Ashu Posted June 23, 2009 ID:92629 Share Posted June 23, 2009 I have a problem with decreasing hard drive. I have it decrease it in front of my eyes without any activity on my part.I have done combofix (have the log), have done rootrepeal (have the log), malaware (did not show any malware), ddr (have the log).Please help me as this is driving me crazy. Many thankstharunam_Attach.txttharunam_DDS.txtTharunam_rootrepal_report.txttharunam_Attach.txttharunam_DDS.txtTharunam_rootrepal_report.txt Link to post Share on other sites More sharing options...
Ashu Posted June 24, 2009 Author ID:92692 Share Posted June 24, 2009 I do not have any restore points.I had 33 gigs 2 days ago and now I only have 13.5 gigs left.Something is going on for sure. don't know what...Please help before I lose it all.Thanks. Please check my log Link to post Share on other sites More sharing options...
sjpritch25 Posted June 25, 2009 ID:93215 Share Posted June 25, 2009 Welcome to Malwarebytes Please download mbr.exe to your root drive(usually C:\).Go to start ---> Run ---> Type C:\mbr.exe -t followed by the Enter key. In your next reply, please include the mbr log. Thanks Link to post Share on other sites More sharing options...
Ashu Posted June 27, 2009 Author ID:93689 Share Posted June 27, 2009 Welcome to Malwarebytes Please download mbr.exe to your root drive(usually C:\).Go to start ---> Run ---> Type C:\mbr.exe -t followed by the Enter key. In your next reply, please include the mbr log. ThanksHere is the log attached for mbr.exe Link to post Share on other sites More sharing options...
Ashu Posted June 27, 2009 Author ID:93690 Share Posted June 27, 2009 Here is the log attached for mbr.exeSorry forgot to upload it here it is Link to post Share on other sites More sharing options...
sjpritch25 Posted June 27, 2009 ID:93706 Share Posted June 27, 2009 i don't see any attachments, but just copy and past the log in your reply. Thanks Link to post Share on other sites More sharing options...
Ashu Posted June 28, 2009 Author ID:93911 Share Posted June 28, 2009 i don't see any attachments, but just copy and past the log in your reply. ThanksStealth MBR rootkit/Mebroot/Sinowal detector 0.3.6 by Gmer, http://www.gmer.netdevice: opened successfullyuser: MBR read successfullycalled modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS kernel: MBR read successfullycopy of MBR has been found in sector 22 !copy of MBR has been found in sector 23 !Here is the output from ROOTREPAL also:ROOTREPEAL © AD, 2007-2009==================================================Scan Time: 2009/06/28 07:00Program Version: Version 1.3.0.0Windows Version: Windows XP SP3==================================================Hidden/Locked Files-------------------Path: Volume C:\Status: MBR Rootkit Detected!Path: C:\hiberfil.sysStatus: Locked to the Windows API!Path: C:\ashampoo-acdw-log.txtStatus: Visible to the Windows API, but not on disk.Path: C:\RootRepeal report 06-28-09 (06-57-01).txtStatus: Visible to the Windows API, but not on disk.Path: C:\RootRepeal report 06-28-09 (06-59-57).txtStatus: Visible to the Windows API, but not on disk.Path: C:\Program Files\AshampooStatus: Visible to the Windows API, but not on disk.Path: C:\Program Files\Aventail ConnectStatus: Visible to the Windows API, but not on disk.Path: C:\Program Files\JavaStatus: Visible to the Windows API, but not on disk.Path: C:\Program Files\Malwarebytes' Anti-MalwareStatus: Visible to the Windows API, but not on disk.Path: c:\windows\schedlgu.txtStatus: Size mismatch (API: 13894, Raw: 3896)Path: C:\WINDOWS\ngevent.dllStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\ngmsgs.dllStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\ngmsi.dllStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\ngutil.exeStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\ngwinx.dllStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\SunStatus: Visible to the Windows API, but not on disk.Path: C:\Documents and Settings\bapasp\IECompatCacheStatus: Visible to the Windows API, but not on disk.Path: C:\Documents and Settings\bapasp\PrivacIEStatus: Visible to the Windows API, but not on disk.Path: C:\Program Files\shield\client.dll.logStatus: Visible to the Windows API, but not on disk.Path: C:\RECYCLER\S-1-5-21-1454471165-362288127-1801674531-1003\Dc1Status: Invisible to the Windows API!Path: C:\RECYCLER\S-1-5-21-1454471165-362288127-1801674531-1003\Dc2.exeStatus: Invisible to the Windows API!Path: C:\RECYCLER\S-1-5-21-1454471165-362288127-1801674531-1003\Dc3.torrentStatus: Invisible to the Windows API!Path: C:\RECYCLER\S-1-5-21-1454471165-362288127-1801674531-1003\Dc4Status: Invisible to the Windows API!Path: C:\RECYCLER\S-1-5-21-1454471165-362288127-1801674531-1003\Dc5Status: Invisible to the Windows API!Path: C:\RECYCLER\S-1-5-21-1454471165-362288127-1801674531-1003\Dc6Status: Invisible to the Windows API!Path: c:\recycler\s-1-5-21-1454471165-362288127-1801674531-1003\info2Status: Size mismatch (API: 20, Raw: 5620)Path: C:\WINDOWS\Prefetch\AGENTSVR.EXE-002E45AB.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\AUTORUN.EXE-2BEFFDCB.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\CSRSS.EXE-12B63473.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\EGUI.EXE-2926BFD4.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\EKRN.EXE-04F4138D.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\ESET NOD32 ANTIVIRUS BUSINESS-31AEB230.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\RUNDLL32.EXE-470F11BD.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\RUNDLL32.EXE-49F747DB.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\RUNDLL32.EXE-4ACB286C.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\RUNDLL32.EXE-4B1DB1FC.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\SETUP.EXE-32DD1568.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\SETUP.EXE-393E66AE.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\SETUP50.EXE-362FF7C9.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\MSOOBE.EXE-30411B02.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\NVCPLUI.EXE-315CED5C.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\NVSVC32.EXE-1F9EED18.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\NVUDISP.EXE-32E0B398.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\OUTPOSTPROINSTALL.EXE-1B5148D6.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\OUTPOSTPROINSTALL.TMP-0C1E8B70.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\OUTPOSTPROINSTALL.TMP-1EA4C196.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\RUNDLL32.EXE-12BF95CE.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\RUNDLL32.EXE-169CA248.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\RUNDLL32.EXE-197CF692.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\RUNDLL32.EXE-1DA3F59A.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\RUNDLL32.EXE-1F660CD2.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\RUNDLL32.EXE-4499C56E.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-297067B9.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-2BCA99B3.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-2C6467D2.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-2F9A6C71.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-307CC304.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-31C66815.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-31D435B2.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-32314E84.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-32405405.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-349CF69B.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-35256F7F.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-37F8BDB2.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-3A736A9C.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\USERINIT.EXE-30B18140.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\VC9REDIST_X86.EXE-225698A3.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-0091AA59.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-00D48DA0.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-00E7D32B.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-03312FA0.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-042A3E54.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-0444C53E.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-045B45CE.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-05972C8C.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-07F57BFD.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-0861C322.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-08A3FD32.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-092E1F29.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-095C05CC.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-0A38897B.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-0A9F0870.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-10C5F78C.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-1124ECFE.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-11DF4F4C.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-13097096.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-151501D1.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-19B615CB.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-1A7F30F0.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-1ACD8FB1.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-1C0F7C45.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-25DF2DE6.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\UPDATE.EXE-263E0406.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\GENINST.EXE-39FBE1A8.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\IE4UINIT.EXE-169A5A39.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\IESETUP.EXE-26B0411B.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\INSTALL.EXE-0D4C4A7D.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\INSTALL_FP6_WU_R88.EXE-277C330A.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\LSASS.EXE-20DB6D1B.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\MRTSTUB.EXE-11632F74.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\RUNDLL32.EXE-1F94F465.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\RUNDLL32.EXE-236BBAFC.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\RUNDLL32.EXE-23F3A032.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\RUNDLL32.EXE-266C0153.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\RUNDLL32.EXE-27D9917D.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\RUNDLL32.EXE-286A7F8C.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\RUNDLL32.EXE-2AF77CC9.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\RUNDLL32.EXE-2F26E69F.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\RUNDLL32.EXE-30906FE7.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\RUNDLL32.EXE-3163B88B.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\RUNDLL32.EXE-3395513A.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\RUNDLL32.EXE-34FD57A0.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\RUNDLL32.EXE-3919F565.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\RUNDLL32.EXE-3C8C9286.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\RUNDLL32.EXE-3C937D0B.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\RUNDLL32.EXE-3F8082C7.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\RUNDLL32.EXE-415F88EC.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\WGASETUP.EXE-100DF432.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\WINDOWS-KB890830-V2.11.EXE-1E60315A.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\WINDOWSXP-KB905474-ENU-X86.EX-0516A016.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\WINDOWSXP-KB923789-X86-ENU.EX-2E6E7F28.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\WORDPAD.EXE-24533991.pfStatus: Invisible to the Windows API!Path: C:\WINDOWS\Prefetch\ACROBATINFO.EXE-35EB20A4.pfStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\ACRODIST.EXE-295636F4.pfStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\ACROTRAY.EXE-11E0E388.pfStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\ASHAMPOO_BURNING_STUDIO_9_904-02137C8F.pfStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\ASHAMPOO_BURNING_STUDIO_9_904-315E33CF.pfStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\ASHDRIVERSETUP.EXE-01373FB4.pfStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\AUTORUN.EXE-3684E09A.pfStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\BURNINGSTUDIO9.EXE-2C09CA63.pfStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\CANCELAUTOPLAY.EXE-0039A219.pfStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\CTFMON.EXE-0E17969B.pfStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\GRPCONV.EXE-111CD845.pfStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\INSTALL.EXE-1498F293.pfStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\IPCONFIG.EXE-2395F30B.pfStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\IRON.EXE-29B10913.pfStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\JAVA.EXE-0C263507.pfStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\Layout.iniStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\LOGON.SCR-151EFAEA.pfStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\MAGICJACK.EXE-3701EB60.pfStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\MAGICJACKLOADER.EXE-34746B21.pfStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\MAGICJACKSPLASH.EXE-2DD62BDB.pfStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\MAGICJACKSPLASH.EXE-2FFC554C.pfStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\MJSETUP.EXE-00E1FE4A.pfStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\MJSETUP.EXE-1D3B1028.pfStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\MSTSC.EXE-39B7CECA.pfStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\NBTSTAT.EXE-050A2164.pfStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\NETREG.EXE-30DD1329.pfStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\NGMONITOR.EXE-3A29ADC8.pfStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\ONECLICKSTARTER.EXE-31B195B2.pfStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\REGOPT.EXE-1FA9FFE4.pfStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\ROOTREPEAL.EXE-05D9F033.pfStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\RUNDLL32.EXE-17638B2D.pfStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\RUNDLL32.EXE-35A483DA.pfStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\RUNDLL32.EXE-4498EFB8.pfStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\SETUP.EXE-3A7EB202.pfStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Prefetch\UTSCSI.EXE-1DBF0E67.pfStatus: Visible to the Windows API, but not on disk.Path: c:\windows\system32\perfstringbackup.iniStatus: Size mismatch (API: 356120, Raw: 355086)Path: C:\WINDOWS\system32\deploytk.dllStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\system32\java.exeStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\system32\javacpl.cplStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\system32\javaw.exeStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\system32\javaws.exeStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\system32\ngclient.dllStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\system32\ngcommon.dllStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\system32\ngdial.exeStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\system32\nghelp.chmStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\system32\nglocenu.dllStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\system32\nglogon.dllStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\system32\ngmonitor.exeStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\system32\ngras.dllStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\system32\ngupdate.exeStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\system32\ngvpnmgr.exeStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\system32\UTSCSI.EXEStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Tasks\Malwarebytes' Scheduled Scan for bapasp.jobStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Tasks\Malwarebytes' Scheduled Update for bapasp.jobStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Temp\Perflib_Perfdata_f8c.datStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\testtime.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\WGAErrLog.txtStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\Perflib_Perfdata_5e0.datStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\inf\Erma.infStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\inf\ngvpn.infStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\inf\ngvpn.PNFStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Installer\2f78e.msiStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Installer\3baf7.mspStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Installer\3baf8.mspStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Installer\740704.msiStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Installer\eb8093.mspStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Installer\eb8094.mspStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Installer\eb8095.mstStatus: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Installer\{26A24AE4-039D-4CA4-87B4-2F83216014FF}Status: Visible to the Windows API, but not on disk.Path: C:\WINDOWS\Downloaded Program Files\erma.infStatus: Visible to the Windows API, but not on disk.Path: C:\Documents and Settings\All Users\Application Data\AventailStatus: Visible to the Windows API, but not on disk.Path: C:\Documents and Settings\All Users\Application Data\MalwarebytesStatus: Visible to the Windows API, but not on disk.Path: C:\Documents and Settings\All Users\Desktop\Adobe Acrobat 9 Pro Extended.lnkStatus: Invisible to the Windows API!Path: C:\Documents and Settings\All Users\Desktop\SRWare Iron.lnkStatus: Invisible to the Windows API!Path: C:\Documents and Settings\All Users\Desktop\TuneUp 1-Click Maintenance.lnkStatus: Invisible to the Windows API!Path: C:\Documents and Settings\All Users\Desktop\TuneUp Utilities 2009.lnkStatus: Invisible to the Windows API!Path: C:\Documents and Settings\All Users\Desktop\VLC media player.lnkStatus: Invisible to the Windows API!Path: C:\Documents and Settings\bapasp\Application Data\AshampooStatus: Visible to the Windows API, but not on disk.Path: C:\Documents and Settings\bapasp\Application Data\AventailStatus: Visible to the Windows API, but not on disk.Path: C:\Documents and Settings\bapasp\Application Data\MalwarebytesStatus: Visible to the Windows API, but not on disk.Path: C:\Documents and Settings\bapasp\Application Data\mjusbspStatus: Visible to the Windows API, but not on disk.Path: C:\Documents and Settings\bapasp\Application Data\SunStatus: Visible to the Windows API, but not on disk.Path: C:\Documents and Settings\bapasp\Cookies\bapasp@microsoft[2].txtStatus: Invisible to the Windows API!Path: C:\Documents and Settings\bapasp\Cookies\bapasp@tune-up[1].txtStatus: Invisible to the Windows API!Path: C:\Documents and Settings\bapasp\Desktop\Perfect Uninstaller.lnkStatus: Invisible to the Windows API!Path: C:\Documents and Settings\bapasp\Desktop\Shortcut (2) to Newly created software.lnkStatus: Invisible to the Windows API!Path: C:\Documents and Settings\bapasp\Desktop\Shortcut to bit download.lnkStatus: Invisible to the Windows API!Path: C:\Documents and Settings\bapasp\Desktop\Spybot - Search & Destroy.lnkStatus: Invisible to the Windows API!Path: C:\Documents and Settings\bapasp\Desktop\vlc-0.9.9-win32.exeStatus: Invisible to the Windows API!Path: C:\Documents and Settings\bapasp\Desktop\WinASO Registry Optimizer.lnkStatus: Invisible to the Windows API!Path: C:\Documents and Settings\bapasp\Desktop\ Link to post Share on other sites More sharing options...
sjpritch25 Posted June 28, 2009 ID:93950 Share Posted June 28, 2009 Well that's good no MBR rootkit. Do you have any P2P program installed on your PC? I only ask because can cause you to loose your hard drive space. Please download Malwarebytes' Anti-Malware from Here.Double Click mbam-setup.exe to install the application.Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.If an update is found, it will download and install the latest version.Once the program has loaded, select "Perform Quick Scan", then click Scan.The scan may take some time to finish,so please be patient.When the scan is complete, click OK, then Show Results to view the results.Make sure that everything is checked, and click Remove Selected.When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.Copy&Paste the entire report in your next reply.Extra Note:If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly. Link to post Share on other sites More sharing options...
Recommended Posts