Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Removal of Antivirus Pro malware [Moved]


  • Please log in to reply
15 replies to this topic

#1 Coastwizard

Coastwizard

  • Members
  • 35 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:25 AM

Posted 13 November 2009 - 03:40 PM

I'll try to make this as clear as possible:

The day before yesterday, my wife as working on her laptop. She clicked on an Internet link to a MySpace site and suddenly her computer was hijacked by a virus posing as an Internet security scan by "Antivirus Pro", which not only began running a false scan, but continually posted pop-ups saying that one file after another was infected and could not be used, and also began opening a porn Web page. Obviously, my wife freaked out and started yelling to me for help.

My wife was just recently given this laptop as a hand-me-down from her father, so I wasn't really sure what AV program she had on it and neither was she. I knew she had downloaded Malwarebytes before, so I tried to run that, but at first the virus wouldn't let me. However, after several false starts, Malwarebytes finally ran a quick scan, but came up clean. I then ran the Malwarebytes full scan, but with the same results.

Next, I went online to try to run a free ESET scan, and it was at this time that I realized her computer already had a paid subscription to ESET Antivirus through December, and ESET was active. However, it had not caught this virus! Even thought ESET said it was current and updated, I ran a full ESET scan anyway, but again, it came up clean.

All the while, I had to keep "X"ing out of pop-up after pop-up from the virus, each one either advising me of another file that was corrupt or telling me my computer was in danger and did I want to "activate my antivirus software".

Since neither Malwarebytes nor ESET had worked, I deleted the ESET so that I could download and run other Anti-virus/Spyware software.

As soon as ESET was deleted, Windows Defender (another program I didn't even know was installed) popped up saying it had found a Trojan that was some sort of fake anti-spyware program and did I want to remove it. I said yes, and a few moments later, the virus stopped.

Breathing a big sigh of relief, I opened Windows Defender and checked all its settings, maximizing them (I thought) to continue protecting her computer in the best way possible. But when I went to update it, I suddenly ran into another unforeseen problem: A notice came up saying that Windows was unable to update itself.

When I searched to see how to resolve THIS problem, I couldn't find anything that didn't involve rebooting with the original Windows Vista DVD (which we do not have, and I'm not sure even her father has; either way, he lives over a thousand miles away).

Back to square one, I decided to reboot her computer and make sure the virus really was gone. I rebooted and guess what...the virus came up again immediately. However, after several minutes of battling the pop-ups, Windows Defender came up once more and I was able to stop the virus.

Next, I downloaded SpybotSD and ran a scan; results came up clean.

I deleted SpybotSD and downloaded Spyware Terminator. This time I was encouraged when it returned with 2 infections, one a Trojan and the other in my Startup. I told it to remove both, which it said it did successfully. I then enabled all Spyware Terminator's features, including real-time protection for browser settings and their ClamAV for additional virus protection. Her computer was now running smoothly and I was satisfied I had solved the problem. However, when I rebooted...yup, you guessed it...the virus was back, and only got caught by Windows Defender. When I went back into Spyware Terminator, its real-time protection was turned off as well as its anti-virus function.

Finally, feeling thoroughly defeated, I decided to turn to you folks at BleepingComputer, since you had helped me with a similar hijack issue on my own computer just days ago.

So, I logged on and went to Windows Vista, where I followed these links:
BleepingComputer.com > Security > HijackThis Logs and Virus/Trojan/Spyware/Malware Removal

NOTE: MY COMPUTER'S OPERATING SYSTEM IS XP, BUT MY WIFE'S IS VISTA.

At that point, I started following the Preparation Guide for use before posting about your potential Malware problem by "Grinler".

EVERYTHING WENT FINE UNTIL I GOT TO STEP 7: Create a RootRepeal Log

At the point where it said: "You will now see the main RootRepeal window. Click on the Report tab as designated by the blue arrow in Figure 11 below. Once you are in the Report screen, click on the Scan button as designated by the red arrow in Figure 11 below."

I messed up! I accidentally clicked on Scan, which ran some sort of scan and came up with a report. Knowing that I had erred, I decided to start over again, so I clicked on the "X" at the top.

Suddenly, a window opened up saying that Windows Explorer had shut down and was trying to start up again. Momentarily, my screen flashed and everything went away. When it came back my desktop background was there, along with the virus pop-ups and the same Windows Explorer warning, but all my other task bars and icons were gone.

I had no control over anything, so I pressed Control+Alt+Delete and opened up the Task Manager. From there, I shut down the computer.

Next, I rebooted into Safe Mode and did a System Restore back to an earlier restore point,before the virus. The system restore was successful, but after Windows finished rebooting, the virus was back again, and so was the Windows Explorer cycling.

At this point, I just shut her computer down and have left it alone until I could get help from you. PLEASE tell me there is an online solution to these problems!

I am communicating with you from my computer.

Randy Merrill
Farmington, Missouri



BC AdBot (Login to Remove)

 


#2 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,807 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:02:25 AM

Posted 13 November 2009 - 03:55 PM

Hello there,

Yowza, what a saga. Since you haven't posted any logs, I'm shifting this topic to the Am I Infected forum where we can begin assisting you. At this point, please do not post logs unless requested.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

#3 Coastwizard

Coastwizard
  • Topic Starter

  • Members
  • 35 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:25 AM

Posted 13 November 2009 - 05:40 PM

I DID run DDS and got its two reports; I just didn't send them because I didn't think I was supposed to unless you asked me to. I also tried running your directions on how to get rid of Antivirus Pro, but it won't let me run Malwarebytes once I've downloaded it to the desktop.

#4 garmanma

garmanma

    Computer Masochist


  • Staff Emeritus
  • 27,809 posts
  • OFFLINE
  •  
  • Location:Cleveland, Ohio
  • Local time:02:25 AM

Posted 14 November 2009 - 10:29 PM

Run this application and try Mbam again

Please download Rkill by Grinler and save it to your desktop.Link 2
Link 3
Link 4
  • Double-click on the Rkill desktop icon to run the tool.
  • If using Vista, right-click on it and Run As Administrator.
  • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
  • If not, delete the file, then download and use the one provided in Link 2.
  • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
  • If the tool does not run from any of the links provided, please let me know.
Do not reboot the computer or you will have to run it again

======================

Try this also

We Need to check for Rootkits with RootRepeal
  • Download RootRepeal from the following location and save it to your desktop.
  • Extract RootRepeal.exe from the archive (If you did not use the "Direct Download" mirror).
  • Open Posted Image on your desktop.
  • Click the Posted Image tab.
  • Click the Posted Image button.
  • Check all seven boxes: Posted Image
  • Push Ok
  • Check the box for your main system drive (Usually C:), and press Ok.
  • Allow RootRepeal to run a scan of your system. This may take some time.
  • Once the scan completes, push the Posted Image button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your next reply, please.

----------------------------------

Please note: If Rootrepeal fails to run, try this step: Click Settings - Options. Set the Disk Access slider to High

Also try: right-click on rootrepeal.exe and rename it to tatertot.scr
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#5 Coastwizard

Coastwizard
  • Topic Starter

  • Members
  • 35 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:25 AM

Posted 15 November 2009 - 07:40 PM

Sorry Mark, but I can't do any of the things you've recommended so far. Here are the reasons why:
  • As soon as Windows opens up, the box starts popping up saying, "Windows Explorer is not running" and another one that says something like "Trying to restart Windows Explorer". Meanwhile, all the icons for all the programs are on the Desktop, but they won't respond when I click on them.
  • Every few seconds, all the icons disappear and then come back, but the "Windows Explorer is not running" box keeps coming back...the cycle continues.
  • If I click on "Cancel" once or twice, all the icons disapper completely as well as the Taskbar. The only thing left for me to do then is press Control+Alt+Del to open the Task Manager and then Shutdown.
  • The virus is also running all this time with its pop-ups about my system being infected, etc.
I managed to access the Internet (by letting the virus do it) and then switched to Google. I then went to Bleeping.Computer and found the download link for Rkill. I clicked on it and told it to save to my desktop. It said it did, but when I went back to the desktop, it wasn't there.

Next, I tried just telling Rkill to Run instead of saving it. It started to run, but it kept getting blocked by Spyware Terminator and Windows Defender. I could not deactivate either of them, because I couldn't find a way to access them without being able to use the desktop.

Same problem with Malewarebytes; it's already on the desktop, but I can't access it, delete it (to start again), or redownload it.

I even tried pressing F2 to run a diagnostic fix...no luck; and I tried using Safe Mode, but had the same exact problems I had outside of Safe Mode.

I'm frustrated and stuck.

Randy

#6 garmanma

garmanma

    Computer Masochist


  • Staff Emeritus
  • 27,809 posts
  • OFFLINE
  •  
  • Location:Cleveland, Ohio
  • Local time:02:25 AM

Posted 16 November 2009 - 06:48 PM

How about safe mode w/networking?
Can you access Task Manager?
Ctrl+Alt+Delete or Ctrl+Shift then Esc
If you can, go to the Applications window and end all tasks
Start a new task and type explorer.exe
Hopefully that should bring up the Desktop
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#7 Coastwizard

Coastwizard
  • Topic Starter

  • Members
  • 35 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:25 AM

Posted 17 November 2009 - 12:25 PM

Ok, Mark, good news! I was able to get Desktop to come up through Task Manager, and from there I was able to run a full scan with Malwarebytes, which found two threats and appears to have removed the virus. At least when the computer rebooted, the virus is no longer coming up. However, the other problem I mentioned with the Windows Explorer continues. Here's what it's doing:
  • As soon as Windows opens up and the Desktop populates with all the icons and Task Bar, a box pops up in the middle of the screen that says, "Windows Explorer has stopped working. Windows is checking for the problem..."
  • Next, another box opens that says, "Windows Explorer is restarting..."
  • That box closes, the screen blinks (all icons go away, leaving only the desktop background), then the whole cycle starts again.
  • Meanwhile, during the cycle, another window opens titled: Problem Reports and Solutions. It says, "Download updates for Windows" and provides a link to Windows Update. Unfortunately, when I click on Windows Update, it tells me that my computer is unable to update itself from Windows Update.
What do I do next?

Thanks for your help so far!!

Randy

#8 garmanma

garmanma

    Computer Masochist


  • Staff Emeritus
  • 27,809 posts
  • OFFLINE
  •  
  • Location:Cleveland, Ohio
  • Local time:02:25 AM

Posted 17 November 2009 - 07:29 PM

Is there anyway you can run this?

Please download Win32kDiag.exe by AD and save it to your desktop.
alternate download 1
alternate download 2
  • This tool will create a diagnostic report
  • Double-click on Win32kDiag.exe to run and let it finish.
  • When it states Finished! Press any key to exit..., press any key on your keyboard to close the program.
  • A file called Win32kDiag.txt should be created on your Desktop.
  • Open that file in Notepad and copy/paste the entire contents (from Starting up... to Finished! Press any key to exit...) in your next reply.
--------------------------------

Go to Posted Image > Run..., then copy and paste this command into the open box: cmd
Click OK.
At the command prompt C:\>, copy and paste the following command and press Enter:
DIR /a/s %windir%\scecli.dll %windir%\netlogon.dll %windir%\eventlog.dll >Log.txt & START notepad Log.txt
A file called log.txt should be created on your Desktop.
Open that file and copy/paste the contents in your next reply.
Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#9 Coastwizard

Coastwizard
  • Topic Starter

  • Members
  • 35 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:25 AM

Posted 17 November 2009 - 08:59 PM

Here's the log report I got from Win32kDiag.exe.

It's really hard to get anything done with this d**n pop-up cycling over and over again.

Couldn't save it to Notebook because I couldn't access Notebook.

Running from: C:\Users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ITS3FRL9\Win32kDiag[1].exeLog file at : C:\Users\Owner\Desktop\Win32kDiag.txtWARNING: Could not get backup privileges!Searching 'C:\Windows'...Cannot access: C:\Windows\bthservsdp.dat[1] 2009-11-15 17:51:29 12 C:\Windows\bthservsdp.dat ()



All desktop icons and taskbar have disappeared, so I can't get back to Start. Will keep trying.

#10 Coastwizard

Coastwizard
  • Topic Starter

  • Members
  • 35 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:25 AM

Posted 17 November 2009 - 11:17 PM

Ok, Mark. I've spent the last several hours just trying to download and use the tools you've indicated. I've read some other sites (you're the only one I'm working with, though) where they said they didn't think this was a virus. But if it's not a virus, it sure acts like one. No matter what I try to do, this thing keeps intefering with it. After a while, it started opening a third box that says Windows is going to shut down the program. Then, no matter what I do, it won't let me proceed without clicking on the "X" or on OK. As soon as I do that, everything else closes.

I even downloaded all the tools I could think of (OTL, ComboFix, Win32kDiag.exe, RootRepeal, and others) on my own computer, then burned them on a CD and transferred them from the CD to my wife's Desktop. I disabled her Spyware Doctor realtime so it would quit interferring with running the Win32Diag.exe. Oh, and don't worry, I know better than to run ComboFix without tech supervision. Finally quit after trying to get RootRepeal to run without success. I was able to get as far as where it asked me if I wanted to allow the file to run. I said "OK", and RootRepeal opened up. I clicked on Report, checked all 7 boxes, clicked on Scan, and a box appeared with dozens of scanned files showing. However, both times I tried this, it never got to Save Report. Instead, the computer completely locked up (mouse wouldn't even respond) on the scan screen, and I had to shut down the whole system by holding down the On/Off button.

Anyway, I'm waiting for your next communication.

Thanks,

Randy

#11 garmanma

garmanma

    Computer Masochist


  • Staff Emeritus
  • 27,809 posts
  • OFFLINE
  •  
  • Location:Cleveland, Ohio
  • Local time:02:25 AM

Posted 18 November 2009 - 05:36 PM

Cannot access: C:\Windows\bthservsdp.dat[1]
Don't know why they would say this isn't a virus

Try Root Repeal one more time and only select Drivers to scan

Whether it works or not, continue with this afterwards

Post the DDS , win32diag, and the Root Repeal [hopefully] logs in our HJT forum

Just give a brief description and tell them that these logs were all you could get to run successfully

Post them here:
http://www.bleepingcomputer.com/forums/f/22/virus-trojan-spyware-and-malware-removal-logs/

The HJT team is extremely busy, so be patient and good luck

Edited by garmanma, 18 November 2009 - 05:38 PM.

Mark
Posted Image
why won't my laptop work?

Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around
Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits
Become a BleepingComputer fan: Facebook and Twitter

#12 Coastwizard

Coastwizard
  • Topic Starter

  • Members
  • 35 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:25 AM

Posted 18 November 2009 - 05:53 PM

Hey Mark,

I'm about to attempt the fixes you recommended. Just thought you ought to know that my wife came home yesterday and told me that some of her friends told her this was the so-called FaceBook virus everyone's been talking about. She WAS on FB when she got the virus.

Randy

#13 Coastwizard

Coastwizard
  • Topic Starter

  • Members
  • 35 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:25 AM

Posted 18 November 2009 - 07:30 PM

ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/11/18 17:48
Program Version: Version 1.3.5.0
Windows Version: Windows Vista SP1
==================================================

Drivers
-------------------
Name: acpi.sys
Image Path: C:\Windows\system32\drivers\acpi.sys
Address: 0x8280F000 Size: 286720 File Visible: - Signed: -
Status: -

Name: ACPI_HAL
Image Path: \Driver\ACPI_HAL
Address: 0x81E51000 Size: 3903488 File Visible: - Signed: -
Status: -

Name: atapi.sys
Image Path: C:\Windows\system32\drivers\atapi.sys
Address: 0x82958000 Size: 32768 File Visible: - Signed: -
Status: -

Name: ataport.SYS
Image Path: C:\Windows\system32\drivers\ataport.SYS
Address: 0x82960000 Size: 122880 File Visible: - Signed: -
Status: -

Name: BATTC.SYS
Image Path: C:\Windows\system32\DRIVERS\BATTC.SYS
Address: 0x8289F000 Size: 40960 File Visible: - Signed: -
Status: -

Name: Beep.SYS
Image Path: C:\Windows\System32\Drivers\Beep.SYS
Address: 0x8A332000 Size: 28672 File Visible: - Signed: -
Status: -

Name: BOOTVID.dll
Image Path: C:\Windows\system32\BOOTVID.dll
Address: 0x80628000 Size: 32768 File Visible: - Signed: -
Status: -

Name: cdfs.sys
Image Path: C:\Windows\system32\DRIVERS\cdfs.sys
Address: 0x8A3BB000 Size: 90112 File Visible: - Signed: -
Status: -

Name: cdrom.sys
Image Path: C:\Windows\system32\DRIVERS\cdrom.sys
Address: 0x86181000 Size: 98304 File Visible: - Signed: -
Status: -

Name: CI.dll
Image Path: C:\Windows\system32\CI.dll
Address: 0x80671000 Size: 917504 File Visible: - Signed: -
Status: -

Name: CLASSPNP.SYS
Image Path: C:\Windows\system32\drivers\CLASSPNP.SYS
Address: 0x863B7000 Size: 135168 File Visible: - Signed: -
Status: -

Name: CLFS.SYS
Image Path: C:\Windows\system32\CLFS.SYS
Address: 0x80630000 Size: 266240 File Visible: - Signed: -
Status: -

Name: compbatt.sys
Image Path: C:\Windows\system32\DRIVERS\compbatt.sys
Address: 0x8289C000 Size: 10496 File Visible: - Signed: -
Status: -

Name: crashdmp.sys
Image Path: C:\Windows\System32\Drivers\crashdmp.sys
Address: 0x8A3D1000 Size: 53248 File Visible: - Signed: -
Status: -

Name: crcdisk.sys
Image Path: C:\Windows\system32\drivers\crcdisk.sys
Address: 0x863D8000 Size: 36864 File Visible: - Signed: -
Status: -

Name: disk.sys
Image Path: C:\Windows\system32\drivers\disk.sys
Address: 0x863A6000 Size: 69632 File Visible: - Signed: -
Status: -

Name: DKbFltr.sys
Image Path: C:\Windows\system32\DRIVERS\DKbFltr.sys
Address: 0x861BE000 Size: 40960 File Visible: - Signed: -
Status: -

Name: dump_diskdump.sys
Image Path: C:\Windows\System32\Drivers\dump_diskdump.sys
Address: 0x8A3DE000 Size: 40960 File Visible: No Signed: -
Status: -

Name: dump_SI3112r.sys
Image Path: C:\Windows\System32\Drivers\dump_SI3112r.sys
Address: 0x8610A000 Size: 131072 File Visible: No Signed: -
Status: -

Name: Dxapi.sys
Image Path: C:\Windows\System32\drivers\Dxapi.sys
Address: 0x8A3E8000 Size: 40960 File Visible: - Signed: -
Status: -

Name: dxg.sys
Image Path: C:\Windows\System32\drivers\dxg.sys
Address: 0x8B300000 Size: 94208 File Visible: - Signed: -
Status: -

Name: ecache.sys
Image Path: C:\Windows\System32\drivers\ecache.sys
Address: 0x8637F000 Size: 159744 File Visible: - Signed: -
Status: -

Name: EMS7SK.sys
Image Path: C:\Windows\system32\DRIVERS\EMS7SK.sys
Address: 0x807EA000 Size: 62208 File Visible: - Signed: -
Status: -

Name: ESD7SK.sys
Image Path: C:\Windows\system32\DRIVERS\ESD7SK.sys
Address: 0x8A216000 Size: 42240 File Visible: - Signed: -
Status: -

Name: ESM7SK.sys
Image Path: C:\Windows\system32\DRIVERS\ESM7SK.sys
Address: 0x8A203000 Size: 76928 File Visible: - Signed: -
Status: -

Name: fileinfo.sys
Image Path: C:\Windows\system32\drivers\fileinfo.sys
Address: 0x807DA000 Size: 65536 File Visible: - Signed: -
Status: -

Name: fltmgr.sys
Image Path: C:\Windows\system32\drivers\fltmgr.sys
Address: 0x829C4000 Size: 204800 File Visible: - Signed: -
Status: -

Name: framebuf.dll
Image Path: C:\Windows\System32\framebuf.dll
Address: 0x8B3B0000 Size: 32768 File Visible: - Signed: -
Status: -

Name: Fs_Rec.SYS
Image Path: C:\Windows\System32\Drivers\Fs_Rec.SYS
Address: 0x8A322000 Size: 36864 File Visible: - Signed: -
Status: -

Name: fwpkclnt.sys
Image Path: C:\Windows\System32\drivers\fwpkclnt.sys
Address: 0x860EF000 Size: 110592 File Visible: - Signed: -
Status: -

Name: GEARAspiWDM.sys
Image Path: C:\Windows\System32\Drivers\GEARAspiWDM.sys
Address: 0x86354000 Size: 9984 File Visible: - Signed: -
Status: -

Name: hal.dll
Image Path: C:\Windows\system32\hal.dll
Address: 0x81E1E000 Size: 208896 File Visible: - Signed: -
Status: -

Name: HDAudBus.sys
Image Path: C:\Windows\system32\DRIVERS\HDAudBus.sys
Address: 0x86199000 Size: 73728 File Visible: - Signed: -
Status: -

Name: HIDCLASS.SYS
Image Path: C:\Windows\system32\DRIVERS\HIDCLASS.SYS
Address: 0x8A395000 Size: 65536 File Visible: - Signed: -
Status: -

Name: HIDPARSE.SYS
Image Path: C:\Windows\system32\DRIVERS\HIDPARSE.SYS
Address: 0x8A3A5000 Size: 28672 File Visible: - Signed: -
Status: -

Name: hidusb.sys
Image Path: C:\Windows\system32\DRIVERS\hidusb.sys
Address: 0x8A38C000 Size: 36864 File Visible: - Signed: -
Status: -

Name: i8042prt.sys
Image Path: C:\Windows\system32\DRIVERS\i8042prt.sys
Address: 0x861AB000 Size: 77824 File Visible: - Signed: -
Status: -

Name: kbdclass.sys
Image Path: C:\Windows\system32\DRIVERS\kbdclass.sys
Address: 0x861C8000 Size: 45056 File Visible: - Signed: -
Status: -

Name: kdcom.dll
Image Path: C:\Windows\system32\kdcom.dll
Address: 0x8060F000 Size: 32768 File Visible: - Signed: -
Status: -

Name: ks.sys
Image Path: C:\Windows\system32\DRIVERS\ks.sys
Address: 0x8A2AD000 Size: 172032 File Visible: - Signed: -
Status: -

Name: ksecdd.sys
Image Path: C:\Windows\System32\Drivers\ksecdd.sys
Address: 0x82A0D000 Size: 462848 File Visible: - Signed: -
Status: -

Name: mouclass.sys
Image Path: C:\Windows\system32\DRIVERS\mouclass.sys
Address: 0x82BEE000 Size: 45056 File Visible: - Signed: -
Status: -

Name: mouhid.sys
Image Path: C:\Windows\system32\DRIVERS\mouhid.sys
Address: 0x8A3B3000 Size: 32768 File Visible: - Signed: -
Status: -

Name: mountmgr.sys
Image Path: C:\Windows\System32\drivers\mountmgr.sys
Address: 0x82944000 Size: 65536 File Visible: - Signed: -
Status: -

Name: Msfs.SYS
Image Path: C:\Windows\System32\Drivers\Msfs.SYS
Address: 0x8A373000 Size: 45056 File Visible: - Signed: -
Status: -

Name: msisadrv.sys
Image Path: C:\Windows\system32\drivers\msisadrv.sys
Address: 0x8285E000 Size: 32768 File Visible: - Signed: -
Status: -

Name: msiscsi.sys
Image Path: C:\Windows\system32\DRIVERS\msiscsi.sys
Address: 0x8A221000 Size: 188416 File Visible: - Signed: -
Status: -

Name: msrpc.sys
Image Path: C:\Windows\system32\drivers\msrpc.sys
Address: 0x82B89000 Size: 176128 File Visible: - Signed: -
Status: -

Name: mssmbios.sys
Image Path: C:\Windows\system32\DRIVERS\mssmbios.sys
Address: 0x8A2D7000 Size: 40960 File Visible: - Signed: -
Status: -

Name: mup.sys
Image Path: C:\Windows\System32\Drivers\mup.sys
Address: 0x86370000 Size: 61440 File Visible: - Signed: -
Status: -

Name: ndis.sys
Image Path: C:\Windows\system32\drivers\ndis.sys
Address: 0x82A7E000 Size: 1093632 File Visible: - Signed: -
Status: -

Name: NETIO.SYS
Image Path: C:\Windows\system32\drivers\NETIO.SYS
Address: 0x82BB4000 Size: 237568 File Visible: - Signed: -
Status: -

Name: Npfs.SYS
Image Path: C:\Windows\System32\Drivers\Npfs.SYS
Address: 0x8A37E000 Size: 57344 File Visible: - Signed: -
Status: -

Name: Ntfs.sys
Image Path: C:\Windows\System32\Drivers\Ntfs.sys
Address: 0x8620C000 Size: 1110016 File Visible: - Signed: -
Status: -

Name: NTIDrvr.sys
Image Path: C:\Windows\system32\DRIVERS\NTIDrvr.sys
Address: 0x86209000 Size: 6144 File Visible: - Signed: -
Status: -

Name: ntkrnlpa.exe
Image Path: C:\Windows\system32\ntkrnlpa.exe
Address: 0x81E51000 Size: 3903488 File Visible: - Signed: -
Status: -

Name: NuidFltr.sys
Image Path: C:\Windows\system32\DRIVERS\NuidFltr.sys
Address: 0x8A3AC000 Size: 28672 File Visible: - Signed: -
Status: -

Name: Null.SYS
Image Path: C:\Windows\System32\Drivers\Null.SYS
Address: 0x8A32B000 Size: 28672 File Visible: - Signed: -
Status: -

Name: partmgr.sys
Image Path: C:\Windows\System32\drivers\partmgr.sys
Address: 0x8288D000 Size: 61440 File Visible: - Signed: -
Status: -

Name: pci.sys
Image Path: C:\Windows\system32\drivers\pci.sys
Address: 0x82866000 Size: 159744 File Visible: - Signed: -
Status: -

Name: pciide.sys
Image Path: C:\Windows\system32\drivers\pciide.sys
Address: 0x82902000 Size: 28672 File Visible: - Signed: -
Status: -

Name: PCIIDEX.SYS
Image Path: C:\Windows\system32\drivers\PCIIDEX.SYS
Address: 0x82909000 Size: 57344 File Visible: - Signed: -
Status: -

Name: pcmcia.sys
Image Path: C:\Windows\system32\DRIVERS\pcmcia.sys
Address: 0x82917000 Size: 184320 File Visible: - Signed: -
Status: -

Name: PnpManager
Image Path: \Driver\PnpManager
Address: 0x81E51000 Size: 3903488 File Visible: - Signed: -
Status: -

Name: psdfilter.sys
Image Path: C:\Windows\system32\DRIVERS\psdfilter.sys
Address: 0x829F6000 Size: 10624 File Visible: - Signed: -
Status: -

Name: PSDNServ.sys
Image Path: C:\Windows\system32\drivers\PSDNServ.sys
Address: 0x8636E000 Size: 7936 File Visible: - Signed: -
Status: -

Name: psdvdisk.sys
Image Path: C:\Windows\system32\drivers\psdvdisk.sys
Address: 0x8635C000 Size: 73728 File Visible: - Signed: -
Status: -

Name: PSHED.dll
Image Path: C:\Windows\system32\PSHED.dll
Address: 0x80617000 Size: 69632 File Visible: - Signed: -
Status: -

Name: PxHelp20.sys
Image Path: C:\Windows\system32\DRIVERS\PxHelp20.sys
Address: 0x82800000 Size: 35680 File Visible: - Signed: -
Status: -

Name: RAW
Image Path: \FileSystem\RAW
Address: 0x81E51000 Size: 3903488 File Visible: - Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\Windows\system32\drivers\rootrepeal.sys
Address: 0x8A3F2000 Size: 49152 File Visible: No Signed: -
Status: -

Name: SCSIPORT.SYS
Image Path: C:\Windows\system32\DRIVERS\SCSIPORT.SYS
Address: 0x8299E000 Size: 155648 File Visible: - Signed: -
Status: -

Name: SI3112r.sys
Image Path: C:\Windows\system32\DRIVERS\SI3112r.sys
Address: 0x8297E000 Size: 131072 File Visible: - Signed: -
Status: -

Name: SiWinAcc.sys
Image Path: C:\Windows\system32\DRIVERS\SiWinAcc.sys
Address: 0x82809000 Size: 12544 File Visible: - Signed: -
Status: -

Name: storport.sys
Image Path: C:\Windows\system32\DRIVERS\storport.sys
Address: 0x8A24F000 Size: 266240 File Visible: - Signed: -
Status: -

Name: swenum.sys
Image Path: C:\Windows\system32\DRIVERS\swenum.sys
Address: 0x8A2AB000 Size: 4992 File Visible: - Signed: -
Status: -

Name: SynTP.sys
Image Path: C:\Windows\system32\DRIVERS\SynTP.sys
Address: 0x861D3000 Size: 172928 File Visible: - Signed: -
Status: -

Name: tcpip.sys
Image Path: C:\Windows\System32\drivers\tcpip.sys
Address: 0x86006000 Size: 954368 File Visible: - Signed: -
Status: -

Name: TDI.SYS
Image Path: C:\Windows\system32\DRIVERS\TDI.SYS
Address: 0x8A290000 Size: 45056 File Visible: - Signed: -
Status: -

Name: termdd.sys
Image Path: C:\Windows\system32\DRIVERS\termdd.sys
Address: 0x8A29B000 Size: 65536 File Visible: - Signed: -
Status: -

Name: TSDDD.dll
Image Path: C:\Windows\System32\TSDDD.dll
Address: 0x8B330000 Size: 36864 File Visible: - Signed: -
Status: -

Name: UBHelper.sys
Image Path: C:\Windows\System32\Drivers\UBHelper.sys
Address: 0x82954000 Size: 13952 File Visible: - Signed: -
Status: -

Name: umbus.sys
Image Path: C:\Windows\system32\DRIVERS\umbus.sys
Address: 0x8A2E1000 Size: 53248 File Visible: - Signed: -
Status: -

Name: USBD.SYS
Image Path: C:\Windows\system32\DRIVERS\USBD.SYS
Address: 0x86357000 Size: 8192 File Visible: - Signed: -
Status: -

Name: usbehci.sys
Image Path: C:\Windows\system32\DRIVERS\usbehci.sys
Address: 0x86172000 Size: 61440 File Visible: - Signed: -
Status: -

Name: usbhub.sys
Image Path: C:\Windows\system32\DRIVERS\usbhub.sys
Address: 0x8A2EE000 Size: 212992 File Visible: - Signed: -
Status: -

Name: usbohci.sys
Image Path: C:\Windows\system32\DRIVERS\usbohci.sys
Address: 0x8612A000 Size: 40960 File Visible: - Signed: -
Status: -

Name: USBPORT.SYS
Image Path: C:\Windows\system32\DRIVERS\USBPORT.SYS
Address: 0x86134000 Size: 253952 File Visible: - Signed: -
Status: -

Name: vga.sys
Image Path: C:\Windows\System32\drivers\vga.sys
Address: 0x8A339000 Size: 49152 File Visible: - Signed: -
Status: -

Name: VIDEOPRT.SYS
Image Path: C:\Windows\System32\drivers\VIDEOPRT.SYS
Address: 0x8A345000 Size: 135168 File Visible: - Signed: -
Status: -

Name: volmgr.sys
Image Path: C:\Windows\system32\drivers\volmgr.sys
Address: 0x828A9000 Size: 61440 File Visible: - Signed: -
Status: -

Name: volmgrx.sys
Image Path: C:\Windows\System32\drivers\volmgrx.sys
Address: 0x828B8000 Size: 303104 File Visible: - Signed: -
Status: -

Name: volsnap.sys
Image Path: C:\Windows\system32\drivers\volsnap.sys
Address: 0x8631B000 Size: 233472 File Visible: - Signed: -
Status: -

Name: watchdog.sys
Image Path: C:\Windows\System32\drivers\watchdog.sys
Address: 0x8A366000 Size: 53248 File Visible: - Signed: -
Status: -

Name: Wdf01000.sys
Image Path: C:\Windows\system32\drivers\Wdf01000.sys
Address: 0x80751000 Size: 507904 File Visible: - Signed: -
Status: -

Name: WDFLDR.SYS
Image Path: C:\Windows\system32\drivers\WDFLDR.SYS
Address: 0x807CD000 Size: 53248 File Visible: - Signed: -
Status: -

Name: Win32k
Image Path: \Driver\Win32k
Address: 0x8B0F0000 Size: 2105344 File Visible: - Signed: -
Status: -

Name: win32k.sys
Image Path: C:\Windows\System32\win32k.sys
Address: 0x8B0F0000 Size: 2105344 File Visible: - Signed: -
Status: -

Name: wmiacpi.sys
Image Path: C:\Windows\system32\DRIVERS\wmiacpi.sys
Address: 0x86200000 Size: 36864 File Visible: - Signed: -
Status: -

Name: WMILIB.SYS
Image Path: C:\Windows\system32\drivers\WMILIB.SYS
Address: 0x82855000 Size: 36864 File Visible: - Signed: -
Status: -

Name: WMIxWDM
Image Path: \Driver\WMIxWDM
Address: 0x81E51000 Size: 3903488 File Visible: - Signed: -
Status: -

#14 Coastwizard

Coastwizard
  • Topic Starter

  • Members
  • 35 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:25 AM

Posted 18 November 2009 - 09:46 PM

Mark...

You may be wondering why I sent these results to you instead of the HJT team. The reason is that I am working from two computers right now trying to reslove this problem. The best I could do was open these text files from Task Manager on my wife's computer and send them to you one at a time on this original topic strand. I could not manage to send them from the new HJT link you provided.

So far, I have been able to back up my wife's data using DriveImage.XML. It was the only one I was able to successfully launch by going into Control Panel through Task Manager and turning off the user protection under Task Manager.

#15 Coastwizard

Coastwizard
  • Topic Starter

  • Members
  • 35 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:12:25 AM

Posted 18 November 2009 - 09:50 PM

Spoke too soon...the backup stopped halfway through saying a file was too large to save to Drive C; and did I want to create another path. I had no idea what to do.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users