S.M.A.R.T. Check, Drive Sector Not Found Error, Other Issues

Page 1 of 2 1, 2  Next

View previous topic View next topic Go down

S.M.A.R.T. Check, Drive Sector Not Found Error, Other Issues

Post by shetrim on Sun 29 Apr 2012, 12:16 pm

My issues started the other day when multiple pop-ups appeared on my computer with the following message: "A write command during the test has failed and may be due to a media or read/write error." Following the pop-ups, a screen with something called S.M.A.R.T. came up and indicated that I had seven issues with my computer and the only way to fix it was to purchase their software. It was clear that it was a scam, but it was too late to fix whatever had invaded my system. I also received "drive sector not found error" and now each time I try to do a search via search engine, I get directed to some other website rather than the one I am actually looking for.

I attempted to run the OTL, but I only received the OTL log (attached) and not the extras log. I then downloaded the "aswMBR," but it would not run. I tried to run it several times to no avail. I can only run my computer in SAFE mode at this time. When I try to run it in normal mode, everything appears to be gone from my START UP menu (no documents, no pictures, no programs, etc).

This is actually the second computer that this S.M.A.R.T. has affected in as many weeks. My other laptop only has a black screen when I turn it on and can't even get into the F8 screen, but thankfully this laptop hasn't completely died on me. If we can address this laptop first, I'd love if perhaps we can discuss possible remedies for the other laptop since it has virtually the same afflictions (although it is further gone now that I only have a black screen with it).

Here is the OTL log:

OTL logfile created on: 4/27/2012 7:53:18 PM - Run 3
OTL by OldTimer - Version 3.2.42.1 Folder = C:\Documents and Settings\Administrator\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

511.23 Mb Total Physical Memory | 54.41 Mb Available Physical Memory | 10.64% Memory free
1.22 Gb Paging File | 0.62 Gb Available in Paging File | 50.74% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.53 Gb Total Space | 49.84 Gb Free Space | 66.88% Space Free | Partition Type: NTFS

Computer Name: TRIMBLE-0E30FCB | User Name: Administrator | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/04/27 19:27:01 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.com
PRC - [2008/04/13 17:12:19 | 001,033,728 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


========== Modules (No Company Name) ==========


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt)
SRV - [2012/04/14 13:00:20 | 000,253,088 | -H-- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/04/04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011/06/25 23:45:56 | 000,256,000 | R--- | M] () [Auto | Stopped] -- C:\ComboFix\pev.3XE -- (PEVSystemStart)
SRV - [2009/09/08 17:25:52 | 000,096,334 | -H-- | M] (Canon Inc.) [Auto | Stopped] -- C:\Program Files\Canon\CAL\CALMAIN.exe -- (CCALib8)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - [2012/04/26 13:21:19 | 000,040,776 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2005/11/10 22:49:24 | 001,406,464 | -H-- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2005/11/02 13:24:34 | 000,424,320 | -H-- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX)
DRV - [2005/04/21 21:58:38 | 000,092,550 | -H-- | M] (O2Micro) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ozscr.sys -- (OZSCR)
DRV - [2004/11/15 15:37:52 | 000,264,440 | -H-- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\stac97.sys -- (STAC97) Audio Driver (WDM)
DRV - [2004/08/18 14:53:54 | 000,016,128 | -H-- | M] (Dell Inc) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\APPDRV.SYS -- (APPDRV)
DRV - [2004/08/03 22:31:34 | 000,020,992 | -H-- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Realtek RTL8139(A/B/C)
DRV - [2001/10/15 05:38:04 | 000,025,434 | RH-- | M] (D-Link Corp. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\DLKRCB.SYS -- (DLKRCB)
DRV - [2000/07/24 01:01:00 | 000,019,537 | -H-- | M] (Brother Industries Ltd.) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\BRPAR.SYS -- (BrPar)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = [You must be registered and logged in to see this link.]

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = [You must be registered and logged in to see this link.]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 50 93 F9 84 B8 22 CD 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = [You must be registered and logged in to see this link.]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/MycameraPlugin: C:\Program Files\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/04/17 17:31:07 | 000,000,000 | -H-D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/04/24 09:41:33 | 000,000,000 | -H-D | M]

[2012/04/24 09:39:17 | 000,000,000 | -H-D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012/04/24 09:39:17 | 000,000,000 | -H-D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}
[2012/04/17 17:30:55 | 000,134,104 | -H-- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/04/24 09:38:52 | 000,476,904 | -H-- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2005/04/05 04:38:20 | 000,053,355 | -H-- | M] (Oracle Corporation) -- C:\Program Files\mozilla firefox\plugins\NPJinit13122.dll
[2012/04/17 17:30:08 | 000,002,252 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/04/17 17:30:07 | 000,002,040 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2006/02/28 05:00:00 | 000,000,734 | -H-- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware (cleanup)] C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} [You must be registered and logged in to see this link.] (SysProWmi Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} [You must be registered and logged in to see this link.] (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFECAFE-0013-0001-0022-ABCDEFABCDEF} Reg Error: Value error. (JInitiator 1.3.1.22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [You must be registered and logged in to see this link.] (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} [You must be registered and logged in to see this link.] (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [You must be registered and logged in to see this link.] (Java Plug-in 1.6.0_31)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} [You must be registered and logged in to see this link.] (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{20B7826C-8EAE-4494-9635-7524EE98D8CD}: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/10/23 13:58:35 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
NetSvcs: HidServ - %SystemRoot%\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found


SafeBootMin: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PEVSystemStart - C:\ComboFix\pev.3XE ()
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: procexp90.Sys - Driver
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

SafeBootNet: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PEVSystemStart - C:\ComboFix\pev.3XE ()
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: procexp90.Sys - Driver
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Security Update for Windows XP (KB923789)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{76BB47AB-72C4-4110-9DC8-84E243B448FD} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax ()
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll ()

CREATERESTOREPOINT
Unable to start System Restore Service. Error code 10

========== Files/Folders - Created Within 30 Days ==========

[2012/04/27 19:26:55 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.com
[2012/04/26 20:52:13 | 000,000,000 | --SD | C] -- C:\ComboFix
[2012/04/26 20:04:56 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2012/04/26 19:55:42 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2012/04/26 19:55:42 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2012/04/26 19:55:42 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2012/04/26 19:55:42 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2012/04/26 19:54:20 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2012/04/26 19:51:37 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/04/26 19:51:10 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents\My Videos
[2012/04/26 19:51:10 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\My Documents\My Videos
[2012/04/26 19:51:10 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\My Documents\My Pictures
[2012/04/26 19:51:09 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\My Documents\My Music
[2012/04/26 19:51:09 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\Administrative Tools
[2012/04/26 19:50:21 | 004,477,246 | R--- | C] (Swearware) -- C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
[2012/04/26 19:14:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Adobe
[2012/04/26 13:21:19 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2012/04/25 12:13:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Sun
[2012/04/25 11:47:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
[2012/04/25 11:45:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/04/25 11:45:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2012/04/25 11:45:36 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012/04/25 10:36:57 | 000,000,000 | ---D | C] -- C:\Program Files\PC Tools
[2012/04/25 10:33:27 | 000,203,088 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\PCTSD.sys
[2012/04/25 10:32:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\TestApp
[2012/04/24 10:09:55 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator\Application Data\Macromedia
[2012/04/24 10:09:43 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator\Application Data\Adobe
[2012/04/24 10:06:47 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Administrator\PrivacIE
[2012/04/24 10:03:27 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Administrator\IETldCache
[2012/04/24 10:03:09 | 000,000,000 | --SD | C] -- C:\Documents and Settings\Administrator\Application Data\Microsoft
[2012/04/24 10:03:09 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Administrator\SendTo
[2012/04/24 10:03:09 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Administrator\Application Data
[2012/04/24 10:03:09 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Administrator\Cookies
[2012/04/24 10:03:09 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator\Recent
[2012/04/24 10:03:09 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator\PrintHood
[2012/04/24 10:03:09 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator\NetHood
[2012/04/24 10:03:09 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator\My Documents
[2012/04/24 10:03:09 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft
[2012/04/24 10:03:09 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator\Local Settings
[2012/04/24 10:03:09 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator\Favorites
[2012/04/24 10:03:09 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator\Desktop
[2012/04/24 10:03:08 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\Startup
[2012/04/24 10:03:08 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Administrator\Start Menu
[2012/04/24 10:03:08 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories
[2012/04/24 10:03:08 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator\Templates
[2012/04/24 09:42:05 | 000,000,000 | -H-D | C] -- C:\Program Files\Ask.com
[2012/04/24 09:39:40 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Application Data\Ask
[2012/04/24 09:39:14 | 000,157,472 | -H-- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2012/04/24 09:39:14 | 000,149,280 | -H-- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2012/04/24 09:39:14 | 000,149,280 | -H-- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2012/04/18 22:19:54 | 000,000,000 | -H-D | C] -- C:\WINDOWS\SxsCaPendDel
[2012/04/13 00:40:38 | 000,418,464 | -H-- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/04/27 19:29:26 | 000,001,324 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2012/04/27 19:27:01 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Desktop\OTL.com
[2012/04/27 16:58:48 | 000,013,646 | -H-- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/04/27 16:58:38 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/04/26 20:05:14 | 000,000,437 | RHS- | M] () -- C:\boot.ini
[2012/04/26 19:50:33 | 004,477,246 | R--- | M] (Swearware) -- C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
[2012/04/26 13:21:19 | 000,040,776 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2012/04/25 12:07:04 | 000,000,234 | -H-- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2012/04/25 11:45:39 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/04/24 09:49:24 | 000,000,176 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\-Fvc04tqgQ4JfGYr
[2012/04/24 09:49:24 | 000,000,000 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\-Fvc04tqgQ4JfGY
[2012/04/24 09:49:18 | 000,000,256 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\Fvc04tqgQ4JfGY
[2012/04/24 09:38:51 | 000,472,808 | -H-- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2012/04/24 09:38:51 | 000,157,472 | -H-- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2012/04/24 09:38:51 | 000,149,280 | -H-- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2012/04/24 09:38:51 | 000,149,280 | -H-- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2012/04/24 09:38:51 | 000,073,728 | -H-- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2012/04/24 09:28:57 | 000,000,176 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\-84VcLM1fyykdGjr
[2012/04/24 09:28:57 | 000,000,000 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\-84VcLM1fyykdGj
[2012/04/24 09:28:52 | 000,000,256 | -H-- | M] () -- C:\Documents and Settings\All Users\Application Data\84VcLM1fyykdGj
[2012/04/24 08:58:05 | 000,000,830 | -H-- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/04/18 22:18:25 | 000,433,346 | -H-- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/04/18 22:18:25 | 000,068,136 | -H-- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012/04/14 13:00:18 | 000,418,464 | -H-- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/04/14 13:00:14 | 000,070,304 | -H-- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012/04/13 00:46:26 | 000,001,729 | -H-- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2012/04/12 21:28:18 | 000,001,374 | -H-- | M] () -- C:\WINDOWS\imsins.BAK
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/04/26 20:05:12 | 000,000,321 | ---- | C] () -- C:\Boot.bak
[2012/04/26 20:04:59 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2012/04/26 19:55:42 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2012/04/26 19:55:42 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2012/04/26 19:55:42 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2012/04/26 19:55:42 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2012/04/26 19:55:42 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012/04/25 11:45:39 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012/04/24 10:03:09 | 000,001,599 | -H-- | C] () -- C:\Documents and Settings\Administrator\Start Menu\Programs\Remote Assistance.lnk
[2012/04/24 10:03:09 | 000,000,792 | -H-- | C] () -- C:\Documents and Settings\Administrator\Start Menu\Programs\Windows Media Player.lnk
[2012/04/24 09:49:24 | 000,000,176 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\-Fvc04tqgQ4JfGYr
[2012/04/24 09:49:24 | 000,000,000 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\-Fvc04tqgQ4JfGY
[2012/04/24 09:49:04 | 000,000,256 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\Fvc04tqgQ4JfGY
[2012/04/24 09:42:09 | 000,000,234 | -H-- | C] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2012/04/24 09:28:57 | 000,000,176 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\-84VcLM1fyykdGjr
[2012/04/24 09:28:57 | 000,000,000 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\-84VcLM1fyykdGj
[2012/04/24 09:28:46 | 000,000,256 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\84VcLM1fyykdGj
[2012/04/13 00:46:26 | 000,001,729 | -H-- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[2012/04/13 00:40:48 | 000,000,830 | -H-- | C] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/02/15 21:08:13 | 000,003,072 | -H-- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012/01/13 22:40:36 | 000,165,376 | -H-- | C] () -- C:\WINDOWS\System32\unrar.dll
[2011/03/17 15:31:32 | 000,434,616 | -H-- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2011/01/17 01:02:27 | 000,036,962 | -H-- | C] () -- C:\WINDOWS\System32\ActPanel.dll
[2010/11/17 20:53:48 | 000,000,410 | -H-- | C] () -- C:\WINDOWS\BRWMARK.INI
[2010/11/17 20:53:48 | 000,000,034 | -H-- | C] () -- C:\WINDOWS\System32\BD2070N.DAT
[2010/11/17 20:49:41 | 000,000,146 | -H-- | C] () -- C:\WINDOWS\BRVIDEO.INI
[2010/11/17 20:49:41 | 000,000,040 | -H-- | C] () -- C:\WINDOWS\BRDIAG.INI
[2010/11/17 20:49:41 | 000,000,023 | -H-- | C] () -- C:\WINDOWS\Brownie.ini
[2010/11/17 20:49:34 | 000,077,824 | -H-- | C] () -- C:\WINDOWS\System32\BROSNMP.DLL
[2010/11/17 20:49:34 | 000,026,624 | -H-- | C] () -- C:\WINDOWS\System32\BRGSRC32.DLL
[2010/11/17 20:49:34 | 000,004,608 | -H-- | C] () -- C:\WINDOWS\System32\BRGSRC16.DLL
[2010/11/17 20:49:30 | 000,009,015 | -H-- | C] () -- C:\WINDOWS\HL-2070N.INI
[2010/11/01 23:53:36 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\nsreg.dat
[2010/10/30 21:48:49 | 000,001,324 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/10/24 13:49:35 | 000,000,004 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\QSLLPSVCShare
[2010/10/24 13:47:55 | 000,757,760 | -H-- | C] () -- C:\WINDOWS\System32\bcm1xsup.dll
[2010/10/24 13:47:55 | 000,086,016 | -H-- | C] () -- C:\WINDOWS\System32\preflib.dll
[2010/10/24 13:47:55 | 000,018,944 | -H-- | C] () -- C:\WINDOWS\System32\WLTRYSVC.EXE
[2010/10/24 13:46:41 | 000,104,376 | -H-- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2010/10/23 14:01:06 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2010/10/23 13:55:30 | 000,021,640 | -H-- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010/10/23 06:27:34 | 000,004,161 | -H-- | C] () -- C:\WINDOWS\ODBCINST.INI
[2010/10/23 06:26:15 | 000,122,136 | -H-- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

========== Custom Scans ==========

< %APPDATA%\Microsoft\*.* >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %USERPROFILE%\Desktop\*.exe >
[2012/04/26 19:50:33 | 004,477,246 | R--- | M] (Swearware) -- C:\Documents and Settings\Administrator\Desktop\ComboFix.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\winn32\*.* >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.exe >
[2012/04/17 17:30:54 | 000,125,912 | -H-- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\crashreporter.exe
[2012/04/17 17:30:36 | 000,924,632 | -H-- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
[2012/04/17 17:30:09 | 000,016,856 | -H-- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\plugin-container.exe
[2012/04/17 17:29:39 | 000,269,272 | -H-- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\updater.exe

< %ProgramFiles%\TinyProxy. >

< %systemroot%\system32\*.* /lockedfiles >
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.* /lockedfiles >

< %PROGRAMFILES%\*. >
[2010/10/29 04:48:42 | 000,000,000 | -H-D | M] -- C:\Program Files\Adobe
[2012/04/24 09:42:13 | 000,000,000 | -H-D | M] -- C:\Program Files\Ask.com
[2010/10/24 13:47:33 | 000,000,000 | -H-D | M] -- C:\Program Files\ATI Technologies
[2010/11/17 20:49:04 | 000,000,000 | -H-D | M] -- C:\Program Files\Brother
[2010/11/17 20:49:32 | 000,000,000 | -H-D | M] -- C:\Program Files\Brownie
[2012/04/18 22:14:01 | 000,000,000 | -H-D | M] -- C:\Program Files\Canon
[2011/10/20 21:19:22 | 000,000,000 | -H-D | M] -- C:\Program Files\Common Files
[2010/10/23 13:55:19 | 000,000,000 | -H-D | M] -- C:\Program Files\ComPlus Applications
[2010/10/24 21:08:47 | 000,000,000 | -H-D | M] -- C:\Program Files\Dell
[2011/09/15 00:43:16 | 000,000,000 | -H-D | M] -- C:\Program Files\Google
[2011/01/17 01:02:26 | 000,000,000 | -H-D | M] -- C:\Program Files\InstallShield Installation Information
[2012/04/12 21:38:19 | 000,000,000 | -H-D | M] -- C:\Program Files\Internet Explorer
[2012/04/24 09:38:45 | 000,000,000 | -H-D | M] -- C:\Program Files\Java
[2012/01/13 22:41:13 | 000,000,000 | -H-D | M] -- C:\Program Files\K-Lite Codec Pack
[2012/04/25 11:45:45 | 000,000,000 | ---D | M] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/10/25 03:43:00 | 000,000,000 | -H-D | M] -- C:\Program Files\Messenger
[2010/10/23 13:58:57 | 000,000,000 | -H-D | M] -- C:\Program Files\microsoft frontpage
[2010/10/25 10:14:53 | 000,000,000 | -H-D | M] -- C:\Program Files\Movie Maker
[2012/04/21 13:20:30 | 000,000,000 | -H-D | M] -- C:\Program Files\Mozilla Firefox
[2010/10/24 13:24:04 | 000,000,000 | -H-D | M] -- C:\Program Files\MSBuild
[2010/10/25 08:24:13 | 000,000,000 | -H-D | M] -- C:\Program Files\MSN
[2010/10/23 13:54:31 | 000,000,000 | -H-D | M] -- C:\Program Files\MSN Gaming Zone
[2010/10/24 13:21:49 | 000,000,000 | -H-D | M] -- C:\Program Files\MSXML 6.0
[2010/10/25 01:06:47 | 000,000,000 | -H-D | M] -- C:\Program Files\NetMeeting
[2010/10/23 21:30:40 | 000,000,000 | -H-D | M] -- C:\Program Files\Online Services
[2011/08/04 22:04:10 | 000,000,000 | -H-D | M] -- C:\Program Files\OpenOffice.org 3
[2011/01/17 01:02:27 | 000,000,000 | -H-D | M] -- C:\Program Files\Oracle
[2010/12/15 02:56:27 | 000,000,000 | -H-D | M] -- C:\Program Files\Outlook Express
[2012/04/25 10:36:57 | 000,000,000 | ---D | M] -- C:\Program Files\PC Tools
[2011/09/01 00:15:22 | 000,000,000 | -H-D | M] -- C:\Program Files\PC Tools Security
[2010/10/24 13:23:57 | 000,000,000 | -H-D | M] -- C:\Program Files\Reference Assemblies
[2010/10/24 13:45:44 | 000,000,000 | -H-D | M] -- C:\Program Files\SigmaTel
[2012/04/18 22:19:38 | 000,000,000 | -H-D | M] -- C:\Program Files\Trend Micro
[2010/10/23 14:04:07 | 000,000,000 | -H-D | M] -- C:\Program Files\Uninstall Information
[2010/10/25 01:11:14 | 000,000,000 | -H-D | M] -- C:\Program Files\Windows Media Player
[2010/10/25 01:06:41 | 000,000,000 | -H-D | M] -- C:\Program Files\Windows NT
[2010/10/23 13:57:07 | 000,000,000 | -H-D | M] -- C:\Program Files\WindowsUpdate
[2010/10/23 13:58:57 | 000,000,000 | -H-D | M] -- C:\Program Files\xerox

< MD5 for: AGP440.SYS >
[2006/02/28 05:00:00 | 018,738,937 | -H-- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2010/10/25 00:56:02 | 023,852,652 | -H-- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2010/10/25 00:56:02 | 023,852,652 | -H-- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 11:36:38 | 000,042,368 | -H-- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 11:36:38 | 000,042,368 | -H-- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
[2004/08/03 16:07:42 | 000,042,368 | -H-- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys
[2004/08/03 16:07:42 | 000,042,368 | -H-- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\system32\ReinstallBackups\0007\DriverFiles\i386\AGP440.SYS

< MD5 for: ATAPI.SYS >
[2006/02/28 05:00:00 | 018,738,937 | -H-- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2010/10/25 00:56:02 | 023,852,652 | -H-- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2010/10/25 00:56:02 | 023,852,652 | -H-- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 11:40:30 | 000,096,512 | -H-- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 11:40:30 | 000,096,512 | -H-- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2006/02/28 05:00:00 | 000,095,360 | -H-- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

< MD5 for: DISK.SYS >
[2006/02/28 05:00:00 | 018,738,937 | -H-- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:disk.sys
[2010/10/25 00:56:02 | 023,852,652 | -H-- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:disk.sys
[2010/10/25 00:56:02 | 023,852,652 | -H-- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:disk.sys
[2006/02/28 05:00:00 | 000,036,352 | -H-- | M] (Microsoft Corporation) MD5=00CA44E4534865F8A3B64F7C0984BFF0 -- C:\WINDOWS\$NtServicePackUninstall$\disk.sys
[2008/04/13 11:40:47 | 000,036,352 | -H-- | M] (Microsoft Corporation) MD5=044452051F3E02E7963599FC8F4F3E25 -- C:\WINDOWS\ServicePackFiles\i386\disk.sys
[2008/04/13 11:40:47 | 000,036,352 | -H-- | M] (Microsoft Corporation) MD5=044452051F3E02E7963599FC8F4F3E25 -- C:\WINDOWS\system32\drivers\disk.sys

< MD5 for: NETLOGON.DLL >
[2008/04/13 17:12:01 | 000,407,040 | -H-- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/13 17:12:01 | 000,407,040 | -H-- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll
[2009/02/06 11:46:09 | 000,408,064 | -H-- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll
[2009/02/06 11:46:09 | 000,408,064 | -H-- | M] (Microsoft Corporation) MD5=6C476D33D82F1054849790181E8F7772 -- C:\WINDOWS\$hf_mig$\KB975467\SP2QFE\netlogon.dll
[2006/02/28 05:00:00 | 000,407,040 | -H-- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2012-04-13 04:38:53

< hklm\software\clients\startmenuinternet|command /rs >
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\HideIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts [2012/04/17 17:29:43 | 000,834,840 | -H-- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ShowIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts [2012/04/17 17:29:43 | 000,834,840 | -H-- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ReinstallCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal [2012/04/17 17:29:43 | 000,834,840 | -H-- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\open\command\\: C:\Program Files\Mozilla Firefox\firefox.exe [2012/04/17 17:30:36 | 000,924,632 | -H-- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\properties\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -preferences [2012/04/17 17:30:36 | 000,924,632 | -H-- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\safemode\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode [2012/04/17 17:30:36 | 000,924,632 | -H-- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\WINDOWS\system32\ie4uinit.exe" -reinstall [2012/02/29 05:17:40 | 000,174,080 | -H-- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -hide [2012/02/29 05:17:40 | 000,174,080 | -H-- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -show [2012/02/29 05:17:40 | 000,174,080 | -H-- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2009/03/08 14:09:26 | 000,638,816 | -H-- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: C:\Program Files\Internet Explorer\iexplore.exe [2009/03/08 14:09:26 | 000,638,816 | -H-- | M] (Microsoft Corporation)

< hklm\software\clients\startmenuinternet|command /64 /rs >
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\HideIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts [2012/04/17 17:29:43 | 000,834,840 | -H-- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ShowIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts [2012/04/17 17:29:43 | 000,834,840 | -H-- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ReinstallCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal [2012/04/17 17:29:43 | 000,834,840 | -H-- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\open\command\\: C:\Program Files\Mozilla Firefox\firefox.exe [2012/04/17 17:30:36 | 000,924,632 | -H-- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\properties\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -preferences [2012/04/17 17:30:36 | 000,924,632 | -H-- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\safemode\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode [2012/04/17 17:30:36 | 000,924,632 | -H-- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\WINDOWS\system32\ie4uinit.exe" -reinstall [2012/02/29 05:17:40 | 000,174,080 | -H-- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -hide [2012/02/29 05:17:40 | 000,174,080 | -H-- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -show [2012/02/29 05:17:40 | 000,174,080 | -H-- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2009/03/08 14:09:26 | 000,638,816 | -H-- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: C:\Program Files\Internet Explorer\iexplore.exe [2009/03/08 14:09:26 | 000,638,816 | -H-- | M] (Microsoft Corporation)

< >

========== Alternate Data Streams ==========

@Alternate Data Stream - 127 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:430C6D84
@Alternate Data Stream - 104 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2

< End of report >

shetrim

Newbie Surfer
Newbie Surfer

Posts : 18
Joined : 2012-04-26
Operating System : XP

View user profile

Back to top Go down

Re: S.M.A.R.T. Check, Drive Sector Not Found Error, Other Issues

Post by Superdave on Mon 30 Apr 2012, 5:28 am

Hello and welcome to GeekPolice.Net My name is Dave. I will be helping you out with your particular problem on your computer.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.

*****************************************************************

  • Please download Unhide by Grinler from here and save it to your desktop.
  • Double click unhide.exe to run the tool.
  • It will take some time to go through all your files, so please be patient.
  • If this tool doesn´t fix the problem, please let me know.

********************************************************
Please download Malwarebytes Anti-Malware from here.
Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Full Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • Please save the log to a location you will remember.
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

Superdave
Tech Staff


Tech Staff

Posts : 4193
Joined : 2010-02-01
Operating System : Windows 8.1 and a dual-boot with XP Home SP3

View user profile

Back to top Go down

Re: S.M.A.R.T. Check, Drive Sector Not Found Error, Other Issues

Post by shetrim on Mon 30 Apr 2012, 9:26 am

I did the things you asked. The UNHIDE allowed me to see my documents and other things from my START menu again, but only when I'm logged in as Adminstrator from the SAFE menu. I cannot see anything when I'm logged in as myself from regular mode. I have to be in SAFE mode and as an administrator to see everything.

The Malwarebytes did not find anything at all. I am posting the log following this message. I am still having problems. When I do a search and click on any search results, I end up on some bizarre website rather than the result that I was seeking. For example, if I searched for Expedia and Expedia came up in my Google search results, I would end up on some strange website that was nothing like Expedia if I clicked on the Expedia link. I keep getting misdirected. Also, when I tried to log back into my computer in regular mode, I noticed that S.M.A.R.T. HDD was still in my START menu. Isn't this part of what is causing me problems? I'm endlessly frustrated since I am not sure what I clicked on to start this entire problem (and as I stated in my original post, this is the second laptop this has happened to). Here is the log from MBAM:

Malwarebytes Anti-Malware (Trial) 1.61.0.1400
[You must be registered and logged in to see this link.]

Database version: v2012.04.29.06

Windows XP Service Pack 3 x86 NTFS (Safe Mode/Networking)
Internet Explorer 8.0.6001.18702
Administrator :: TRIMBLE-0E30FCB [administrator]

Protection: Disabled

4/29/2012 1:06:52 PM
mbam-log-2012-04-29 (13-06-52).txt

Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 275399
Time elapsed: 41 minute(s), 45 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

shetrim

Newbie Surfer
Newbie Surfer

Posts : 18
Joined : 2012-04-26
Operating System : XP

View user profile

Back to top Go down

Re: S.M.A.R.T. Check, Drive Sector Not Found Error, Other Issues

Post by Superdave on Mon 30 Apr 2012, 12:10 pm

Also, when I tried to log back into my computer in regular mode, I noticed that S.M.A.R.T. HDD was still in my START menu. Isn't this part of what is causing me problems?
Yes, this is known as Scareware designed to make you think that there's something seriously wrong with your computer and only by purchasing their programs will fix the problem.
Reboot your computer in Safe Mode with Networking and download the following program.


Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
Save Rkill to your desktop.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

iExplore.exe

When at the download page, click on the Download Now button labeled iExplore.exe download link. When you are prompted where to save it, please save it on your desktop.

Once it is downloaded, double-click on the iExplore.exe icon in order to automatically attempt to stop any processes associated with Smart HDD and other Rogue programs. If you cannot find the iExplore.exe icon that you downloaded, you can also execute the program by doing the following steps based on your version of Windows:

For Windows 7 and Windows Vista, click on the Start button and then in the search field enter %userprofile%\desktop\iexplore.exe and then press the Enter key on your keyboard. If you Windows prompts you to allow it to run, please allow it to do so.

For Windows XP, click on the Start button and then click on the Run menu option. In the Open: field enter %userprofile%\desktop\iexplore.exe and press the OK button. If you Windows prompts you to allow it to run, please allow it to do so.

Please be patient while the program looks for various malware programs and ends them. When it has finished, the black window will automatically close and you can continue with the next step. If you get a message that RKill is an infection, do not be concerned. This message is just a fake warning given by Smart HDD when it terminates programs that may potentially remove it. If you run into these infections warnings that close RKill, a trick is to leave the warning on the screen and then run RKill again. By not closing the warning, this typically will allow you to bypass the malware trying to protect itself so that rkill can terminate Smart HDD . So, please try running RKill until the malware is no longer running. You will then be able to proceed with the rest of the guide. If you continue having problems running RKill, you can download the other renamed versions of RKill from the rkill download page. All of the files are renamed copies of RKill, which you can try instead. Please note that the download page will open in a new browser window or tab.

Do not reboot your computer after running RKill as the malware programs will start again.
Now try to run MBAM in Safe Mode and let me know what happens.

Superdave
Tech Staff


Tech Staff

Posts : 4193
Joined : 2010-02-01
Operating System : Windows 8.1 and a dual-boot with XP Home SP3

View user profile

Back to top Go down

Re: S.M.A.R.T. Check, Drive Sector Not Found Error, Other Issues

Post by shetrim on Mon 30 Apr 2012, 2:39 pm

Ran Rkill and did not get any warnings. Ran MBAM again and still no issues found. Here is the Rkill log:

This log file is located at C:\rkill.log.
Please post this only if requested to by the person helping you.
Otherwise you can close this log when you wish.

Rkill was run on 04/29/2012 at 19:03:23.
Operating System: Microsoft Windows XP


Processes terminated by Rkill or while it was running:



Rkill completed on 04/29/2012 at 19:04:37.


Here is the MBAM log:

Malwarebytes Anti-Malware (Trial) 1.61.0.1400
[You must be registered and logged in to see this link.]

Database version: v2012.04.30.02

Windows XP Service Pack 3 x86 NTFS (Safe Mode/Networking)
Internet Explorer 8.0.6001.18702
Administrator :: TRIMBLE-0E30FCB [administrator]

Protection: Disabled

4/29/2012 7:10:44 PM
mbam-log-2012-04-29 (19-10-44).txt

Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 278474
Time elapsed: 58 minute(s), 6 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)


I am still having the misdirected search engines. I tested by going into Google and searched for "Washington Post," but when I clicked on "Washington Post," I was directed to some other strange site.

shetrim

Newbie Surfer
Newbie Surfer

Posts : 18
Joined : 2012-04-26
Operating System : XP

View user profile

Back to top Go down

Re: S.M.A.R.T. Check, Drive Sector Not Found Error, Other Issues

Post by Superdave on Tue 01 May 2012, 6:06 am


  • Download TDSSKiller and save it to your Desktop.
  • Extract its contents to your desktop.
  • Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.



  • If an infected file is detected, the default action will be Cure, click on Continue.



  • If a suspicious file is detected, the default action will be Skip, click on Continue.



  • It may ask you to reboot the computer to complete the process. Click on Reboot Now.



  • Click the Report button and copy/paste the contents of it into your next reply
Note:It will also create a log in the C:\ directory..

Superdave
Tech Staff


Tech Staff

Posts : 4193
Joined : 2010-02-01
Operating System : Windows 8.1 and a dual-boot with XP Home SP3

View user profile

Back to top Go down

Re: S.M.A.R.T. Check, Drive Sector Not Found Error, Other Issues

Post by shetrim on Wed 02 May 2012, 11:36 am

I tried running the tdskiller twice and it won't open and run. I followed the directions exactly as described and it would not run. I could not get to the screens as shown above. I downloaded the program in SAFE mode and in regular mode and could not get it to run either way. I could extract all the files, but when the files were extracted, there was a file with a 3KB Eula documents and a red and black "K" (the red part of the "K" was shaped like a "v" and the black part was shaped like an "arrow" making up the shape of a "K."). When I clicked on the black and red "K," nothing happens.

shetrim

Newbie Surfer
Newbie Surfer

Posts : 18
Joined : 2012-04-26
Operating System : XP

View user profile

Back to top Go down

Re: S.M.A.R.T. Check, Drive Sector Not Found Error, Other Issues

Post by Superdave on Wed 02 May 2012, 11:50 am

Ok. let's try this one.

Please download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it



Click the "Scan" button to start scan

Note: Do not take action against any **Rootkit** entries until I have reviewed the log. Often there are false positives



On completion of the scan click save log, save it to your desktop and post in your next reply

Superdave
Tech Staff


Tech Staff

Posts : 4193
Joined : 2010-02-01
Operating System : Windows 8.1 and a dual-boot with XP Home SP3

View user profile

Back to top Go down

Re: S.M.A.R.T. Check, Drive Sector Not Found Error, Other Issues

Post by shetrim on Wed 02 May 2012, 12:10 pm

It won't run either (I'm in SAFE mode). Should I try in regular mode? I was not able to do the last direction in either mode, so I suspect I'll have the same issue. What do you think? I double click and nothing happens.

shetrim

Newbie Surfer
Newbie Surfer

Posts : 18
Joined : 2012-04-26
Operating System : XP

View user profile

Back to top Go down

Re: S.M.A.R.T. Check, Drive Sector Not Found Error, Other Issues

Post by shetrim on Wed 02 May 2012, 3:15 pm

I cannot run aswMBR in normal mode either. This is the same program that I initially tried running when I wrote to you the first time. It would not run then either. I'm still having the search engine misdirect issues...very discouraging. Thank you for continuing to try to get to the bottom of this most frustrating situation.

shetrim

Newbie Surfer
Newbie Surfer

Posts : 18
Joined : 2012-04-26
Operating System : XP

View user profile

Back to top Go down

Re: S.M.A.R.T. Check, Drive Sector Not Found Error, Other Issues

Post by Superdave on Thu 03 May 2012, 6:31 am

Save these instructions so you can have access to them while in Safe Mode.

Please click here to download AVP Tool by Kaspersky.

  • Save it to your desktop.
  • Reboot your computer into SafeMode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight SafeMode then hit enter.
  • Double click the setup file to run it.
  • Click Next to continue.
  • Accept the License agreement and click on next.
  • It will, by default, install it to your desktop folder. Click Next.
  • It will then open a box There will be a tab that says Automatic scan.
  • Under Automatic scan make sure these are checked.

  • Hidden Startup Objects
  • System Memory
  • Disk Boot Sectors.
  • My Computer.
  • Also any other drives (Removable that you may have)

Leave the rest of the settings as they appear as default.
•Then click on Scan at the to right hand Corner.
•It will automatically Neutralize any objects found.
•If some objects are left un-neutralized then click the button that says Neutralize all
•If it says it cannot be neutralized then choose the delete option when prompted.
•After that is done click on the reports button at the bottom and save it to file name it Kas.
•Save it somewhere convenient like your desktop and just post only the detected Virus\malware in the report it will be at the very top under Detected post those results in your next reply.

Note: This tool will self uninstall when you close it so please save the log before closing it.

Superdave
Tech Staff


Tech Staff

Posts : 4193
Joined : 2010-02-01
Operating System : Windows 8.1 and a dual-boot with XP Home SP3

View user profile

Back to top Go down

Re: S.M.A.R.T. Check, Drive Sector Not Found Error, Other Issues

Post by shetrim on Thu 03 May 2012, 12:18 pm

Here is the detected malware report:

Status: Disinfected (events: 2)
5/2/2012 2:12:13 PM Disinfected Trojan program Exploit.Java.CVE-2011-3544.ph C:\Documents and Settings\David\Application Data\Sun\Java\Deployment\cache\6.0\1\767a9b81-73db0a0e High
5/2/2012 2:12:13 PM Disinfected Trojan program Exploit.Java.CVE-2011-3544.ph C:\Documents and Settings\David\Application Data\Sun\Java\Deployment\cache\6.0\1\767a9b81-73db0a0e/a/y.class High



shetrim

Newbie Surfer
Newbie Surfer

Posts : 18
Joined : 2012-04-26
Operating System : XP

View user profile

Back to top Go down

Re: S.M.A.R.T. Check, Drive Sector Not Found Error, Other Issues

Post by Superdave on Thu 03 May 2012, 12:53 pm

Can you run any of the other tools such as MBAM, TDSSKiller?

Superdave
Tech Staff


Tech Staff

Posts : 4193
Joined : 2010-02-01
Operating System : Windows 8.1 and a dual-boot with XP Home SP3

View user profile

Back to top Go down

Re: S.M.A.R.T. Check, Drive Sector Not Found Error, Other Issues

Post by shetrim on Fri 04 May 2012, 2:45 am

I can't run TDSSKiller or aswMBR. I've always been able to run the Malwarebytes program, but oddly enough I am getting a new message when I start up my machine from Malwarebytes Anti-Malware that says the following: [OpenEvent] Failed to perform desired action. Error Code: 2

I am still having the search engine issues with it being misdirected.

shetrim

Newbie Surfer
Newbie Surfer

Posts : 18
Joined : 2012-04-26
Operating System : XP

View user profile

Back to top Go down

Re: S.M.A.R.T. Check, Drive Sector Not Found Error, Other Issues

Post by Superdave on Fri 04 May 2012, 6:14 am

Download Combofix from any of the links below, and save it to your DESKTOP.

Link 1
Link 2
Link 3

When saving ComboFix rename it to PCHelpForum.exe to prevent it from being blocked by malware.

To prevent your anti-virus application interfering with ComboFix we need to disable it. See here for a tutorial regarding how to do so if you are unsure.

  • Close any open windows and double click PCHelpForum.exe to run it.

    You will see the following image:



Click I Agree to start the program.

ComboFix will then extract the necessary files and you will see this:



As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. This will not occur in Windows Vista and 7

It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

If you did not have it installed, you will see the prompt below. Choose YES.



Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:



Click on Yes, to continue scanning for malware.

When finished, it will produce a report for you. Please post the contents of the log (C:\ComboFix.txt).

Leave your computer alone while ComboFix is running. ComboFix will restart your computer if malware is found; allow it to do so.

Note: Please Do NOT mouseclick combofix's window while its running because it may cause it to stall.

Superdave
Tech Staff


Tech Staff

Posts : 4193
Joined : 2010-02-01
Operating System : Windows 8.1 and a dual-boot with XP Home SP3

View user profile

Back to top Go down

Re: S.M.A.R.T. Check, Drive Sector Not Found Error, Other Issues

Post by shetrim on Sun 06 May 2012, 1:06 pm

I followed the directions after downloading the first link. I've tried doing the process several times, but it keeps freezing while the scan is happening. It reaches the blue screen where it says that it is scanning for infected files and that the process takes up to ten minutes, but for badly infected computers, it can take double the time. After about twenty minutes, I notice that the screen is frozen...nothing is happening. I'm going to keep trying until I hear from you again. Thanks so much for your help!!

shetrim

Newbie Surfer
Newbie Surfer

Posts : 18
Joined : 2012-04-26
Operating System : XP

View user profile

Back to top Go down

Re: S.M.A.R.T. Check, Drive Sector Not Found Error, Other Issues

Post by Superdave on Mon 07 May 2012, 5:42 am

Please try running ComboFix in Safe Mode.

Superdave
Tech Staff


Tech Staff

Posts : 4193
Joined : 2010-02-01
Operating System : Windows 8.1 and a dual-boot with XP Home SP3

View user profile

Back to top Go down

Re: S.M.A.R.T. Check, Drive Sector Not Found Error, Other Issues

Post by shetrim on Mon 07 May 2012, 7:44 am

It still won't work...freezes no matter what mode I'm running in.

shetrim

Newbie Surfer
Newbie Surfer

Posts : 18
Joined : 2012-04-26
Operating System : XP

View user profile

Back to top Go down

Re: S.M.A.R.T. Check, Drive Sector Not Found Error, Other Issues

Post by Superdave on Mon 07 May 2012, 10:59 am

I just want to check to see what type of infection we're dealing with. Have you ever seen this pop up on your computer?



I would like you to try running TDSSKiller a number of times. With this type of infection, it should run eventually. The same goes for TDSSKiller. The infection gives a warning when you try to open programs in order to convince you that something is seriously wrong with the computer.
I would like you to try running HJT. There is a couple of lines I'm searching for.
Your initial OTL log shows that you had ComboFix on your computer. Did you ever run a scan with it? If you did, there should be a log in the ComboFix folder on your C drive. If found, please attach it.
Did you delete any temp files since this started?


Please download: HiJackThis to your Desktop.

  • Double Click the HijackThis icon, located on your Desktop.
  • By Default, it will install to: C:\Program Files\Trend Micro\HijackThis
  • Accept the license agreement.
  • Click the Open the Misc Tools section button.
  • Click Do a System Scan and Save a Logfile. Or, if you see a white screen, click Scan.
  • Please post the log in your next reply.

Superdave
Tech Staff


Tech Staff

Posts : 4193
Joined : 2010-02-01
Operating System : Windows 8.1 and a dual-boot with XP Home SP3

View user profile

Back to top Go down

Re: S.M.A.R.T. Check, Drive Sector Not Found Error, Other Issues

Post by shetrim on Tue 08 May 2012, 6:04 am

Hijack This LOG:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:01:05 PM, on 5/7/2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Microsoft
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: OpenOffice.org 3.3.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {CAFECAFE-0013-0001-0022-ABCDEFABCDEF} (JInitiator 1.3.1.22) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - [You must be registered and logged in to see this link.]
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: PEVSystemStart - Unknown owner - C:\PCHelpForum25347P\pev.3XE
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 4687 bytes


I am not sure what I did when this initially happened. SMART HDD did pop up on my screen telling me that I had a bunch of critical errors. I do not think that exact screen popped up, but something very similar (and it very well may could have been the same). I do not think I deleted any temporary files, but at this point, I have no idea what I'm doing. I don't see a ComboFix log on my computer, but I'll keep snooping around. I'm going to keep trying the TDSSKiller as well. Thanks.

shetrim

Newbie Surfer
Newbie Surfer

Posts : 18
Joined : 2012-04-26
Operating System : XP

View user profile

Back to top Go down

Re: S.M.A.R.T. Check, Drive Sector Not Found Error, Other Issues

Post by Superdave on Tue 08 May 2012, 9:45 am

Thanks. I'm going to ask a colleague to take a look at this thread.

Superdave
Tech Staff


Tech Staff

Posts : 4193
Joined : 2010-02-01
Operating System : Windows 8.1 and a dual-boot with XP Home SP3

View user profile

Back to top Go down

Re: S.M.A.R.T. Check, Drive Sector Not Found Error, Other Issues

Post by Superdave on Wed 09 May 2012, 10:16 am

Please try to run this one.

Please download MBRCheck.exe by a_d_13 from one of the links provided below and save it to your desktop.

Link 1
Link 2
Link 3

•Double-click on MBRCheck.exe to run it.

•It will open a black window...please do not fix anything (if it gives you an option).

•When complete, you should see Done! Press ENTER to exit.... Press Enter on the keyboard.

•A log named MBRCheck_date_time.txt (i.e. MBRCheck_07.21.10_10.22.51.txt) will appear on the desktop.
•Please copy and paste the contents of that log in your next reply.

Superdave
Tech Staff


Tech Staff

Posts : 4193
Joined : 2010-02-01
Operating System : Windows 8.1 and a dual-boot with XP Home SP3

View user profile

Back to top Go down

Re: S.M.A.R.T. Check, Drive Sector Not Found Error, Other Issues

Post by shetrim on Wed 09 May 2012, 1:27 pm

It appears to have found something, but I did not fix anything. I clicked "N" for "No" and exited out. Here is the log:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000000c

Kernel Drivers (total 87):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806EF000 \WINDOWS\system32\hal.dll
0xF8C36000 \WINDOWS\system32\KDCOM.DLL
0xF8B46000 \WINDOWS\system32\BOOTVID.dll
0xF86E7000 ACPI.sys
0xF8C38000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF86D6000 pci.sys
0xF8736000 isapnp.sys
0xF8B4A000 compbatt.sys
0xF8B4E000 \WINDOWS\system32\DRIVERS\BATTC.SYS
0xF8CFE000 PCIIde.sys
0xF89B6000 \WINDOWS\System32\Drivers\PCIIDEX.SYS
0xF8C3A000 intelide.sys
0xF86B8000 pcmcia.sys
0xF8746000 MountMgr.sys
0xF8699000 ftdisk.sys
0xF89BE000 PartMgr.sys
0xF8756000 VolSnap.sys
0xF8681000 atapi.sys
0xF8766000 disk.sys
0xF8776000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF8661000 fltmgr.sys
0xF864F000 sr.sys
0xF8638000 KSecDD.sys
0xF85AB000 Ntfs.sys
0xF857E000 NDIS.sys
0xF8564000 Mup.sys
0xF8786000 agp440.sys
0xF89DE000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xF84E7000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF89E6000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF89F6000 \SystemRoot\system32\DRIVERS\DLKRCB.SYS
0xF87A6000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF8A06000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF8A0E000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF87B6000 \SystemRoot\system32\DRIVERS\imapi.sys
0xF87C6000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xF87D6000 \SystemRoot\system32\DRIVERS\redbook.sys
0xF84C4000 \SystemRoot\system32\DRIVERS\ks.sys
0xF87E6000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF8BDE000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF84AD000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF87F6000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF8806000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF8A36000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF849C000 \SystemRoot\system32\DRIVERS\psched.sys
0xF8816000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF8A46000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF8A56000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF8826000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF8C40000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF843E000 \SystemRoot\system32\DRIVERS\update.sys
0xF8BEE000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF8836000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF8C44000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF8846000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF8C48000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF8DBA000 \SystemRoot\System32\Drivers\Null.SYS
0xF8C4C000 \SystemRoot\System32\Drivers\Beep.SYS
0xF8A96000 \SystemRoot\System32\drivers\vga.sys
0xF8402000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0xF8C50000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF8AA6000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF8AB6000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF8C22000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xF83CF000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xF8376000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xF834E000 \SystemRoot\system32\DRIVERS\netbt.sys
0xF8328000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xF8C32000 \SystemRoot\System32\drivers\ws2ifsl.sys
0xF8306000 \SystemRoot\System32\drivers\afd.sys
0xF8856000 \SystemRoot\system32\DRIVERS\netbios.sys
0xF82DB000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xF8243000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xF8876000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xF822B000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF8C58000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xF843A000 \SystemRoot\System32\drivers\Dxapi.sys
0xF8AFE000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xF8D04000 \SystemRoot\System32\drivers\dxgthk.sys
0xBFF50000 \SystemRoot\System32\framebuf.dll
0xBF012000 \SystemRoot\System32\ATMFD.DLL
0xF7F5F000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xF6CC1000 \SystemRoot\system32\DRIVERS\srv.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 16):
0 System Idle Process
4 System
376 C:\WINDOWS\system32\smss.exe
424 csrss.exe
448 C:\WINDOWS\system32\winlogon.exe
492 C:\WINDOWS\system32\services.exe
504 C:\WINDOWS\system32\lsass.exe
656 C:\WINDOWS\system32\svchost.exe
704 svchost.exe
824 C:\WINDOWS\system32\svchost.exe
880 svchost.exe
952 svchost.exe
1228 C:\WINDOWS\explorer.exe
392 C:\Program Files\Internet Explorer\iexplore.exe
812 C:\WINDOWS\system32\ctfmon.exe
600 C:\Documents and Settings\Administrator\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: WDCWD800VE-75HDT1, Rev: 11.07D11

Size Device Name MBR Status
--------------------------------------------
74 GB \\.\PhysicalDrive0 MBR Code Faked!
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!

shetrim

Newbie Surfer
Newbie Surfer

Posts : 18
Joined : 2012-04-26
Operating System : XP

View user profile

Back to top Go down

Re: S.M.A.R.T. Check, Drive Sector Not Found Error, Other Issues

Post by Superdave on Thu 10 May 2012, 6:01 am

Ok. There it is; a bad MBR. We'll try to repair it. If you can't install the Recovery Console you won't be able to run the second one. If successful installing the RC proceed with the second and then post another scan with MBRCheck.

Please download this file from Microsoft and save it on your desktop.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU

Next, please drop/drop it onto Combofix, and Combofix will install the recovery console.



Once that is done, Combofix will ask if you want to continue to scan. Select no, and then let me know once you have gotten this far.

*****************************************************
Earlier on ComboFix installed the Recovery Console. We're going to use that now.

Reboot your machine and when the Boot Menu flashes up - select "Microsoft Windows Recovery Console"
(you need to be very fast with the arrow key as you only have a couple of seconds before it defaults to the windows XP bootup)





When you get to the above screen, take note of the number that references your operating system.

If it's '1' like the picture above, type 1 and press Enter



Next type FIXMBR

If it ask if you're sure you want to write a new MBR, answer 'Y'

Then type EXIT to reboot the machine.

With that done, please post back and let me know how things are now.

Superdave
Tech Staff


Tech Staff

Posts : 4193
Joined : 2010-02-01
Operating System : Windows 8.1 and a dual-boot with XP Home SP3

View user profile

Back to top Go down

Re: S.M.A.R.T. Check, Drive Sector Not Found Error, Other Issues

Post by shetrim on Thu 10 May 2012, 12:20 pm

I downloaded the file from Microsoft and dropped it on the ComboFix, but it seems like I'm doing something wrong. ComboFix goes to the blue screen and wants to do the scan and I'm not sure how to get out of it. I was never successful with ComboFix to begin with as it kept freezing before, so it's a problem. I tried to do the second step because I do have the option for the Windows Recovery Console, but all that happens is my computer says it is starting the Window Recovery Console, but it just stays at the same screen doing nothing...very confused.

shetrim

Newbie Surfer
Newbie Surfer

Posts : 18
Joined : 2012-04-26
Operating System : XP

View user profile

Back to top Go down

Re: S.M.A.R.T. Check, Drive Sector Not Found Error, Other Issues

Post by Sponsored content Today at 4:22 am


Sponsored content


Back to top Go down

Page 1 of 2 1, 2  Next

View previous topic View next topic Back to top


 
Permissions in this forum:
You cannot reply to topics in this forum