MBR rootkit on external hard drives

Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Want a New HP LaserJet MFP? Trade in your old printer and receive $1,000 in savings!
Trade in your old printer and receive up to $1,000 in saving on a new HP LaserJet Multifunction Printer. Click here for savings!

BleepingComputer.com > Security > Virus, Trojan, Spyware, and Malware Removal Logs

Forum Guidelines

Read the following topic before creating a new topic in this forum. It contains instructions on the what we would like you to post, which will enable us to help you more quickly.

Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help

DO NOT RUN ComboFix unless requested to.

Only members of the Malware Response Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log.

When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc.

Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.

MBR rootkit on external hard drives

Options

nerak View Member Profile	Jan 6 2010, 07:30 PM Post #1
New Member Group: Members Posts: 7 Joined: 23-December 09 Member No.: 422,299	My elderly laptop suffered three waves of Trojans and rootkits (one of them was TDSS.rootkit) and is now in a state where it will only boot into the Windows Recovery Console. I was about to get a new one anyway, and my data had been backed up to external hard drives, so I will most likely wipe the old machine. But before I transfer any data to the new machine, I want to make sure the external drives are clean. But it appears they may both have an MBR rootkit. All scans are being run from another old machine that does not appear to be infected, as far as I can tell. What I need help with is cleaning up the external drives. I had run RootRepeal on both and had to restart the computer before I had a chance to post the logs, and upon restarting Windows informed me that D: was "dirty" and proceeded to make some disk repairs. I am including the RootRepeal scans from before and after the restart in case the "before" scan is of any use to anyone. Thanks in advance, Karen DDS (Ver_09-12-01.01) - NTFSx86 Run by Karen at 18:35:00.98 on Mon 01/04/2010 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.767.124 [GMT -8:00] AV: avast! antivirus 4.8.1368 [VPS 100104-0] On-access scanning enabled (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup C:\WINDOWS\System32\S24EvMon.exe svchost.exe svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\RegSrvc.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\Program Files\IT Connection Manager\SRUserService.exe C:\WINDOWS\System32\svchost.exe -k imgsvc c:\WINDOWS\system32\ZuneBusEnum.exe C:\Program Files\Windows Home Server\WHSConnector.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\ZCfgSvc.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\1XConfig.exe C:\WINDOWS\BCMSMMSG.exe C:\Program Files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\System32\DSentry.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe C:\Program Files\Microsoft IntelliPoint\point32.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Zune\ZuneLauncher.exe C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Karen\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = about:blank uDefault_Page_URL = hxxp://www.dell4me.com/myway uInternet Connection Wizard,ShellNext = hxxp://www.dell4me.com/myway BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll BHO: del.icio.us Toolbar Helper: {7aa07ae6-01ef-44ec-93ca-9d7cd41ccdb6} - c:\program files\del.icio.us\internet explorer buttons\dlcsIE.dll BHO: BrowserHelper Class: {9a065c65-4ee7-4ddd-9918-f129089a894a} - c:\program files\windows home server\WHSDeskBands.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.1125.0\msneshellx.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: Microsoft Web Test Recorder 9.0 Helper: {e31ce47f-c268-41ba-897b-b415e613947d} - c:\program files\microsoft visual studio 9.0\common7\ide\privateassemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO90.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll BHO: {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - No File TB: {BA52B914-B692-46c4-B683-905236F6F655} - No File TB: del.icio.us: {981fe6a8-260c-4930-960f-c3bc82746cb0} - c:\program files\del.icio.us\internet explorer buttons\dlcsIE.dll TB: Home Server Banner: {d73e76a3-f902-45bd-8fc8-95ae8e014671} - c:\program files\windows home server\WHSDeskBands.dll TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.1125.0\msneshellx.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File EB: Web Test Recorder 9.0: {3c7adade-d1e8-45d2-bdcd-7f8d8b99b2a2} - mscoree.dll EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File EB: &Research: {ff059e31-cc5a-4e2e-bf3b-96e929d65503} - c:\progra~1\mi1933~1\office12\REFIEBAR.DLL uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe" uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe mRun: [Apoint] c:\program files\apoint\Apoint.exe mRun: [BCMSMMSG] BCMSMMSG.exe mRun: [PRONoMgr.exe] c:\program files\intel\prosetwireless\ncs\proset\PRONoMgr.exe mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe mRun: [UpdateManager] "c:\program files\common files\sonic\update manager\sgtray.exe" /r mRun: [DVDSentry] c:\windows\system32\DSentry.exe mRun: [PCMService] "c:\program files\dell\media experience\PCMService.exe" mRun: [mmtask] c:\program files\musicmatch\musicmatch jukebox\mmtask.exe mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\point32.exe" mRun: [gemstrmw] c:\windows\system32\gemstrmw.exe /r mRun: [Microsoft Works Update Detection] c:\program files\common files\microsoft shared\works shared\WkUFind.exe mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe" mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [Zune Launcher] "c:\program files\zune\ZuneLauncher.exe" mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\WINDOW~1.LNK - IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office12\EXCEL.EXE/3000 IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\mi1933~1\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office12\REFIEBAR.DLL DPF: {01010200-5E80-11D8-9E86-0007E96C65AE} - hxxps://ra.qwest.com/sdccommon/download/tgctlins.cab DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} - hxxp://support.dell.com/systemprofiler/SysPro.CAB DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} - hxxp://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader5.cab DPF: {0DB074F0-617E-4EE9-912C-2965CF2AA5A4} - hxxp://download.microsoft.com/download/0/f/b/0fb0fab9-7f09-4bb6-86d8-8e791ba99ac5/VirtualEarth3D.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/5/b/0/5b0d4654-aa20-495c-b89f-c1c34c691085/LegitCheckControl.cab DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} - hxxp://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab DPF: {3D19135C-6D38-44AD-80F0-D9318F48726D} - hxxp://rcps1.onvoip.net/commpilot/customcontrols/BwOutlook.CAB DPF: {3DC2E31C-371A-4BD3-9A27-CDF57CE604CF} - hxxp://moneycentral.msn.com/cabs/pmupd806.exe DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc2.cab DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://www.costcophotocenter.com/CostcoActivia.cab DPF: {4BFC73A6-F8AE-42B3-AAEC-792C3CF0B418} - hxxp://sg60.oar.net/VCGSU.CAB DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://bin.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://spaces.msn.com//PhotoUpload/MsnPUpld.cab DPF: {544EB377-350A-4295-9BEB-EAB8392E09C6} - hxxp://fdl.msn.com/public/investor/v13/invinstl.exe DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} - hxxp://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader.cab DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1143695995500 DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} - hxxp://zone.msn.com/bingame/amun/default/mjolauncher.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {90051A81-3018-4826-8B38-DD60B6B53F9C} - hxxp://www.costcophotocenter.com/CostcoUpload.cab DPF: {963BE66B-121D-4E6C-BF9F-1A774D9A2E41} - hxxp://moneycentral.msn.com/cabs/webinst.exe DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} - hxxp://www.crucial.com/controls/cpcScanner.cab DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - hxxp://bin.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,21/mcgdmgr.cab DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_08-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} - hxxp://zone.msn.com/binframework/v10/StProxy.cab55579.cab DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} - hxxp://zone.msn.com/bingame/hsol/default/SCEWebLauncher.cab DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - hxxp://zone.msn.com/bingame/popcaploader_v10.cab DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} - hxxp://fdl.msn.com/zone/datafiles/heartbeat.cab DPF: {FF3C5A9F-5A99-4930-80E8-4709194C2AD3} - hxxp://zone.msn.com/bingame/zpagames/ZPA_Backgammon.cab64162.cab Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll Notify: AtiExtEvent - Ati2evxx.dll Notify: Sebring - c:\windows\system32\LgNotify.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\karen\applic~1\mozilla\firefox\profiles\obv2pnm4.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - about:blank FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll FF - plugin: c:\program files\virtual earth 3d\npVE3D.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} ============= SERVICES / DRIVERS =============== R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-11-19 114768] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-11-19 20560] R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2009-11-19 138680] R2 SRUserService;IT Connection Manager;c:\program files\it connection manager\SRUserService.exe [2005-5-26 260232] R2 WHSConnector;Windows Home Server Connector Service;c:\program files\windows home server\WHSConnector.exe [2009-4-20 335728] R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592] R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2009-11-19 254040] R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2009-11-19 352920] R3 OZSCR;O2Micro SmartCardBus Smartcard Reader;c:\windows\system32\drivers\ozscr.sys [1979-12-31 92550] S2 gupdate1ca6cc0e5923760;Google Update Service (gupdate1ca6cc0e5923760);c:\program files\google\update\GoogleUpdate.exe [2009-11-23 133104] S3 GEMPCC;Gemplus GemPC400 PCMCIA Smart Card Reader;c:\windows\system32\drivers\gempcc.sys [2004-10-8 18464] S3 GPR400;GEMPLUS GPR400 PCMCIA Smart Card Reader;c:\windows\system32\drivers\gpr400.sys [2004-10-8 17408] S3 VSPerfDrv90;Performance Tools Driver 9.0;c:\program files\microsoft visual studio 9.0\team tools\performance tools\VSPerfDrv90.sys [2007-9-4 55664] S4 msvsmon80;Visual Studio 2005 Remote Debugger;"c:\program files\microsoft visual studio 8\common7\ide\remote debugger\x86\msvsmon.exe" /service msvsmon80 --> c:\program files\microsoft visual studio 8\common7\ide\remote debugger\x86\msvsmon.exe [?] =============== Created Last 30 ================ 2010-01-04 01:21:52 0 dc----w- c:\program files\Trend Micro ==================== Find3M ==================== 2009-11-03 04:42:06 195456 -c----w- c:\windows\system32\MpSigStub.exe 2009-10-29 07:45:38 916480 -c--a-w- c:\windows\system32\wininet.dll 2009-10-21 05:38:36 75776 -c--a-w- c:\windows\system32\strmfilt.dll 2009-10-21 05:38:36 25088 -c--a-w- c:\windows\system32\httpapi.dll 2009-10-13 10:30:16 270336 -c--a-w- c:\windows\system32\oakley.dll 2009-10-12 13:38:19 149504 -c--a-w- c:\windows\system32\rastls.dll 2009-10-12 13:38:18 79872 -c--a-w- c:\windows\system32\raschap.dll 2009-10-11 12:17:27 411368 -c--a-w- c:\windows\system32\deploytk.dll 2008-09-05 05:34:27 32768 -csha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008090420080905\index.dat ============= FINISH: 18:38:12.10 =============== RootRepeal log before restarting: ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2010/01/04 18:45 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP3 ================================================== Drivers ------------------- Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xAD2A8000 Size: 98304 File Visible: No Signed: - Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xF7A6F000 Size: 8192 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xA9468000 Size: 49152 File Visible: No Signed: - Status: - Hidden/Locked Files ------------------- Path: C:\hiberfil.sys Status: Locked to the Windows API! Path: C:\Documents and Settings\Karen\Cookies\topic281706[1].htm Status: Locked to the Windows API! Path: c:\documents and settings\networkservice\ietldcache\index.dat Status: Allocation size mismatch (API: 45056, Raw: 53248) Path: c:\documents and settings\karen\local settings\temp\~df4642.tmp Status: Allocation size mismatch (API: 4096, Raw: 0) Path: c:\documents and settings\karen\local settings\temp\~df5321.tmp Status: Allocation size mismatch (API: 4096, Raw: 16384) Path: c:\documents and settings\karen\local settings\temp\~df2582.tmp Status: Allocation size mismatch (API: 4096, Raw: 0) Path: c:\documents and settings\karen\local settings\temp\~df2944.tmp Status: Allocation size mismatch (API: 4096, Raw: 16384) Path: c:\documents and settings\karen\local settings\temp\~dfcebf.tmp Status: Allocation size mismatch (API: 4096, Raw: 0) Path: c:\documents and settings\karen\local settings\temp\~dfd2a4.tmp Status: Allocation size mismatch (API: 4096, Raw: 0) Path: c:\documents and settings\karen\local settings\temp\~dfd35d.tmp Status: Allocation size mismatch (API: 4096, Raw: 0) Path: c:\documents and settings\networkservice\local settings\temp\cookies\index.dat Status: Allocation size mismatch (API: 4096, Raw: 16384) Path: c:\documents and settings\karen\local settings\temporary internet files\content.ie5\2l6nnute\3055-8022_4-10227353[1].html Status: Allocation size mismatch (API: 16384, Raw: 4096) Path: c:\documents and settings\karen\local settings\temporary internet files\content.ie5\81a592uj\topic281706[1].htm Status: Allocation size mismatch (API: 126976, Raw: 151552) Path: c:\documents and settings\karen\local settings\temporary internet files\content.ie5\9um1x76m\t239348[1].htm Status: Allocation size mismatch (API: 8192, Raw: 4096) Path: c:\documents and settings\karen\local settings\temporary internet files\content.ie5\aszjnz01\search[1].htm Status: Allocation size mismatch (API: 8192, Raw: 4096) Path: c:\documents and settings\karen\local settings\temporary internet files\content.ie5\eyns6n0a\3000-2239_4-10019223[1].html Status: Allocation size mismatch (API: 40960, Raw: 12288) Path: c:\documents and settings\networkservice\local settings\temp\history\history.ie5\index.dat Status: Allocation size mismatch (API: 4096, Raw: 16384) Path: Volume D:\ Status: MBR Rootkit Detected! Path: Volume D:\, Sector 62 Status: Sector mismatch Path: D:\ƒ9”;My.ass Status: Invisible to the Windows API! Path: D:\ƒ9”;My.ass\…¡ÎüÿÇEè. Status: Invisible to the Windows API! Path: D:\ƒ9”;My.ass\ÿéÍ% Status: Invisible to the Windows API! Path: Volume F:\ Status: MBR Rootkit Detected! Path: Volume F:\, Sector 1 Status: Sector mismatch Path: Volume F:\, Sector 2 Status: Sector mismatch Path: Volume F:\, Sector 3 Status: Sector mismatch Path: Volume F:\, Sector 4 Status: Sector mismatch Path: Volume F:\, Sector 5 Status: Sector mismatch Path: Volume F:\, Sector 6 Status: Sector mismatch Path: Volume F:\, Sector 7 Status: Sector mismatch Path: Volume F:\, Sector 8 Status: Sector mismatch Path: Volume F:\, Sector 9 Status: Sector mismatch Path: Volume F:\, Sector 10 Status: Sector mismatch Path: Volume F:\, Sector 11 Status: Sector mismatch Path: Volume F:\, Sector 12 Status: Sector mismatch Path: Volume F:\, Sector 13 Status: Sector mismatch Path: Volume F:\, Sector 14 Status: Sector mismatch Path: Volume F:\, Sector 15 Status: Sector mismatch Path: Volume F:\, Sector 16 Status: Sector mismatch Path: Volume F:\, Sector 17 Status: Sector mismatch Path: Volume F:\, Sector 18 Status: Sector mismatch Path: Volume F:\, Sector 19 Status: Sector mismatch Path: Volume F:\, Sector 20 Status: Sector mismatch Path: Volume F:\, Sector 21 Status: Sector mismatch Path: Volume F:\, Sector 22 Status: Sector mismatch Path: Volume F:\, Sector 23 Status: Sector mismatch Path: Volume F:\, Sector 24 Status: Sector mismatch Path: Volume F:\, Sector 25 Status: Sector mismatch Path: Volume F:\, Sector 26 Status: Sector mismatch Path: Volume F:\, Sector 27 Status: Sector mismatch Path: Volume F:\, Sector 28 Status: Sector mismatch Path: Volume F:\, Sector 29 Status: Sector mismatch Path: Volume F:\, Sector 30 Status: Sector mismatch Path: Volume F:\, Sector 31 Status: Sector mismatch Path: Volume F:\, Sector 32 Status: Sector mismatch Path: Volume F:\, Sector 33 Status: Sector mismatch Path: Volume F:\, Sector 34 Status: Sector mismatch Path: Volume F:\, Sector 35 Status: Sector mismatch Path: Volume F:\, Sector 36 Status: Sector mismatch Path: Volume F:\, Sector 37 Status: Sector mismatch Path: Volume F:\, Sector 38 Status: Sector mismatch Path: Volume F:\, Sector 39 Status: Sector mismatch Path: Volume F:\, Sector 40 Status: Sector mismatch Path: Volume F:\, Sector 41 Status: Sector mismatch Path: Volume F:\, Sector 42 Status: Sector mismatch Path: Volume F:\, Sector 43 Status: Sector mismatch Path: Volume F:\, Sector 44 Status: Sector mismatch Path: Volume F:\, Sector 45 Status: Sector mismatch Path: Volume F:\, Sector 46 Status: Sector mismatch Path: Volume F:\, Sector 47 Status: Sector mismatch Path: Volume F:\, Sector 48 Status: Sector mismatch Path: Volume F:\, Sector 49 Status: Sector mismatch Path: Volume F:\, Sector 50 Status: Sector mismatch Path: Volume F:\, Sector 51 Status: Sector mismatch Path: Volume F:\, Sector 52 Status: Sector mismatch Path: Volume F:\, Sector 53 Status: Sector mismatch Path: Volume F:\, Sector 54 Status: Sector mismatch Path: Volume F:\, Sector 55 Status: Sector mismatch Path: Volume F:\, Sector 56 Status: Sector mismatch Path: Volume F:\, Sector 57 Status: Sector mismatch Path: Volume F:\, Sector 58 Status: Sector mismatch Path: Volume F:\, Sector 59 Status: Sector mismatch Path: Volume F:\, Sector 60 Status: Sector mismatch Path: Volume F:\, Sector 61 Status: Sector mismatch Path: Volume F:\, Sector 62 Status: Sector mismatch Path: F:\.Trashes Status: Visible to the Windows API, but not on disk. Path: F:\autorun Status: Visible to the Windows API, but not on disk. Path: F:\System Volume Information Status: Visible to the Windows API, but not on disk. Path: F:\Karen Documents Status: Visible to the Windows API, but not on disk. Path: F:\Hdrive Status: Visible to the Windows API, but not on disk. Path: F:\New Status: Visible to the Windows API, but not on disk. Path: F:\autorun.inf.txt Status: Visible to the Windows API, but not on disk. Path: F:\Recycled Status: Visible to the Windows API, but not on disk. Path: F:\email copy Status: Visible to the Windows API, but not on disk. Path: F:\Ian Status: Visible to the Windows API, but not on disk. Path: F:\Kirov Orchestra-Valery Gergiev Status: Visible to the Windows API, but not on disk. Path: F:\dissertation Status: Visible to the Windows API, but not on disk. Path: F:\40 Status: Visible to the Windows API, but not on disk. Path: F:\My Music Status: Visible to the Windows API, but not on disk. Path: F:\SDRG Status: Visible to the Windows API, but not on disk. Path: F:\Chronolog.doc Status: Visible to the Windows API, but not on disk. Path: F:\mediation.doc Status: Visible to the Windows API, but not on disk. Path: F:\ParadiseBeach_RU_090629.zip Status: Visible to the Windows API, but not on disk. Path: F:\temp Status: Visible to the Windows API, but not on disk. Path: F:\Robot.Chicken.Star.Wars.Episode.II.PDTV.XviD-aAF.avi Status: Visible to the Windows API, but not on disk. Path: F:\Nouvelle Vague Status: Visible to the Windows API, but not on disk. Path: F:\Depesha.rar Status: Visible to the Windows API, but not on disk. Path: F:\П.Т.В.П Status: Visible to the Windows API, but not on disk. Path: F:\Кино Status: Visible to the Windows API, but not on disk. Path: F:\Ленинград Status: Visible to the Windows API, but not on disk. Path: F:\Photos4Karen Status: Visible to the Windows API, but not on disk. Path: F:\UBCD4WinV350.exe Status: Visible to the Windows API, but not on disk. Path: F:\UBCD4Win Status: Visible to the Windows API, but not on disk. Path: F:\ComboFix.exe Status: Visible to the Windows API, but not on disk. SSDT ------------------- #: 025 Function Name: NtClose Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba88f6b8 #: 041 Function Name: NtCreateKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba88f574 #: 065 Function Name: NtDeleteValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba88fa52 #: 068 Function Name: NtDuplicateObject Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba88f14c #: 119 Function Name: NtOpenKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba88f64e #: 122 Function Name: NtOpenProcess Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba88f08c #: 128 Function Name: NtOpenThread Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba88f0f0 #: 177 Function Name: NtQueryValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba88f76e #: 204 Function Name: NtRestoreKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba88f72e #: 247 Function Name: NtSetValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba88f8ae ==EOF== RootRepeal log after restarting: ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2010/01/05 15:08 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP3 ================================================== Drivers ------------------- Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xAD3D9000 Size: 98304 File Visible: No Signed: - Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xF79C9000 Size: 8192 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xAA48C000 Size: 49152 File Visible: No Signed: - Status: - Hidden/Locked Files ------------------- Path: C:\hiberfil.sys Status: Locked to the Windows API! Path: c:\windows\temp\perflib_perfdata_32c.dat Status: Allocation size mismatch (API: 4096, Raw: 16384) Path: Volume D:\ Status: MBR Rootkit Detected! Path: Volume D:\, Sector 62 Status: Sector mismatch Path: D:\p Status: Invisible to the Windows API! Path: D:\FOUND.000 Status: Visible to the Windows API, but not on disk. Path: D:\autorun.inf Status: Visible to the Windows API, but not on disk. Path: D:\Install.ini Status: Visible to the Windows API, but not on disk. Path: D:\JSTART.exe Status: Visible to the Windows API, but not on disk. Path: D:\Launcher.exe Status: Visible to the Windows API, but not on disk. Path: D:\Setup.exe Status: Visible to the Windows API, but not on disk. Path: D:\WDInstaller.xml Status: Visible to the Windows API, but not on disk. Path: D:\WDSetup.exe Status: Visible to the Windows API, but not on disk. Path: D:\WDSync.exe Status: Visible to the Windows API, but not on disk. Path: D:\WD_Windows_Tools Status: Visible to the Windows API, but not on disk. Path: D:\WD_Mac_Tools Status: Visible to the Windows API, but not on disk. Path: D:\MioNet Status: Visible to the Windows API, but not on disk. Path: D:\Documentation Status: Visible to the Windows API, but not on disk. Path: D:\autorun Status: Visible to the Windows API, but not on disk. Path: D:\Install.log Status: Visible to the Windows API, but not on disk. Path: D:\wdEULA.log Status: Visible to the Windows API, but not on disk. Path: D:\wdstatus.log Status: Visible to the Windows API, but not on disk. Path: D:\System Volume Information Status: Visible to the Windows API, but not on disk. Path: D:\WD Sync Data Status: Visible to the Windows API, but not on disk. Path: D:\backup Status: Visible to the Windows API, but not on disk. Path: D:\ForGene Status: Visible to the Windows API, but not on disk. Path: D:\Recycled Status: Visible to the Windows API, but not on disk. Path: D:\p\x¯U€ Status: Invisible to the Windows API! Path: D:\p\P Status: Invisible to the Windows API! Path: Volume F:\ Status: MBR Rootkit Detected! Path: Volume F:\, Sector 1 Status: Sector mismatch Path: Volume F:\, Sector 2 Status: Sector mismatch Path: Volume F:\, Sector 3 Status: Sector mismatch Path: Volume F:\, Sector 4 Status: Sector mismatch Path: Volume F:\, Sector 5 Status: Sector mismatch Path: Volume F:\, Sector 7 Status: Sector mismatch Path: Volume F:\, Sector 8 Status: Sector mismatch Path: Volume F:\, Sector 9 Status: Sector mismatch Path: Volume F:\, Sector 10 Status: Sector mismatch Path: Volume F:\, Sector 11 Status: Sector mismatch Path: Volume F:\, Sector 12 Status: Sector mismatch Path: Volume F:\, Sector 13 Status: Sector mismatch Path: Volume F:\, Sector 14 Status: Sector mismatch Path: Volume F:\, Sector 15 Status: Sector mismatch Path: Volume F:\, Sector 16 Status: Sector mismatch Path: Volume F:\, Sector 17 Status: Sector mismatch Path: Volume F:\, Sector 18 Status: Sector mismatch Path: Volume F:\, Sector 19 Status: Sector mismatch Path: Volume F:\, Sector 20 Status: Sector mismatch Path: Volume F:\, Sector 21 Status: Sector mismatch Path: Volume F:\, Sector 22 Status: Sector mismatch Path: Volume F:\, Sector 23 Status: Sector mismatch Path: Volume F:\, Sector 24 Status: Sector mismatch Path: Volume F:\, Sector 25 Status: Sector mismatch Path: Volume F:\, Sector 26 Status: Sector mismatch Path: Volume F:\, Sector 27 Status: Sector mismatch Path: Volume F:\, Sector 28 Status: Sector mismatch Path: Volume F:\, Sector 29 Status: Sector mismatch Path: Volume F:\, Sector 30 Status: Sector mismatch Path: Volume F:\, Sector 31 Status: Sector mismatch Path: Volume F:\, Sector 32 Status: Sector mismatch Path: Volume F:\, Sector 33 Status: Sector mismatch Path: Volume F:\, Sector 35 Status: Sector mismatch Path: Volume F:\, Sector 36 Status: Sector mismatch Path: Volume F:\, Sector 37 Status: Sector mismatch Path: Volume F:\, Sector 38 Status: Sector mismatch Path: Volume F:\, Sector 39 Status: Sector mismatch Path: Volume F:\, Sector 40 Status: Sector mismatch Path: Volume F:\, Sector 41 Status: Sector mismatch Path: Volume F:\, Sector 42 Status: Sector mismatch Path: Volume F:\, Sector 43 Status: Sector mismatch Path: Volume F:\, Sector 44 Status: Sector mismatch Path: Volume F:\, Sector 45 Status: Sector mismatch Path: Volume F:\, Sector 46 Status: Sector mismatch Path: Volume F:\, Sector 47 Status: Sector mismatch Path: Volume F:\, Sector 49 Status: Sector mismatch Path: Volume F:\, Sector 50 Status: Sector mismatch Path: Volume F:\, Sector 51 Status: Sector mismatch Path: Volume F:\, Sector 52 Status: Sector mismatch Path: Volume F:\, Sector 53 Status: Sector mismatch Path: Volume F:\, Sector 56 Status: Sector mismatch Path: Volume F:\, Sector 57 Status: Sector mismatch Path: Volume F:\, Sector 58 Status: Sector mismatch Path: Volume F:\, Sector 59 Status: Sector mismatch Path: Volume F:\, Sector 60 Status: Sector mismatch Path: Volume F:\, Sector 61 Status: Sector mismatch Path: Volume F:\, Sector 62 Status: Sector mismatch Path: F:\.Trashes Status: Visible to the Windows API, but not on disk. Path: F:\autorun Status: Visible to the Windows API, but not on disk. Path: F:\System Volume Information Status: Visible to the Windows API, but not on disk. Path: F:\Karen Documents Status: Visible to the Windows API, but not on disk. Path: F:\Hdrive Status: Visible to the Windows API, but not on disk. Path: F:\New Status: Visible to the Windows API, but not on disk. Path: F:\autorun.inf.txt Status: Visible to the Windows API, but not on disk. Path: F:\Recycled Status: Visible to the Windows API, but not on disk. Path: F:\email copy Status: Visible to the Windows API, but not on disk. Path: F:\Ian Status: Visible to the Windows API, but not on disk. Path: F:\Kirov Orchestra-Valery Gergiev Status: Visible to the Windows API, but not on disk. Path: F:\dissertation Status: Visible to the Windows API, but not on disk. Path: F:\40 Status: Visible to the Windows API, but not on disk. Path: F:\My Music Status: Visible to the Windows API, but not on disk. Path: F:\SDRG Status: Visible to the Windows API, but not on disk. Path: F:\Chronolog.doc Status: Visible to the Windows API, but not on disk. Path: F:\mediation.doc Status: Visible to the Windows API, but not on disk. Path: F:\ParadiseBeach_RU_090629.zip Status: Visible to the Windows API, but not on disk. Path: F:\temp Status: Visible to the Windows API, but not on disk. Path: F:\Robot.Chicken.Star.Wars.Episode.II.PDTV.XviD-aAF.avi Status: Visible to the Windows API, but not on disk. Path: F:\Nouvelle Vague Status: Visible to the Windows API, but not on disk. Path: F:\Depesha.rar Status: Visible to the Windows API, but not on disk. Path: F:\П.Т.В.П Status: Visible to the Windows API, but not on disk. Path: F:\Кино Status: Visible to the Windows API, but not on disk. Path: F:\Ленинград Status: Visible to the Windows API, but not on disk. Path: F:\Photos4Karen Status: Visible to the Windows API, but not on disk. Path: F:\UBCD4WinV350.exe Status: Visible to the Windows API, but not on disk. Path: F:\UBCD4Win Status: Visible to the Windows API, but not on disk. Path: F:\ComboFix.exe Status: Visible to the Windows API, but not on disk. SSDT ------------------- #: 025 Function Name: NtClose Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba95c6b8 #: 041 Function Name: NtCreateKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba95c574 #: 065 Function Name: NtDeleteValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba95ca52 #: 068 Function Name: NtDuplicateObject Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba95c14c #: 119 Function Name: NtOpenKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba95c64e #: 122 Function Name: NtOpenProcess Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba95c08c #: 128 Function Name: NtOpenThread Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba95c0f0 #: 177 Function Name: NtQueryValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba95c76e #: 204 Function Name: NtRestoreKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba95c72e #: 247 Function Name: NtSetValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba95c8ae ==EOF== And for good measure (because I saw someone else with an MBR rootkit was asked for one), an MBR log from Gmer and a Gmer scan: Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully kernel: MBR read successfully user & kernel MBR OK GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-01-04 23:15:30 Windows 5.1.2600 Service Pack 3 Running: gmer.exe; Driver: C:\DOCUME~1\Karen\LOCALS~1\Temp\awtdypob.sys ---- System - GMER 1.0.15 ---- SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0xBA88F6B8] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0xBA88F574] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0xBA88FA52] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDuplicateObject [0xBA88F14C] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0xBA88F64E] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenProcess [0xBA88F08C] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenThread [0xBA88F0F0] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0xBA88F76E] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0xBA88F72E] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0xBA88F8AE] Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateProcessEx [0xBA89882E] Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateSection [0xBA898678] Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwLoadDriver [0xBA8987AC] Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) NtCreateSection ---- Devices - GMER 1.0.15 ---- Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/ALWIL Software) AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software) AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software) AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software) AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software) AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software) AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation) AttachedDevice \FileSystem\Fastfat \Fat aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software) ---- Registry - GMER 1.0.15 ---- Reg HKLM\SOFTWARE\Classes\CLSID\{2DA93FC2-192D-002B-F974-1CAF66C808E2}\InprocHandler32@ ole32.dll Reg HKLM\SOFTWARE\Classes\CLSID\{2DA93FC2-192D-002B-F974-1CAF66C808E2}\InProcServer32@Assembly Microsoft.Office.Interop.Word, Version=11.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c Reg HKLM\SOFTWARE\Classes\CLSID\{2DA93FC2-192D-002B-F974-1CAF66C808E2}\InProcServer32@Class Microsoft.Office.Interop.Word.ApplicationClass Reg HKLM\SOFTWARE\Classes\CLSID\{2DA93FC2-192D-002B-F974-1CAF66C808E2}\InProcServer32@RuntimeVersion v1.1.4322 Reg HKLM\SOFTWARE\Classes\CLSID\{2DA93FC2-192D-002B-F974-1CAF66C808E2}\InProcServer32\11.0.0.0 Reg HKLM\SOFTWARE\Classes\CLSID\{2DA93FC2-192D-002B-F974-1CAF66C808E2}\InProcServer32\11.0.0.0@Class Microsoft.Office.Interop.Word.ApplicationClass Reg HKLM\SOFTWARE\Classes\CLSID\{2DA93FC2-192D-002B-F974-1CAF66C808E2}\InProcServer32\11.0.0.0@RuntimeVersion v1.1.4322 Reg HKLM\SOFTWARE\Classes\CLSID\{2DA93FC2-192D-002B-F974-1CAF66C808E2}\InProcServer32\11.0.0.0@Assembly Microsoft.Office.Interop.Word, Version=11.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c Reg HKLM\SOFTWARE\Classes\CLSID\{2DA93FC2-192D-002B-F974-1CAF66C808E2}\LocalServer32@ C:\PROGRA~1\MI1933~1\OFFICE11\WINWORD.EXE /Automation Reg HKLM\SOFTWARE\Classes\CLSID\{2DA93FC2-192D-002B-F974-1CAF66C808E2}\LocalServer32@LocalServer32 ']gAVn-}f(ZXfeAR6.jiWORDFiles>P`os,1@SW=P7v6GPl]Xh /Automation? Reg HKLM\SOFTWARE\Classes\CLSID\{2DA93FC2-192D-002B-F974-1CAF66C808E2}\ProgID@ Word.Application.11 Reg HKLM\SOFTWARE\Classes\CLSID\{2DA93FC2-192D-002B-F974-1CAF66C808E2}\VersionIndependentProgID@ Word.Application Reg HKLM\SOFTWARE\Classes\CLSID\{7068F753-86F0-CAA4-2F34-A44A63EC61C9}\InprocServer32@Class Microsoft.Office.Interop.Publisher.ApplicationClass Reg HKLM\SOFTWARE\Classes\CLSID\{7068F753-86F0-CAA4-2F34-A44A63EC61C9}\InprocServer32@Assembly Microsoft.Office.Interop.Publisher, Version=11.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c Reg HKLM\SOFTWARE\Classes\CLSID\{7068F753-86F0-CAA4-2F34-A44A63EC61C9}\InprocServer32@RuntimeVersion v1.1.4322 Reg HKLM\SOFTWARE\Classes\CLSID\{7068F753-86F0-CAA4-2F34-A44A63EC61C9}\InprocServer32\11.0.0.0 Reg HKLM\SOFTWARE\Classes\CLSID\{7068F753-86F0-CAA4-2F34-A44A63EC61C9}\InprocServer32\11.0.0.0@Class Microsoft.Office.Interop.Publisher.ApplicationClass Reg HKLM\SOFTWARE\Classes\CLSID\{7068F753-86F0-CAA4-2F34-A44A63EC61C9}\InprocServer32\11.0.0.0@Assembly Microsoft.Office.Interop.Publisher, Version=11.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c Reg HKLM\SOFTWARE\Classes\CLSID\{7068F753-86F0-CAA4-2F34-A44A63EC61C9}\InprocServer32\11.0.0.0@RuntimeVersion v1.1.4322 Reg HKLM\SOFTWARE\Classes\CLSID\{7068F753-86F0-CAA4-2F34-A44A63EC61C9}\LocalServer32@ C:\PROGRA~1\MI1933~1\OFFICE11\MSPUB.EXE /Automation Reg HKLM\SOFTWARE\Classes\CLSID\{7068F753-86F0-CAA4-2F34-A44A63EC61C9}\LocalServer32@LocalServer32 ']gAVn-}f(ZXfeAR6.jiPubPrimary>dic+V~SM09P_'_@$%)xK /Automation? Reg HKLM\SOFTWARE\Classes\CLSID\{7068F753-86F0-CAA4-2F34-A44A63EC61C9}\NotInsertable@ Reg HKLM\SOFTWARE\Classes\CLSID\{7068F753-86F0-CAA4-2F34-A44A63EC61C9}\ProgID@ Publisher.Application.11 Reg HKLM\SOFTWARE\Classes\CLSID\{7068F753-86F0-CAA4-2F34-A44A63EC61C9}\Programmable@ Reg HKLM\SOFTWARE\Classes\CLSID\{7068F753-86F0-CAA4-2F34-A44A63EC61C9}\TypeLib@ {0002123C-0000-0000-C000-000000000046} Reg HKLM\SOFTWARE\Classes\CLSID\{7068F753-86F0-CAA4-2F34-A44A63EC61C9}\VersionIndependentProgID@ Publisher.Application Reg HKLM\SOFTWARE\Classes\CLSID\{942D82A5-DA03-640B-5E19-3CBD62700780}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} Reg HKLM\SOFTWARE\Classes\CLSID\{942D82A5-DA03-640B-5E19-3CBD62700780}\InprocServer32@ C:\Program Files\Microsoft AntiSpyware\gcAntiSpywareLibrary.dll Reg HKLM\SOFTWARE\Classes\CLSID\{942D82A5-DA03-640B-5E19-3CBD62700780}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{942D82A5-DA03-640B-5E19-3CBD62700780}\ProgID@ gcAntiSpywareLibrary.System Reg HKLM\SOFTWARE\Classes\CLSID\{942D82A5-DA03-640B-5E19-3CBD62700780}\TypeLib@ {6B64D109-9674-4D70-8E63-EE0F9A7C9436} Reg HKLM\SOFTWARE\Classes\CLSID\{942D82A5-DA03-640B-5E19-3CBD62700780}\VERSION@ 1.0 Reg HKLM\SOFTWARE\Classes\CLSID\{9890B33A-40C2-F9F0-A467-8C93174CDA20}\InProcServer32@ C:\WINDOWS\system32\msxml4.dll Reg HKLM\SOFTWARE\Classes\CLSID\{9890B33A-40C2-F9F0-A467-8C93174CDA20}\InProcServer32@ThreadingModel Both Reg HKLM\SOFTWARE\Classes\CLSID\{A2E9832F-4060-CF57-1A71-85123E949025}\InprocServer32@ C:\Program Files\Common Files\System\ado\msado15.dll Reg HKLM\SOFTWARE\Classes\CLSID\{A2E9832F-4060-CF57-1A71-85123E949025}\InprocServer32@ThreadingModel Both Reg HKLM\SOFTWARE\Classes\CLSID\{A2E9832F-4060-CF57-1A71-85123E949025}\ProgID@ ADODB.Recordset.2.8 Reg HKLM\SOFTWARE\Classes\CLSID\{A2E9832F-4060-CF57-1A71-85123E949025}\VersionIndependentProgID@ ADODB.Recordset Reg HKLM\SOFTWARE\Classes\CLSID\{E553DAF6-FCA6-C8B7-70AE-3045F402CE4A}\AuxUserType\2 Reg HKLM\SOFTWARE\Classes\CLSID\{E553DAF6-FCA6-C8B7-70AE-3045F402CE4A}\AuxUserType\2@ MIDI Sequence Reg HKLM\SOFTWARE\Classes\CLSID\{E553DAF6-FCA6-C8B7-70AE-3045F402CE4A}\DataFormats\DefaultSet Reg HKLM\SOFTWARE\Classes\CLSID\{E553DAF6-FCA6-C8B7-70AE-3045F402CE4A}\DataFormats\DefaultSet@ MIDFile Reg HKLM\SOFTWARE\Classes\CLSID\{E553DAF6-FCA6-C8B7-70AE-3045F402CE4A}\DataFormats\GetSet Reg HKLM\SOFTWARE\Classes\CLSID\{E553DAF6-FCA6-C8B7-70AE-3045F402CE4A}\DataFormats\GetSet\0 Reg HKLM\SOFTWARE\Classes\CLSID\{E553DAF6-FCA6-C8B7-70AE-3045F402CE4A}\DataFormats\GetSet\0@ Embed Source,1,8,1 Reg HKLM\SOFTWARE\Classes\CLSID\{E553DAF6-FCA6-C8B7-70AE-3045F402CE4A}\DataFormats\GetSet\1 Reg HKLM\SOFTWARE\Classes\CLSID\{E553DAF6-FCA6-C8B7-70AE-3045F402CE4A}\DataFormats\GetSet\1@ 3,1,32,1 Reg HKLM\SOFTWARE\Classes\CLSID\{E553DAF6-FCA6-C8B7-70AE-3045F402CE4A}\DataFormats\GetSet\2 Reg HKLM\SOFTWARE\Classes\CLSID\{E553DAF6-FCA6-C8B7-70AE-3045F402CE4A}\DataFormats\GetSet\2@ 8,1,1,1 Reg HKLM\SOFTWARE\Classes\CLSID\{E553DAF6-FCA6-C8B7-70AE-3045F402CE4A}\DefaultIcon@ mplay32.exe,5 Reg HKLM\SOFTWARE\Classes\CLSID\{E553DAF6-FCA6-C8B7-70AE-3045F402CE4A}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} Reg HKLM\SOFTWARE\Classes\CLSID\{E553DAF6-FCA6-C8B7-70AE-3045F402CE4A}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}@ Reg HKLM\SOFTWARE\Classes\CLSID\{E553DAF6-FCA6-C8B7-70AE-3045F402CE4A}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} Reg HKLM\SOFTWARE\Classes\CLSID\{E553DAF6-FCA6-C8B7-70AE-3045F402CE4A}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}@ Reg HKLM\SOFTWARE\Classes\CLSID\{E553DAF6-FCA6-C8B7-70AE-3045F402CE4A}\InprocHandler32@ ole32.dll Reg HKLM\SOFTWARE\Classes\CLSID\{E553DAF6-FCA6-C8B7-70AE-3045F402CE4A}\Insertable@ Reg HKLM\SOFTWARE\Classes\CLSID\{E553DAF6-FCA6-C8B7-70AE-3045F402CE4A}\LocalServer@ mplay32.exe /mid Reg HKLM\SOFTWARE\Classes\CLSID\{E553DAF6-FCA6-C8B7-70AE-3045F402CE4A}\LocalServer32@ mplay32.exe /mid Reg HKLM\SOFTWARE\Classes\CLSID\{E553DAF6-FCA6-C8B7-70AE-3045F402CE4A}\MiscStatus@ 0 Reg HKLM\SOFTWARE\Classes\CLSID\{E553DAF6-FCA6-C8B7-70AE-3045F402CE4A}\PersistentHandler@ {098f2470-bae0-11cd-b579-08002b30bfeb} Reg HKLM\SOFTWARE\Classes\CLSID\{E553DAF6-FCA6-C8B7-70AE-3045F402CE4A}\ProgID@ MIDFile Reg HKLM\SOFTWARE\Classes\CLSID\{E553DAF6-FCA6-C8B7-70AE-3045F402CE4A}\verb\0 Reg HKLM\SOFTWARE\Classes\CLSID\{E553DAF6-FCA6-C8B7-70AE-3045F402CE4A}\verb\0@ &Play,0,3 Reg HKLM\SOFTWARE\Classes\CLSID\{E553DAF6-FCA6-C8B7-70AE-3045F402CE4A}\verb\1 Reg HKLM\SOFTWARE\Classes\CLSID\{E553DAF6-FCA6-C8B7-70AE-3045F402CE4A}\verb\1@ &Edit,0,2 Reg HKLM\SOFTWARE\Classes\CLSID\{E553DAF6-FCA6-C8B7-70AE-3045F402CE4A}\verb\2 Reg HKLM\SOFTWARE\Classes\CLSID\{E553DAF6-FCA6-C8B7-70AE-3045F402CE4A}\verb\2@ &Open,0,2 ---- Files - GMER 1.0.15 ---- File C:\Program Files\Java\jre1.5.0_08\lib\cmm\CIEXYZ.pf 51236 bytes File C:\Program Files\Java\jre1.5.0_08\lib\cmm\GRAY.pf 632 bytes File C:\Program Files\Java\jre1.5.0_08\lib\cmm\LINEAR_RGB.pf 1044 bytes File C:\Program Files\Java\jre1.5.0_08\lib\cmm\sRGB.pf 150368 bytes File C:\Program Files\Java\jre1.5.0_08\lib\ext\dnsns.jar 8176 bytes File C:\Program Files\Java\jre1.5.0_08\lib\ext\localedata.jar 797269 bytes File C:\Program Files\Java\jre1.5.0_08\lib\ext\sunjce_provider.jar 158417 bytes File C:\Program Files\Java\jre1.5.0_08\lib\ext\sunpkcs11.jar 175811 bytes File C:\Program Files\Java\jre1.5.0_08\lib\im\indicim.jar 10233 bytes File C:\Program Files\Java\jre1.5.0_08\lib\im\thaiim.jar 7945 bytes File C:\Program Files\Java\jre1.5.0_08\lib\images\cursors 0 bytes File C:\Program Files\Java\jre1.5.0_08\lib\images\cursors\cursors.properties 1318 bytes File C:\Program Files\Java\jre1.5.0_08\lib\images\cursors\invalid32x32.gif 153 bytes File C:\Program Files\Java\jre1.5.0_08\lib\images\cursors\win32_CopyDrop32x32.gif 165 bytes File C:\Program Files\Java\jre1.5.0_08\lib\images\cursors\win32_CopyNoDrop32x32.gif 153 bytes File C:\Program Files\Java\jre1.5.0_08\lib\images\cursors\win32_LinkDrop32x32.gif 168 bytes File C:\Program Files\Java\jre1.5.0_08\lib\images\cursors\win32_LinkNoDrop32x32.gif 153 bytes File C:\Program Files\Java\jre1.5.0_08\lib\images\cursors\win32_MoveDrop32x32.gif 147 bytes File C:\Program Files\Java\jre1.5.0_08\lib\images\cursors\win32_MoveNoDrop32x32.gif 153 bytes ---- EOF - GMER 1.0.15 ----

Blind Faith View Member Profile	Jan 14 2010, 09:21 AM Post #2
Bleeping Cookie Group: Malware Study Hall Senior Posts: 1,880 Joined: 15-October 08 From: I don't know. Member No.: 246,867	Hello and welcome to Bleeping Computer! We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here. If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far. Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware. If you have already posted a DDS log, please do so again, as your situation may have changed. Use the 'Add Reply' and add the new log to this thread. Thanks and again sorry for the delay. We need to see some information about what is happening in your machine. Please perform the following scan: Download DDS by sUBs from one of the following links. Save it to your desktop. DDS.scr DDS.pif Double click on the DDS icon, allow it to run. A small box will open, with an explaination about the tool. No input is needed, the scan is running. Notepad will open with the results. Follow the instructions that pop up for posting the results. Close the program window, and delete the program from your desktop. Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet. Information on A/V control HERE Elle -------------------- Can you hear it?It's all around! Tomar ki manè acchè? Yadi thakè, tahalè Ki kshama kartè paro? If I haven't replied in 48 hours, please feel free to send me a PM. Member of the *Bleeping Computer* A.I.I. early response team!

nerak View Member Profile	Jan 19 2010, 01:54 AM Post #3
New Member Group: Members Posts: 7 Joined: 23-December 09 Member No.: 422,299	New DDS scan: DDS (Ver_09-12-01.01) - NTFSx86 Run by Karen at 22:45:17.02 on Mon 01/18/2010 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.767.216 [GMT -8:00] AV: avast! antivirus 4.8.1368 [VPS 100118-1] On-access scanning enabled (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup C:\WINDOWS\System32\S24EvMon.exe svchost.exe svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\ZCfgSvc.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\BCMSMMSG.exe C:\Program Files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\System32\DSentry.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe C:\Program Files\Microsoft IntelliPoint\point32.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\RegSrvc.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\Program Files\IT Connection Manager\SRUserService.exe C:\WINDOWS\System32\svchost.exe -k imgsvc c:\WINDOWS\system32\ZuneBusEnum.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\Windows Home Server\WHSConnector.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\1XConfig.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Karen\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = about:blank uDefault_Page_URL = hxxp://www.dell4me.com/myway uInternet Connection Wizard,ShellNext = hxxp://www.dell4me.com/myway BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll BHO: del.icio.us Toolbar Helper: {7aa07ae6-01ef-44ec-93ca-9d7cd41ccdb6} - c:\program files\del.icio.us\internet explorer buttons\dlcsIE.dll BHO: BrowserHelper Class: {9a065c65-4ee7-4ddd-9918-f129089a894a} - c:\program files\windows home server\WHSDeskBands.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.1125.0\msneshellx.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: Microsoft Web Test Recorder 9.0 Helper: {e31ce47f-c268-41ba-897b-b415e613947d} - c:\program files\microsoft visual studio 9.0\common7 \ide\privateassemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO90.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll BHO: {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - No File TB: {BA52B914-B692-46c4-B683-905236F6F655} - No File TB: del.icio.us: {981fe6a8-260c-4930-960f-c3bc82746cb0} - c:\program files\del.icio.us\internet explorer buttons\dlcsIE.dll TB: Home Server Banner: {d73e76a3-f902-45bd-8fc8-95ae8e014671} - c:\program files\windows home server\WHSDeskBands.dll TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.1125.0\msneshellx.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File EB: Web Test Recorder 9.0: {3c7adade-d1e8-45d2-bdcd-7f8d8b99b2a2} - mscoree.dll EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File EB: &Research: {ff059e31-cc5a-4e2e-bf3b-96e929d65503} - c:\progra~1\mi1933~1\office12\REFIEBAR.DLL uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe" uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe mRun: [Apoint] c:\program files\apoint\Apoint.exe mRun: [BCMSMMSG] BCMSMMSG.exe mRun: [PRONoMgr.exe] c:\program files\intel\prosetwireless\ncs\proset\PRONoMgr.exe mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe mRun: [UpdateManager] "c:\program files\common files\sonic\update manager\sgtray.exe" /r mRun: [DVDSentry] c:\windows\system32\DSentry.exe mRun: [PCMService] "c:\program files\dell\media experience\PCMService.exe" mRun: [mmtask] c:\program files\musicmatch\musicmatch jukebox\mmtask.exe mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\point32.exe" mRun: [gemstrmw] c:\windows\system32\gemstrmw.exe /r mRun: [Microsoft Works Update Detection] c:\program files\common files\microsoft shared\works shared\WkUFind.exe mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe" mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [Zune Launcher] "c:\program files\zune\ZuneLauncher.exe" mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\WINDOW~1.LNK - IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office12\EXCEL.EXE/3000 IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\mi1933~1\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office12\REFIEBAR.DLL DPF: {01010200-5E80-11D8-9E86-0007E96C65AE} - hxxps://ra.qwest.com/sdccommon/download/tgctlins.cab DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} - hxxp://support.dell.com/systemprofiler/SysPro.CAB DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} - hxxp://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader5.cab DPF: {0DB074F0-617E-4EE9-912C-2965CF2AA5A4} - hxxp://download.microsoft.com/download/0/f/b/0fb0fab9-7f09-4bb6-86d8-8e791ba99ac5/VirtualEarth3D.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/5/b/0/5b0d4654-aa20-495c-b89f-c1c34c691085/LegitCheckControl.cab DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} - hxxp://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab DPF: {3D19135C-6D38-44AD-80F0-D9318F48726D} - hxxp://rcps1.onvoip.net/commpilot/customcontrols/BwOutlook.CAB DPF: {3DC2E31C-371A-4BD3-9A27-CDF57CE604CF} - hxxp://moneycentral.msn.com/cabs/pmupd806.exe DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc2.cab DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} - hxxp://www.costcophotocenter.com/CostcoActivia.cab DPF: {4BFC73A6-F8AE-42B3-AAEC-792C3CF0B418} - hxxp://sg60.oar.net/VCGSU.CAB DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://bin.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://spaces.msn.com//PhotoUpload/MsnPUpld.cab DPF: {544EB377-350A-4295-9BEB-EAB8392E09C6} - hxxp://fdl.msn.com/public/investor/v13/invinstl.exe DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} - hxxp://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader.cab DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1143695995500 DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} - hxxp://zone.msn.com/bingame/amun/default/mjolauncher.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {90051A81-3018-4826-8B38-DD60B6B53F9C} - hxxp://www.costcophotocenter.com/CostcoUpload.cab DPF: {963BE66B-121D-4E6C-BF9F-1A774D9A2E41} - hxxp://moneycentral.msn.com/cabs/webinst.exe DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} - hxxp://www.crucial.com/controls/cpcScanner.cab DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - hxxp://bin.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,21/mcgdmgr.cab DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_08-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} - hxxp://zone.msn.com/binframework/v10/StProxy.cab55579.cab DPF: {DAF5D9A2-D982-4671-83E4-0398706A5F6A} - hxxp://zone.msn.com/bingame/hsol/default/SCEWebLauncher.cab DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - hxxp://zone.msn.com/bingame/popcaploader_v10.cab DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} - hxxp://fdl.msn.com/zone/datafiles/heartbeat.cab DPF: {FF3C5A9F-5A99-4930-80E8-4709194C2AD3} - hxxp://zone.msn.com/bingame/zpagames/ZPA_Backgammon.cab64162.cab Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll Notify: AtiExtEvent - Ati2evxx.dll Notify: Sebring - c:\windows\system32\LgNotify.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\karen\applic~1\mozilla\firefox\profiles\obv2pnm4.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - about:blank FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll FF - plugin: c:\program files\virtual earth 3d\npVE3D.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} ============= SERVICES / DRIVERS =============== R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-11-19 114768] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-11-19 20560] R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2009-11-19 138680] R2 SRUserService;IT Connection Manager;c:\program files\it connection manager\SRUserService.exe [2005-5-26 260232] R2 WHSConnector;Windows Home Server Connector Service;c:\program files\windows home server\WHSConnector.exe [2009-4-20 335728] R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592] R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2009-11-19 254040] R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2009-11-19 352920] R3 OZSCR;O2Micro SmartCardBus Smartcard Reader;c:\windows\system32\drivers\ozscr.sys [1979-12-31 92550] S2 gupdate1ca6cc0e5923760;Google Update Service (gupdate1ca6cc0e5923760);c:\program files\google\update\GoogleUpdate.exe [2009-11-23 133104] S3 GEMPCC;Gemplus GemPC400 PCMCIA Smart Card Reader;c:\windows\system32\drivers\gempcc.sys [2004-10-8 18464] S3 GPR400;GEMPLUS GPR400 PCMCIA Smart Card Reader;c:\windows\system32\drivers\gpr400.sys [2004-10-8 17408] S3 VSPerfDrv90;Performance Tools Driver 9.0;c:\program files\microsoft visual studio 9.0\team tools\performance tools\VSPerfDrv90.sys [2007-9-4 55664] S4 msvsmon80;Visual Studio 2005 Remote Debugger;"c:\program files\microsoft visual studio 8\common7\ide\remote debugger\x86\msvsmon.exe" /service msvsmon80 --> c:\program files\microsoft visual studio 8\common7\ide\remote debugger\x86\msvsmon.exe [?] =============== Created Last 30 ================ 2010-01-14 03:33:41 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll 2010-01-04 01:21:52 0 dc----w- c:\program files\Trend Micro ==================== Find3M ==================== 2010-01-14 19:12:06 181120 -c----w- c:\windows\system32\MpSigStub.exe 2009-10-29 07:45:38 916480 -c--a-w- c:\windows\system32\wininet.dll 2008-09-05 05:34:27 32768 -csha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008090420080905\index.dat ============= FINISH: 22:46:46.05 =============== Attached File(s) Attach.zip ( 4.67k ) Number of downloads: 9

sundavis View Member Profile	Jan 19 2010, 12:35 PM Post #4
Forum Addict Group: Malware Response Team Posts: 2,097 Joined: 11-August 07 Member No.: 149,370	Hi nerak, Welcome to BleepingComputer HijackThis Logs and Malware Removal, My name is sundavis, I will be helping you to deal with your Malware problems today. Step1 Start RootRepeal from your desktop, and rescan your computer as instructed in this thread . When done, click Files tap in the bottom right and locate File Path: Volume D:\ and Status: MBR Rootkit Detected! Right click Volume D:\ , and select Restore and Reboot Immediately as instructed in this thread . Repeat the process with Volume F:\ . After that, rescan the computer and post the contents in your next reply. Step2 Go to this thread and Download TDSSKiller.zip to your Desktop. Extract its contents to your desktop and drag TDSSKiller.exe on the desktop, not in the folder. Start > Run and copy/paste the following bolded command into run box and hit Enter. "%userprofile%\Desktop\TDSSKiller.exe" -l C:\TDSSKiller.txt -v If TDSSKiller alerts you that the system needs to reboot, please consent. When done, a log file should be created on your C: drive named "TDSSKiller.txt" please copy and paste the contents in your next reply. In your next reply, please post back: 1.RootRepeal log 2.TDSSKiller log Thanks

nerak View Member Profile	Jan 24 2010, 11:32 PM Post #5
New Member Group: Members Posts: 7 Joined: 23-December 09 Member No.: 422,299	RootRepeal log: ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2010/01/19 22:22 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP3 ================================================== Drivers ------------------- Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xAE3D8000 Size: 98304 File Visible: No Signed: - Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xF7A25000 Size: 8192 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xAA4F5000 Size: 49152 File Visible: No Signed: - Status: - Hidden/Locked Files ------------------- Path: C:\hiberfil.sys Status: Locked to the Windows API! Path: c:\documents and settings\karen\local settings\temp\~df8105.tmp Status: Allocation size mismatch (API: 16384, Raw: 0) Path: c:\documents and settings\karen\local settings\temporary internet files\content.ie5\index.dat Status: Allocation size mismatch (API: 2113536, Raw: 2117632) Path: c:\documents and settings\karen\local settings\temporary internet files\content.ie5\t149k963\solutions[1].htm Status: Allocation size mismatch (API: 20480, Raw: 4096) Path: Volume D:\ Status: MBR Rootkit Detected! Path: Volume D:\, Sector 62 Status: Sector mismatch Path: D:\FOUND.000 Status: Visible to the Windows API, but not on disk. Path: D:\autorun.inf Status: Visible to the Windows API, but not on disk. Path: D:\Install.ini Status: Visible to the Windows API, but not on disk. Path: D:\JSTART.exe Status: Visible to the Windows API, but not on disk. Path: D:\Launcher.exe Status: Visible to the Windows API, but not on disk. Path: D:\Setup.exe Status: Visible to the Windows API, but not on disk. Path: D:\WDInstaller.xml Status: Visible to the Windows API, but not on disk. Path: D:\WDSetup.exe Status: Visible to the Windows API, but not on disk. Path: D:\WDSync.exe Status: Visible to the Windows API, but not on disk. Path: D:\WD_Windows_Tools Status: Visible to the Windows API, but not on disk. Path: D:\WD_Mac_Tools Status: Visible to the Windows API, but not on disk. Path: D:\MioNet Status: Visible to the Windows API, but not on disk. Path: D:\Documentation Status: Visible to the Windows API, but not on disk. Path: D:\autorun Status: Visible to the Windows API, but not on disk. Path: D:\Install.log Status: Visible to the Windows API, but not on disk. Path: D:\wdEULA.log Status: Visible to the Windows API, but not on disk. Path: D:\wdstatus.log Status: Visible to the Windows API, but not on disk. Path: D:\System Volume Information Status: Visible to the Windows API, but not on disk. Path: D:\WD Sync Data Status: Visible to the Windows API, but not on disk. Path: D:\backup Status: Visible to the Windows API, but not on disk. Path: D:\ForGene Status: Visible to the Windows API, but not on disk. Path: D:\Recycled Status: Visible to the Windows API, but not on disk. Path: Volume F:\ Status: MBR Rootkit Detected! Path: Volume F:\, Sector 1 Status: Sector mismatch Path: Volume F:\, Sector 2 Status: Sector mismatch Path: Volume F:\, Sector 3 Status: Sector mismatch Path: Volume F:\, Sector 5 Status: Sector mismatch Path: Volume F:\, Sector 6 Status: Sector mismatch Path: Volume F:\, Sector 7 Status: Sector mismatch Path: Volume F:\, Sector 8 Status: Sector mismatch Path: Volume F:\, Sector 9 Status: Sector mismatch Path: Volume F:\, Sector 11 Status: Sector mismatch Path: Volume F:\, Sector 12 Status: Sector mismatch Path: Volume F:\, Sector 13 Status: Sector mismatch Path: Volume F:\, Sector 14 Status: Sector mismatch Path: Volume F:\, Sector 15 Status: Sector mismatch Path: Volume F:\, Sector 16 Status: Sector mismatch Path: Volume F:\, Sector 19 Status: Sector mismatch Path: Volume F:\, Sector 20 Status: Sector mismatch Path: Volume F:\, Sector 21 Status: Sector mismatch Path: Volume F:\, Sector 22 Status: Sector mismatch Path: Volume F:\, Sector 23 Status: Sector mismatch Path: Volume F:\, Sector 25 Status: Sector mismatch Path: Volume F:\, Sector 26 Status: Sector mismatch Path: Volume F:\, Sector 27 Status: Sector mismatch Path: Volume F:\, Sector 28 Status: Sector mismatch Path: Volume F:\, Sector 29 Status: Sector mismatch Path: Volume F:\, Sector 30 Status: Sector mismatch Path: Volume F:\, Sector 31 Status: Sector mismatch Path: Volume F:\, Sector 32 Status: Sector mismatch Path: Volume F:\, Sector 33 Status: Sector mismatch Path: Volume F:\, Sector 34 Status: Sector mismatch Path: Volume F:\, Sector 35 Status: Sector mismatch Path: Volume F:\, Sector 36 Status: Sector mismatch Path: Volume F:\, Sector 37 Status: Sector mismatch Path: Volume F:\, Sector 38 Status: Sector mismatch Path: Volume F:\, Sector 39 Status: Sector mismatch Path: Volume F:\, Sector 40 Status: Sector mismatch Path: Volume F:\, Sector 41 Status: Sector mismatch Path: Volume F:\, Sector 42 Status: Sector mismatch Path: Volume F:\, Sector 44 Status: Sector mismatch Path: Volume F:\, Sector 45 Status: Sector mismatch Path: Volume F:\, Sector 46 Status: Sector mismatch Path: Volume F:\, Sector 47 Status: Sector mismatch Path: Volume F:\, Sector 48 Status: Sector mismatch Path: Volume F:\, Sector 49 Status: Sector mismatch Path: Volume F:\, Sector 50 Status: Sector mismatch Path: Volume F:\, Sector 51 Status: Sector mismatch Path: Volume F:\, Sector 52 Status: Sector mismatch Path: Volume F:\, Sector 53 Status: Sector mismatch Path: Volume F:\, Sector 54 Status: Sector mismatch Path: Volume F:\, Sector 55 Status: Sector mismatch Path: Volume F:\, Sector 56 Status: Sector mismatch Path: Volume F:\, Sector 57 Status: Sector mismatch Path: Volume F:\, Sector 58 Status: Sector mismatch Path: Volume F:\, Sector 59 Status: Sector mismatch Path: Volume F:\, Sector 60 Status: Sector mismatch Path: Volume F:\, Sector 61 Status: Sector mismatch Path: Volume F:\, Sector 62 Status: Sector mismatch Path: F:\.Trashes Status: Visible to the Windows API, but not on disk. Path: F:\autorun Status: Visible to the Windows API, but not on disk. Path: F:\System Volume Information Status: Visible to the Windows API, but not on disk. Path: F:\Karen Documents Status: Visible to the Windows API, but not on disk. Path: F:\Hdrive Status: Visible to the Windows API, but not on disk. Path: F:\New Status: Visible to the Windows API, but not on disk. Path: F:\autorun.inf.txt Status: Visible to the Windows API, but not on disk. Path: F:\Recycled Status: Visible to the Windows API, but not on disk. Path: F:\email copy Status: Visible to the Windows API, but not on disk. Path: F:\Ian Status: Visible to the Windows API, but not on disk. Path: F:\Kirov Orchestra-Valery Gergiev Status: Visible to the Windows API, but not on disk. Path: F:\dissertation Status: Visible to the Windows API, but not on disk. Path: F:\40 Status: Visible to the Windows API, but not on disk. Path: F:\My Music Status: Visible to the Windows API, but not on disk. Path: F:\SDRG Status: Visible to the Windows API, but not on disk. Path: F:\Chronolog.doc Status: Visible to the Windows API, but not on disk. Path: F:\mediation.doc Status: Visible to the Windows API, but not on disk. Path: F:\ParadiseBeach_RU_090629.zip Status: Visible to the Windows API, but not on disk. Path: F:\temp Status: Visible to the Windows API, but not on disk. Path: F:\Robot.Chicken.Star.Wars.Episode.II.PDTV.XviD-aAF.avi Status: Visible to the Windows API, but not on disk. Path: F:\Nouvelle Vague Status: Visible to the Windows API, but not on disk. Path: F:\Depesha.rar Status: Visible to the Windows API, but not on disk. Path: F:\П.Т.В.П Status: Visible to the Windows API, but not on disk. Path: F:\Кино Status: Visible to the Windows API, but not on disk. Path: F:\Ленинград Status: Visible to the Windows API, but not on disk. Path: F:\Photos4Karen Status: Visible to the Windows API, but not on disk. Path: F:\UBCD4WinV350.exe Status: Visible to the Windows API, but not on disk. Path: F:\UBCD4Win Status: Visible to the Windows API, but not on disk. Path: F:\ComboFix.exe Status: Visible to the Windows API, but not on disk. SSDT ------------------- #: 025 Function Name: NtClose Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba1626b8 #: 041 Function Name: NtCreateKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba162574 #: 065 Function Name: NtDeleteValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba162a52 #: 068 Function Name: NtDuplicateObject Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba16214c #: 119 Function Name: NtOpenKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba16264e #: 122 Function Name: NtOpenProcess Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba16208c #: 128 Function Name: NtOpenThread Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba1620f0 #: 177 Function Name: NtQueryValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba16276e #: 204 Function Name: NtRestoreKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba16272e #: 247 Function Name: NtSetValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba1628ae ==EOF== TDSSKiller log: 22:12:09:163 2336 TDSS rootkit removing tool 2.2.2 Jan 13 2010 08:42:25 22:12:09:163 2336 ================================================================================ 22:12:09:163 2336 SystemInfo: 22:12:09:163 2336 OS Version: 5.1.2600 ServicePack: 3.0 22:12:09:163 2336 Product type: Workstation 22:12:09:163 2336 ComputerName: SRA_N1 22:12:09:163 2336 UserName: Karen 22:12:09:163 2336 Windows directory: C:\WINDOWS 22:12:09:163 2336 Processor architecture: Intel x86 22:12:09:163 2336 Number of processors: 1 22:12:09:163 2336 Page size: 0x1000 22:12:09:163 2336 Boot type: Normal boot 22:12:09:163 2336 ================================================================================ 22:12:09:163 2336 UnloadDriverW: NtUnloadDriver error 2 22:12:09:163 2336 ForceUnloadDriverW: UnloadDriverW(klmd21) error 2 22:12:09:163 2336 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\drivers\klmd.sys) returned status 00000000 22:12:09:274 2336 UtilityInit: KLMD drop and load success 22:12:09:274 2336 KLMD_OpenDevice: Trying to open KLMD Device(KLMD201000) 22:12:09:274 2336 UtilityInit: KLMD open success 22:12:09:274 2336 UtilityInit: Initialize success 22:12:09:274 2336 22:12:09:274 2336 Scanning Services ... 22:12:09:274 2336 CreateRegParser: Registry parser init started 22:12:09:274 2336 DisableWow64Redirection: GetProcAddress(Wow64DisableWow64FsRedirection) error 127 22:12:09:274 2336 CreateRegParser: DisableWow64Redirection error 22:12:09:274 2336 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\system 22:12:09:274 2336 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\config\system) returned status C0000043 22:12:09:274 2336 wfopen_ex: MyNtCreateFileW error 32 (C0000043) 22:12:09:274 2336 wfopen_ex: Trying to KLMD file open 22:12:09:274 2336 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\config\system 22:12:09:274 2336 wfopen_ex: File opened ok (Flags 2) 22:12:09:274 2336 CreateRegParser: HIVE_ADAPTER(C:\WINDOWS\system32\config\system) init success: 394EE8 22:12:09:274 2336 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\software 22:12:09:274 2336 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\config\software) returned status C0000043 22:12:09:274 2336 wfopen_ex: MyNtCreateFileW error 32 (C0000043) 22:12:09:274 2336 wfopen_ex: Trying to KLMD file open 22:12:09:274 2336 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\config\software 22:12:09:274 2336 wfopen_ex: File opened ok (Flags 2) 22:12:09:274 2336 CreateRegParser: HIVE_ADAPTER(C:\WINDOWS\system32\config\software) init success: 394DD8 22:12:09:274 2336 EnableWow64Redirection: GetProcAddress(Wow64RevertWow64FsRedirection) error 127 22:12:09:274 2336 CreateRegParser: EnableWow64Redirection error 22:12:09:274 2336 CreateRegParser: RegParser init completed 22:12:10:025 2336 GetAdvancedServicesInfo: Raw services enum returned 387 services 22:12:10:035 2336 fclose_ex: Trying to close file C:\WINDOWS\system32\config\system 22:12:10:035 2336 fclose_ex: Trying to close file C:\WINDOWS\system32\config\software 22:12:10:035 2336 22:12:10:035 2336 Scanning Kernel memory ... 22:12:10:035 2336 KLMD_GetSystemObjectAddressByNameW: Trying to get system object address by name \Driver\Disk 22:12:10:035 2336 DetectCureTDL3: \Driver\Disk PDRIVER_OBJECT: 83BE61E0 22:12:10:035 2336 DetectCureTDL3: KLMD_GetDeviceObjectList returned 7 DevObjects 22:12:10:035 2336 22:12:10:035 2336 DetectCureTDL3: DEVICE_OBJECT: 82A24488 22:12:10:035 2336 KLMD_GetLowerDeviceObject: Trying to get lower device object for 82A24488 22:12:10:035 2336 KLMD_ReadMem: Trying to ReadMemory 0x82A24488[0x38] 22:12:10:035 2336 DetectCureTDL3: DRIVER_OBJECT: 83BE61E0 22:12:10:035 2336 KLMD_ReadMem: Trying to ReadMemory 0x83BE61E0[0xA8] 22:12:10:035 2336 KLMD_ReadMem: Trying to ReadMemory 0xE190A490[0x18] 22:12:10:055 2336 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk 22:12:10:055 2336 DetectCureTDL3: IrpHandler (0) addr: F74F5BB0 22:12:10:055 2336 DetectCureTDL3: IrpHandler (1) addr: 804FA87E 22:12:10:055 2336 DetectCureTDL3: IrpHandler (2) addr: F74F5BB0 22:12:10:055 2336 DetectCureTDL3: IrpHandler (3) addr: F74EFD1F 22:12:10:055 2336 DetectCureTDL3: IrpHandler (4) addr: F74EFD1F 22:12:10:055 2336 DetectCureTDL3: IrpHandler (5) addr: 804FA87E 22:12:10:055 2336 DetectCureTDL3: IrpHandler (6) addr: 804FA87E 22:12:10:055 2336 DetectCureTDL3: IrpHandler (7) addr: 804FA87E 22:12:10:055 2336 DetectCureTDL3: IrpHandler (8) addr: 804FA87E 22:12:10:055 2336 DetectCureTDL3: IrpHandler (9) addr: F74F02E2 22:12:10:055 2336 DetectCureTDL3: IrpHandler (10) addr: 804FA87E 22:12:10:055 2336 DetectCureTDL3: IrpHandler (11) addr: 804FA87E 22:12:10:055 2336 DetectCureTDL3: IrpHandler (12) addr: 804FA87E 22:12:10:055 2336 DetectCureTDL3: IrpHandler (13) addr: 804FA87E 22:12:10:055 2336 DetectCureTDL3: IrpHandler (14) addr: F74F03BB 22:12:10:055 2336 DetectCureTDL3: IrpHandler (15) addr: F74F3F28 22:12:10:055 2336 DetectCureTDL3: IrpHandler (16) addr: F74F02E2 22:12:10:055 2336 DetectCureTDL3: IrpHandler (17) addr: 804FA87E 22:12:10:055 2336 DetectCureTDL3: IrpHandler (18) addr: 804FA87E 22:12:10:055 2336 DetectCureTDL3: IrpHandler (19) addr: 804FA87E 22:12:10:055 2336 DetectCureTDL3: IrpHandler (20) addr: 804FA87E 22:12:10:055 2336 DetectCureTDL3: IrpHandler (21) addr: 804FA87E 22:12:10:055 2336 DetectCureTDL3: IrpHandler (22) addr: F74F1C82 22:12:10:055 2336 DetectCureTDL3: IrpHandler (23) addr: F74F699E 22:12:10:055 2336 DetectCureTDL3: IrpHandler (24) addr: 804FA87E 22:12:10:055 2336 DetectCureTDL3: IrpHandler (25) addr: 804FA87E 22:12:10:055 2336 DetectCureTDL3: IrpHandler (26) addr: 804FA87E 22:12:10:055 2336 TDL3_FileDetect: Processing driver: Disk 22:12:10:055 2336 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\disk.sys 22:12:10:055 2336 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\disk.sys 22:12:10:055 2336 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean 22:12:10:055 2336 22:12:10:055 2336 DetectCureTDL3: DEVICE_OBJECT: 82A64030 22:12:10:055 2336 KLMD_GetLowerDeviceObject: Trying to get lower device object for 82A64030 22:12:10:055 2336 DetectCureTDL3: DEVICE_OBJECT: 82ACA940 22:12:10:055 2336 KLMD_GetLowerDeviceObject: Trying to get lower device object for 82ACA940 22:12:10:055 2336 KLMD_ReadMem: Trying to ReadMemory 0x82ACA940[0x38] 22:12:10:055 2336 DetectCureTDL3: DRIVER_OBJECT: 839D8B10 22:12:10:055 2336 KLMD_ReadMem: Trying to ReadMemory 0x839D8B10[0xA8] 22:12:10:055 2336 KLMD_ReadMem: Trying to ReadMemory 0xE2B6A148[0x1E] 22:12:10:055 2336 DetectCureTDL3: DRIVER_OBJECT name: \Driver\USBSTOR, Driver Name: USBSTOR 22:12:10:055 2336 DetectCureTDL3: IrpHandler (0) addr: BA41F218 22:12:10:055 2336 DetectCureTDL3: IrpHandler (1) addr: 804FA87E 22:12:10:055 2336 DetectCureTDL3: IrpHandler (2) addr: BA41F218 22:12:10:055 2336 DetectCureTDL3: IrpHandler (3) addr: BA41F23C 22:12:10:055 2336 DetectCureTDL3: IrpHandler (4) addr: BA41F23C 22:12:10:055 2336 DetectCureTDL3: IrpHandler (5) addr: 804FA87E 22:12:10:055 2336 DetectCureTDL3: IrpHandler (6) addr: 804FA87E 22:12:10:055 2336 DetectCureTDL3: IrpHandler (7) addr: 804FA87E 22:12:10:055 2336 DetectCureTDL3: IrpHandler (8) addr: 804FA87E 22:12:10:055 2336 DetectCureTDL3: IrpHandler (9) addr: 804FA87E 22:12:10:055 2336 DetectCureTDL3: IrpHandler (10) addr: 804FA87E 22:12:10:055 2336 DetectCureTDL3: IrpHandler (11) addr: 804FA87E 22:12:10:055 2336 DetectCureTDL3: IrpHandler (12) addr: 804FA87E 22:12:10:055 2336 DetectCureTDL3: IrpHandler (13) addr: 804FA87E 22:12:10:055 2336 DetectCureTDL3: IrpHandler (14) addr: BA41F180 22:12:10:055 2336 DetectCureTDL3: IrpHandler (15) addr: BA41A9E6 22:12:10:055 2336 DetectCureTDL3: IrpHandler (16) addr: 804FA87E 22:12:10:055 2336 DetectCureTDL3: IrpHandler (17) addr: 804FA87E 22:12:10:065 2336 DetectCureTDL3: IrpHandler (18) addr: 804FA87E 22:12:10:065 2336 DetectCureTDL3: IrpHandler (19) addr: 804FA87E 22:12:10:065 2336 DetectCureTDL3: IrpHandler (20) addr: 804FA87E 22:12:10:065 2336 DetectCureTDL3: IrpHandler (21) addr: 804FA87E 22:12:10:065 2336 DetectCureTDL3: IrpHandler (22) addr: BA41E5F0 22:12:10:065 2336 DetectCureTDL3: IrpHandler (23) addr: BA41CA6E 22:12:10:065 2336 DetectCureTDL3: IrpHandler (24) addr: 804FA87E 22:12:10:065 2336 DetectCureTDL3: IrpHandler (25) addr: 804FA87E 22:12:10:065 2336 DetectCureTDL3: IrpHandler (26) addr: 804FA87E 22:12:10:065 2336 KLMD_ReadMem: Trying to ReadMemory 0xBA41BF26[0x400] 22:12:10:065 2336 TDL3_StartIoHookDetect: CheckParameters: 0, 00000000, 0 22:12:10:065 2336 TDL3_FileDetect: Processing driver: USBSTOR 22:12:10:065 2336 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 22:12:10:065 2336 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 22:12:10:075 2336 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS - Verdict: Clean 22:12:10:075 2336 22:12:10:075 2336 DetectCureTDL3: DEVICE_OBJECT: 82A59B60 22:12:10:075 2336 KLMD_GetLowerDeviceObject: Trying to get lower device object for 82A59B60 22:12:10:075 2336 KLMD_ReadMem: Trying to ReadMemory 0x82A59B60[0x38] 22:12:10:075 2336 DetectCureTDL3: DRIVER_OBJECT: 83BE61E0 22:12:10:075 2336 KLMD_ReadMem: Trying to ReadMemory 0x83BE61E0[0xA8] 22:12:10:075 2336 KLMD_ReadMem: Trying to ReadMemory 0xE190A490[0x18] 22:12:10:075 2336 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk 22:12:10:075 2336 DetectCureTDL3: IrpHandler (0) addr: F74F5BB0 22:12:10:075 2336 DetectCureTDL3: IrpHandler (1) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (2) addr: F74F5BB0 22:12:10:075 2336 DetectCureTDL3: IrpHandler (3) addr: F74EFD1F 22:12:10:075 2336 DetectCureTDL3: IrpHandler (4) addr: F74EFD1F 22:12:10:075 2336 DetectCureTDL3: IrpHandler (5) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (6) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (7) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (8) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (9) addr: F74F02E2 22:12:10:075 2336 DetectCureTDL3: IrpHandler (10) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (11) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (12) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (13) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (14) addr: F74F03BB 22:12:10:075 2336 DetectCureTDL3: IrpHandler (15) addr: F74F3F28 22:12:10:075 2336 DetectCureTDL3: IrpHandler (16) addr: F74F02E2 22:12:10:075 2336 DetectCureTDL3: IrpHandler (17) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (18) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (19) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (20) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (21) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (22) addr: F74F1C82 22:12:10:075 2336 DetectCureTDL3: IrpHandler (23) addr: F74F699E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (24) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (25) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (26) addr: 804FA87E 22:12:10:075 2336 TDL3_FileDetect: Processing driver: Disk 22:12:10:075 2336 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\disk.sys 22:12:10:075 2336 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\disk.sys 22:12:10:075 2336 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean 22:12:10:075 2336 22:12:10:075 2336 DetectCureTDL3: DEVICE_OBJECT: 82A18840 22:12:10:075 2336 KLMD_GetLowerDeviceObject: Trying to get lower device object for 82A18840 22:12:10:075 2336 DetectCureTDL3: DEVICE_OBJECT: 82A0EEA0 22:12:10:075 2336 KLMD_GetLowerDeviceObject: Trying to get lower device object for 82A0EEA0 22:12:10:075 2336 KLMD_ReadMem: Trying to ReadMemory 0x82A0EEA0[0x38] 22:12:10:075 2336 DetectCureTDL3: DRIVER_OBJECT: 839D8B10 22:12:10:075 2336 KLMD_ReadMem: Trying to ReadMemory 0x839D8B10[0xA8] 22:12:10:075 2336 KLMD_ReadMem: Trying to ReadMemory 0xE2B6A148[0x1E] 22:12:10:075 2336 DetectCureTDL3: DRIVER_OBJECT name: \Driver\USBSTOR, Driver Name: USBSTOR 22:12:10:075 2336 DetectCureTDL3: IrpHandler (0) addr: BA41F218 22:12:10:075 2336 DetectCureTDL3: IrpHandler (1) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (2) addr: BA41F218 22:12:10:075 2336 DetectCureTDL3: IrpHandler (3) addr: BA41F23C 22:12:10:075 2336 DetectCureTDL3: IrpHandler (4) addr: BA41F23C 22:12:10:075 2336 DetectCureTDL3: IrpHandler (5) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (6) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (7) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (8) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (9) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (10) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (11) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (12) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (13) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (14) addr: BA41F180 22:12:10:075 2336 DetectCureTDL3: IrpHandler (15) addr: BA41A9E6 22:12:10:075 2336 DetectCureTDL3: IrpHandler (16) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (17) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (18) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (19) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (20) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (21) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (22) addr: BA41E5F0 22:12:10:075 2336 DetectCureTDL3: IrpHandler (23) addr: BA41CA6E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (24) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (25) addr: 804FA87E 22:12:10:075 2336 DetectCureTDL3: IrpHandler (26) addr: 804FA87E 22:12:10:075 2336 KLMD_ReadMem: Trying to ReadMemory 0xBA41BF26[0x400] 22:12:10:075 2336 TDL3_StartIoHookDetect: CheckParameters: 0, 00000000, 0 22:12:10:075 2336 TDL3_FileDetect: Processing driver: USBSTOR 22:12:10:075 2336 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 22:12:10:075 2336 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 22:12:10:075 2336 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS - Verdict: Clean 22:12:10:075 2336 22:12:10:075 2336 DetectCureTDL3: DEVICE_OBJECT: 83B59C68 22:12:10:085 2336 KLMD_GetLowerDeviceObject: Trying to get lower device object for 83B59C68 22:12:10:085 2336 KLMD_ReadMem: Trying to ReadMemory 0x83B59C68[0x38] 22:12:10:085 2336 DetectCureTDL3: DRIVER_OBJECT: 83BE61E0 22:12:10:085 2336 KLMD_ReadMem: Trying to ReadMemory 0x83BE61E0[0xA8] 22:12:10:085 2336 KLMD_ReadMem: Trying to ReadMemory 0xE190A490[0x18] 22:12:10:085 2336 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk 22:12:10:085 2336 DetectCureTDL3: IrpHandler (0) addr: F74F5BB0 22:12:10:085 2336 DetectCureTDL3: IrpHandler (1) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (2) addr: F74F5BB0 22:12:10:085 2336 DetectCureTDL3: IrpHandler (3) addr: F74EFD1F 22:12:10:085 2336 DetectCureTDL3: IrpHandler (4) addr: F74EFD1F 22:12:10:085 2336 DetectCureTDL3: IrpHandler (5) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (6) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (7) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (8) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (9) addr: F74F02E2 22:12:10:085 2336 DetectCureTDL3: IrpHandler (10) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (11) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (12) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (13) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (14) addr: F74F03BB 22:12:10:085 2336 DetectCureTDL3: IrpHandler (15) addr: F74F3F28 22:12:10:085 2336 DetectCureTDL3: IrpHandler (16) addr: F74F02E2 22:12:10:085 2336 DetectCureTDL3: IrpHandler (17) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (18) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (19) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (20) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (21) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (22) addr: F74F1C82 22:12:10:085 2336 DetectCureTDL3: IrpHandler (23) addr: F74F699E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (24) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (25) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (26) addr: 804FA87E 22:12:10:085 2336 TDL3_FileDetect: Processing driver: Disk 22:12:10:085 2336 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\disk.sys 22:12:10:085 2336 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\disk.sys 22:12:10:085 2336 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean 22:12:10:085 2336 22:12:10:085 2336 DetectCureTDL3: DEVICE_OBJECT: 83BCB9F0 22:12:10:085 2336 KLMD_GetLowerDeviceObject: Trying to get lower device object for 83BCB9F0 22:12:10:085 2336 KLMD_ReadMem: Trying to ReadMemory 0x83BCB9F0[0x38] 22:12:10:085 2336 DetectCureTDL3: DRIVER_OBJECT: 83BE61E0 22:12:10:085 2336 KLMD_ReadMem: Trying to ReadMemory 0x83BE61E0[0xA8] 22:12:10:085 2336 KLMD_ReadMem: Trying to ReadMemory 0xE190A490[0x18] 22:12:10:085 2336 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk 22:12:10:085 2336 DetectCureTDL3: IrpHandler (0) addr: F74F5BB0 22:12:10:085 2336 DetectCureTDL3: IrpHandler (1) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (2) addr: F74F5BB0 22:12:10:085 2336 DetectCureTDL3: IrpHandler (3) addr: F74EFD1F 22:12:10:085 2336 DetectCureTDL3: IrpHandler (4) addr: F74EFD1F 22:12:10:085 2336 DetectCureTDL3: IrpHandler (5) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (6) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (7) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (8) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (9) addr: F74F02E2 22:12:10:085 2336 DetectCureTDL3: IrpHandler (10) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (11) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (12) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (13) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (14) addr: F74F03BB 22:12:10:085 2336 DetectCureTDL3: IrpHandler (15) addr: F74F3F28 22:12:10:085 2336 DetectCureTDL3: IrpHandler (16) addr: F74F02E2 22:12:10:085 2336 DetectCureTDL3: IrpHandler (17) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (18) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (19) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (20) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (21) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (22) addr: F74F1C82 22:12:10:085 2336 DetectCureTDL3: IrpHandler (23) addr: F74F699E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (24) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (25) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (26) addr: 804FA87E 22:12:10:085 2336 TDL3_FileDetect: Processing driver: Disk 22:12:10:085 2336 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\disk.sys 22:12:10:085 2336 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\disk.sys 22:12:10:085 2336 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean 22:12:10:085 2336 22:12:10:085 2336 DetectCureTDL3: DEVICE_OBJECT: 83BCDAB8 22:12:10:085 2336 KLMD_GetLowerDeviceObject: Trying to get lower device object for 83BCDAB8 22:12:10:085 2336 DetectCureTDL3: DEVICE_OBJECT: 83BE4D98 22:12:10:085 2336 KLMD_GetLowerDeviceObject: Trying to get lower device object for 83BE4D98 22:12:10:085 2336 KLMD_ReadMem: Trying to ReadMemory 0x83BE4D98[0x38] 22:12:10:085 2336 DetectCureTDL3: DRIVER_OBJECT: 83BA1388 22:12:10:085 2336 KLMD_ReadMem: Trying to ReadMemory 0x83BA1388[0xA8] 22:12:10:085 2336 KLMD_ReadMem: Trying to ReadMemory 0xE18B5F50[0x1A] 22:12:10:085 2336 DetectCureTDL3: DRIVER_OBJECT name: \Driver\atapi, Driver Name: atapi 22:12:10:085 2336 DetectCureTDL3: IrpHandler (0) addr: F74046F2 22:12:10:085 2336 DetectCureTDL3: IrpHandler (1) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (2) addr: F74046F2 22:12:10:085 2336 DetectCureTDL3: IrpHandler (3) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (4) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (5) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (6) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (7) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (8) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (9) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (10) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (11) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (12) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (13) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (14) addr: F7404712 22:12:10:085 2336 DetectCureTDL3: IrpHandler (15) addr: F7400852 22:12:10:085 2336 DetectCureTDL3: IrpHandler (16) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (17) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (18) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (19) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (20) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (21) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (22) addr: F740473C 22:12:10:085 2336 DetectCureTDL3: IrpHandler (23) addr: F740B336 22:12:10:085 2336 DetectCureTDL3: IrpHandler (24) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (25) addr: 804FA87E 22:12:10:085 2336 DetectCureTDL3: IrpHandler (26) addr: 804FA87E 22:12:10:085 2336 KLMD_ReadMem: Trying to ReadMemory 0xF7401864[0x400] 22:12:10:085 2336 TDL3_StartIoHookDetect: CheckParameters: 0, 00000000, 0 22:12:10:085 2336 TDL3_FileDetect: Processing driver: atapi 22:12:10:085 2336 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\atapi.sys 22:12:10:085 2336 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\atapi.sys 22:12:10:105 2336 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\atapi.sys - Verdict: Clean 22:12:10:105 2336 22:12:10:105 2336 Completed 22:12:10:105 2336 22:12:10:105 2336 Results: 22:12:10:105 2336 Memory objects infected / cured / cured on reboot: 0 / 0 / 0 22:12:10:105 2336 Registry objects infected / cured / cured on reboot: 0 / 0 / 0 22:12:10:105 2336 File objects infected / cured / cured on reboot: 0 / 0 / 0 22:12:10:105 2336 22:12:10:105 2336 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\drivers\klmd.sys) returned status 00000000 22:12:10:105 2336 UtilityDeinit: KLMD(ARK) unloaded successfully

sundavis View Member Profile	Jan 25 2010, 12:33 AM Post #6
Forum Addict Group: Malware Response Team Posts: 2,097 Joined: 11-August 07 Member No.: 149,370	Hi nerak, Please rescan your pc with RootRepeal, click Files tap in the bottom right, and delete any Status: Sector mismatch by right click and select Force Delete in D:\ and F:\ and delete the following: QUOTE Path: D:\Install.ini Status: Visible to the Windows API, but not on disk. Path: D:\JSTART.exe Status: Visible to the Windows API, but not on disk. Path: D:\Launcher.exe Status: Visible to the Windows API, but not on disk. After that, Right click Volume D:\ and F:\ , and select Restore and Reboot Immediately one at a time. Step1 Please download mbr.exe and save it to your desktop and cope this file to your D and F drive. Start button >Run >Type cmd into the run box and press enter, and At the prompt type the following: D: <----Press Enter, it will bring you to D drive. At the D:\ command prompt type in mbr.exe - f (be sure to place a space after "mbr.exe") <---Press Enter Then type Exit <--Press Enter A log file will be produced and found at the root of the HDD were mbr.exe is saved (eg: D:\mbr.txt) Please repeat the process with F drive and post the contents in your next reply. Step2 If you already have Combofix, please delete that copy and download it again as it's being updated regularly. Please visit this webpage for download links, and instructions for running the tool: http://www.bleepingcomputer.com/combofix/how-to-use-combofix Note: CombFix has recently been updated to include the option for installing the Recovery Console automatically. The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. Close/disable all antivirus and antimalware programs so they do not interfere with the running of ComboFix. Click Yes to allow Combofix to continue scanning for malware. When done, a log will be produced (or locate it in C:\ComboFix.txt). Please post that log in your next reply. Do not mouse click on Combofix while it is running. That may cause it to stall. In your next reply, please post back: 1.RootRepeal log 2.MBR log 3.ComboFix log Thanks

nerak View Member Profile	Jan 27 2010, 09:19 PM Post #7
New Member Group: Members Posts: 7 Joined: 23-December 09 Member No.: 422,299	Hi Sundavis, I'm not sure I understood these instructions: "Please rescan your pc with RootRepeal, click Files tap in the bottom right, and delete any Status: Sector mismatch by right click and select Force Delete in D:\ and F:\ and delete the following:" I did manage to delete the three files that were specified, but if you wanted me to delete things like Volume D:\,Sector 62, with a status of Sector Mismatch, I was unable to do so. Right-clicking on those rows in the Files tab didn't give me a menu. I do get an error when I start RootRepeal: Error - invalid PE image found! I tried downloading a fresh copy of RootRepeal, but I get the same error. I was able to do everything else. Logs follow: ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2010/01/27 15:39 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP3 ================================================== Drivers ------------------- Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xAEDF3000 Size: 98304 File Visible: No Signed: - Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xAF234000 Size: 8192 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xABCCC000 Size: 49152 File Visible: No Signed: - Status: - Hidden/Locked Files ------------------- Path: C:\hiberfil.sys Status: Locked to the Windows API! Path: c:\windows\temp\perflib_perfdata_7e8.dat Status: Allocation size mismatch (API: 4096, Raw: 0) Path: c:\documents and settings\karen\local settings\temp\~df23c8.tmp Status: Allocation size mismatch (API: 4096, Raw: 0) Path: c:\documents and settings\karen\local settings\temp\~df2501.tmp Status: Allocation size mismatch (API: 4096, Raw: 0) Path: c:\documents and settings\karen\local settings\temp\~df9997.tmp Status: Allocation size mismatch (API: 16384, Raw: 0) Path: c:\documents and settings\karen\local settings\temp\~dfacff.tmp Status: Allocation size mismatch (API: 16384, Raw: 0) Path: c:\documents and settings\karen\local settings\temporary internet files\content.ie5\pqaya5rs\ads[1].htm Status: Allocation size mismatch (API: 8192, Raw: 4096) Path: c:\documents and settings\karen\local settings\application data\microsoft\internet explorer\recovery\active\{deec2fc4-0b9c-11df-a19b-000e35279845}.dat Status: Allocation size mismatch (API: 20480, Raw: 12288) Path: Volume D:\ Status: MBR Rootkit Detected! Path: Volume D:\, Sector 62 Status: Sector mismatch Path: D:\FOUND.000 Status: Visible to the Windows API, but not on disk. Path: D:\Setup.exe Status: Visible to the Windows API, but not on disk. Path: D:\WDInstaller.xml Status: Visible to the Windows API, but not on disk. Path: D:\WDSetup.exe Status: Visible to the Windows API, but not on disk. Path: D:\WDSync.exe Status: Visible to the Windows API, but not on disk. Path: D:\WD_Windows_Tools Status: Visible to the Windows API, but not on disk. Path: D:\WD_Mac_Tools Status: Visible to the Windows API, but not on disk. Path: D:\MioNet Status: Visible to the Windows API, but not on disk. Path: D:\Documentation Status: Visible to the Windows API, but not on disk. Path: D:\autorun Status: Visible to the Windows API, but not on disk. Path: D:\Install.log Status: Visible to the Windows API, but not on disk. Path: D:\wdEULA.log Status: Visible to the Windows API, but not on disk. Path: D:\wdstatus.log Status: Visible to the Windows API, but not on disk. Path: D:\System Volume Information Status: Visible to the Windows API, but not on disk. Path: D:\WD Sync Data Status: Visible to the Windows API, but not on disk. Path: D:\backup Status: Visible to the Windows API, but not on disk. Path: D:\ForGene Status: Visible to the Windows API, but not on disk. Path: D:\Recycled Status: Visible to the Windows API, but not on disk. Path: D:\mbr.exe Status: Visible to the Windows API, but not on disk. Path: D:\mbr.log Status: Visible to the Windows API, but not on disk. Path: Volume F:\ Status: MBR Rootkit Detected! Path: Volume F:\, Sector 1 Status: Sector mismatch Path: Volume F:\, Sector 3 Status: Sector mismatch Path: Volume F:\, Sector 4 Status: Sector mismatch Path: Volume F:\, Sector 5 Status: Sector mismatch Path: Volume F:\, Sector 6 Status: Sector mismatch Path: Volume F:\, Sector 7 Status: Sector mismatch Path: Volume F:\, Sector 8 Status: Sector mismatch Path: Volume F:\, Sector 9 Status: Sector mismatch Path: Volume F:\, Sector 10 Status: Sector mismatch Path: Volume F:\, Sector 11 Status: Sector mismatch Path: Volume F:\, Sector 12 Status: Sector mismatch Path: Volume F:\, Sector 13 Status: Sector mismatch Path: Volume F:\, Sector 14 Status: Sector mismatch Path: Volume F:\, Sector 15 Status: Sector mismatch Path: Volume F:\, Sector 16 Status: Sector mismatch Path: Volume F:\, Sector 17 Status: Sector mismatch Path: Volume F:\, Sector 18 Status: Sector mismatch Path: Volume F:\, Sector 19 Status: Sector mismatch Path: Volume F:\, Sector 20 Status: Sector mismatch Path: Volume F:\, Sector 21 Status: Sector mismatch Path: Volume F:\, Sector 22 Status: Sector mismatch Path: Volume F:\, Sector 23 Status: Sector mismatch Path: Volume F:\, Sector 24 Status: Sector mismatch Path: Volume F:\, Sector 25 Status: Sector mismatch Path: Volume F:\, Sector 26 Status: Sector mismatch Path: Volume F:\, Sector 27 Status: Sector mismatch Path: Volume F:\, Sector 28 Status: Sector mismatch Path: Volume F:\, Sector 29 Status: Sector mismatch Path: Volume F:\, Sector 31 Status: Sector mismatch Path: Volume F:\, Sector 32 Status: Sector mismatch Path: Volume F:\, Sector 33 Status: Sector mismatch Path: Volume F:\, Sector 34 Status: Sector mismatch Path: Volume F:\, Sector 35 Status: Sector mismatch Path: Volume F:\, Sector 36 Status: Sector mismatch Path: Volume F:\, Sector 37 Status: Sector mismatch Path: Volume F:\, Sector 38 Status: Sector mismatch Path: Volume F:\, Sector 39 Status: Sector mismatch Path: Volume F:\, Sector 40 Status: Sector mismatch Path: Volume F:\, Sector 41 Status: Sector mismatch Path: Volume F:\, Sector 42 Status: Sector mismatch Path: Volume F:\, Sector 43 Status: Sector mismatch Path: Volume F:\, Sector 44 Status: Sector mismatch Path: Volume F:\, Sector 45 Status: Sector mismatch Path: Volume F:\, Sector 46 Status: Sector mismatch Path: Volume F:\, Sector 47 Status: Sector mismatch Path: Volume F:\, Sector 48 Status: Sector mismatch Path: Volume F:\, Sector 49 Status: Sector mismatch Path: Volume F:\, Sector 50 Status: Sector mismatch Path: Volume F:\, Sector 51 Status: Sector mismatch Path: Volume F:\, Sector 52 Status: Sector mismatch Path: Volume F:\, Sector 53 Status: Sector mismatch Path: Volume F:\, Sector 54 Status: Sector mismatch Path: Volume F:\, Sector 55 Status: Sector mismatch Path: Volume F:\, Sector 56 Status: Sector mismatch Path: Volume F:\, Sector 57 Status: Sector mismatch Path: Volume F:\, Sector 58 Status: Sector mismatch Path: Volume F:\, Sector 59 Status: Sector mismatch Path: Volume F:\, Sector 60 Status: Sector mismatch Path: Volume F:\, Sector 61 Status: Sector mismatch Path: Volume F:\, Sector 62 Status: Sector mismatch Path: F:\.Trashes Status: Visible to the Windows API, but not on disk. Path: F:\autorun Status: Visible to the Windows API, but not on disk. Path: F:\System Volume Information Status: Visible to the Windows API, but not on disk. Path: F:\Karen Documents Status: Visible to the Windows API, but not on disk. Path: F:\Hdrive Status: Visible to the Windows API, but not on disk. Path: F:\New Status: Visible to the Windows API, but not on disk. Path: F:\autorun.inf.txt Status: Visible to the Windows API, but not on disk. Path: F:\Recycled Status: Visible to the Windows API, but not on disk. Path: F:\email copy Status: Visible to the Windows API, but not on disk. Path: F:\Ian Status: Visible to the Windows API, but not on disk. Path: F:\Kirov Orchestra-Valery Gergiev Status: Visible to the Windows API, but not on disk. Path: F:\dissertation Status: Visible to the Windows API, but not on disk. Path: F:\40 Status: Visible to the Windows API, but not on disk. Path: F:\My Music Status: Visible to the Windows API, but not on disk. Path: F:\SDRG Status: Visible to the Windows API, but not on disk. Path: F:\Chronolog.doc Status: Visible to the Windows API, but not on disk. Path: F:\mediation.doc Status: Visible to the Windows API, but not on disk. Path: F:\ParadiseBeach_RU_090629.zip Status: Visible to the Windows API, but not on disk. Path: F:\temp Status: Visible to the Windows API, but not on disk. Path: F:\Robot.Chicken.Star.Wars.Episode.II.PDTV.XviD-aAF.avi Status: Visible to the Windows API, but not on disk. Path: F:\Nouvelle Vague Status: Visible to the Windows API, but not on disk. Path: F:\Depesha.rar Status: Visible to the Windows API, but not on disk. Path: F:\П.Т.В.П Status: Visible to the Windows API, but not on disk. Path: F:\Кино Status: Visible to the Windows API, but not on disk. Path: F:\Ленинград Status: Visible to the Windows API, but not on disk. Path: F:\Photos4Karen Status: Visible to the Windows API, but not on disk. Path: F:\UBCD4WinV350.exe Status: Visible to the Windows API, but not on disk. Path: F:\UBCD4Win Status: Visible to the Windows API, but not on disk. Path: F:\ComboFix.exe Status: Visible to the Windows API, but not on disk. Path: F:\mbr.exe Status: Visible to the Windows API, but not on disk. Path: F:\mbr.log Status: Visible to the Windows API, but not on disk. SSDT ------------------- #: 025 Function Name: NtClose Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba9d56b8 #: 041 Function Name: NtCreateKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba9d5574 #: 065 Function Name: NtDeleteValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba9d5a52 #: 068 Function Name: NtDuplicateObject Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba9d514c #: 119 Function Name: NtOpenKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba9d564e #: 122 Function Name: NtOpenProcess Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba9d508c #: 128 Function Name: NtOpenThread Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba9d50f0 #: 177 Function Name: NtQueryValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba9d576e #: 204 Function Name: NtRestoreKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba9d572e #: 247 Function Name: NtSetValueKey Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xba9d58ae ==EOF== MBR scan log for D: Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully kernel: MBR read successfully user & kernel MBR OK MBR scan log for F: Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully kernel: MBR read successfully user & kernel MBR OK ComboFix log: ComboFix 10-01-26.02 - Karen 01/26/2010 23:02:09.1.1 - x86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.767.311 [GMT -8:00] Running from: c:\documents and settings\Karen\Desktop\ComboFix.exe AV: avast! antivirus 4.8.1368 [VPS 100126-1] On-access scanning disabled (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\Downloaded Program Files\popcaploader.dll c:\windows\Downloaded Program Files\popcaploader.inf c:\windows\Downloaded Program Files\Temp c:\windows\EventSystem.log c:\windows\system32\_000054_.tmp.dll c:\windows\system32\comrepl.exe c:\windows\system32\drivers\fad.sys D:\autorun.inf . ((((((((((((((((((((((((( Files Created from 2009-12-27 to 2010-01-27 ))))))))))))))))))))))))))))))) . 2010-01-14 03:33 . 2009-11-21 15:51 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll 2010-01-04 04:03 . 2010-01-04 04:03 -------- dcsh--w- c:\documents and settings\NetworkService\IETldCache 2010-01-04 01:21 . 2010-01-04 01:21 -------- dc----w- c:\program files\Trend Micro . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-01-26 06:13 . 2008-01-31 03:50 -------- dc----w- c:\documents and settings\All Users\Application Data\Google Updater 2010-01-22 02:35 . 2007-11-02 06:31 -------- dc----w- c:\program files\Microsoft Silverlight 2010-01-14 19:12 . 2009-11-19 04:14 181120 -c----w- c:\windows\system32\MpSigStub.exe 2010-01-14 06:42 . 2004-10-09 08:57 -------- dc----w- c:\documents and settings\All Users\Application Data\Microsoft Help 2010-01-07 00:03 . 2006-06-05 04:19 -------- dc----w- c:\program files\Google 2009-12-21 19:14 . 2004-02-06 23:05 916480 -c--a-w- c:\windows\system32\wininet.dll 2009-12-06 20:07 . 2005-06-05 18:26 115984 -c--a-w- c:\documents and settings\Guest\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-12-01 15:14 . 2009-12-01 15:14 -------- dc----w- c:\documents and settings\Karen\Application Data\Malwarebytes 2009-12-01 15:13 . 2009-12-01 15:13 -------- dc----w- c:\program files\Malwarebytes' Anti-Malware 2009-12-01 15:13 . 2009-12-01 15:13 -------- dc----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-11-24 23:54 . 2009-11-20 06:44 1280480 -c--a-w- c:\windows\system32\aswBoot.exe 2009-11-24 23:51 . 2009-11-20 06:44 93424 -c--a-w- c:\windows\system32\drivers\aswmon.sys 2009-11-24 23:49 . 2009-11-20 06:45 48560 -c--a-w- c:\windows\system32\drivers\aswTdi.sys 2009-11-24 23:48 . 2009-11-20 06:45 23120 -c--a-w- c:\windows\system32\drivers\aswRdr.sys 2009-11-24 23:47 . 2009-11-20 06:45 27408 -c--a-w- c:\windows\system32\drivers\aavmker4.sys 2009-11-24 23:47 . 2009-11-20 06:44 97480 -c--a-w- c:\windows\system32\AvastSS.scr 2009-11-24 04:12 . 2009-11-24 04:12 152576 -c--a-w- c:\documents and settings\Karen\Application Data\Sun\Java\jre1.6.0_17\lzma.dll 2009-11-24 04:12 . 2009-11-23 07:00 79488 -c--a-w- c:\documents and settings\Karen\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll 2009-11-21 15:51 . 2002-08-29 10:00 471552 -c--a-w- c:\windows\AppPatch\aclayers.dll 2009-11-20 11:13 . 2008-06-12 09:05 18368 -c--a-w- c:\documents and settings\All Users\Application Data\Microsoft\VSA\9.0\1033\ResourceCache.dll 2009-11-20 11:12 . 2008-06-12 09:05 2031040 -c--a-w- c:\documents and settings\All Users\Application Data\Microsoft\visualstudio\9.0\1033\ResourceCache.dll 2009-11-20 05:31 . 2004-07-09 15:47 115984 -c--a-w- c:\documents and settings\Karen\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2004-11-07 20:58 . 2004-11-30 08:49 44151 -c--a-w- c:\program files\mozilla firefox\components\inspector.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-01-31 68856] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="c:\program files\Apoint\Apoint.exe" [2004-02-02 155648] "BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 122880] "PRONoMgr.exe"="c:\program files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe" [2003-12-19 86016] "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-04-06 339968] "UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592] "DVDSentry"="c:\windows\System32\DSentry.exe" [2003-08-13 28672] "PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2003-12-12 217088] "mmtask"="c:\program files\MusicMatch\MusicMatch Jukebox\mmtask.exe" [2003-10-06 53248] "IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2003-05-15 163840] "gemstrmw"="c:\windows\system32\gemstrmw.exe" [2003-08-30 24576] "Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2002-07-10 28672] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072] "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-04 866584] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-02-04 98304] "Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2007-11-16 166304] "HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696] "Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-11-24 198160] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring] 2004-01-13 20:17 110592 ----a-w- c:\windows\SYSTEM32\LgNotify.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "quickcare"=c:\program files\Qwest\QuickCare\bin\sprtcmd.exe /P QUICKCARE [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\WINDOWS\\network diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Windows Home Server\\Discovery.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015 "1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016 "500:UDP"= 500:UDP:@xpsp2res.dll,-22017 R1 aswSP;avast! Self Protection;c:\windows\SYSTEM32\DRIVERS\aswSP.sys [11/19/2009 10:44 PM 114768] R2 aswFsBlk;aswFsBlk;c:\windows\SYSTEM32\DRIVERS\aswFsBlk.sys [11/19/2009 10:44 PM 20560] R2 SRUserService;IT Connection Manager;c:\program files\IT Connection Manager\SRUserService.exe [5/26/2005 8:00 PM 260232] R2 WHSConnector;Windows Home Server Connector Service;c:\program files\Windows Home Server\WHSConnector.exe [4/20/2009 8:37 PM 335728] R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 6:19 PM 13592] R3 OZSCR;O2Micro SmartCardBus Smartcard Reader;c:\windows\SYSTEM32\DRIVERS\ozscr.sys [12/31/1979 9:00 PM 92550] S2 gupdate1ca6cc0e5923760;Google Update Service (gupdate1ca6cc0e5923760);c:\program files\Google\Update\GoogleUpdate.exe [11/23/2009 8:44 PM 133104] S3 GEMPCC;Gemplus GemPC400 PCMCIA Smart Card Reader;c:\windows\SYSTEM32\DRIVERS\gempcc.sys [10/8/2004 4:08 PM 18464] S3 GPR400;GEMPLUS GPR400 PCMCIA Smart Card Reader;c:\windows\SYSTEM32\DRIVERS\gpr400.sys [10/8/2004 2:50 PM 17408] S3 VSPerfDrv90;Performance Tools Driver 9.0;c:\program files\Microsoft Visual Studio 9.0\Team Tools\Performance Tools\VSPerfDrv90.sys [9/4/2007 3:53 PM 55664] S4 msvsmon80;Visual Studio 2005 Remote Debugger;"c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe" /service msvsmon80 --> c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [?] . Contents of the 'Scheduled Tasks' folder 2010-01-27 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-10-25 16:18] 2010-01-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-11-24 04:44] 2010-01-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-11-24 04:44] 2010-01-26 c:\windows\Tasks\MP Scheduled Scan.job - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-04 02:20] 2010-01-27 c:\windows\Tasks\User_Feed_Synchronization-{32DC6D3C-29EB-4510-B479-10F41D74AF21}.job - c:\windows\system32\msfeedssync.exe [2006-10-17 11:31] . . ------- Supplementary Scan ------- . uStart Page = about:blank uInternet Connection Wizard,ShellNext = hxxp://www.dell4me.com/myway IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000 IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html DPF: {01010200-5E80-11D8-9E86-0007E96C65AE} - hxxps://ra.qwest.com/sdccommon/download/tgctlins.cab DPF: {3D19135C-6D38-44AD-80F0-D9318F48726D} - hxxp://rcps1.onvoip.net/commpilot/customcontrols/BwOutlook.CAB DPF: {4BFC73A6-F8AE-42B3-AAEC-792C3CF0B418} - hxxp://sg60.oar.net/VCGSU.CAB FF - ProfilePath - c:\documents and settings\Karen\Application Data\Mozilla\Firefox\Profiles\obv2pnm4.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - about:blank FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll FF - plugin: c:\program files\Virtual Earth 3D\npVE3D.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ . - - - - ORPHANS REMOVED - - - - WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file) ************************************************************************ catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-01-26 23:15 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(864) c:\windows\system32\Ati2evxx.dll c:\windows\System32\LgNotify.dll . Completion time: 2010-01-26 23:22:48 ComboFix-quarantined-files.txt 2010-01-27 07:22 Pre-Run: 2,570,792,960 bytes free Post-Run: 3,338,317,824 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn - - End Of File - - 5C814AC257E1B0C4491E1508EC8AD3F9 Thanks, Karen

sundavis View Member Profile	Jan 27 2010, 11:26 PM Post #8
Forum Addict Group: Malware Response Team Posts: 2,097 Joined: 11-August 07 Member No.: 149,370	Hi nerak, QUOTE Right-clicking on those rows in the Files tab didn't give me a menu. That's ok. Sector mismatch might be the RP can't read or decipher the sector properly. Sometimes, MBR rootkit will have the same behavior. Therefore, RP reports it. After mbr was applied to your external drives, it seemed to be fine. We can live with that. Let's scan the remnants with Kas Online Scanner. It will take some time to run the full course, Please be patient and do the following: Please remove the following outdated javas via Add/Remove Programs and clear the java cache as instructed in this thread . J2SE Runtime Environment 5.0 Update 10 J2SE Runtime Environment 5.0 Update 2 J2SE Runtime Environment 5.0 Update 4 J2SE Runtime Environment 5.0 Update 6 J2SE Runtime Environment 5.0 Update 8 Java 2 Runtime Environment, SE v1.4.2_03 Java™ 6 Update 2 Java™ 6 Update 3 Java™ 6 Update 5 Java™ 6 Update 7 Java™ SE Runtime Environment 6 Update 1 After that, go into the Control Panel (Classic View) and double-click the Java Icon (looks like a coffee cup) to upgrade your java version. Step1 Please download Flash_Disinfector and save it to your desktop. Double click to run it. You will be prompted to plug in your flash drive. Remember to plug in the flash drive to disinfect as well. Flash_Disinfector will start disinfecting your flash and hard drives. This takes a few seconds. Your desktop will disappear in the meantime. When done, a message box will appear. Click OK. Your desktop should now appear. If it doesn't, press Ctrl + Shift + Esc to open Task Manager. Click on File > New Task (Run...). Type in explorer.exe and press Enter. Your desktop should now appear. Step2 Let's clean some temp files. Please do the following: Please download ATF Cleaner by Atribune. Double-click ATF-Cleaner.exe to run the program. Under Main "Select Files to Delete" choose: Select All. Click the Empty Selected button. If you use Firefox browser Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. If you use Opera browser Click Opera at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. Click Exit on the Main menu to close the program. Step3 Please perform an online scan with Firefox or Internet Explorer at Kaspersky Online Scanner. Please go to Kaspersky Online Scanner and perform an online antivirus scan. Click Accept button on the "Requirements and limitations". When Java warning " The applcation digital signature has been verified. Do you want to run the application " appears, Click on "Run" button. It will be Downloading and installing the program and Updating the database. When Updating the database have finished, click on Settings. Make sure all boxes are checked. then click on the Save button. Click on My Computer under Scan menu. It will start scanning, so be patient and let it run. Once the scan is completed, Click on View Scan Report. You may see a list of infected items over there. Click on Save Report As. Click "Desktop" , Name the file as "KAS", Change the Files of type to Text file (.txt) and Click on Save button. Please post the contents in your next reply. You can refer to this animation Note for Internet Explorer 8 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%. Please post back the logs in your next reply. 1.Kas Online Scan Report Tell me if you have any remaining issues on your pc. This post has been edited by sundavis: Jan 27 2010, 11:40 PM

nerak View Member Profile	Feb 1 2010, 10:38 AM Post #9
New Member Group: Members Posts: 7 Joined: 23-December 09 Member No.: 422,299	Well, the Kaspersky Online Scan seems to hang at about 20% of the way through. The first time it got 23% through and found a few suspicious files, but I couldn't get the report to come up to show me which ones they were. I took note of where it hung the next time I tried, and it was on C:\WINDOWS\sprof32.dll, so I tried scanning that particular file, with no problems. Then when I tried scanning C:\WINDOWS, it hung at C:\WINDOWS\SoftwareDistribution\ScanFile\a774ea19-56b0-4706-9a41-452f04bbe281. I scanned C:\WINDOWS\SoftwareDistribution\ without a problem. But when I ran the full scan again it hung at the same place. Any suggestions? Karen

sundavis View Member Profile	Feb 1 2010, 02:02 PM Post #10
Forum Addict Group: Malware Response Team Posts: 2,097 Joined: 11-August 07 Member No.: 149,370	Hi nerak, OK. The kas seemed unable to analyze the windows update folders properly. It may stall or hang over there. Let's take the following instead. Step1 Please run a free online scan with the ESET Online Scanner Note: You will need to use Internet Explorer for this scan. Tick the box next to YES, I accept the Terms of Use. Click Start When asked, allow the ActiveX control to install Click Start Make sure that the options Remove found threats and the option Scan unwanted applications is checked Click Scan Wait for the scan to finish Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt Copy and paste that log as a reply to this topic. I will give you another one, just in case. Please go to F-Secure Online Scanner Follow the on screen prompts to download activeX. Once that has completed, you'll be presented with types of scans. Tick 'My Scan' and click 'Show Options' Under Select File Types, tick All File Types Under Select Folders for Scanning, tick 'Scan a Folder' and click Select Select the C:\ drive, otherwise it will scan all drives. Click OK Click Start After it has completed, save the log and copy/paste the results in your next reply. If you have problems to run F-Secure Online Scanner, You may refer to this thread. Let me know how things went.

nerak View Member Profile	Feb 2 2010, 01:10 AM Post #11
New Member Group: Members Posts: 7 Joined: 23-December 09 Member No.: 422,299	Success! Here is the ESET log: ESETSmartInstaller@High as CAB hook log: OnlineScanner.ocx - registred OK # version=7 # iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339) # OnlineScanner.ocx=1.0.0.6211 # api_version=3.0.2 # EOSSerial=6a6035fc7744d248b5765bda0ae4dddd # end=finished # remove_checked=true # archives_checked=true # unwanted_checked=true # unsafe_checked=true # antistealth_checked=true # utc_time=2010-02-02 05:59:26 # local_time=2010-02-01 09:59:26 (-0800, Pacific Standard Time) # country="United States" # lang=9 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=512 16777215 100 0 1587417 1587417 0 0 # compatibility_mode=769 16775141 100 98 0 200429483 0 0 # compatibility_mode=4864 16777215 100 0 77434501 77434501 0 0 # compatibility_mode=6143 16777215 0 0 0 0 0 0 # compatibility_mode=8192 67108863 100 0 0 0 0 0 # scanned=318891 # found=6 # cleaned=6 # scan_time=16837 C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1485\A0196571.exe multiple threats (deleted - quarantined) 00000000000000000000000000000000 C D:\backup\Kolibri2\Karen\Memeo\Karen\C_\Documents and Settings\Karen\Desktop\UBCD4WinV350.exe multiple threats (deleted - quarantined) 00000000000000000000000000000000 C F:\UBCD4WinV350.exe multiple threats (deleted - quarantined) 00000000000000000000000000000000 C F:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP1509\A0202449.exe multiple threats (deleted - quarantined) 00000000000000000000000000000000 C F:\UBCD4Win\PROGRAMS\sdfix\SDFix.exe Win32/PrcView application (deleted - quarantined) 00000000000000000000000000000000 C F:\UBCD4Win\PROGRAMS\Crossloop\winvnc.exe Win32/RemoteAdmin.WinVNC application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

sundavis View Member Profile	Feb 2 2010, 01:59 AM Post #12
Forum Addict Group: Malware Response Team Posts: 2,097 Joined: 11-August 07 Member No.: 149,370	Hi nerak, As far as listed UBCD4Win as multiple threats in ESET log, it might be a false positive. You need to download it again if you like to burn a new CD. Other than that, your system appears clean now. If you have no remaining issues on your pc, let's do some tidy up and you should be good to go. Step1 Click START then RUN Now copy/paste ComboFix /Uninstall in the runbox and click OK. Note the space between the x and the /Uninstall, it needs to be there. This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again. Step2 Download OTC by OldTimer and save it to your desktop. Double click OTC and let it run Then Click the Cleanup button. You will get a prompt saying "Being Cleanup Process". Please select Yes. Restart your computer when prompted. Please delete all the tools and logs we have used. Now that your system is clean, kindly follow these simple steps in order to keep your computer clean and secure: Update your antivirus programs Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system. You can use one of these sites to check if any updates are needed for your pc. Secunia Software Inspector F-secure Health Check Update all programs regularly - Make sure you update all the programs regularly. Without regular updates you WILL NOT be protected when new malicious programs are released. Backup your valid registry -ERUNT (Emergency Recovery Utility NT) allows you to store a complete backup of your registry and restore if needed. Due to malware affects, a corrupt registry can prevent a system from booting. You're well advised to backup your valid registry while the system is clean now. For more info: Here and Here . Please check out Tony Klein's article "How did I get infected in the first place?" Read some information Here how to prevent Malware. Glad to be of help. Safe surfing!!

sundavis View Member Profile	Feb 10 2010, 01:12 AM Post #13
Forum Addict Group: Malware Response Team Posts: 2,097 Joined: 11-August 07 Member No.: 149,370	Since this issue appears resolved ... this Topic is closed. Glad we could help. Everyone else please begin a New Topic.

« Next Oldest · Virus, Trojan, Spyware, and Malware Removal Logs · Next Newest »

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Display Mode: Standard · Switch to: Linear+ · Switch to: Outline

Track this topic · Email this topic · Print this topic · Subscribe to this forum

Lo-Fi Version

Time is now: 9th September 2010 - 05:46 AM

Advertise \| About Us \| Terms of Use \| Privacy Policy \| Contact Us \| Site Map \| Chat \| Tutorials \| Uninstall List
Discussion Forums \| The Computer Glossary \| Resources \| RSS Feeds \| Startups \| The File Database \| Virus Removal Guides