BleepingComputer.com: Redirect Virus and non execution of programs

Thank you in advance for the help. I have been fighting a redirect virus for some time, and can't seem to get rid of it completely. AVG continues to block a "black hole exploit" in various locations, and the DDS report warns of a root kit infection. Additionally, several programs do not execute when run (primarily firefox). I run Windows x64 XP professional, and have attached both DDS files, as it would not let me post the dds in the thread. Thanks again.

Hello and Welcome to the forums!

My name is Gringo and I'll be glad to help you with your computer problems.

Somethings to remember while we are working together.

• Do not run any other tool untill instructed to do so!
  
• please Do not Attach logs or put in code boxes.
  
• Tell me about any problems that have occurred during the fix.
  
• Tell me of any other symptoms you may be having as these can help also.
  
• Do not run anything while running a fix.
  
• Do not run any other tool untill instructed to do so!

Click on the Watch Topic Button and select Immediate Notification and click on proceed, this will help you to get notified faster when I have replied and make the cleaning process faster.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

I would like to get a better look at your system, please do the following so I can get some more detailed logs.


DeFogger:

Please download DeFogger to your desktop.

Double click DeFogger to run the tool.

• The application window will appear
  
• Click the Disable button to disable your CD Emulation drivers
  
• Click Yes to continue
  
• A 'Finished!' message will appear
  
• Click OK
  
• DeFogger may ask you to reboot the machine, if it does - click OK

Do not re-enable these drivers until otherwise instructed.

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.

Download DDS:

Please download DDS by sUBs from one of the links below and save it to your desktop:


Download DDS and save it to your desktop

Link1
Link2
Link3

Please disable any anti-malware program that will block scripts from running before running DDS.


• Double-Click on dds.scr and a command window will appear. This is normal.
  
• Shortly after two logs will appear:
  
  • DDS.txt
    
  • Attach.txt
  
  
• A window will open instructing you save & post the logs
  
• Save the logs to a convenient place such as your desktop
  
• Copy the contents of both logs & post in your next reply

Scan With RKUnHooker

• Please Download Rootkit Unhooker Save it to your desktop.
  
• Now double-click on RKUnhookerLE.exe to run it.
  
• Click the Report tab, then click Scan.
  
• Check (Tick) Drivers, Stealth,. Uncheck the rest. then Click OK.
  
• Wait till the scanner has finished and then click File, Save Report.
  
• Save the report somewhere where you can find it. Click Close.

Copy the entire contents of the report and paste it in a reply here.

Note** you may get this warning it is ok, just ignore

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

"just click on Cancel, then Accept".

information and logs:

In your next post I need the following


1.logs from DDS
2.RKUnHooker
3.let me know of any problems you may have had

Gringo

Gringo,

I am getting a "server connection reset" page whenever I try to paste reports in the reply window (I assume due to file size). Is there a trick to getting those in here?


Thanks,

Joe Fouts

Up load them here - http://www.mediafire.com/ and send me the link for them


it is the virus that is doing this



Gringo

Gringo,

Here are the links to the "attach" DDS file and the RKU report. The DDS report is having a "connection error" on Mediafire, I assume due to the virus as well. I will keep trying, but let me know if there is another way around this.


http://www.mediafire.com/?rpj000dq1cma4h7
http://www.mediafire.com/?vffwrikiq8iqjfr



Thanks,

Joe

I want you to run this tool for me next.

tdsskiller:

Please read carefully and follow these steps.

• Download TDSSKiller and save it to your Desktop.
  
• doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  
• If an infected file is detected, the default action will be Cure, click on Continue.
  
• If a suspicious file is detected, the default action will be Skip, click on Continue.
  
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  
• If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
  
• If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

Gringo

The problem seems to be solved (at least temporarily). Here is the requested report:


Tdsskiller Report:




2011/04/19 08:58:37.0930 5072 TDSS rootkit removing tool 2.4.21.0 Mar 10 2011 12:26:28
2011/04/19 08:58:38.0426 5072 ================================================================================
2011/04/19 08:58:38.0426 5072 SystemInfo:
2011/04/19 08:58:38.0426 5072
2011/04/19 08:58:38.0426 5072 OS Version: 5.1.2600 ServicePack: 3.0
2011/04/19 08:58:38.0426 5072 Product type: Workstation
2011/04/19 08:58:38.0426 5072 ComputerName: DELL_XP32_ENG
2011/04/19 08:58:38.0426 5072 UserName: Joe
2011/04/19 08:58:38.0426 5072 Windows directory: C:\WINDOWS
2011/04/19 08:58:38.0426 5072 System windows directory: C:\WINDOWS
2011/04/19 08:58:38.0426 5072 Processor architecture: Intel x86
2011/04/19 08:58:38.0426 5072 Number of processors: 8
2011/04/19 08:58:38.0426 5072 Page size: 0x1000
2011/04/19 08:58:38.0426 5072 Boot type: Normal boot
2011/04/19 08:58:38.0426 5072 ================================================================================
2011/04/19 08:58:38.0839 5072 Initialize success
2011/04/19 08:59:05.0430 0948 ================================================================================
2011/04/19 08:59:05.0430 0948 Scan started
2011/04/19 08:59:05.0430 0948 Mode: Manual;
2011/04/19 08:59:05.0430 0948 ================================================================================
2011/04/19 08:59:05.0827 0948 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/04/19 08:59:05.0893 0948 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
2011/04/19 08:59:05.0926 0948 adfs (73685e15ef8b0bd9c30f1af413f13d49) C:\WINDOWS\system32\drivers\adfs.sys
2011/04/19 08:59:05.0976 0948 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/04/19 08:59:06.0009 0948 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
2011/04/19 08:59:06.0124 0948 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2011/04/19 08:59:06.0223 0948 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/04/19 08:59:06.0240 0948 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/04/19 08:59:06.0290 0948 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/04/19 08:59:06.0356 0948 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/04/19 08:59:06.0422 0948 AvgLdx86 (b8c187439d27aba430dd69fdcf1fa657) C:\WINDOWS\System32\Drivers\avgldx86.sys
2011/04/19 08:59:06.0438 0948 AvgMfx86 (53b3f979930a786a614d29cafe99f645) C:\WINDOWS\System32\Drivers\avgmfx86.sys
2011/04/19 08:59:06.0471 0948 AvgRkx86 (5bbcd8646074a3af4ee9b321d12c2b64) C:\WINDOWS\system32\Drivers\avgrkx86.sys
2011/04/19 08:59:06.0521 0948 AvgTdiX (22e3b793c3e61720f03d3a22351af410) C:\WINDOWS\System32\Drivers\avgtdix.sys
2011/04/19 08:59:06.0637 0948 b57w2k (d0692f7b8217e3b82d2bfac535816117) C:\WINDOWS\system32\DRIVERS\b57xp32.sys
2011/04/19 08:59:06.0719 0948 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/04/19 08:59:06.0736 0948 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/04/19 08:59:06.0785 0948 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/04/19 08:59:06.0851 0948 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/04/19 08:59:06.0918 0948 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/04/19 08:59:07.0000 0948 ctac32k (8a9c65ce4fe6e8cb24ce06ba28d951a0) C:\WINDOWS\system32\drivers\ctac32k.sys
2011/04/19 08:59:07.0050 0948 ctaud2k (47236971dfb3e03690b98e41665d0924) C:\WINDOWS\system32\drivers\ctaud2k.sys
2011/04/19 08:59:07.0083 0948 ctdvda2k (5a0eeb00b02fc78605aa9d3590b24978) C:\WINDOWS\system32\drivers\ctdvda2k.sys
2011/04/19 08:59:07.0099 0948 ctprxy2k (2381cf056c15271f6b8dab50ff82cf3a) C:\WINDOWS\system32\drivers\ctprxy2k.sys
2011/04/19 08:59:07.0116 0948 ctsfm2k (da1c530de86c85a701138b30fb145af3) C:\WINDOWS\system32\drivers\ctsfm2k.sys
2011/04/19 08:59:07.0149 0948 cvintdrv (dbd89bc0dbe00dcd245be8f61dbee291) C:\WINDOWS\system32\drivers\cvintdrv.sys
2011/04/19 08:59:07.0199 0948 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/04/19 08:59:07.0248 0948 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
2011/04/19 08:59:07.0298 0948 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
2011/04/19 08:59:07.0298 0948 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/04/19 08:59:07.0331 0948 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/04/19 08:59:07.0364 0948 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/04/19 08:59:07.0397 0948 emupia (661cf27263f3e0b553be050a42d357db) C:\WINDOWS\system32\drivers\emupia2k.sys
2011/04/19 08:59:07.0413 0948 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/04/19 08:59:07.0463 0948 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
2011/04/19 08:59:07.0513 0948 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
2011/04/19 08:59:07.0529 0948 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
2011/04/19 08:59:07.0562 0948 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
2011/04/19 08:59:07.0579 0948 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/04/19 08:59:07.0595 0948 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/04/19 08:59:07.0645 0948 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
2011/04/19 08:59:07.0678 0948 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/04/19 08:59:07.0711 0948 ha20x2k (862d4185d43128fef7818711f8f30436) C:\WINDOWS\system32\drivers\ha20x2k.sys
2011/04/19 08:59:07.0760 0948 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/04/19 08:59:07.0810 0948 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/04/19 08:59:07.0860 0948 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\drivers\i8042prt.sys
2011/04/19 08:59:07.0893 0948 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/04/19 08:59:07.0926 0948 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/04/19 08:59:07.0959 0948 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
2011/04/19 08:59:07.0975 0948 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/04/19 08:59:07.0992 0948 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/04/19 08:59:08.0008 0948 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/04/19 08:59:08.0025 0948 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/04/19 08:59:08.0041 0948 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/04/19 08:59:08.0074 0948 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/04/19 08:59:08.0107 0948 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/04/19 08:59:08.0124 0948 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2011/04/19 08:59:08.0141 0948 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/04/19 08:59:08.0174 0948 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/04/19 08:59:08.0240 0948 lvalarmk (bad54f937b43f0e75db242c1f40c2dcf) C:\WINDOWS\system32\drivers\lvalarmk.sys
2011/04/19 08:59:08.0256 0948 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/04/19 08:59:08.0289 0948 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
2011/04/19 08:59:08.0306 0948 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/04/19 08:59:08.0322 0948 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/04/19 08:59:08.0339 0948 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/04/19 08:59:08.0372 0948 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/04/19 08:59:08.0405 0948 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/04/19 08:59:08.0455 0948 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/04/19 08:59:08.0488 0948 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/04/19 08:59:08.0504 0948 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/04/19 08:59:08.0537 0948 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/04/19 08:59:08.0570 0948 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/04/19 08:59:08.0603 0948 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
2011/04/19 08:59:08.0620 0948 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/04/19 08:59:08.0636 0948 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/04/19 08:59:08.0653 0948 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/04/19 08:59:08.0653 0948 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/04/19 08:59:08.0669 0948 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/04/19 08:59:08.0702 0948 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/04/19 08:59:08.0735 0948 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/04/19 08:59:08.0785 0948 ni1006k (2ad3c955a4b2a0c82c1906f61cb297f8) C:\WINDOWS\system32\drivers\ni1006k.sys
2011/04/19 08:59:08.0802 0948 ni1045k (f965ee798882b6ccf8de95af3dd18b7c) C:\WINDOWS\system32\drivers\ni1045kl.sys
2011/04/19 08:59:08.0818 0948 ni1065k (a5cd3acbac593859ad03ed957b443760) C:\WINDOWS\system32\drivers\ni1065k.sys
2011/04/19 08:59:08.0868 0948 ni488lock (f8616853cbf96a431ee9aa893360a720) C:\WINDOWS\system32\drivers\ni488lock.sys
2011/04/19 08:59:08.0934 0948 niarbk (5d249c5365f819f70882570a1746c9d2) C:\WINDOWS\system32\drivers\niarbk.dll
2011/04/19 08:59:08.0950 0948 nibffrk (ec11f3561e9ef42b515839c5feed393b) C:\WINDOWS\system32\drivers\nibffrk.dll
2011/04/19 08:59:08.0983 0948 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2011/04/19 08:59:09.0016 0948 nicdrk (f96bdcf214ba8a022b5755815aff0291) C:\WINDOWS\system32\drivers\nicdrkl.sys
2011/04/19 08:59:09.0066 0948 nicmrk (fe37800e2dffdbab97de5992f6a200d9) C:\WINDOWS\system32\drivers\nicmrkl.sys
2011/04/19 08:59:09.0132 0948 nicondrk (b33b0bf6e36ac349d3f22b8100e4b76b) C:\WINDOWS\system32\drivers\nicondrkl.sys
2011/04/19 08:59:09.0182 0948 nicsrk (875425aa51c3ff321220cb7f203b0c13) C:\WINDOWS\system32\drivers\nicsrkl.sys
2011/04/19 08:59:09.0198 0948 nicsrkw (028d93e1b9b73dfd447442366f31a0d8) C:\WINDOWS\system32\DRIVERS\nicsrkw.sys
2011/04/19 08:59:09.0264 0948 Nidaq32k (45e8f127606c4bd0d70ed2214146bdc3) C:\WINDOWS\system32\drivers\Nidaq32k.sys
2011/04/19 08:59:09.0297 0948 nidimk (5b49b7840d9a690a40bfea0820387372) C:\WINDOWS\system32\drivers\nidimkl.sys
2011/04/19 08:59:09.0330 0948 nidmmk (cb774c85d1814afc0efdf8c3f13a10e5) C:\WINDOWS\system32\drivers\nidmmk.dll
2011/04/19 08:59:09.0347 0948 nidmxfk (71862fb2b47ee230cb4b5ef4df6864ae) C:\WINDOWS\system32\drivers\nidmxfkl.sys
2011/04/19 08:59:09.0413 0948 nidsark (bfbb3c5c890707105efaa939d4f4ee0f) C:\WINDOWS\system32\drivers\nidsarkl.sys
2011/04/19 08:59:09.0463 0948 nidwgk (42656e74c9f98f0c462fd23cce4c0f82) C:\WINDOWS\system32\drivers\nidwgkl.sys
2011/04/19 08:59:09.0512 0948 niemrk (f30bab9dcdd43d7c32d5242ba7a2ac48) C:\WINDOWS\system32\drivers\niemrkl.sys
2011/04/19 08:59:09.0562 0948 niesrk (9b57bb022f9018e6b2ff2703f5c0a449) C:\WINDOWS\system32\drivers\niesrkl.sys
2011/04/19 08:59:09.0628 0948 NIEthernetDeviceEnumerator (ba1a836450696c575c50ca7f34cefb46) C:\WINDOWS\system32\DRIVERS\niede.sys
2011/04/19 08:59:09.0661 0948 nihsdrk (d35bdfed48a6e2504d4e353f72ec314c) C:\WINDOWS\system32\drivers\nihsdrkl.sys
2011/04/19 08:59:09.0694 0948 nimdbgk (3759d89ba13dd30f0d165f8e8a05c3a8) C:\WINDOWS\system32\drivers\nimdbgkl.sys
2011/04/19 08:59:09.0727 0948 nimdsk (dd4b89019ab1eca5c04757e2f7d8a9e4) C:\WINDOWS\system32\drivers\nimdsk.dll
2011/04/19 08:59:09.0777 0948 nimru2k (a4d639dd7cf0463228435beeb25d0ca2) C:\WINDOWS\system32\drivers\nimru2kl.sys
2011/04/19 08:59:09.0810 0948 nimsdrk (6eeb6445ddc7adfc3d43e890f4f06e99) C:\WINDOWS\system32\drivers\nimsdrkl.sys
2011/04/19 08:59:09.0859 0948 nimslk (99521722c0858ab23e06855e1069c725) C:\WINDOWS\system32\drivers\nimslk.dll
2011/04/19 08:59:09.0909 0948 nimsrlk (acfd05455df010e85e0c8a56e9c255c3) C:\WINDOWS\system32\drivers\nimsrlk.dll
2011/04/19 08:59:09.0925 0948 nimstsk (655b435233e75742fdcfc0192bdcfe8c) C:\WINDOWS\system32\drivers\nimstskl.sys
2011/04/19 08:59:09.0942 0948 nimxdfk (c1d3fe97174283dbece900a73bc5498e) C:\WINDOWS\system32\drivers\nimxdfkl.sys
2011/04/19 08:59:09.0958 0948 nimxpk (509c06e63dfc7ab4c71f358e1fe0449b) C:\WINDOWS\system32\drivers\nimxpkl.sys
2011/04/19 08:59:09.0991 0948 ninshsdk (839c73aa11b60e39b7fee9fe3e202371) C:\WINDOWS\system32\drivers\ninshsdkl.sys
2011/04/19 08:59:10.0025 0948 niorbk (2ee2631f636f2cceb8f054bee79ad6c4) C:\WINDOWS\system32\drivers\niorbkl.sys
2011/04/19 08:59:10.0058 0948 nipalfwedl (32d1a4386ab0e9ba56511d0d30d243e7) C:\WINDOWS\system32\drivers\nipalfwedl.sys
2011/04/19 08:59:10.0140 0948 NIPALK (eb3830319a069420a50a2fa88dffad8a) C:\WINDOWS\system32\drivers\nipalk.sys
2011/04/19 08:59:10.0157 0948 nipalusbedl (23f5a7a43d2554ee749d80863ba73fa2) C:\WINDOWS\system32\drivers\nipalusbedl.sys
2011/04/19 08:59:10.0190 0948 nipbcfk (96c846ab33c383583282b0375b34e9d2) C:\WINDOWS\system32\drivers\nipbcfk.sys
2011/04/19 08:59:10.0239 0948 nipsdk (5a8d0fcdca9911383880bd074b576978) C:\WINDOWS\system32\drivers\nipsdkl.sys
2011/04/19 08:59:10.0256 0948 nipxibaf (487f469717ebdafe2b933a2c449d43de) C:\WINDOWS\system32\drivers\nipxibaf.sys
2011/04/19 08:59:10.0272 0948 nipxibrc (7518a39976162f0312e7714a1f5df4fe) C:\WINDOWS\system32\drivers\nipxibrc.sys
2011/04/19 08:59:10.0305 0948 nipxigpk (159860b9418bfbc2ad6f5782cf1fe667) C:\WINDOWS\system32\drivers\nipxigpk.sys
2011/04/19 08:59:10.0339 0948 nipxirmk (f2a9ae586502774b9d1c1d790a6626b4) C:\WINDOWS\system32\drivers\nipxirmkl.sys
2011/04/19 08:59:10.0372 0948 niraptrk (7a75ee716f14411c386b3320f108361c) C:\WINDOWS\system32\drivers\niraptrkl.sys
2011/04/19 08:59:10.0405 0948 niRFSA2k (abced9fb275546eb05ced63f2a2640bb) C:\WINDOWS\system32\drivers\niRFSA2kl.sys
2011/04/19 08:59:10.0438 0948 niRFSGk (376a851931f2f33030080e37d914e665) C:\WINDOWS\system32\drivers\niRFSGkl.sys
2011/04/19 08:59:10.0471 0948 niscdk (179dc92cb67bf63a096e002b60038516) C:\WINDOWS\system32\drivers\niscdkl.sys
2011/04/19 08:59:10.0520 0948 nisdigk (9ac3f0d19f89afa5d723b089e9477c84) C:\WINDOWS\system32\drivers\nisdigkl.sys
2011/04/19 08:59:10.0570 0948 nisftk (5c764ba1f7f3b5f54b60ee2c864f8bb6) C:\WINDOWS\system32\drivers\nisftkl.sys
2011/04/19 08:59:10.0619 0948 nisldk (17fa6411f97342b805b971b31df98b44) C:\WINDOWS\system32\drivers\nisldkl.sys
2011/04/19 08:59:10.0636 0948 nispdk (7303c44805909d3f661f9c1057faf337) C:\WINDOWS\system32\drivers\nispdkl.sys
2011/04/19 08:59:10.0702 0948 nisrcdk (d30dbd774d3bee61069ac6e3a8a43c40) C:\WINDOWS\system32\drivers\nisrcdkl.sys
2011/04/19 08:59:10.0752 0948 nissrk (4c1a1794b6f0dc80fe2817e8f44ffea4) C:\WINDOWS\system32\drivers\nissrkl.sys
2011/04/19 08:59:10.0785 0948 nistc2k (f3e81b7b92dd962e674018c810a3025e) C:\WINDOWS\system32\drivers\nistc2kl.sys
2011/04/19 08:59:10.0818 0948 nistc3rk (f535f490c890594747225d902347c178) C:\WINDOWS\system32\drivers\nistc3rkl.sys
2011/04/19 08:59:10.0867 0948 nistck (45bffaed056b917407cc2d52a520a582) C:\WINDOWS\system32\drivers\nistck.dll
2011/04/19 08:59:10.0900 0948 nistcrk (3130589570081e83a1813c0b62aaca9f) C:\WINDOWS\system32\drivers\nistcrkl.sys
2011/04/19 08:59:10.0933 0948 nistreamk (ca0f520b63cd0d7b296b9a13d221271d) C:\WINDOWS\system32\drivers\nistreamkl.sys
2011/04/19 08:59:10.0950 0948 niswdk (fed5c82ec62112bcd339118d26a673ee) C:\WINDOWS\system32\drivers\niswdkl.sys
2011/04/19 08:59:11.0016 0948 nitiork (fe25687990f399e1c1a88cc3667f04ff) C:\WINDOWS\system32\drivers\nitiorkl.sys
2011/04/19 08:59:11.0066 0948 nitnr2k (a03e31d17159c7a65fc36eb0a5a63c10) C:\WINDOWS\system32\drivers\nitnr2kl.sys
2011/04/19 08:59:11.0082 0948 niufurk (0e312ac39974d299318cfa26ce34b77e) C:\WINDOWS\system32\drivers\niufurkl.sys
2011/04/19 08:59:11.0115 0948 niufurkw (95268b30b7be7d79367a153617bd5432) C:\WINDOWS\system32\DRIVERS\niufurkw.sys
2011/04/19 08:59:11.0181 0948 NiViPciK (29ebe67b68d51d4f03f4257b81e5a22e) C:\WINDOWS\system32\drivers\NiViPciKl.sys
2011/04/19 08:59:11.0248 0948 NiViPxiK (9a202cc17625a5e8f84504ce45445d84) C:\WINDOWS\system32\drivers\NiViPxiKl.sys
2011/04/19 08:59:11.0297 0948 niwfrk (0bb14a240b5868a06fb63ad7191274ec) C:\WINDOWS\system32\drivers\niwfrkl.sys
2011/04/19 08:59:11.0347 0948 nixsrk (51b97905f9812dad80d5e5d35ee7f8e3) C:\WINDOWS\system32\drivers\nixsrkl.sys
2011/04/19 08:59:11.0396 0948 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/04/19 08:59:11.0446 0948 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/04/19 08:59:11.0512 0948 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/04/19 08:59:11.0611 0948 nv (e6412ce5a04ed36f77e47244076efa95) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
2011/04/19 08:59:11.0694 0948 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/04/19 08:59:11.0694 0948 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/04/19 08:59:11.0727 0948 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2011/04/19 08:59:11.0760 0948 ossrv (99f877a7bb6feb5af1184eafe937c208) C:\WINDOWS\system32\drivers\ctoss2k.sys
2011/04/19 08:59:11.0776 0948 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
2011/04/19 08:59:11.0793 0948 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/04/19 08:59:11.0809 0948 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/04/19 08:59:11.0842 0948 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/04/19 08:59:11.0892 0948 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/04/19 08:59:11.0925 0948 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
2011/04/19 08:59:12.0008 0948 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/04/19 08:59:12.0041 0948 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/04/19 08:59:12.0057 0948 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/04/19 08:59:12.0123 0948 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/04/19 08:59:12.0140 0948 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/04/19 08:59:12.0156 0948 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/04/19 08:59:12.0173 0948 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/04/19 08:59:12.0190 0948 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/04/19 08:59:12.0206 0948 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/04/19 08:59:12.0239 0948 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2011/04/19 08:59:12.0272 0948 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/04/19 08:59:12.0305 0948 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/04/19 08:59:12.0338 0948 RimUsb (c48ed71f500f07a01aa8ac274e144e93) C:\WINDOWS\system32\Drivers\RimUsb.sys
2011/04/19 08:59:12.0421 0948 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/04/19 08:59:12.0454 0948 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
2011/04/19 08:59:12.0454 0948 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
2011/04/19 08:59:12.0487 0948 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/04/19 08:59:12.0553 0948 slabbus (886dbe1e6de104591e8b7334b6d42ed8) C:\WINDOWS\system32\DRIVERS\slabbus.sys
2011/04/19 08:59:12.0603 0948 slabser (ed71f8c82ef11c0da1c57be021a2fdc9) C:\WINDOWS\system32\DRIVERS\slabser.sys
2011/04/19 08:59:12.0669 0948 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/04/19 08:59:12.0702 0948 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/04/19 08:59:12.0735 0948 Srv (0f6aefad3641a657e18081f52d0c15af) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/04/19 08:59:12.0768 0948 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/04/19 08:59:12.0801 0948 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/04/19 08:59:12.0867 0948 symmpi (a42f863305943869ba00a613c8ee8c7e) C:\WINDOWS\system32\drivers\symmpi.sys
2011/04/19 08:59:12.0917 0948 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/04/19 08:59:12.0983 0948 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/04/19 08:59:12.0999 0948 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/04/19 08:59:13.0049 0948 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/04/19 08:59:13.0065 0948 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/04/19 08:59:13.0115 0948 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/04/19 08:59:13.0181 0948 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/04/19 08:59:13.0231 0948 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/04/19 08:59:13.0264 0948 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/04/19 08:59:13.0297 0948 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/04/19 08:59:13.0330 0948 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/04/19 08:59:13.0363 0948 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/04/19 08:59:13.0379 0948 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/04/19 08:59:13.0412 0948 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/04/19 08:59:13.0446 0948 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/04/19 08:59:13.0479 0948 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/04/19 08:59:13.0545 0948 \HardDisk0 - detected Rootkit.Win32.TDSS.tdl4 (0)
2011/04/19 08:59:13.0545 0948 ================================================================================
2011/04/19 08:59:13.0545 0948 Scan finished
2011/04/19 08:59:13.0545 0948 ================================================================================
2011/04/19 08:59:13.0545 3548 Detected object count: 1
2011/04/19 08:59:24.0717 3548 \HardDisk0 (Rootkit.Win32.TDSS.tdl4) - will be cured after reboot
2011/04/19 08:59:24.0717 3548 \HardDisk0 - ok
2011/04/19 08:59:24.0717 3548 Rootkit.Win32.TDSS.tdl4(\HardDisk0) - User select action: Cure
2011/04/19 08:59:28.0898 5064 Deinitialize success

Hello

I Would like you to do the following.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.

Link 1
Link 2
Link 3

1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following


• Log from Combofix
  
• let me know of any problems you may have had
  
• How is the computer doing now?

Gringo

Hello

48 Hour bump

It has been more than 48 hours since my last post.

• do you still need help with this?
  
• do you need more time?
  
• are you having problems following my instructions?
  
• if after 48hrs you have not replied to this thread then it will have to be closed!

Gringo

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days. Please include a link to your topic in the Private Message. Thank you.