GMER says NAV is Infected!!!

Discussion in 'other anti-malware software' started by Wendi, Nov 9, 2010.

Thread Status:
Not open for further replies.
  1. Wendi

    Wendi Registered Member

    Joined:
    Aug 8, 2008
    Posts:
    522
    Location:
    NY, USA
    My system is running Windows XP (SP3) and I desperately need some advice re GMER....

    Over this past weekend I had a bootup issue but I was able to boot the system into safe-mode, reverted to the last known working configuration (or whatever) and when I rebooted the system all seemed well.

    Yesteday I had the same bootup issue, so when I finally got Windows running I decided to run a chkdsk /f which found (and corrected) quite a few errors. I thought that was probably the cause of my bootup problems until today when I again had a bootup issue! So I decided to do a full system scan with my Norton AV - which reported my system was 100% clean.

    Having read about rootkit activity, I just downloaded GMER and ran it. GMER immediately reported that a rootkit was likely on my system and when I let it do a scan it found 5 Red (infected) items, 3 Norton (NAV) services and 2 NAV update files!!! :doubt:

    Now I'm bewildered and don't know if I should believe GMER and allow it to disable/delete those NAV items or not - what do you think I should do? o_O
     
  2. CloneRanger

    CloneRanger Registered Member

    Joined:
    Jan 4, 2006
    Posts:
    4,833
    Hi, don't panic ;)

    Sounds like FP's due to RK like behaviour from NAV.

    If you could upload your GMER log as a .txt file and/or post screenies of the 5 Red items, we can check them for you.
     
  3. Wendi

    Wendi Registered Member

    Joined:
    Aug 8, 2008
    Posts:
    522
    Location:
    NY, USA
    CR, thank you for offering to help, but where do I find the GMER log?
     
  4. CloneRanger

    CloneRanger Registered Member

    Joined:
    Jan 4, 2006
    Posts:
    4,833
    After it scans click SAVE

    gs.gif

    Choose where to save eg Desktop & name it something like Gmer Log :thumb:

    I have to go out now, but i'll be back later. In the meantime i hope others can step in to assist :)

    All the best
     
  5. Meriadoc

    Meriadoc Registered Member

    Joined:
    Mar 28, 2006
    Posts:
    2,642
    Location:
    Cymru
    If you've nothing suspicious happening to you while using your machine and gmer is flagging Norton files then you are probably okay. Saying that imo antivirus should be uninstalled before running an antirootkit and a reboot before checking with another antirootkit, but for now save your log.

    It may also be appropriate to post the log at sysinternals forums or a dedicated removal forum as Wilders don't cater for logs or upload it to rapidshare if you like and PM me or CloneRanger(hope that's okay)the link.
     
    Last edited: Nov 9, 2010
  6. Wendi

    Wendi Registered Member

    Joined:
    Aug 8, 2008
    Posts:
    522
    Location:
    NY, USA
    Thanks - I will let it scan again and do that.
     
  7. Wendi

    Wendi Registered Member

    Joined:
    Aug 8, 2008
    Posts:
    522
    Location:
    NY, USA
    Meriadoc, did you read my first post? - I've been experiencing bootup issues!
     
  8. Meriadoc

    Meriadoc Registered Member

    Joined:
    Mar 28, 2006
    Posts:
    2,642
    Location:
    Cymru
    Hi Wendi, up your log file here - no need to make an account - and PM me the link.
     
  9. Wendi

    Wendi Registered Member

    Joined:
    Aug 8, 2008
    Posts:
    522
    Location:
    NY, USA
    You've got mail... ;)
     
  10. Meriadoc

    Meriadoc Registered Member

    Joined:
    Mar 28, 2006
    Posts:
    2,642
    Location:
    Cymru
  11. Wendi

    Wendi Registered Member

    Joined:
    Aug 8, 2008
    Posts:
    522
    Location:
    NY, USA
    Just to update you all, after my last post I shutdown my PC for a few hours. Later on when I went back to it, it wouldn't boot (reporting that Windows\System32\System was either missing or corrupt).

    This time I couldn't even boot into safe-mode and when I told that to my girlfriend she sent her husband (a software engineer) over to checkout my PC. I'm not really sure how he repaired it, but I do know that he used my Windows XP CD to do it. He told me that my bootup problems were definitely due to a corrupted registry. He then scanned my system with Hitman Pro and MBAM, neither of which found any serious infections (just tracking cookies).

    I've been using Advanced SystemCare Pro (daily) to cleanup my PC and he believes that it was deleting important registry items! He advised me not to use ASCP anymore (nor any other registry cleaner!) and see if my bootup problems go away.

    I have since restarted Windows several times - so far, so good...

    Wendi
     
    Last edited: Nov 10, 2010
  12. Aaron Here

    Aaron Here Registered Member

    Joined:
    Jun 4, 2006
    Posts:
    1,205
    Location:
    USA
    Very sound advice - imho reg cleaners do a lot more harm than good (and for that matter, I'm not convinced any of them do any good).

    Btw, glad to hear all is now working well.
     
    Last edited: Nov 10, 2010
  13. CloneRanger

    CloneRanger Registered Member

    Joined:
    Jan 4, 2006
    Posts:
    4,833
    Hi Wendi, glad you got it sorted, see my PM reply to yours :thumb:
     
  14. Wendi

    Wendi Registered Member

    Joined:
    Aug 8, 2008
    Posts:
    522
    Location:
    NY, USA
    After my friend's husband advised me against using registry cleaners I removed ASCP. Since then I have shutdown, booted-up, and restarted several times - so far all is well. :)
     
  15. Osaban

    Osaban Registered Member

    Joined:
    Apr 11, 2005
    Posts:
    4,222
    It is good that a friend helped you out. Perhaps in the future you ought to try to image your system as in my experience this is the only remedy to mistakes that we all make paradoxically trying to improve our computer efficiency. Something odd happens, you can't boot, a recovery CD and some ten minutes later your computer is alive again.
     
  16. Meriadoc

    Meriadoc Registered Member

    Joined:
    Mar 28, 2006
    Posts:
    2,642
    Location:
    Cymru
    Hi Wendi, it didn't sound like you had a rootkit from your description and as you know the log showed they were f/ps from your antivirus. Glad your sorted, pmed you.
     
  17. Aaron Here

    Aaron Here Registered Member

    Joined:
    Jun 4, 2006
    Posts:
    1,205
    Location:
    USA
    Wendi, I enthusiastically 2nd Osban's good advice. While discontinuing use of reg cleaners may prevent repeats of your booting issues, you never know when something else will mess-up your system! There is nothing as secure as having a recent system backup (disk-image on an external hard drive) which would allow you to recover from just about any malady. :thumb:
     
  18. Meriadoc

    Meriadoc Registered Member

    Joined:
    Mar 28, 2006
    Posts:
    2,642
    Location:
    Cymru
    Sound advice there guys:thumb:
     
Thread Status:
Not open for further replies.