GMER says NAV is Infected!!!

My system is running Windows XP (SP3) and I desperately need some advice re GMER....

Over this past weekend I had a bootup issue but I was able to boot the system into safe-mode, reverted to the last known working configuration (or whatever) and when I rebooted the system all seemed well.

Yesteday I had the same bootup issue, so when I finally got Windows running I decided to run a chkdsk /f which found (and corrected) quite a few errors. I thought that was probably the cause of my bootup problems until today when I again had a bootup issue! So I decided to do a full system scan with my Norton AV - which reported my system was 100% clean.

Having read about rootkit activity, I just downloaded GMER and ran it. GMER immediately reported that a rootkit was likely on my system and when I let it do a scan it found 5 Red (infected) items, 3 Norton (NAV) services and 2 NAV update files!!!

Now I'm bewildered and don't know if I should believe GMER and allow it to disable/delete those NAV items or not - what do you think I should do?

 

Hi, don't panic

Sounds like FP's due to RK like behaviour from NAV.

If you could upload your GMER log as a .txt file and/or post screenies of the 5 Red items, we can check them for you.

 

CR, thank you for offering to help, but where do I find the GMER log?

 

After it scans click SAVE



Choose where to save eg Desktop & name it something like Gmer Log

I have to go out now, but i'll be back later. In the meantime i hope others can step in to assist

All the best

 

If you've nothing suspicious happening to you while using your machine and gmer is flagging Norton files then you are probably okay. Saying that imo antivirus should be uninstalled before running an antirootkit and a reboot before checking with another antirootkit, but for now save your log.

It may also be appropriate to post the log at sysinternals forums or a dedicated removal forum as Wilders don't cater for logs or upload it to rapidshare if you like and PM me or CloneRanger(hope that's okay)the link.

 

Thanks - I will let it scan again and do that.

 

Meriadoc, did you read my first post? - I've been experiencing bootup issues!

 

Hi Wendi, up your log file here - no need to make an account - and PM me the link.

 

You've got mail...

 

PMed.

 

Just to update you all, after my last post I shutdown my PC for a few hours. Later on when I went back to it, it wouldn't boot (reporting that Windows\System32\System was either missing or corrupt).

This time I couldn't even boot into safe-mode and when I told that to my girlfriend she sent her husband (a software engineer) over to checkout my PC. I'm not really sure how he repaired it, but I do know that he used my Windows XP CD to do it. He told me that my bootup problems were definitely due to a corrupted registry. He then scanned my system with Hitman Pro and MBAM, neither of which found any serious infections (just tracking cookies).

I've been using Advanced SystemCare Pro (daily) to cleanup my PC and he believes that it was deleting important registry items! He advised me not to use ASCP anymore (nor any other registry cleaner!) and see if my bootup problems go away.

I have since restarted Windows several times - so far, so good...

Wendi

 

Very sound advice - imho reg cleaners do a lot more harm than good (and for that matter, I'm not convinced any of them do any good).

Btw, glad to hear all is now working well.

 

Hi Wendi, glad you got it sorted, see my PM reply to yours

 

After my friend's husband advised me against using registry cleaners I removed ASCP. Since then I have shutdown, booted-up, and restarted several times - so far all is well.

 

It is good that a friend helped you out. Perhaps in the future you ought to try to image your system as in my experience this is the only remedy to mistakes that we all make paradoxically trying to improve our computer efficiency. Something odd happens, you can't boot, a recovery CD and some ten minutes later your computer is alive again.

 

Hi Wendi, it didn't sound like you had a rootkit from your description and as you know the log showed they were f/ps from your antivirus. Glad your sorted, pmed you.

 

Wendi, I enthusiastically 2nd Osban's good advice. While discontinuing use of reg cleaners may prevent repeats of your booting issues, you never know when something else will mess-up your system! There is nothing as secure as having a recent system backup (disk-image on an external hard drive) which would allow you to recover from just about any malady.

 

Sound advice there guys