Help!!!! MY OTL has been scanning for 2 hours and still going. Is this bad

View previous topic View next topic Go down

Re: Help!!!! MY OTL has been scanning for 2 hours and still going. Is this bad

Post by psycochic on Sun Jul 25, 2010 6:19 pm

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-07-22 22:21:45
< End of report >


No extras were given only OTL log

Having an Extremely hard time posting OTL log from "infected" computer. Gives me a lost connection error report everytime. That is why there are some many posts *sorry*

psycochic
Novice
Novice

Status :
Online
Offline

Posts : 37
Joined : 2010-07-22
OS : vista

View user profile

Back to top Go down

Re: Help!!!! MY OTL has been scanning for 2 hours and still going. Is this bad

Post by Dr Jay on Mon Jul 26, 2010 8:08 am

Please run the [You must be registered and logged in to see this link.]

  • Follow the Instruction [You must be registered and logged in to see this link.] for installation.
  • Accept the License Agreement.
  • Once the ActiveX installs,Click Full System Scan
  • Once the download completes,the scan will begin automatically.
  • The scan will take some time to finish,so please be patient.
  • When the scan completes, click the Automatic cleaning (recommended) button.
  • Click the Show Report button and Copy&Paste the entire report in your next reply.


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Status :
Online
Offline

Posts : 13711
Joined : 2009-09-06
Gender : Male
OS : Windows 10 Home & Pro

View user profile

Back to top Go down

Re: Help!!!! MY OTL has been scanning for 2 hours and still going. Is this bad

Post by psycochic on Tue Jul 27, 2010 12:26 am

Sorry to be a pain Jay but... The online scanner will not run for me. Or download for that matter. I went to the link you specified and I get an automation error. Am I supposed to download something or just run the online thing. What do I do next?

psycochic
Novice
Novice

Status :
Online
Offline

Posts : 37
Joined : 2010-07-22
OS : vista

View user profile

Back to top Go down

Re: Help!!!! MY OTL has been scanning for 2 hours and still going. Is this bad

Post by psycochic on Tue Jul 27, 2010 2:07 am

Got it working will post results as soon as I get them 99% for the last 30 minutes.

psycochic
Novice
Novice

Status :
Online
Offline

Posts : 37
Joined : 2010-07-22
OS : vista

View user profile

Back to top Go down

Re: Help!!!! MY OTL has been scanning for 2 hours and still going. Is this bad

Post by psycochic on Tue Jul 27, 2010 4:00 am

F secure will not finish 23561 scanned @ 99% for an hour. 7 spywares found. I am going to let it go overnight unless you say to quit. Any options if this doesn't work?

psycochic
Novice
Novice

Status :
Online
Offline

Posts : 37
Joined : 2010-07-22
OS : vista

View user profile

Back to top Go down

Re: Help!!!! MY OTL has been scanning for 2 hours and still going. Is this bad

Post by Dr Jay on Tue Jul 27, 2010 5:43 am

Please do a scan with [You must be registered and logged in to see this link.]

Click on the Accept button and install any components it needs.

  • The program will install and then begin downloading the latest definition files.
  • After the files have been downloaded on the left side of the page in the Scan section select My Computer.
  • This will start the program and scan your system.
  • The scan will take a while, so be patient and let it run.
  • Once the scan is complete, click on View scan report
  • Now, click on the Save Report as button.
  • Save the file to your desktop.
  • Copy and paste that information in your next post.

Note: If the scan freezes for more than 30 minutes, stop the scan, and report back to me.


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Status :
Online
Offline

Posts : 13711
Joined : 2009-09-06
Gender : Male
OS : Windows 10 Home & Pro

View user profile

Back to top Go down

Re: Help!!!! MY OTL has been scanning for 2 hours and still going. Is this bad

Post by psycochic on Tue Jul 27, 2010 6:28 pm

Tuesday, July 27, 2010
Operating system: Microsoft Windows Vista Home Premium Edition, 32-bit (build 6000)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Tuesday, July 27, 2010 08:05:37
Records in database: 4196059
Scan settings
scan using the following database extended
Scan archives yes
Scan e-mail databases yes
Scan area My Computer
C:\
D:\
Scan statistics
Objects scanned 95978
Threats found 10
Infected objects found 14
Suspicious objects found 0
Scan duration 02:26:37

File name Threat Threats count
C:\Users\ezlj\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44\5473416c-6c798ae0 Infected: Exploit.Java.Agent.f 1
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\310e48cf-13e5dde3 Infected: Exploit.Java.Agent.f 1
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2\299bd202-72ddd6a2 Infected: Exploit.Java.Agent.f 1
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2\299bd202-72ddd6a2 Infected: Trojan-Downloader.Java.Agent.cd 1
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2\299bd202-72ddd6a2 Infected: Trojan-Downloader.Java.OpenStream.al 1
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25\16646899-67124f50 Infected: Exploit.Java.Agent.f 1
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41\17212269-7be5104c Infected: Trojan-Downloader.Java.Agent.ft 1
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41\17212269-7be5104c Infected: Trojan-Downloader.Java.Agent.fu 1
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41\17212269-7be5104c Infected: Trojan-Downloader.Java.Agent.fv 1
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48\2121b370-36996514 Infected: Trojan-Downloader.Java.Agent.fl 1
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48\2121b370-36996514 Infected: Trojan-Downloader.Java.Agent.fk 1
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48\2121b370-36996514 Infected: Trojan-Downloader.Java.Agent.fj 1
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\445d036-3d61ea20 Infected: Exploit.Java.Agent.f 1
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\689709ff-33d35449 Infected: Trojan-Downloader.Java.Agent.cf 1
Selected area has been scanned.

psycochic
Novice
Novice

Status :
Online
Offline

Posts : 37
Joined : 2010-07-22
OS : vista

View user profile

Back to top Go down

Re: Help!!!! MY OTL has been scanning for 2 hours and still going. Is this bad

Post by Dr Jay on Tue Jul 27, 2010 7:13 pm

Hiya! Your logs appear to be clean. If there are no more issues, then we shall clean up!

Clear your Java Cache
  • Click on Start-> Control Panel (Classic View)-> Java (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH Checked

        Applications and Applets
        Trace and Log Files
    • Click OK on Delete Temporary Files Window
      Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
    • Click OK to leave the Temporary Files Window
    • Click OK to leave the Java Control Panel.


Clean up System Restore

Now, to get you off to a clean start, we will be creating a new Restore Point, then clearing the old ones to make sure you do not get reinfected, in case you need to "restore back."

To manually create a new Restore Point

  • Go to Control Panel and select System and Maintenance
  • Select System
  • On the left select Advance System Settings and accept the warning if you get one
  • Select System Protection Tab
  • Select Create at the bottom
  • Type in a name i.e. Clean
  • Select Create
Now we can purge the infected ones
  • Go back to the System and Maintenance page
  • Select Performance Information and Tools
  • On the left select Open Disk Cleanup
  • Select Files from all users and accept the warning if you get one
  • In the drop down box select your main drive i.e. C
  • For a few moments the system will make some calculations
  • Select the More Options tab
  • In the System Restore and Shadow Backups select Clean up
  • Select Delete on the pop up
  • Select OK
  • Select Delete


Run OTC to remove our tools

To remove all of the tools we used and the files and folders they created, please do the following:
Please download [You must be registered and logged in to see this link.] by OldTimer:
  • Save it to your Desktop.
  • Double click OTC.exe.
  • Click the CleanUp! button.
  • If you are prompted to Reboot during the cleanup, select Yes.
  • The tool will delete itself once it finishes.

Note: If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.

Purge old temporary files

Please download [You must be registered and logged in to see this link.] to your desktop
  • Please double-click TFC.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • It will close all programs when run, so make sure you have saved all your work before you begin.
  • Click the Start
    button to begin the process. Depending on how often you clean temp
    files, execution time should be anywhere from a few seconds to a minute
    or two. Let it run uninterrupted to completion.
  • Once it's finished it should reboot your machine. If it does not, please manually reboot the machine yourself to ensure a complete clean.


Security Check

Please download Security Check by screen317 from [You must be registered and logged in to see this link.] or [You must be registered and logged in to see this link.].
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.


Tell me in your next reply, if you have completed these tasks:
  • Cleaned System Restore
  • Ran OTC
  • Ran TFC
  • Ran Security Check

Also, let me know how your computer is running, and don't forget to post the contents of the Security Check log.


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Status :
Online
Offline

Posts : 13711
Joined : 2009-09-06
Gender : Male
OS : Windows 10 Home & Pro

View user profile

Back to top Go down

Re: Help!!!! MY OTL has been scanning for 2 hours and still going. Is this bad

Post by psycochic on Tue Jul 27, 2010 8:37 pm

Results of screen317's Security Check version 0.99.4
Windows Vista (UAC is disabled!)
[You must be registered and logged in to see this link.]
Internet Explorer 7 Out of date!
``````````````````````````````
Antivirus/Firewall Check:

Windows Firewall Enabled!
AVG Free 9.0
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:

Malwarebytes' Anti-Malware
CCleaner
Java(TM) 6 Update 20
Java(TM) 6 Update 4
Out of date Java installed!
Adobe Flash Player 10.0.22.87
Adobe Reader 9
Out of date Adobe Reader installed!
Mozilla Firefox (3.6.8)
````````````````````````````````
Process Check:
objlist.exe by Laurent

AVG avgwdsvc.exe
AVG avgtray.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
````````````````````````````````
DNS Vulnerability Check:

Request Timed Out (Wireless Internet connection/Disconnected Internet/Proxy?)

``````````End of Log````````````




--------------------------------------------------------------------------------------------
* Cleaned System Restore (DONE)
* Ran OTC (DONE)
* Ran TFC (DONE)
* Ran Security Check (DONE)


Still getting redirected everytime I search. What next?

psycochic
Novice
Novice

Status :
Online
Offline

Posts : 37
Joined : 2010-07-22
OS : vista

View user profile

Back to top Go down

Re: Help!!!! MY OTL has been scanning for 2 hours and still going. Is this bad

Post by psycochic on Tue Jul 27, 2010 11:06 pm

I was afraid I missed something here is the updated log:



Results of screen317's Security Check version 0.99.4
Windows Vista (UAC is disabled!)
[You must be registered and logged in to see this link.]
Internet Explorer 7 Out of date!
``````````````````````````````
Antivirus/Firewall Check:

Windows Firewall Enabled!
AVG Free 9.0
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:

Malwarebytes' Anti-Malware
CCleaner
Java(TM) 6 Update 20
Java(TM) 6 Update 4
Out of date Java installed!
Adobe Flash Player 10.0.22.87
Adobe Reader 9
Out of date Adobe Reader installed!
Mozilla Firefox (3.6.8)
````````````````````````````````
Process Check:
objlist.exe by Laurent

AVG avgwdsvc.exe
AVG avgtray.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
````````````````````````````````
DNS Vulnerability Check:

Request Timed Out (Wireless Internet connection/Disconnected Internet/Proxy?)

``````````End of Log````````````

psycochic
Novice
Novice

Status :
Online
Offline

Posts : 37
Joined : 2010-07-22
OS : vista

View user profile

Back to top Go down

Re: Help!!!! MY OTL has been scanning for 2 hours and still going. Is this bad

Post by Dr Jay on Wed Jul 28, 2010 2:59 am

Adobe Reader Update!

Please download the newest version of Adobe Acrobat Reader from [You must be registered and logged in to see this link.]

Before installing: it is important to remove older versions of Acrobat Reader since it does not do so automatically and old versions still leave you vulnerable.
Go to the Control Panel and enter Add or Remove Programs (Programs and Features in Vista/7).
Search in the list for all previous installed versions of Adobe Acrobat Reader. Uninstall/Remove each of them.

Once old versions are gone, please install the newest version.

Java Update!

Please download the newest version of Java from [You must be registered and logged in to see this link.].

Before installing: it is important to remove older versions of Java since it does not do so automatically and old versions still leave you vulnerable.
Go to the Control Panel and enter Add or Remove Programs (Programs and Features in Vista/7).
Search in the list for all previous installed versions of Java. (J2SE Runtime Environment). Please uninstall/remove each of them.

Once old versions are gone, please install the newest version.




Please download the [You must be registered and logged in to see this link.] and save it to your desktop.

You will need to enter your name, e-mail address and location in order to access the download page.

  • Once you have downloaded the file, double click the sarsfx icon
  • Review the licence agreement and click on the Accept button
  • The scanner will prompt you to extract the files to C:\SOPHTEMP - DO NOT change this location, simply click the Install button

  • Once the files have been extracted; using Windows Explorer, navigate to C:\SOPHTEMP and double click on the blue shield icon called sargui
  • Ensure that there are checkmarks next to Running processes, Windows registry and Local hard drives, then click Start scan
  • Allow the program to scan your computer - please be patient as it may take some time
  • Once the scan has completed a window will pop-up with the results of the scan - click OK to this
  • In the main window, you will see each of the entries found by the scan (if any)

    • If the scanner generated any warning messages, please click on each warning and copy and paste the text of it into this thread for me to review
    • Once you have posted any warning messages here, you can close the scanner and wait for me to get back to you

  • If you have not had any warnings, any entries which can be cleaned up by the scanner will have a box with a green checkmark in it next to the entry
  • To clean up these entries click on the Clean up checked items button
  • If you accidentally check a file NOT recommended for clean up, you will get a warning message and if necessary can re-select the entries you want to clean up
  • Once you have cleaned the selected files, you will be prompted to re-boot your computer - please do so.


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Status :
Online
Offline

Posts : 13711
Joined : 2009-09-06
Gender : Male
OS : Windows 10 Home & Pro

View user profile

Back to top Go down

Re: Help!!!! MY OTL has been scanning for 2 hours and still going. Is this bad

Post by psycochic on Wed Jul 28, 2010 4:23 am

All the ones I read said--Removable: Yes (but clean up not recommended for this file)
Unfortunately I did not copy all of them. No green "check marks" but they all had green boxes. Do I need to scan again? Is it recommended to delete the scanner or wait to delete it?


Area: Local hard drives
Description: Unknown hidden file
Location: C:\Users\ezlj\AppData\Local\Mozilla\Firefox\Profiles\kasiuv91.default\Cache\A6303E1Ed01
Removable: Yes (but clean up not recommended for this file)
Notes: (no more detail available)

Area: Local hard drives
Description: Unknown hidden file
Location: C:\Program Files\VideoLAN\VLC\uninstall.exe
Removable: Yes (but clean up not recommended for this file)
Notes: (no more detail available)

Area: Local hard drives
Description: Unknown hidden file
Location: C:\downloads\FOGDownloader-RoM_3_0_1_2153.exe
Removable: Yes (but clean up not recommended for this file)
Notes: (no more detail available)

Area: Local hard drives
Description: Unknown hidden file
Location: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DF6RU5UY\tandard;sz=4x4;tile=6;demo=D;u=pos-atf%7Cenvid-origin%7Curi-_arcade_wgt_landing%7Ctag-adj%7Cmtype-standard%7Csz-4x4%7Ctile-6%7Cdemo-D;[1]
Removable: Yes (but clean up not recommended for this file)
Notes: (no more detail available)

Area: Local hard drives
Description: Unknown hidden file
Location: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DF6RU5UY\o=D;dcopt=ist;u=pos-atf%7Cenvid-origin%7Curi-_arcade_wgt_landing%7Ctag-adj%7Cmtype-standard%7Csz-728x90%7Ctile-1%7Cdemo-D%7Cdcopt-ist;[1]
Removable: Yes (but clean up not recommended for this file)
Notes: (no more detail available)

Area: Local hard drives
Description: Unknown hidden file
Location: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DF6RU5UY\sz=300x250;tile=2;demo=D;u=pos-atf%7Cenvid-origin%7Curi-_arcade_wgt_landing%7Ctag-adj%7Cmtype-standard%7Csz-300x250%7Ctile-2%7Cdemo-D;[1]
Removable: Yes (but clean up not recommended for this file)
Notes: (no more detail available)

Area: Local hard drives
Description: Unknown hidden file
Location: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D8MQ6IU3\ile=3;demo=D;u=promobox-skin%7Cenvid-origin%7Curi-_arcade_wgt_landing%7Cpos-btf%7Ctag-adj%7Cmtype-standard%7Csz-1x1%7Ctile-3%7Cdemo-D;[1]
Removable: Yes (but clean up not recommended for this file)
Notes: (no more detail available)

Area: Local hard drives
Description: Unknown hidden file
Location: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GDO0BRHA\emo=D;u=promobox-globaltxtad%7Cpos-atf%7Cenvid-origin%7Curi-_arcade_wgt_landing%7Ctag-adj%7Cmtype-standard%7Csz-1x1%7Ctile-4%7Cdemo-D;[1]
Removable: Yes (but clean up not recommended for this file)
Notes: (no more detail available)

Area: Local hard drives
Description: Unknown hidden file
Location: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MUSI99E5\e=7;demo=D;u=pos-btf%7Cresearch-survey%7Cenvid-origin%7Curi-_arcade_wgt_landing%7Ctag-adj%7Cmtype-standard%7Csz-1x2%7Ctile-7%7Cdemo-D;[1]
Removable: Yes (but clean up not recommended for this file)
Notes: (no more detail available)

Area: Local hard drives
Description: Unknown hidden file
Location: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GDO0BRHA\d;sz=4x4;tile=7;demo=D;u=!category-shows%7Cpos-atf%7Cenvid-origin%7Curi-_shows_%7Ctag-adj%7Cmtype-standard%7Csz-4x4%7Ctile-7%7Cdemo-D;[1]
Removable: Yes (but clean up not recommended for this file)
Notes: (no more detail available)

Area: Local hard drives
Description: Unknown hidden file
Location: C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG2
Removable: Yes (but clean up not recommended for this file)
Notes: (no more detail available)

psycochic
Novice
Novice

Status :
Online
Offline

Posts : 37
Joined : 2010-07-22
OS : vista

View user profile

Back to top Go down

Re: Help!!!! MY OTL has been scanning for 2 hours and still going. Is this bad

Post by Dr Jay on Wed Jul 28, 2010 9:04 pm

Please download [You must be registered and logged in to see this link.] and install it. If you already have it, no need to reinstall.

Then, download [You must be registered and logged in to see this link.] and save the setup to your Desktop.

  • Right-click on the RootkitUnhooker setup and mouse-over 7-Zip then click Extract to "RKU***"
  • Once that is done, enter the folder, and double-click on the setup file. Navigate through setup and finish.
  • Once that is done, you will see another folder that was created inside the RKU folder. Enter that folder, and double-click on the randomly named file. (It will be alpha-numeric and have an EXE extension on it.)
  • It will initialize itself and load the scanner. It will also install its driver. Please wait for the interface to begin.
  • Once inside the interface, do not fix anything. Click on the Report tab.
  • Next, click on the Scan button and a popup will show. Make sure all are checked, then click on OK. It will begin scanning. When it gets to the Files tab, it will ask you what drives to scan. Just select C:\ and hit OK.
  • It will finish in about 5 minutes or a little longer depending on how badly infected the system is, or if your security software is enabled.
  • When finished, it will show the report in the Report tab. Please copy all of it, and post it in your next reply. Depending on how large the log is, you may have to use two or three posts to get all the information in.


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Status :
Online
Offline

Posts : 13711
Joined : 2009-09-06
Gender : Male
OS : Windows 10 Home & Pro

View user profile

Back to top Go down

Re: Help!!!! MY OTL has been scanning for 2 hours and still going. Is this bad

Post by psycochic on Thu Jul 29, 2010 1:20 am

RkU Version: 3.8.388.590, Type LE (SR2)
==============================================
OS Name: Windows Vista
Version 6.0.6000
Number of processors #2
==============================================
>SSDT State
==============================================
==============================================
>Shadow
==============================================
==============================================
>Processes
==============================================
0x98C2CD90 [12] C:\Windows\System32\spoolsv.exe (Microsoft Corporation, Spooler SubSystem App)
0x838CA570 [344] C:\Windows\System32\taskeng.exe (Microsoft Corporation, Task Scheduler Engine)
0x8A086C00 [420] C:\Windows\System32\smss.exe (Microsoft Corporation, Windows Session Manager)
0x84810CA8 [512] C:\Windows\System32\csrss.exe (Microsoft Corporation, Client Server Runtime Process)
0x8A1D74B8 [560] C:\Windows\System32\wininit.exe (Microsoft Corporation, Windows Start-Up Application)
0x848A27F0 [568] C:\Windows\System32\csrss.exe (Microsoft Corporation, Client Server Runtime Process)
0x8D18B020 [580] C:\Program Files\AVG\AVG9\avgchsvx.exe (AVG Technologies CZ, s.r.o., AVG Cache Server)
0x8D18CD90 [588] C:\Program Files\AVG\AVG9\avgrsx.exe (AVG Technologies CZ, s.r.o., AVG Resident Shield Service)
0x8D1AB150 [620] C:\Windows\System32\services.exe (Microsoft Corporation, Services and Controller app)
0x8D1AD020 [632] C:\Windows\System32\lsass.exe (Microsoft Corporation, Local Security Authority Process)
0x8D1ADAD8 [640] C:\Windows\System32\lsm.exe (Microsoft Corporation, Local Session Manager Service)
0x8D1B5D90 [668] C:\Windows\System32\winlogon.exe (Microsoft Corporation, Windows Logon Application)
0x93C36D90 [768] C:\Program Files\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o., AVG Scanning Core Module - Server Part)
0x98C3CD90 [864] C:\Windows\System32\dwm.exe (Microsoft Corporation, Desktop Window Manager)
0x93C9F020 [876] C:\Windows\System32\svchost.exe (Microsoft Corporation, Host Process for Windows Services)
0x8335D280 [1056] C:\Windows\System32\svchost.exe (Microsoft Corporation, Host Process for Windows Services)
0x98C2DD90 [1060] C:\Windows\System32\svchost.exe (Microsoft Corporation, Host Process for Windows Services)
0x93CCED90 [1068] C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation, NVIDIA Driver Helper Service, Version 178.13)
0x93CC7220 [1100] C:\Windows\System32\svchost.exe (Microsoft Corporation, Host Process for Windows Services)
0x93D45750 [1252] C:\Windows\System32\svchost.exe (Microsoft Corporation, Host Process for Windows Services)
0x93D74638 [1288] C:\Windows\System32\svchost.exe (Microsoft Corporation, Host Process for Windows Services)
0x98C6DC08 [1316] C:\Windows\explorer.exe (Microsoft Corporation, Windows Explorer)
0x96441898 [1536] C:\Windows\System32\wuauclt.exe (Microsoft Corporation, Windows Update)
0x96517D90 [1556] C:\Windows\System32\svchost.exe (Microsoft Corporation, Host Process for Windows Services)
0x96466170 [1588] C:\Windows\System32\SLsvc.exe (Microsoft Corporation, Microsoft Software Licensing Service)
0x96520020 [1640] C:\Windows\System32\rundll32.exe (Microsoft Corporation, Windows host process (Rundll32))
0x847948C0 [1784] C:\Windows\System32\svchost.exe (Microsoft Corporation, Host Process for Windows Services)
0x96580798 [1964] C:\Windows\System32\svchost.exe (Microsoft Corporation, Host Process for Windows Services)
0x98D92940 [2212] C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o., AVG Watchdog Service)
0x93D58D90 [2272] C:\Users\ezlj\Desktop\RkU3.8.388.590\MustBeRandomlyNamed\Hw55eCa.exe (UG North, RKULE, SR2 Normandy)
0x98DC24C0 [2320] C:\Program Files\Verizon\VSP\VerizonServicepoint.exe (Verizon, Verizon Servicepoint Application)
0x83847400 [2360] C:\Windows\System32\wuauclt.exe (Microsoft Corporation, Windows Update)
0x9B528988 [2432] C:\Program Files\Windows Media Player\wmpnetwk.exe (Microsoft Corporation, Windows Media Player Network Sharing Service)
0x838A8B48 [2436] C:\Windows\System32\taskeng.exe (Microsoft Corporation, Task Scheduler Engine)
0x98DE2740 [2456] C:\Windows\System32\rundll32.exe (Microsoft Corporation, Windows host process (Rundll32))
0x98DD7738 [2508] C:\Windows\System32\SearchFilterHost.exe (Microsoft Corporation, Microsoft Windows Search Filter Host)
0x9B48ED90 [2556] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o., AVG Tray Monitor)
0x98DE7B98 [2648] C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc., Java(TM) Update Scheduler)
0x9B4A19D8 [2656] C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation, Windows Media Player Network Sharing Service Configuration Application)
0x9B448338 [2868] C:\Windows\System32\svchost.exe (Microsoft Corporation, Host Process for Windows Services)
0x9B4BDD90 [3020] C:\Program Files\AVG\AVG9\avgnsx.exe (AVG Technologies CZ, s.r.o., AVG Network scanner Service)
0x98C2C020 [3044] C:\Windows\System32\wbem\unsecapp.exe (Microsoft Corporation, Sink to receive asynchronous callbacks for WMI client application)
0x9B4F7AF0 [3176] C:\Windows\System32\svchost.exe (Microsoft Corporation, Host Process for Windows Services)
0x9B538D90 [3284] C:\Windows\System32\svchost.exe (Microsoft Corporation, Host Process for Windows Services)
0x9B59B020 [3384] C:\Windows\System32\SearchIndexer.exe (Microsoft Corporation, Microsoft Windows Search Indexer)
0x9B575D90 [3472] C:\Program Files\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o., AVG E-Mail Scanner)
0x9B428020 [3604] C:\Program Files\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o., AVG Scanning Core Module - Server Part)
0x848B1020 [3904] C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation, Firefox)
0x83743C80 [3976] C:\Windows\System32\SearchProtocolHost.exe (Microsoft Corporation, Microsoft Windows Search Protocol Host)
0x82D6D020 [4] System
0x93DACD90 [1404] C:\Windows\System32\audiodg.exe (Microsoft Corporation, Windows Audio Device Graph Isolation )
==============================================
>Drivers
==============================================
0x896F6000 C:\Windows\system32\DRIVERS\nvlddmkm.sys 7380992 bytes (NVIDIA Corporation, NVIDIA Compatible Windows Vista Kernel Mode Driver, Version 178.13 )
0x81800000 C:\Windows\system32\ntkrnlpa.exe 3805184 bytes (Microsoft Corporation, NT Kernel & System)
0x81800000 PnpManager 3805184 bytes
0x81800000 RAW 3805184 bytes
0x81800000 WMIxWDM 3805184 bytes
0x88FCB000 C:\Windows\system32\drivers\ALCXWDM.SYS 2314240 bytes (Realtek Semiconductor Corp., Realtek AC'97 Audio Driver (WDM))
0x90A00000 Win32k 2097152 bytes
0x90A00000 C:\Windows\System32\win32k.sys 2097152 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0x84EF8000 C:\Windows\System32\Drivers\Ntfs.sys 1081344 bytes (Microsoft Corporation, NT File System Driver)
0x8069D000 C:\Windows\system32\drivers\ndis.sys 1064960 bytes (Microsoft Corporation, NDIS 6.0 wrapper driver)
0x8051F000 C:\Windows\system32\CI.dll 921600 bytes (Microsoft Corporation, Code Integrity Module)
0x9A29A000 C:\Windows\system32\drivers\peauth.sys 909312 bytes (Microsoft Corporation, Protected Environment Authentication and Authorization Export Driver)
0x89F2B000 C:\Windows\System32\drivers\tcpip.sys 872448 bytes (Microsoft Corporation, TCP/IP Driver)
0x88EA2000 C:\Windows\System32\drivers\dxgkrnl.sys 643072 bytes (Microsoft Corporation, DirectX Graphics Kernel)
0x97F32000 C:\Windows\system32\drivers\spsys.sys 581632 bytes (Microsoft Corporation, security processor)
0x804A4000 C:\Windows\system32\drivers\Wdf01000.sys 503808 bytes (Microsoft Corporation, WDF Dynamic)
0x84E8E000 C:\Windows\System32\Drivers\ksecdd.sys 434176 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0x9890A000 C:\Windows\system32\drivers\HTTP.sys 430080 bytes (Microsoft Corporation, HTTP Protocol Stack)
0x88F4C000 C:\Windows\system32\DRIVERS\netr61.sys 364544 bytes (Ralink Technology, Corp., Ralink 802.11 Wireless Adapter Driver)
0x99DAF000 C:\Windows\System32\DRIVERS\srv.sys 331776 bytes (Microsoft Corporation, Server driver)
0x80417000 C:\Windows\System32\drivers\volmgrx.sys 303104 bytes (Microsoft Corporation, Volume Manager Extension Driver)
0x89E78000 C:\Windows\system32\drivers\afd.sys 290816 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0x8022A000 C:\Windows\system32\drivers\acpi.sys 274432 bytes (Microsoft Corporation, ACPI Driver for NT)
0x88E03000 C:\Windows\system32\DRIVERS\storport.sys 262144 bytes (Microsoft Corporation, Microsoft Storage Port Driver)
0x88A93000 C:\Windows\system32\DRIVERS\USBPORT.SYS 249856 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0x8027A000 C:\Windows\system32\CLFS.SYS 241664 bytes (Microsoft Corporation, Common Log File System Driver)
0x89E2A000 C:\Windows\system32\DRIVERS\rdbss.sys 241664 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0x89EF1000 C:\Windows\System32\Drivers\avgtdix.sys 237568 bytes (AVG Technologies CZ, s.r.o., AVG Network connection watcher)
0x99549000 C:\Windows\system32\DRIVERS\mrxsmb10.sys 233472 bytes (Microsoft Corporation, Longhorn SMB Downlevel SubRdr)
0x80639000 C:\Windows\system32\drivers\NETIO.SYS 233472 bytes (Microsoft Corporation, Network I/O Subsystem)
0x80603000 C:\Windows\system32\drivers\volsnap.sys 221184 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0x81BA1000 ACPI_HAL 212992 bytes
0x8A78C000 C:\Windows\System32\Drivers\avgldx86.sys 212992 bytes (AVG Technologies CZ, s.r.o., AVG AVI Loader Driver)
0x81BA1000 C:\Windows\system32\hal.dll 212992 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0x89567000 C:\Windows\system32\DRIVERS\usbhub.sys 212992 bytes (Microsoft Corporation, Default Hub Driver for USB)
0x89EBF000 C:\Windows\System32\DRIVERS\netbt.sys 204800 bytes (Microsoft Corporation, MBT Transport driver)
0x807B1000 C:\Windows\system32\drivers\fltmgr.sys 200704 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0x88A58000 C:\Windows\system32\drivers\portcls.sys 184320 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0x88E43000 C:\Windows\system32\DRIVERS\msiscsi.sys 176128 bytes (Microsoft Corporation, Microsoft iSCSI Initiator Driver)
0x80672000 C:\Windows\system32\drivers\msrpc.sys 176128 bytes (Microsoft Corporation, Kernel Remote Procedure Call Provider)
0x97E87000 C:\Windows\system32\DRIVERS\nwifi.sys 176128 bytes (Microsoft Corporation, NativeWiFi Miniport Driver)
0x88A09000 C:\Windows\system32\drivers\ks.sys 172032 bytes (Microsoft Corporation, Kernel CSA Library)
0x88A33000 C:\Windows\system32\drivers\drmk.sys 151552 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
0x84E4B000 C:\Windows\System32\drivers\ecache.sys 151552 bytes (Microsoft Corporation, Special Memory Device Cache)
0x8047F000 C:\Windows\system32\drivers\pci.sys 151552 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0x99513000 C:\Windows\System32\DRIVERS\srv2.sys 147456 bytes (Microsoft Corporation, Smb 2.0 Server driver)
0x895D6000 C:\Windows\system32\DRIVERS\ndiswan.sys 143360 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0x84E19000 C:\Windows\system32\drivers\CLASSPNP.SYS 135168 bytes (Microsoft Corporation, SCSI Class System Dll)
0x894AA000 C:\Windows\System32\drivers\VIDEOPRT.SYS 135168 bytes (Microsoft Corporation, Video Port Driver)
0x995A0000 C:\Windows\system32\drivers\mrxdav.sys 131072 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
0x807E2000 C:\Windows\system32\drivers\ataport.SYS 122880 bytes (Microsoft Corporation, ATAPI Driver Extension)
0x99582000 C:\Windows\system32\DRIVERS\mrxsmb.sys 122880 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0x94052000 C:\Windows\system32\drivers\luafv.sys 110592 bytes (Microsoft Corporation, LUA File Virtualization Filter Driver)
0x988AF000 C:\Windows\System32\DRIVERS\srvnet.sys 110592 bytes (Microsoft Corporation, Server Network driver)
0x98856000 C:\Windows\system32\DRIVERS\bowser.sys 102400 bytes (Microsoft Corporation, NT Lan Manager Datagram Receiver Driver)
0x89458000 C:\Windows\System32\drivers\fwpkclnt.sys 102400 bytes (Microsoft Corporation, FWP/IPsec Kernel-Mode API)
0x88FB3000 C:\Windows\system32\DRIVERS\cdrom.sys 98304 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0x89E13000 C:\Windows\System32\Drivers\dfsc.sys 94208 bytes (Microsoft Corporation, DFS Client MUP Surrogate Driver)
0x89604000 C:\Windows\system32\DRIVERS\rasl2tp.sys 94208 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0x94262000 C:\Windows\system32\DRIVERS\cdfs.sys 90112 bytes (Microsoft Corporation, CD-ROM File System Driver)
0x89419000 C:\Windows\system32\DRIVERS\pacer.sys 90112 bytes (Microsoft Corporation, QoS Packet Scheduler)
0x89443000 C:\Windows\system32\DRIVERS\tdx.sys 86016 bytes (Microsoft Corporation, TDI Translation Driver)
0x98842000 C:\Windows\System32\drivers\mpsdrv.sys 81920 bytes (Microsoft Corporation, Microsoft Protection Service Driver)
0x8942F000 C:\Windows\system32\DRIVERS\smb.sys 81920 bytes (Microsoft Corporation, SMB Transport driver)
0x88E84000 C:\Windows\system32\DRIVERS\i8042prt.sys 77824 bytes (Microsoft Corporation, i8042 Port Driver)
0x895B4000 C:\Windows\system32\DRIVERS\raspptp.sys 77824 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0x97E74000 C:\Windows\system32\DRIVERS\rspndr.sys 77824 bytes (Microsoft Corporation, Link-Layer Topology Responder Driver for NDIS 6)
0x89E65000 C:\Windows\system32\DRIVERS\wanarp.sys 77824 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0x99537000 C:\Windows\system32\DRIVERS\mrxsmb20.sys 73728 bytes (Microsoft Corporation, Longhorn SMB 2.0 Redirector)
0x84E3A000 C:\Windows\system32\drivers\disk.sys 69632 bytes (Microsoft Corporation, PnP Disk Driver)
0x807A1000 C:\Windows\system32\drivers\fileinfo.sys 65536 bytes (Microsoft Corporation, FileInfo Filter Driver)
0x885A0000 C:\Windows\system32\DRIVERS\lltdio.sys 65536 bytes (Microsoft Corporation, Link-Layer Topology Mapper I/O Driver)
0x8046F000 C:\Windows\System32\drivers\mountmgr.sys 65536 bytes (Microsoft Corporation, Mount Point Manager)
0x88500000 C:\Windows\System32\Drivers\NDProxy.SYS 65536 bytes (Microsoft Corporation, NDIS Proxy)
0x885B0000 C:\Windows\system32\DRIVERS\ohci1394.sys 65536 bytes (Microsoft Corporation, 1394 OpenHCI Port Driver)
0x85844000 C:\Windows\system32\DRIVERS\amdk8.sys 61440 bytes (Microsoft Corporation, Processor Device Driver)
0x8A96A000 C:\Windows\system32\DRIVERS\monitor.sys 61440 bytes (Microsoft Corporation, Monitor Driver)
0x84E70000 C:\Windows\System32\Drivers\mup.sys 61440 bytes (Microsoft Corporation, Multiple UNC Provider driver)
0x84E7F000 C:\Windows\System32\drivers\partmgr.sys 61440 bytes (Microsoft Corporation, Partition Management Driver)
0x895C7000 C:\Windows\system32\DRIVERS\raspppoe.sys 61440 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0x895A5000 C:\Windows\system32\DRIVERS\termdd.sys 61440 bytes (Microsoft Corporation, Terminal Server Driver)
0x8020A000 C:\Windows\system32\drivers\volmgr.sys 61440 bytes (Microsoft Corporation, Volume Manager Driver)
0x88FA5000 C:\Windows\system32\DRIVERS\1394BUS.SYS 57344 bytes (Microsoft Corporation, 1394 Bus Device Driver)
0x93210000 C:\Windows\System32\cdd.dll 57344 bytes (Microsoft Corporation, Canonical Display Driver)
0x8940B000 C:\Windows\system32\DRIVERS\netbios.sys 57344 bytes (Microsoft Corporation, NetBIOS interface driver)
0x89471000 C:\Windows\System32\Drivers\Npfs.SYS 57344 bytes (Microsoft Corporation, NPFS Driver)
0x80461000 C:\Windows\system32\drivers\PCIIDEX.SYS 57344 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0x88A85000 C:\Windows\system32\DRIVERS\usbehci.sys 57344 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0x896A8000 C:\Windows\System32\Drivers\crashdmp.sys 53248 bytes (Microsoft Corporation, Crash Dump Driver)
0x89633000 C:\Windows\system32\DRIVERS\umbus.sys 53248 bytes (Microsoft Corporation, User-Mode Bus Enumerator)
0x88F3F000 C:\Windows\System32\drivers\watchdog.sys 53248 bytes (Microsoft Corporation, Watchdog Driver)
0x8026D000 C:\Windows\system32\drivers\WDFLDR.SYS 53248 bytes (Microsoft Corporation, WDFLDR)
0x894CB000 C:\Windows\System32\drivers\vga.sys 49152 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0x8A768000 C:\Windows\System32\Drivers\dump_dumpata.sys 45056 bytes
0x88E97000 C:\Windows\system32\DRIVERS\fdc.sys 45056 bytes (Microsoft Corporation, Floppy Disk Controller Driver)
0x88E6E000 C:\Windows\system32\DRIVERS\kbdclass.sys 45056 bytes (Microsoft Corporation, Keyboard Class Driver)
0x88E79000 C:\Windows\system32\DRIVERS\mouclass.sys 45056 bytes (Microsoft Corporation, Mouse Class Driver)
0x8947F000 C:\Windows\System32\Drivers\Msfs.SYS 45056 bytes (Microsoft Corporation, Mailslot driver)
0x895F9000 C:\Windows\system32\DRIVERS\ndistapi.sys 45056 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0x8A747000 C:\Windows\System32\drivers\tcpipreg.sys 45056 bytes (Microsoft Corporation, TCP/IP Registry Compatibility Driver)
0x8961B000 C:\Windows\system32\DRIVERS\TDI.SYS 45056 bytes (Microsoft Corporation, TDI Wrapper)
0x85C4B000 C:\Windows\system32\DRIVERS\tunnel.sys 45056 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver)
0x8A687000 C:\Windows\System32\drivers\Dxapi.sys 40960 bytes (Microsoft Corporation, DirectX API Driver)
0x8959B000 C:\Windows\system32\DRIVERS\mssmbios.sys 40960 bytes (Microsoft Corporation, System Management BIOS Driver)
0x8A691000 C:\Windows\system32\DRIVERS\ndisuio.sys 40960 bytes (Microsoft Corporation, NDIS User mode I/O driver)
0x89401000 C:\Windows\system32\drivers\nsiproxy.sys 40960 bytes (Microsoft Corporation, NSI Proxy)
0x8A6B9000 C:\Windows\System32\Drivers\secdrv.SYS 40960 bytes (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K., Macrovision SECURITY Driver)
0x88406000 C:\Windows\system32\DRIVERS\usbohci.sys 40960 bytes (Microsoft Corporation, OHCI USB Miniport Driver)
0x88BA5000 C:\Windows\system32\DRIVERS\asyncmac.sys 36864 bytes (Microsoft Corporation, MS Remote Access serial network driver)
0x84E10000 C:\Windows\system32\drivers\crcdisk.sys 36864 bytes (Microsoft Corporation, Disk Block Verification Filter Driver)
0x88B4B000 C:\Windows\System32\Drivers\Fs_Rec.SYS 36864 bytes (Microsoft Corporation, File System Recognizer Driver)
0x88B6F000 C:\Windows\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)
0x802BD000 C:\Windows\system32\PSHED.dll 36864 bytes (Microsoft Corporation, Platform Specific Hardware Error Driver)
0x88B5D000 C:\Windows\System32\DRIVERS\rasacd.sys 36864 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
0x93200000 C:\Windows\System32\TSDDD.dll 36864 bytes (Microsoft Corporation, Framebuffer Display Driver)
0x88B30000 C:\Windows\system32\DRIVERS\tunmp.sys 36864 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver)
0x80221000 C:\Windows\system32\drivers\WMILIB.SYS 36864 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0x8040F000 C:\Windows\system32\drivers\atapi.sys 32768 bytes (Microsoft Corporation, ATAPI IDE Miniport Driver)
0x802B5000 C:\Windows\system32\BOOTVID.dll 32768 bytes (Microsoft Corporation, VGA Boot Driver)
0x894DF000 C:\Windows\System32\Drivers\dump_atapi.sys 32768 bytes
0x802C6000 C:\Windows\system32\kdcom.dll 32768 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
0x80219000 C:\Windows\system32\drivers\msisadrv.sys 32768 bytes (Microsoft Corporation, ISA Driver)
0x85DD8000 C:\Windows\System32\DRIVERS\RDPCDD.sys 32768 bytes (Microsoft Corporation, RDP Miniport)
0x85D98000 C:\Windows\system32\drivers\rdpencdd.sys 32768 bytes (Microsoft Corporation, RDP Miniport)
0x80407000 C:\Windows\System32\Drivers\spldr.sys 32768 bytes (Microsoft Corporation, loader for security processor)
0x88486000 C:\Windows\System32\Drivers\Beep.SYS 28672 bytes (Microsoft Corporation, BEEP Driver)
0x8848D000 C:\Windows\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
0x8847F000 C:\Windows\System32\Drivers\Null.SYS 28672 bytes (Microsoft Corporation, NULL Driver)
0x80203000 C:\Windows\system32\drivers\pciide.sys 28672 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
0x88B2A000 C:\Windows\System32\Drivers\avgmfx86.sys 24576 bytes (AVG Technologies CZ, s.r.o., AVG Resident Shield Minifilter Driver)
0x884BF000 C:\Windows\system32\DRIVERS\AegisP.sys 20480 bytes (Meetinghouse Data Communications, IEEE 802.1X Protocol Driver)
0x85C5C000 C:\Windows\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
!!!!!!!!!!!Hidden driver: 0x83B8CCE2 ?_empty_? 798 bytes
0x83B8CEE4 unknown_irp_handler 284 bytes
!!!!!!!!!!!Hidden driver: 0x8480EC88 ?_empty_? 0 bytes
==============================================
>Stealth
==============================================
==============================================
>Files
==============================================
==============================================
>Hooks
==============================================
ntkrnlpa.exe+0x0009138E, Type: Inline - RelativeJump 0x8189138E-->81891395 [ntkrnlpa.exe]
[1056]svchost.exe-->mswsock.dll+0x00002479, Type: Inline - RelativeJump 0x74CE2479-->00000000 [unknown_code_page]
[1056]svchost.exe-->mswsock.dll+0x00003DCE, Type: Inline - RelativeJump 0x74CE3DCE-->00000000 [unknown_code_page]
[1056]svchost.exe-->mswsock.dll+0x000040A3, Type: Inline - RelativeJump 0x74CE40A3-->00000000 [unknown_code_page]
[1056]svchost.exe-->ntdll.dll-->KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x77070E88-->00000000 [unknown_code_page]
[1056]svchost.exe-->ntdll.dll-->NtProtectVirtualMemory, Type: Inline - RelativeJump 0x7706FD74-->00000000 [unknown_code_page]
[1056]svchost.exe-->ntdll.dll-->NtWriteVirtualMemory, Type: Inline - RelativeJump 0x770706F4-->00000000 [unknown_code_page]
[1056]svchost.exe-->user32.dll-->GetCursorPos, Type: Inline - RelativeJump 0x75BBC664-->00000000 [unknown_code_page]
[1316]explorer.exe-->mswsock.dll+0x00002479, Type: Inline - RelativeJump 0x74CE2479-->00000000 [unknown_code_page]
[1316]explorer.exe-->mswsock.dll+0x00003DCE, Type: Inline - RelativeJump 0x74CE3DCE-->00000000 [unknown_code_page]
[1316]explorer.exe-->mswsock.dll+0x000040A3, Type: Inline - RelativeJump 0x74CE40A3-->00000000 [unknown_code_page]
[1316]explorer.exe-->ntdll.dll-->KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x77070E88-->00000000 [unknown_code_page]
[1316]explorer.exe-->ntdll.dll-->NtProtectVirtualMemory, Type: Inline - RelativeJump 0x7706FD74-->00000000 [unknown_code_page]
[1316]explorer.exe-->ntdll.dll-->NtWriteVirtualMemory, Type: Inline - RelativeJump 0x770706F4-->00000000 [unknown_code_page]
[1536]wuauclt.exe-->mswsock.dll+0x00002479, Type: Inline - RelativeJump 0x74CE2479-->00000000 [unknown_code_page]
[1536]wuauclt.exe-->mswsock.dll+0x00003DCE, Type: Inline - RelativeJump 0x74CE3DCE-->00000000 [unknown_code_page]
[1536]wuauclt.exe-->mswsock.dll+0x000040A3, Type: Inline - RelativeJump 0x74CE40A3-->00000000 [unknown_code_page]
[1536]wuauclt.exe-->ntdll.dll-->KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x77070E88-->00000000 [unknown_code_page]
[1536]wuauclt.exe-->ntdll.dll-->NtProtectVirtualMemory, Type: Inline - RelativeJump 0x7706FD74-->00000000 [unknown_code_page]
[1536]wuauclt.exe-->ntdll.dll-->NtWriteVirtualMemory, Type: Inline - RelativeJump 0x770706F4-->00000000 [unknown_code_page]
[1640]rundll32.exe-->advapi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77C914B8-->00000000 [shimeng.dll]
[1640]rundll32.exe-->gdi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77B71170-->00000000 [shimeng.dll]
[1640]rundll32.exe-->shell32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x15D23408-->00000000 [shimeng.dll]
[1640]rundll32.exe-->user32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77D612F8-->00000000 [shimeng.dll]
[1640]rundll32.exe-->wininet.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x71721480-->00000000 [shimeng.dll]
[1640]rundll32.exe-->ws2_32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x6C9F11E8-->00000000 [shimeng.dll]
[2360]wuauclt.exe-->mswsock.dll+0x00002479, Type: Inline - RelativeJump 0x74CE2479-->00000000 [unknown_code_page]
[2360]wuauclt.exe-->mswsock.dll+0x00003DCE, Type: Inline - RelativeJump 0x74CE3DCE-->00000000 [unknown_code_page]
[2360]wuauclt.exe-->mswsock.dll+0x000040A3, Type: Inline - RelativeJump 0x74CE40A3-->00000000 [unknown_code_page]
[2360]wuauclt.exe-->ntdll.dll-->KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x77070E88-->00000000 [unknown_code_page]
[2360]wuauclt.exe-->ntdll.dll-->NtProtectVirtualMemory, Type: Inline - RelativeJump 0x7706FD74-->00000000 [unknown_code_page]
[2360]wuauclt.exe-->ntdll.dll-->NtWriteVirtualMemory, Type: Inline - RelativeJump 0x770706F4-->00000000 [unknown_code_page]
[2456]rundll32.exe-->advapi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77C914B8-->00000000 [shimeng.dll]
[2456]rundll32.exe-->gdi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77B71170-->00000000 [shimeng.dll]
[2456]rundll32.exe-->shell32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x15D23408-->00000000 [shimeng.dll]
[2456]rundll32.exe-->user32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77D612F8-->00000000 [shimeng.dll]
[2456]rundll32.exe-->wininet.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x71721480-->00000000 [shimeng.dll]
[3904]firefox.exe-->mswsock.dll+0x00002479, Type: Inline - RelativeJump 0x74CE2479-->00000000 [unknown_code_page]
[3904]firefox.exe-->mswsock.dll+0x00003DCE, Type: Inline - RelativeJump 0x74CE3DCE-->00000000 [unknown_code_page]
[3904]firefox.exe-->mswsock.dll+0x000040A3, Type: Inline - RelativeJump 0x74CE40A3-->00000000 [unknown_code_page]
[3904]firefox.exe-->ntdll.dll-->KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x77070E88-->00000000 [unknown_code_page]
[3904]firefox.exe-->ntdll.dll-->NtProtectVirtualMemory, Type: Inline - RelativeJump 0x7706FD74-->00000000 [unknown_code_page]
[3904]firefox.exe-->ntdll.dll-->NtWriteVirtualMemory, Type: Inline - RelativeJump 0x770706F4-->00000000 [unknown_code_page]


!!POSSIBLE ROOTKIT ACTIVITY DETECTED!! =)

psycochic
Novice
Novice

Status :
Online
Offline

Posts : 37
Joined : 2010-07-22
OS : vista

View user profile

Back to top Go down

Re: Help!!!! MY OTL has been scanning for 2 hours and still going. Is this bad

Post by psycochic on Thu Jul 29, 2010 1:23 am

My hard drive is incredibly low(369mb) is there anything I can do to free up space . Will put the scanned files report next....I hope

psycochic
Novice
Novice

Status :
Online
Offline

Posts : 37
Joined : 2010-07-22
OS : vista

View user profile

Back to top Go down

Re: Help!!!! MY OTL has been scanning for 2 hours and still going. Is this bad

Post by psycochic on Thu Jul 29, 2010 1:52 am

4 hidden files. Will not let me copy them.

psycochic
Novice
Novice

Status :
Online
Offline

Posts : 37
Joined : 2010-07-22
OS : vista

View user profile

Back to top Go down

Re: Help!!!! MY OTL has been scanning for 2 hours and still going. Is this bad

Post by psycochic on Thu Jul 29, 2010 2:26 am

Got a blocked infection twice today. Exploit Phoenix Exploit Kit(type 1112)

Just thought I would pass it on to you.

psycochic
Novice
Novice

Status :
Online
Offline

Posts : 37
Joined : 2010-07-22
OS : vista

View user profile

Back to top Go down

Re: Help!!!! MY OTL has been scanning for 2 hours and still going. Is this bad

Post by Dr Jay on Thu Jul 29, 2010 4:36 am

GMER

Note about this tool:
  • This program may freeze. Do not reboot the computer, unless it has been frozen for over 30 minutes.
  • This program may cause a blue screen of death. If it does, do not scan, and then reply to let me know.
  • No matter what is in the log, please post all the information/contents of the log.


Please download the [You must be registered and logged in to see this link.]. Unzip it to your Desktop.

Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.

Double-click gmer.exe. The program will begin to run.

**Caution**
These types of scans can produce false positives. Do NOT take any action on any
"<--- ROOKIT" entries unless advised!

If possible rootkit activity is found, you will be asked if you would like to perform a full scan.

  • Click NO
  • In the right panel, you will see a bunch of boxes that have been checked ... leave everything checked and ensure the Show all box is un-checked.
  • Now click the Scan button.
    Once the scan is complete, you may receive another notice about rootkit activity.
  • Click OK.
  • GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
  • Save it where you can easily find it, such as your desktop.

Post the contents of GMER.txt in your next reply.


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Status :
Online
Offline

Posts : 13711
Joined : 2009-09-06
Gender : Male
OS : Windows 10 Home & Pro

View user profile

Back to top Go down

Re: Help!!!! MY OTL has been scanning for 2 hours and still going. Is this bad

Post by psycochic on Thu Jul 29, 2010 2:49 pm

Locked up within seconds! Whats next? Need room on hard drive fast!

psycochic
Novice
Novice

Status :
Online
Offline

Posts : 37
Joined : 2010-07-22
OS : vista

View user profile

Back to top Go down

Re: Help!!!! MY OTL has been scanning for 2 hours and still going. Is this bad

Post by Dr Jay on Thu Jul 29, 2010 6:52 pm

Please download [You must be registered and logged in to see this link.] to your desktop
  • Please double-click TFC.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • It will close all programs when run, so make sure you have saved all your work before you begin.
  • Click the Start
    button to begin the process. Depending on how often you clean temp
    files, execution time should be anywhere from a few seconds to a minute
    or two. Let it run uninterrupted to completion.
  • Once it's finished it should reboot your machine. If it does not, please manually reboot the machine yourself to ensure a complete clean.





ESET Online Scan

Please run a free online scan with the [You must be registered and logged in to see this link.]
  • Tick the box next to YES, I accept the Terms of Use
  • Click Start
  • When asked, allow the ActiveX control to install
  • Click Start
  • Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  • Click Scan (This scan can take several hours, so please be patient)
  • Once the scan is completed, you may close the window
  • Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  • Copy and paste that log as a reply to this topic


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Status :
Online
Offline

Posts : 13711
Joined : 2009-09-06
Gender : Male
OS : Windows 10 Home & Pro

View user profile

Back to top Go down

Re: Help!!!! MY OTL has been scanning for 2 hours and still going. Is this bad

Post by psycochic on Thu Jul 29, 2010 11:40 pm

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=c7ff480f6b650a48aef73f0177541d68
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-07-29 09:35:21
# local_time=2010-07-29 04:35:21 (-0600, Central Daylight Time)
# country="United States"
# lang=1033
# osver=6.0.6000 NT
# compatibility_mode=1024 16777175 100 0 0 0 0 0
# compatibility_mode=5892 16776574 100 100 6209513 117043899 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=87828
# found=1
# cleaned=1
# scan_time=2950
C:\Windows\System32\Win Avi Converter 7.7 + Keygen\Keygen\keygen.exe probably a variant of Win32/Agent trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

psycochic
Novice
Novice

Status :
Online
Offline

Posts : 37
Joined : 2010-07-22
OS : vista

View user profile

Back to top Go down

Re: Help!!!! MY OTL has been scanning for 2 hours and still going. Is this bad

Post by Dr Jay on Fri Jul 30, 2010 4:54 am

What other symptoms of infection are there? Any?


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Status :
Online
Offline

Posts : 13711
Joined : 2009-09-06
Gender : Male
OS : Windows 10 Home & Pro

View user profile

Back to top Go down

Re: Help!!!! MY OTL has been scanning for 2 hours and still going. Is this bad

Post by psycochic on Fri Jul 30, 2010 1:16 pm

All I am having issues with is browser redirect and pop-ups. If I do a Google search and click on a topic I get redirected. When I open my browser I get windows opening. Are my browser settings wrong? Is there another topic I should post this symptom in. I thank you for all of your help.

psycochic
Novice
Novice

Status :
Online
Offline

Posts : 37
Joined : 2010-07-22
OS : vista

View user profile

Back to top Go down

Re: Help!!!! MY OTL has been scanning for 2 hours and still going. Is this bad

Post by Dr Jay on Sat Jul 31, 2010 4:11 am

Please download the latest version of Kaspersky GetSystemInfo (GSI) from [You must be registered and logged in to see this link.] and save it to your Desktop.

Note: please close all other applications running on your system.

Double click GetSystemInfo.exe to open it. It will display an agreement. Click on I Agree to continue.

Click the Settings button.



Set the slider to Maximum.



IMPORTANT! Then, click Customize - choose Driver / Ports tab and uncheck Scan Ports.




On the General tab, make sure all of the boxes are checked.




On the Misc tab, make sure all the checkboxes are checked.

Then, click OK on the windows that you launched.



Click Create Report to run it.


It will begin scanning.

It will create a zip folder called GetSystemInfo_XXXXXXXXXXXXXX.zip on your Desktop.

It should automatically upload it to [You must be registered and logged in to see this link.] If it does not, then please submit it manually by going to the site and doing the upload process.

It will redirect to a page, where it will provide a sharing URL for specialists. Copy and paste the url of the GSI Parser report in your next reply.


Dr. Jay (DJ)


[You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.] ~ [You must be registered and logged in to see this link.]

Dr Jay
Head Administrator
Head Administrator

Status :
Online
Offline

Posts : 13711
Joined : 2009-09-06
Gender : Male
OS : Windows 10 Home & Pro

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum