Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

My computer is infected with a bad undetectable trojan


  • Please log in to reply
16 replies to this topic

#1 Slayer90

Slayer90

  • Members
  • 216 posts
  • OFFLINE
  •  
  • Local time:03:34 AM

Posted 18 April 2012 - 04:46 PM

My computer was fine until few days ago when its become very slow and unresponsive and it freeze for couple minutes ever so often.
Malwarebytes,McAfee hijack this, and Norton. couldn't detect. Not even F secure could detect. They all report no malware. 2 years my computer infected with TrojanDownloader/W32/reno, no anti malware was able detect until F secure and removed it. but was back then. This is a new type of trojan that even F secure can't detect it. Is there an alternative free online scanner that works just F secure? I want remove the trojan with having to computer having uninstalling everything and start over all over again on my computer.

Edited by Slayer90, 18 April 2012 - 04:49 PM.


BC AdBot (Login to Remove)

 


#2 Slayer90

Slayer90
  • Topic Starter

  • Members
  • 216 posts
  • OFFLINE
  •  
  • Local time:03:34 AM

Posted 18 April 2012 - 05:48 PM

help.

#3 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,738 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:03:34 AM

Posted 18 April 2012 - 07:09 PM

Download and install System Information for Windows
Run the program.
After it scans your computer, navigate to Hardware>Sensors and post all info from there.

Posted Image

My Website

My help doesn't cost a penny, but if you'd like to consider a donation, click DONATE

 


#4 Slayer90

Slayer90
  • Topic Starter

  • Members
  • 216 posts
  • OFFLINE
  •  
  • Local time:03:34 AM

Posted 18 April 2012 - 07:56 PM

Posted Image

#5 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,738 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:03:34 AM

Posted 18 April 2012 - 08:00 PM

That looks good.

Download Security Check from HERE, and save it to your Desktop.

* Double-click SecurityCheck.exe
* Follow the onscreen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt; please post the contents of that document.

=============================================================================

Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
  • Make sure the following options are checked:
    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center/Action Center
    • Windows Update
    • Windows Defender
  • Press "Scan".
  • It will create a log (FSS.txt) in the same directory the tool is run.
  • Please copy and paste the log to your reply.

====================================================================================

Please download MiniToolBox and run it.

Checkmark following boxes:
  • Report IE Proxy Settings
  • Report FF Proxy Settings
  • List content of Hosts
  • List IP configuration
  • List Winsock Entries
  • List last 10 Event Viewer log
  • List Installed Programs
  • List Devices (do NOT change any settings here)
  • List Users, Partitions and Memory size
Click Go and post the result.

=============================================================================

Download Malwarebytes' Anti-Malware (aka MBAM): https://www.bleepingcomputer.com/download/malwarebytes-anti-malware/ to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform quick scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Be sure to restart the computer.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

=============================================================================

Download aswMBR to your desktop.
Double click the aswMBR.exe to run it.
If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".
Click the "Scan" button to start scan.
On completion of the scan click "Save log", save it to your desktop and post in your next reply.

NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.

My Website

My help doesn't cost a penny, but if you'd like to consider a donation, click DONATE

 


#6 Slayer90

Slayer90
  • Topic Starter

  • Members
  • 216 posts
  • OFFLINE
  •  
  • Local time:03:34 AM

Posted 18 April 2012 - 09:23 PM

Results of screen317's Security Check version 0.99.24
Windows Vista Service Pack 2 x86 (UAC is enabled)
Internet Explorer 9
``````````````````````````````
Antivirus/Firewall Check:

Windows Firewall Enabled!
AVG Security Toolbar
Norton AntiVirus
McAfee Security Scan Plus
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:

Malwarebytes' Anti-Malware
Java™ 6 Update 31
Adobe Flash Player 11.2.202.233
Mozilla Firefox (3.6.22) Firefox Out of Date!
````````````````````````````````
Process Check:
objlist.exe by Laurent

Norton ccSvcHst.exe
``````````End of Log````````````

#7 Slayer90

Slayer90
  • Topic Starter

  • Members
  • 216 posts
  • OFFLINE
  •  
  • Local time:03:34 AM

Posted 18 April 2012 - 09:25 PM

============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is OK.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1


File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcsvc.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys => MD5 is legit
C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll => MD5 is legit
C:\Windows\system32\bfe.dll => MD5 is legit
C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll => MD5 is legit
C:\Windows\system32\vssvc.exe => MD5 is legit
C:\Windows\system32\wscsvc.dll => MD5 is legit
C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\system32\wuaueng.dll => MD5 is legit
C:\Windows\system32\qmgr.dll => MD5 is legit
C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit


**** End of log ****

#8 Slayer90

Slayer90
  • Topic Starter

  • Members
  • 216 posts
  • OFFLINE
  •  
  • Local time:03:34 AM

Posted 18 April 2012 - 09:29 PM

MiniToolBox by Farbar Version: 18-01-2012
Ran by alvin (administrator) on 18-04-2012 at 19:27:08
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86)
Boot Mode: Normal
***************************************************************************

========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.

========================= FF Proxy Settings: ==============================

"network.proxy.type", 0
========================= Hosts content: =================================

127.0.0.1 activate.adobe.com
127.0.0.1 activate.adobe.com

========================= IP Configuration: ================================

Realtek RTL8101 Family PCI-E Fast Ethernet NIC (NDIS 6.0) = Local Area Connection (Connected)


# ----------------------------------
# IPv4 Configuration
# ----------------------------------
pushd interface ipv4

reset
set global icmpredirects=enabled


popd
# End of IPv4 configuration



Windows IP Configuration

Host Name . . . . . . . . . . . . : alvin-PC
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Realtek RTL8101 Family PCI-E Fast Ethernet NIC (NDIS 6.0)
Physical Address. . . . . . . . . : 00-19-DB-5C-A9-83
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::ed63:84d0:9811:6502%8(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.1.148(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Wednesday, April 18, 2012 9:30:54 AM
Lease Expires . . . . . . . . . . : Wednesday, April 18, 2012 7:28:44 PM
Default Gateway . . . . . . . . . : 192.168.1.1
DHCP Server . . . . . . . . . . . : 192.168.1.1
DHCPv6 IAID . . . . . . . . . . . : 184555995
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-13-E8-F4-BE-00-19-DB-5C-A9-83
DNS Servers . . . . . . . . . . . : 192.168.1.1
NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter Local Area Connection* 6:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 02-00-54-55-4E-01
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2001:0:5ef5:79fb:1057:20bd:3f57:fe6b(Preferred)
Link-local IPv6 Address . . . . . : fe80::1057:20bd:3f57:fe6b%9(Preferred)
Default Gateway . . . . . . . . . : ::
NetBIOS over Tcpip. . . . . . . . : Disabled

Tunnel adapter Local Area Connection* 7:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : isatap.{55B7C7B4-46C4-432F-A42D-13B216CBE3CD}
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Server: WRT54GS
Address: 192.168.1.1

Name: google.com
Addresses: 173.194.33.2
173.194.33.7
173.194.33.8
173.194.33.14
173.194.33.5
173.194.33.3
173.194.33.6
173.194.33.1
173.194.33.9
173.194.33.4
173.194.33.0



Pinging google.com [173.194.33.0] with 32 bytes of data:

Reply from 173.194.33.0: bytes=32 time=12ms TTL=56

Reply from 173.194.33.0: bytes=32 time=14ms TTL=56



Ping statistics for 173.194.33.0:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 12ms, Maximum = 14ms, Average = 13ms

Server: WRT54GS
Address: 192.168.1.1

Name: yahoo.com
Addresses: 209.191.122.70
98.139.183.24
72.30.38.140



Pinging yahoo.com [209.191.122.70] with 32 bytes of data:

Reply from 209.191.122.70: bytes=32 time=81ms TTL=52

Reply from 209.191.122.70: bytes=32 time=79ms TTL=52



Ping statistics for 209.191.122.70:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 79ms, Maximum = 81ms, Average = 80ms

Server: WRT54GS
Address: 192.168.1.1

Name: bleepingcomputer.com
Address: 208.43.87.2



Pinging bleepingcomputer.com [208.43.87.2] with 32 bytes of data:

Reply from 208.43.87.2: Destination host unreachable.

Reply from 208.43.87.2: Destination host unreachable.



Ping statistics for 208.43.87.2:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),



Pinging 127.0.0.1 with 32 bytes of data:

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128



Ping statistics for 127.0.0.1:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 0ms, Average = 0ms

===========================================================================
Interface List
8 ...00 19 db 5c a9 83 ...... Realtek RTL8101 Family PCI-E Fast Ethernet NIC (NDIS 6.0)
1 ........................... Software Loopback Interface 1
9 ...02 00 54 55 4e 01 ...... Teredo Tunneling Pseudo-Interface
12 ...00 00 00 00 00 00 00 e0 isatap.{55B7C7B4-46C4-432F-A42D-13B216CBE3CD}
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.148 20
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.1.0 255.255.255.0 On-link 192.168.1.148 276
192.168.1.148 255.255.255.255 On-link 192.168.1.148 276
192.168.1.255 255.255.255.255 On-link 192.168.1.148 276
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.1.148 276
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.1.148 276
===========================================================================
Persistent Routes:
None

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
9 18 ::/0 On-link
1 306 ::1/128 On-link
9 18 2001::/32 On-link
9 266 2001:0:5ef5:79fb:1057:20bd:3f57:fe6b/128
On-link
8 276 fe80::/64 On-link
9 266 fe80::/64 On-link
9 266 fe80::1057:20bd:3f57:fe6b/128
On-link
8 276 fe80::ed63:84d0:9811:6502/128
On-link
1 306 ff00::/8 On-link
9 266 ff00::/8 On-link
8 276 ff00::/8 On-link
===========================================================================
Persistent Routes:
None
========================= Winsock entries =====================================

Catalog5 01 C:\Windows\system32\NLAapi.dll [48128] (Microsoft Corporation)
Catalog5 02 C:\Windows\system32\napinsp.dll [50176] (Microsoft Corporation)
Catalog5 03 C:\Windows\system32\pnrpnsp.dll [62464] (Microsoft Corporation)
Catalog5 04 C:\Windows\system32\pnrpnsp.dll [62464] (Microsoft Corporation)
Catalog5 05 C:\Windows\System32\mswsock.dll [223232] (Microsoft Corporation)
Catalog5 06 C:\Windows\System32\winrnr.dll [19968] (Microsoft Corporation)
Catalog9 01 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 02 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 03 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 04 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 05 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 06 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 07 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 08 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 09 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 10 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 11 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 12 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 13 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 14 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 15 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 16 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 17 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 18 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

========================= Event log errors: ===============================

Application errors:
==================
Error: (04/18/2012 05:59:24 PM) (Source: Application Error) (User: )
Description: Faulting application siw.exe, version 2011.10.29.0, time stamp 0x4f812b29, faulting module unknown, version 0.0.0.0, time stamp 0x00000000, exception code 0xc0000005, fault offset 0x00000000,
process id 0x158c, application start time 0xsiw.exe0.

Error: (04/18/2012 05:52:57 PM) (Source: Application Error) (User: )
Description: Faulting application Photoshop.exe, version 12.0.4.0, time stamp 0x4d9d8cbc, faulting module updaternotifications.dll, version 1.0.0.68, time stamp 0x4bd92869, exception code 0x80000003, fault offset 0x00006855,
process id 0x155c, application start time 0xPhotoshop.exe0.

Error: (04/18/2012 05:52:45 PM) (Source: Application Error) (User: )
Description: Faulting application Photoshop.exe, version 12.0.4.0, time stamp 0x4d9d8cbc, faulting module updaternotifications.dll, version 1.0.0.68, time stamp 0x4bd92869, exception code 0x80000003, fault offset 0x00006855,
process id 0x1250, application start time 0xPhotoshop.exe0.

Error: (04/18/2012 05:41:41 PM) (Source: Perflib) (User: )
Description: PolicyAgent

Error: (04/18/2012 05:41:41 PM) (Source: Perflib) (User: )
Description: OpenIPSecPerformanceDataC:\Windows\System32\ipsecsvc.dllPolicyAgent4

Error: (04/18/2012 05:41:40 PM) (Source: Perflib) (User: )
Description: PNRPsvcC:\Windows\system32\pnrpperf.dll4

Error: (04/18/2012 05:41:38 PM) (Source: Perflib) (User: )
Description: EmdCacheC:\Windows\system32\emdmgmt.dll4

Error: (04/16/2012 10:29:39 PM) (Source: Application Hang) (User: )
Description: The program iexplore.exe version 9.0.8112.16421 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel.
Process ID: c10
Start Time: 01cd1c5aed08b5c8
Termination Time: 250

Error: (04/15/2012 11:34:13 AM) (Source: Windows Search Service) (User: )
Description: The entry <C:\USERS\ALVIN\DESKTOP\ERICA DAVIDSON PICTURE 77972432\ERICADAVIDSON42ABIGDGIEH.JPG> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

Error: (04/15/2012 11:34:13 AM) (Source: Windows Search Service) (User: )
Description: The entry <C:\USERS\ALVIN\DESKTOP\ERICA DAVIDSON PICTURE 77972432\ERICA20.JPG> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)


System errors:
=============
Error: (04/18/2012 06:04:18 PM) (Source: DCOM) (User: alvin)
Description: machine-defaultLocalActivation{9BA05972-F6A8-11CF-A442-00A0C90A8F39}alvin-PCalvinS-1-5-21-3799224096-1170514331-673851510-1000LocalHost (Using LRPC)

Error: (04/18/2012 06:03:18 PM) (Source: DCOM) (User: alvin)
Description: machine-defaultLocalActivation{9BA05972-F6A8-11CF-A442-00A0C90A8F39}alvin-PCalvinS-1-5-21-3799224096-1170514331-673851510-1000LocalHost (Using LRPC)

Error: (04/18/2012 06:02:41 PM) (Source: DCOM) (User: alvin)
Description: machine-defaultLocalActivation{9BA05972-F6A8-11CF-A442-00A0C90A8F39}alvin-PCalvinS-1-5-21-3799224096-1170514331-673851510-1000LocalHost (Using LRPC)

Error: (04/18/2012 05:55:34 PM) (Source: DCOM) (User: alvin)
Description: machine-defaultLocalActivation{9BA05972-F6A8-11CF-A442-00A0C90A8F39}alvin-PCalvinS-1-5-21-3799224096-1170514331-673851510-1000LocalHost (Using LRPC)

Error: (04/18/2012 02:10:58 PM) (Source: DCOM) (User: alvin)
Description: machine-defaultLocalActivation{9BA05972-F6A8-11CF-A442-00A0C90A8F39}alvin-PCalvinS-1-5-21-3799224096-1170514331-673851510-1000LocalHost (Using LRPC)

Error: (04/18/2012 09:32:44 AM) (Source: DCOM) (User: alvin)
Description: machine-defaultLocalActivation{9BA05972-F6A8-11CF-A442-00A0C90A8F39}alvin-PCalvinS-1-5-21-3799224096-1170514331-673851510-1000LocalHost (Using LRPC)

Error: (04/17/2012 11:25:36 PM) (Source: DCOM) (User: alvin)
Description: machine-defaultLocalActivation{9BA05972-F6A8-11CF-A442-00A0C90A8F39}alvin-PCalvinS-1-5-21-3799224096-1170514331-673851510-1000LocalHost (Using LRPC)

Error: (04/17/2012 11:24:12 PM) (Source: DCOM) (User: alvin)
Description: machine-defaultLocalActivation{9BA05972-F6A8-11CF-A442-00A0C90A8F39}alvin-PCalvinS-1-5-21-3799224096-1170514331-673851510-1000LocalHost (Using LRPC)

Error: (04/17/2012 11:23:17 PM) (Source: DCOM) (User: alvin)
Description: machine-defaultLocalActivation{9BA05972-F6A8-11CF-A442-00A0C90A8F39}alvin-PCalvinS-1-5-21-3799224096-1170514331-673851510-1000LocalHost (Using LRPC)

Error: (04/17/2012 11:17:07 PM) (Source: DCOM) (User: alvin)
Description: machine-defaultLocalActivation{9BA05972-F6A8-11CF-A442-00A0C90A8F39}alvin-PCalvinS-1-5-21-3799224096-1170514331-673851510-1000LocalHost (Using LRPC)


Microsoft Office Sessions:
=========================
Error: (04/18/2012 05:59:24 PM) (Source: Application Error)(User: )
Description: siw.exe2011.10.29.04f812b29unknown0.0.0.000000000c000000500000000158c01cd1dc797e35d23

Error: (04/18/2012 05:52:57 PM) (Source: Application Error)(User: )
Description: Photoshop.exe12.0.4.04d9d8cbcupdaternotifications.dll1.0.0.684bd928698000000300006855155c01cd1dc6befa95f3

Error: (04/18/2012 05:52:45 PM) (Source: Application Error)(User: )
Description: Photoshop.exe12.0.4.04d9d8cbcupdaternotifications.dll1.0.0.684bd928698000000300006855125001cd1dc6af2bf473

Error: (04/18/2012 05:41:41 PM) (Source: Perflib)(User: )
Description: PolicyAgent

Error: (04/18/2012 05:41:41 PM) (Source: Perflib)(User: )
Description: OpenIPSecPerformanceDataC:\Windows\System32\ipsecsvc.dllPolicyAgent4

Error: (04/18/2012 05:41:40 PM) (Source: Perflib)(User: )
Description: PNRPsvcC:\Windows\system32\pnrpperf.dll4

Error: (04/18/2012 05:41:38 PM) (Source: Perflib)(User: )
Description: EmdCacheC:\Windows\system32\emdmgmt.dll4

Error: (04/16/2012 10:29:39 PM) (Source: Application Hang)(User: )
Description: iexplore.exe9.0.8112.16421c1001cd1c5aed08b5c8250

Error: (04/15/2012 11:34:13 AM) (Source: Windows Search Service)(User: )
Description: Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)
C:\USERS\ALVIN\DESKTOP\ERICA DAVIDSON PICTURE 77972432\ERICADAVIDSON42ABIGDGIEH.JPG

Error: (04/15/2012 11:34:13 AM) (Source: Windows Search Service)(User: )
Description: Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)
C:\USERS\ALVIN\DESKTOP\ERICA DAVIDSON PICTURE 77972432\ERICA20.JPG


=========================== Installed Programs ============================

Adobe AIR (Version: 1.5.3.9120)
Adobe Community Help (Version: 3.0.0)
Adobe Community Help (Version: 3.0.0.400)
Adobe Flash Player 11 Plugin (Version: 11.2.202.233)
Adobe Media Player (Version: 1.8)
Adobe Photoshop CS5 (Version: 12.0)
Ask Toolbar (Version: 1.6.6.0)
ATI Catalyst Install Manager (Version: 3.0.608.0)
Audacity 1.3.4 (Unicode)
AVG Security Toolbar (Version: 10.2.0.3)
BitTorrent
BitTorrentBar Toolbar (Version: 6.2.2.4)
CamStudio
Conduit Engine (Version: )
DAEMON Tools Toolbar (Version: 1.1.2.0185)
EAX™ Unified (SHELL)
Fraps (remove only)
Google Chrome (Version: 18.0.1025.162)
Google Toolbar for Internet Explorer (Version: 1.0.0)
Google Toolbar for Internet Explorer (Version: 7.3.2710.138)
Google Update Helper (Version: 1.3.21.111)
IsoBuster 2.6 (Version: 2.6)
Java Auto Updater (Version: 2.0.7.1)
Java™ 6 Update 31 (Version: 6.0.310)
LAME v3.98.2 for Audacity
Lernout & Hauspie TruVoice American English TTS Engine
LiveUpdate 3.2 (Symantec Corporation) (Version: 3.2.0.68)
LiveUpdate Notice (Symantec Corporation) (Version: 1.4.5)
Malwarebytes' Anti-Malware
MAMEUIFX32 (Version: 0.140)
McAfee Security Scan Plus (Version: 2.0.181.2)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Games for Windows - LIVE (Version: 3.1.186.0)
Microsoft Games for Windows - LIVE Redistributable (Version: 3.1.99.0)
Microsoft Text-to-Speech Engine 4.0 (English)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft_VC80_ATL_x86 (Version: 8.0.50727.4053)
Microsoft_VC80_CRT_x86 (Version: 8.0.50727.4053)
Microsoft_VC80_MFC_x86 (Version: 8.0.50727.4053)
Microsoft_VC80_MFCLOC_x86 (Version: 8.0.50727.4053)
Microsoft_VC90_ATL_x86 (Version: 1.00.0000)
Microsoft_VC90_CRT_x86 (Version: 1.00.0000)
Microsoft_VC90_MFC_x86 (Version: 1.00.0000)
Mozilla Firefox (3.6.22) (Version: 3.6.22 (en-US))
Norton AntiVirus (Version: 18.7.1.3)
NVIDIA Display Control Panel (Version: 6.14.11.9745)
NVIDIA Drivers (Version: 1.10.59.37)
PDF Settings CS5 (Version: 10.0)
PowerISO (Version: 4.6)
PVSonyDll (Version: 1.00.0001)
Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista (Version: 1.00.0000)
Realtek High Definition Audio Driver (Version: 6.0.1.5331)
Samsung Printer Live Update
SoftThinks Recovery Center Installer (Version: 1.01.010)
Speakonia (Version: 1.0.3.5)
StarCraft II (Version: 1.0.1.16195)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
VLC media player 1.1.4 (Version: 1.1.4)
WinRAR archiver
Your Uninstaller! 2010 (Version: 7.0)

========================= Devices: ================================


========================= Memory info: ===================================

Percentage of memory in use: 39%
Total physical RAM: 2046.7 MB
Available physical RAM: 1228.89 MB
Total Pagefile: 4331.93 MB
Available Pagefile: 3304.78 MB
Total Virtual: 2047.88 MB
Available Virtual: 1946.7 MB

========================= Partitions: =====================================

1 Drive c: (Alvin's Games) (Fixed) (Total:223.81 GB) (Free:61.74 GB) NTFS
2 Drive d: (HD 2) (Fixed) (Total:465.65 GB) (Free:190.22 GB) FAT32
7 Drive i: (Recovery) (Fixed) (Total:9.08 GB) (Free:4.62 GB) NTFS

========================= Users: ========================================

User accounts for \\ALVIN-PC

Administrator alvin Guest


**** End of log ****

#9 Slayer90

Slayer90
  • Topic Starter

  • Members
  • 216 posts
  • OFFLINE
  •  
  • Local time:03:34 AM

Posted 18 April 2012 - 09:43 PM

Malwarebytes Anti-Malware (Trial) 1.61.0.1400
www.malwarebytes.org

Database version: v2012.04.19.01

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
alvin :: ALVIN-PC [administrator]

Protection: Enabled

4/18/2012 7:34:21 PM
mbam-log-2012-04-18 (19-34-21).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 176366
Time elapsed: 6 minute(s), 44 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

#10 Slayer90

Slayer90
  • Topic Starter

  • Members
  • 216 posts
  • OFFLINE
  •  
  • Local time:03:34 AM

Posted 18 April 2012 - 09:57 PM

aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software
Run date: 2012-04-18 19:47:20
-----------------------------
19:47:20.086 OS Version: Windows 6.0.6002 Service Pack 2
19:47:20.086 Number of processors: 2 586 0x4B02
19:47:20.086 ComputerName: ALVIN-PC UserName: alvin
19:47:21.521 Initialize success
19:50:31.970 AVAST engine defs: 12041802
19:51:17.116 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
19:51:17.116 Disk 0 Vendor: ST3250820AS 3.AAE Size: 238475MB BusType: 3
19:51:17.132 Disk 0 MBR read successfully
19:51:17.132 Disk 0 MBR scan
19:51:17.132 Disk 0 unknown MBR code
19:51:17.163 Disk 0 Partition 1 00 07 HPFS/NTFS NTFS 9295 MB offset 469355040
19:51:17.163 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 229177 MB offset 63
19:51:17.194 Disk 0 scanning sectors +488392065
19:51:17.257 Disk 0 scanning C:\Windows\system32\drivers
19:51:27.147 Service scanning
19:51:45.836 Service sptd C:\Windows\System32\Drivers\sptd.sys **LOCKED** 32
19:51:53.183 Modules scanning
19:51:59.767 Disk 0 trace - called modules:
19:51:59.782 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll >>UNKNOWN [0x840881f8]<<
19:51:59.798 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x851efac8]
19:51:59.798 3 CLASSPNP.SYS[881a98b3] -> nt!IofCallDriver -> [0x84ab5020]
19:51:59.813 5 acpi.sys[8072e6bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x84a4ab98]
19:51:59.813 \Driver\atapi[0x84a66170] -> IRP_MJ_CREATE -> 0x840881f8
19:52:00.718 AVAST engine scan C:\Windows
19:52:04.025 AVAST engine scan C:\Windows\system32
19:56:00.397 AVAST engine scan C:\Windows\system32\drivers
19:56:19.251 AVAST engine scan C:\Users\alvin
19:56:46.082 Disk 0 MBR has been saved successfully to "C:\Users\alvin\Desktop\MBR.dat"
19:56:46.092 The log file has been saved successfully to "C:\Users\alvin\Desktop\aswMBR.txt"

#11 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,738 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:03:34 AM

Posted 18 April 2012 - 09:59 PM

All looks clean so far.

Please download GMER from one of the following locations and save it to your desktop:
  • Main Mirror
    This version will download a randomly named file (Recommended)
  • Zipped Mirror
    This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  • Disconnect from the Internet and close all running programs.
  • Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  • Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  • Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.

    Posted Image
  • GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  • If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  • Now click the Scan button. If you see a rootkit warning window, click OK.
  • When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  • Click the Copy button and paste the results into your next reply.
  • Exit GMER and be sure to re-enable your anti-virus, Firewall and any other security programs you had disabled.

IMPORTANT! If for some reason GMER refuses to run, try again.
If it still fails, try to UN-check "Devices" in right pane.
If still no joy, try to run it from Safe Mode.

My Website

My help doesn't cost a penny, but if you'd like to consider a donation, click DONATE

 


#12 Slayer90

Slayer90
  • Topic Starter

  • Members
  • 216 posts
  • OFFLINE
  •  
  • Local time:03:34 AM

Posted 19 April 2012 - 12:11 AM

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-04-18 22:08:22
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST3250820AS rev.3.AAE
Running: hebigm53.exe; Driver: C:\Users\alvin\AppData\Local\Temp\pwlorpod.sys


---- System - GMER 1.0.15 ----

SSDT 8641F548 ZwAlertResumeThread
SSDT 8641F628 ZwAlertThread
SSDT 8641FF38 ZwAllocateVirtualMemory
SSDT 8639D358 ZwAlpcConnectPort
SSDT 86420CE8 ZwAssignProcessToJobObject
SSDT 8641F298 ZwCreateMutant
SSDT 86420A08 ZwCreateSymbolicLinkObject
SSDT 8641E7A8 ZwCreateThread
SSDT 86420DC8 ZwDebugActiveProcess
SSDT 8641E4F0 ZwDuplicateObject
SSDT 8641FD58 ZwFreeVirtualMemory
SSDT 8641F388 ZwImpersonateAnonymousToken
SSDT 8641F468 ZwImpersonateThread
SSDT 8639D2E0 ZwLoadDriver
SSDT 8641FC58 ZwMapViewOfSection
SSDT 8641F1B8 ZwOpenEvent
SSDT 8641E690 ZwOpenProcess
SSDT 8641F008 ZwOpenProcessToken
SSDT 86420FD0 ZwOpenSection
SSDT 8641E5C0 ZwOpenThread
SSDT 86420BF8 ZwProtectVirtualMemory
SSDT 8641F708 ZwResumeThread
SSDT 8641F9A8 ZwSetContextThread
SSDT 8641FA88 ZwSetInformationProcess
SSDT 86420EA8 ZwSetSystemInformation
SSDT 8641F0D8 ZwSuspendProcess
SSDT 8641F7E8 ZwSuspendThread
SSDT 8641E888 ZwTerminateProcess
SSDT 8641F8C8 ZwTerminateThread
SSDT 8641FB78 ZwUnmapViewOfSection
SSDT 8641FE48 ZwWriteVirtualMemory
SSDT 86420AF8 ZwCreateThreadEx

INT 0x51 ? 84084BF8
INT 0x62 ? 85A93BF8
INT 0x72 ? 85A93BF8
INT 0x82 ? 85A93BF8
INT 0x82 ? 85A93BF8
INT 0x82 ? 85A93BF8
INT 0x92 ? 85A93BF8
INT 0xA2 ? 84084BF8
INT 0xB2 ? 84084BF8

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!KeSetEvent + 11D 81EF58A0 8 Bytes [48, F5, 41, 86, 28, F6, 41, ...]
.text ntkrnlpa.exe!KeSetEvent + 131 81EF58B4 4 Bytes [38, FF, 41, 86]
.text ntkrnlpa.exe!KeSetEvent + 13D 81EF58C0 4 Bytes [58, D3, 39, 86]
.text ntkrnlpa.exe!KeSetEvent + 191 81EF5914 4 Bytes CALL 9E759B25
.text ntkrnlpa.exe!KeSetEvent + 1F5 81EF5978 4 Bytes [98, F2, 41, 86]
.text ...
? System32\Drivers\spmt.sys The system cannot find the path specified. !
.text USBPORT.SYS!DllUnload 87F4641B 5 Bytes JMP 85A931D8
? C:\Users\alvin\AppData\Local\Temp\aswMBR.sys The system cannot find the file specified. !

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Mozilla Firefox\firefox.exe[1708] ntdll.dll!LdrLoadDll 77A49378 5 Bytes JMP 010713F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)
.text C:\Program Files\Mozilla Firefox\firefox.exe[1708] ntdll.dll!NtMapViewOfSection 77A84994 5 Bytes JMP 003F003A
.text C:\Program Files\Mozilla Firefox\firefox.exe[1708] ntdll.dll!NtSetInformationProcess 77A85194 5 Bytes JMP 003F00F7
.text C:\Program Files\Mozilla Firefox\firefox.exe[1708] kernel32.dll!ReadProcessMemory + 3E 77941CB3 7 Bytes JMP 003F01B0
.text C:\Program Files\Mozilla Firefox\firefox.exe[1708] kernel32.dll!WriteProcessMemory + 106 77941DBE 7 Bytes JMP 003F03D2
.text C:\Program Files\Mozilla Firefox\firefox.exe[1708] kernel32.dll!CreateIoCompletionPort + 52 77969DA6 7 Bytes JMP 003F0488
.text C:\Program Files\Mozilla Firefox\firefox.exe[1708] kernel32.dll!VirtualAllocEx + 54 7798AF70 7 Bytes JMP 003F031C
.text C:\Program Files\Mozilla Firefox\firefox.exe[1708] kernel32.dll!GetProcessHandleCount + 35 779D5D4F 7 Bytes JMP 003F0266

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortUchar] [806066D6] \SystemRoot\System32\Drivers\spmt.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUchar] [80606042] \SystemRoot\System32\Drivers\spmt.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort] [80606800] \SystemRoot\System32\Drivers\spmt.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUshort] [806060C0] \SystemRoot\System32\Drivers\spmt.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort] [8060613E] \SystemRoot\System32\Drivers\spmt.sys
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [80615B90] \SystemRoot\System32\Drivers\spmt.sys

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 84A1D1F8
Device \FileSystem\fastfat \FatCdrom 85AA41F8
Device \Driver\volmgr \Device\VolMgrControl 840861F8
Device \Driver\usbohci \Device\USBPDO-0 85EB11F8
Device \Driver\usbohci \Device\USBPDO-1 85EB11F8
Device \Driver\usbohci \Device\USBPDO-2 85EB11F8
Device \Driver\usbohci \Device\USBPDO-3 85EB11F8
Device \Driver\USBSTOR \Device\00000060 866281F8
Device \Driver\USBSTOR \Device\00000061 866281F8
Device \Driver\usbohci \Device\USBPDO-4 85EB11F8

AttachedDevice \Driver\tdx \Device\Tcp SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)

Device \Driver\USBSTOR \Device\00000062 866281F8
Device \Driver\usbehci \Device\USBPDO-5 85B4A1F8
Device \Driver\volmgr \Device\HarddiskVolume1 840861F8
Device \Driver\volmgr \Device\HarddiskVolume2 840861F8
Device \Driver\cdrom \Device\CdRom0 8599D1F8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0 840881F8
Device \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-3 840881F8
Device \Driver\atapi \Device\Ide\IdePort0 840881F8
Device \Driver\atapi \Device\Ide\IdePort1 840881F8
Device \Driver\atapi \Device\Ide\IdePort2 840881F8
Device \Driver\atapi \Device\Ide\IdePort3 840881F8
Device \Driver\volmgr \Device\HarddiskVolume3 840861F8
Device \Driver\volmgr \Device\HarddiskVolume4 840861F8
Device \Driver\USBSTOR \Device\00000067 866281F8
Device \Driver\volmgr \Device\HarddiskVolume5 840861F8
Device \Driver\USBSTOR \Device\00000068 866281F8
Device \Driver\volmgr \Device\HarddiskVolume6 840861F8
Device \Driver\USBSTOR \Device\00000069 866281F8
Device \Driver\volmgr \Device\HarddiskVolume7 840861F8
Device \Driver\netbt \Device\NetBt_Wins_Export 863902A0
Device \Driver\Smb \Device\NetbiosSmb 863AB1F8
Device \Driver\iScsiPrt \Device\RaidPort0 840921F8

AttachedDevice \Driver\tdx \Device\Udp SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\tdx \Device\RawIp SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)

Device \Driver\USBSTOR \Device\0000006a 866281F8
Device \Driver\usbohci \Device\USBFDO-0 85EB11F8
Device \Driver\usbohci \Device\USBFDO-1 85EB11F8
Device \Driver\usbohci \Device\USBFDO-2 85EB11F8
Device \Driver\usbohci \Device\USBFDO-3 85EB11F8
Device \Driver\usbohci \Device\USBFDO-4 85EB11F8
Device \Driver\usbehci \Device\USBFDO-5 85B4A1F8
Device \FileSystem\fastfat \Fat 85AA41F8

AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device \FileSystem\cdfs \Cdfs 877FD500

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xE8 0x7D 0xB9 0xD3 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xE8 0x7D 0xB9 0xD3 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...

---- EOF - GMER 1.0.15 ----

#13 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,738 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:03:34 AM

Posted 19 April 2012 - 10:37 AM

I don't see anything malicious there.

I suggest you start new topic in Windows forum.

My Website

My help doesn't cost a penny, but if you'd like to consider a donation, click DONATE

 


#14 Slayer90

Slayer90
  • Topic Starter

  • Members
  • 216 posts
  • OFFLINE
  •  
  • Local time:03:34 AM

Posted 19 April 2012 - 01:46 PM

This Trojan is undetectable. 2 years ago I was infected by different trojan, I cam here and did most of the same stuff. None of the programs like ones here say its all clean. It took F secure to finally to discover it was TrojanDownloader/W32/Reno. So I'm saying my computer is infected. This trojan is most likely a new type. it slow unresponsive. It was finally last week and before. But this time even F secure can't detect it.

#15 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,738 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:03:34 AM

Posted 19 April 2012 - 02:14 PM

If you want to go through more advanced checks...

Please follow the instructions in ==>This Guide<== starting at Step 6. If you cannot complete a step, skip it and continue.

Once the proper logs are created, then make a NEW TOPIC and post it ==>HERE<== Please include a description of your computer issues, what you have done to resolve them, and a link to this topic.

If you can produce at least some of the logs, then please create the new topic and explain what happens when you try to create the log(s) that you couldn't get. If you cannot produce any of the logs, then still post the topic and explain that you followed the Prep. Guide, were unable to create the logs, and describe what happens when you try to create the logs.

It would be helpful if you post a note here once you have completed the steps in the guide and have started your topic in malware removal. Good luck and be patient.

If HelpBot replies to your topic, PLEASE follow Step One so it will report your topic to the team members.

My Website

My help doesn't cost a penny, but if you'd like to consider a donation, click DONATE

 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users