,000,055 | R--- | M] () - D:\autorun.inf -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (sprestrt)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/01/10 07:14:32 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Owner.OWNER-41B21B8CE\Desktop\OTL.exe
[2012/01/09 19:42:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner.OWNER-41B21B8CE\Application Data\Malwarebytes
[2012/01/09 19:42:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/01/09 19:42:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2012/01/09 19:42:46 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012/01/09 19:42:46 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012/01/09 17:45:59 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Owner.OWNER-41B21B8CE\Desktop\Tony Repair Files Registry
[2012/01/09 17:44:21 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2012/01/09 17:44:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\ERUNT
[2012/01/09 17:20:48 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2012/01/09 17:20:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner.OWNER-41B21B8CE\Application Data\Adobe
[2012/01/09 17:12:28 | 000,314,456 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2012/01/09 17:12:28 | 000,020,568 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2012/01/09 17:12:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\avast! Free Antivirus
[2012/01/09 17:12:26 | 000,052,952 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2012/01/09 17:12:26 | 000,034,392 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2012/01/09 17:12:24 | 000,111,320 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2012/01/09 17:12:24 | 000,105,176 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2012/01/09 17:12:24 | 000,030,808 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2012/01/09 17:12:16 | 000,199,816 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2012/01/09 17:12:08 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2012/01/09 16:13:22 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2012/01/09 15:59:07 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2012/01/09 15:42:32 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2012/01/09 15:37:40 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents\My Videos
[2012/01/09 15:21:33 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\appmgmt
[2012/01/09 09:16:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner.OWNER-41B21B8CE\.swt
[2012/01/09 09:15:23 | 000,000,000 | ---D | C] -- C:\Program Files\Conduit
[2012/01/09 09:15:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner.OWNER-41B21B8CE\Local Settings\Application Data\Conduit
[2012/01/09 09:15:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner.OWNER-41B21B8CE\Local Settings\Application Data\Temp
[2011/09/09 17:47:11 | 000,393,728 | ---- | C] (Корпорация Майкрософт) -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\sfa.exe
[13 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/01/10 07:14:37 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner.OWNER-41B21B8CE\Desktop\OTL.exe
[2012/01/10 06:46:24 | 000,001,230 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/01/10 06:46:23 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/01/10 06:31:22 | 000,000,718 | ---- | M] () -- C:\Documents and Settings\Owner.OWNER-41B21B8CE\Desktop\regfix.reg
[2012/01/09 19:42:47 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/01/09 18:39:13 | 000,616,658 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/01/09 18:39:13 | 000,127,292 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012/01/09 18:38:41 | 000,004,507 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012/01/09 17:18:46 | 000,002,625 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2012/01/09 17:12:28 | 000,001,689 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2012/01/09 16:26:58 | 000,285,176 | ---- | M] () -- C:\WINDOWS\System32\nvdrsdb0.bin
[2012/01/09 16:26:58 | 000,000,001 | ---- | M] () -- C:\WINDOWS\System32\nvdrssel.bin
[2012/01/09 16:26:56 | 000,285,176 | ---- | M] () -- C:\WINDOWS\System32\nvdrsdb1.bin
[2012/01/09 16:11:20 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2012/01/09 15:59:10 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2012/01/09 09:22:49 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2012/01/09 09:22:48 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2012/01/09 09:15:53 | 000,001,505 | ---- | M] () -- C:\Documents and Settings\Owner.OWNER-41B21B8CE\Application Data\Microsoft\Internet Explorer\Quick Launch\Vuze.lnk
[2012/01/09 09:15:53 | 000,001,505 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Vuze.lnk
[2012/01/09 08:29:40 | 000,090,296 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[13 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/01/10 06:25:30 | 000,000,718 | ---- | C] () -- C:\Documents and Settings\Owner.OWNER-41B21B8CE\Desktop\regfix.reg
[2012/01/09 19:42:47 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/01/09 17:12:28 | 000,001,689 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2012/01/09 15:59:10 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2012/01/09 15:59:08 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2012/01/09 09:15:53 | 000,001,505 | ---- | C] () -- C:\Documents and Settings\Owner.OWNER-41B21B8CE\Application Data\Microsoft\Internet Explorer\Quick Launch\Vuze.lnk
[2012/01/09 09:15:53 | 000,001,505 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Vuze.lnk
[2011/09/18 09:58:13 | 000,285,176 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb1.bin
[2011/09/18 09:58:13 | 000,285,176 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb0.bin
[2011/09/18 09:58:13 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\nvdrssel.bin
[2011/09/18 09:58:04 | 002,130,002 | ---- | C] () -- C:\WINDOWS\System32\nvdata.data
[2011/09/18 09:40:29 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2011/09/17 19:38:11 | 000,007,168 | ---- | C] () -- C:\Documents and Settings\Owner.OWNER-41B21B8CE\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/09/09 17:47:12 | 000,001,088 | -HS- | C] () -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\r8m0v5l806q
[2011/09/09 17:47:12 | 000,001,088 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\r8m0v5l806q
[2011/09/09 17:47:11 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\wwgb.exe
[2011/09/09 17:47:11 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\vllo.exe
[2011/09/09 17:47:11 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\upom.exe
[2011/09/09 17:47:11 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\mwhn.exe
[2011/09/09 17:47:11 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\idkd.exe
[2011/09/09 17:47:11 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\gpvx.exe
[2011/09/09 17:47:11 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\gnlo.exe
[2011/09/09 17:47:11 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\ftlh.exe
[2011/09/09 17:47:11 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\fqua.exe
[2011/09/09 17:47:11 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\cpgr.exe
[2011/09/09 17:47:11 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\bgei.exe
[2011/09/09 17:47:11 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\ahfr.exe
[2011/09/07 17:20:07 | 000,001,324 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/05/30 03:57:34 | 000,054,016 | ---- | C] () -- C:\WINDOWS\System32\drivers\fdleqj.sys
[2010/07/06 20:18:05 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2010/07/02 20:33:51 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI
[2010/04/15 22:13:59 | 000,016,332 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2009/08/26 06:34:47 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\j0780707.dat
[2009/08/23 10:21:29 | 000,004,767 | ---- | C] () -- C:\WINDOWS\Irremote.ini
[2009/08/15 11:50:46 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2009/08/15 11:47:27 | 000,022,748 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2009/08/15 04:41:22 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2009/08/15 04:38:39 | 000,090,296 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009/08/03 14:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.DLL
[2008/10/06 21:33:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2008/04/14 04:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2008/04/14 04:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2008/04/14 04:00:00 | 000,616,658 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2008/04/14 04:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2008/04/14 04:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2008/04/14 04:00:00 | 000,127,292 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2008/04/14 04:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2008/04/14 04:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2008/04/14 04:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2008/04/14 04:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2008/04/14 04:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2008/04/14 04:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2007/10/08 08:33:16 | 001,018,864 | ---- | C] () -- C:\WINDOWS\System32\samm.exe

========== LOP Check ==========

[2011/09/18 10:37:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
[2009/08/16 08:24:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Azureus
[2011/02/23 23:26:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\d848ca
[2011/05/30 03:57:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\dD01848HcPfA01848
[2011/05/23 07:17:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/02/05 17:09:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2011/05/30 04:22:49 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{AB2D8F2E-F7AD-4446-A11A-50D846B2CF2A}
[2012/01/09 09:18:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.OWNER-41B21B8CE\Application Data\Azureus
[2011/09/18 11:57:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner.OWNER-41B21B8CE\Application Data\OpenOffice.org

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 2736 bytes -> C:\WINDOWS\3514236649:369199406.exe

< End of report >

Regards
tonyh

Edited by tonyjh, 09 January 2012 - 08:51 PM.

  • 0

Advertisements


#2
tonyjh

tonyjh

    Member

  • Topic Starter
  • Member
  • PipPip
  • 18 posts
ok
This topic can be closed as i did a complete format and reinstall of windows due to major problems caused by the zeroaccess rootkit and associated problems it caused.

Regards
tony
  • 0

#3
Gammo

Gammo

    Member 2k

  • Malware Removal
  • 2,299 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP