BleepingComputer.com: TDSS/TDL ? Google redirects, svchost crashes, rootkit ?

Hi folks,

I am totally out of ideas, I freely admit I thought I could get this one on my own, and I probably did some stupid things, and ran some stuff I shouldn't have trying to get rid of my problem.

While I am not sure how I caught it, I first noticed search engine redirection - easy enough to get around, but seriously annoying.

I subsequently noticed that svchost, the one running with the netsvcs arg in the command line gets really bogged down. It turns out it's opening hundreds of TCPIP connections, so now I suspect I am part of a bot-net. Sometimes it gets so enthusiastic, it crashes svchost.

Finally I have one more problem which may prove serious - ever since this started I have been unable to successfully shut down or restart the PC, it always crashes just after the Windows is shutting down message gets onscreen, so tools that need to reboot to continue are frequently messed up because they never get to write their restart records, and they don't start themselves back up after the reboot.

I can tell you that without Defogger, GMER would never even see anything wrong, and TDSSKiller has NEVER scored a positive hit on this bug.

Logs attached:


.
DDS (Ver_11-03-05.01) - NTFSx86
Run by Compaq_Owner at 3:24:28.35 on Tue 05/03/2011
Internet Explorer: 9.0.8112.16421
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.1470.633 [GMT -4:00]
.
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k apphost
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\lxdxcoms.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe
C:\Windows\SOUNDMAN.EXE
C:\Windows\WindowsMobile\wmdSync.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\DAEMON Tools Lite\DTLite.exe
E:\Program Files\Office14\ONENOTEM.EXE
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\svchost.exe -k iissvcs
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
D:\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\svchost.exe -k WindowsMobile
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Windows\system32\vssvc.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Users\Compaq_Owner\Downloads\ProcessExplorer\procexp.exe
C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\rundll32.exe
C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Compaq_Owner\Desktop\dds.scr
.
============== Pseudo HJT Report ===============
.
uWindow Title = Internet Explorer, optimized for Bing and MSN
uURLSearchHooks: H - No File
uURLSearchHooks: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - c:\program files\vuze_remote\prxtbVuz0.dll
mURLSearchHooks: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - c:\program files\vuze_remote\prxtbVuz0.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngin0.dll
BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - d:\spybot~1\SDHelper.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - e:\progra~1\office14\GROOVEEX.DLL
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No File
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - e:\progra~1\office14\URLREDIR.DLL
BHO: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - c:\program files\vuze_remote\prxtbVuz0.dll
BHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn toolbar\platform\6.3.2380.0\npwinext.dll
BHO: SMTTB2009 Class: {fcbccb87-9224-4b8d-b117-f56d924beb18} - c:\program files\hypercam toolbar\tbcore3.dll
TB: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - c:\program files\vuze_remote\prxtbVuz0.dll
TB: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngin0.dll
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
TB: HyperCam Toolbar: {338b4dfe-2e2c-4338-9e41-e176d497299e} - c:\program files\hypercam toolbar\tbcore3.dll
TB: @c:\program files\msn toolbar\platform\6.3.2380.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - c:\program files\msn toolbar\platform\6.3.2380.0\npwinext.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [Google Update] "c:\users\compaq_owner\appdata\local\google\update\GoogleUpdate.exe" /c
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [SpybotSD TeaTimer] d:\spybot - search & destroy\TeaTimer.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [Zune Launcher] "c:\program files\zune\ZuneLauncher.exe"
mRun: [PWRISOVM.EXE] c:\program files\poweriso\PWRISOVM.EXE
mRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume
mRun: [lxdxmon.exe] "c:\program files\lexmark 3600-4600 series\lxdxmon.exe"
mRun: [EzPrint] "c:\program files\lexmark 3600-4600 series\ezprint.exe"
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [BCSSync] "e:\program files\office14\BCSSync.exe" /DelayServices
mRun: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
StartupFolder: c:\users\compaq~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\onenot~1.lnk - e:\program files\office14\ONENOTEM.EXE
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - e:\progra~1\office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - e:\progra~1\office14\ONBttnIE.dll/105
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - e:\program files\office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - e:\program files\office14\ONBttnIELinkedNotes.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - d:\spybot~1\SDHelper.dll
Trusted Zone: intuit.com\ttlc
DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - hxxp://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - e:\progra~1\office14\GROOVEEX.DLL
.
============= SERVICES / DRIVERS ===============
.
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2011-2-23 218688]
R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2011-2-24 21504]
R2 lxdx_device;lxdx_device;c:\windows\system32\lxdxcoms.exe -service --> c:\windows\system32\lxdxcoms.exe -service [?]
R2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2009-10-20 50704]
R2 SBSDWSCService;SBSD Security Center Service;d:\spybot - search & destroy\SDWinSec.exe [2011-4-26 1153368]
R3 WSDPrintDevice;WSD Print Support via UMB;c:\windows\system32\drivers\WSDPrint.sys [2011-2-24 16896]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 lxdxCATSCustConnectService;lxdxCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdxserv.exe [2011-2-20 94208]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;d:\lavasoft\ad-aware\AAWService.exe [2011-4-25 2146496]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;e:\program files\office14\GROOVE.EXE [2010-1-21 30963576]
S3 Normandy;Normandy SR2;c:\windows\system32\drivers\Normandy.sys [2011-5-3 34560]
S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]
S3 WMZuneComm;Zune Windows Mobile Connectivity Service;c:\program files\zune\WMZuneComm.exe [2010-11-11 268528]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
SUnknown PEVSystemStart;PEVSystemStart; [x]
.
=============== Created Last 30 ================
.
2011-05-03 07:01:37 34560 ----a-w- c:\windows\system32\drivers\Normandy.sys
2011-05-03 06:22:55 -------- d-----w- c:\program files\DIY DataRecovery MBRtool
2011-05-03 04:59:56 16968 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2011-05-03 04:59:20 -------- d-----w- c:\progra~2\Hitman Pro
2011-05-01 05:56:41 -------- d-----w- c:\program files\Exterminate It!
2011-05-01 00:22:25 135032 ----a-w- c:\windows\system32\drivers\dwprot.sys
2011-04-29 04:29:50 -------- d-----w- c:\users\compaq_owner\DoctorWeb
2011-04-29 01:48:31 -------- d-----w- c:\users\compaq~1\appdata\roaming\AVG
2011-04-28 05:34:42 -------- d-----w- c:\users\compaq~1\appdata\roaming\Malwarebytes
2011-04-28 05:34:27 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-04-28 05:34:27 -------- d-----w- c:\progra~2\Malwarebytes
2011-04-28 05:34:21 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-04-28 05:34:21 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-04-27 06:46:42 16432 ----a-w- c:\windows\system32\lsdelete.exe
2011-04-27 05:07:16 98392 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-04-27 04:49:31 -------- dc-h--w- c:\progra~2\{91EC863D-D912-4466-91CC-9489A4A2ADD3}
2011-04-27 04:33:26 -------- d-----w- c:\users\compaq~1\appdata\roaming\Safer Networking
2011-04-27 02:56:59 -------- d-----w- c:\progra~2\Spybot - Search & Destroy
2011-04-26 06:37:01 -------- d-----w- c:\users\compaq~1\appdata\roaming\PE Explorer
2011-04-26 03:11:05 -------- d-----w- c:\windows\Start Menu
2011-04-26 03:11:05 -------- d-----w- c:\windows\Desktop
2011-04-26 03:10:20 608448 ----a-w- c:\windows\system32\Comctl32.ocx
2011-04-26 03:10:20 198848 ----a-w- c:\windows\system32\Mci32.ocx
2011-04-26 03:10:16 558080 ----a-w- c:\windows\system32\temp.001
2011-04-26 03:10:16 1388544 ----a-w- c:\windows\system32\temp.000
2011-04-25 06:19:07 -------- d-----w- c:\users\compaq~1\appdata\roaming\Nemetschek
2011-04-25 04:27:33 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin7.dll
2011-04-25 04:27:33 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin6.dll
2011-04-25 04:27:33 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin5.dll
2011-04-25 04:27:33 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin4.dll
2011-04-25 04:27:33 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin3.dll
2011-04-25 04:27:32 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin2.dll
2011-04-25 04:27:32 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin.dll
2011-04-25 04:24:30 -------- d-----w- c:\users\compaq~1\appdata\local\Apple
2011-04-25 04:10:29 90112 ----a-w- c:\windows\unvise32.exe
2011-04-19 05:55:54 -------- d-----w- c:\users\compaq~1\appdata\local\Julien_Schapman
2011-04-19 05:53:55 -------- d-----w- c:\users\compaq~1\appdata\local\Windows Phone Device Manager
2011-04-19 05:52:08 -------- d-----w- c:\users\compaq~1\appdata\local\Xenocode
2011-04-19 05:51:56 -------- d-----w- c:\windows\WPDeviceManager
2011-04-19 05:50:02 -------- d-----w- c:\users\compaq~1\appdata\local\Downloaded Installations
2011-04-14 22:46:05 34304 ----a-w- c:\windows\system32\atmlib.dll
2011-04-14 22:46:05 292864 ----a-w- c:\windows\system32\atmfd.dll
2011-04-14 22:46:01 79360 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2011-04-14 22:46:01 69632 ----a-w- c:\windows\system32\drivers\bowser.sys
2011-04-14 22:46:01 213504 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-04-14 22:46:01 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-14 22:45:59 1162240 ----a-w- c:\windows\system32\mfc42u.dll
2011-04-14 22:45:59 1136640 ----a-w- c:\windows\system32\mfc42.dll
2011-04-14 22:45:56 2041856 ----a-w- c:\windows\system32\win32k.sys
2011-04-14 22:45:53 86528 ----a-w- c:\windows\system32\dnsrslvr.dll
2011-04-14 22:45:53 25088 ----a-w- c:\windows\system32\dnscacheugc.exe
2011-04-14 22:45:51 305152 ----a-w- c:\windows\system32\drivers\srv.sys
2011-04-14 22:45:51 146432 ----a-w- c:\windows\system32\drivers\srv2.sys
2011-04-14 22:45:51 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys
2011-04-14 22:45:49 739328 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-14 22:45:44 2409784 ----a-w- c:\program files\windows mail\OESpamFilter.dat
2011-04-14 02:17:52 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
2011-04-12 07:06:54 -------- d-----w- c:\program files\Microsoft Synchronization Services
2011-04-12 07:06:09 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2011-04-12 07:04:01 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2011-04-12 07:02:45 -------- d-----w- c:\program files\Microsoft Analysis Services
2011-04-12 07:02:16 -------- d-----w- c:\users\compaq~1\appdata\local\Microsoft Help
2011-04-10 22:53:57 -------- d-----w- C:\inetpub
2011-04-05 04:10:20 -------- d-----w- c:\program files\ABC Amber Text Converter
.
==================== Find3M ====================
.
2011-03-30 22:21:58 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2011-02-28 06:45:17 101888 ----a-w- c:\windows\system32\ifxcardm.dll
2011-02-28 06:45:09 82432 ----a-w- c:\windows\system32\axaltocm.dll
2011-02-22 14:13:01 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2011-02-22 13:33:12 1068544 ----a-w- c:\windows\system32\DWrite.dll
2011-02-22 13:33:09 797696 ----a-w- c:\windows\system32\FntCache.dll
2011-02-22 05:24:06 297808 ----a-w- c:\windows\system32\mscoree.dll
2011-02-22 05:24:06 1130824 ----a-w- c:\windows\system32\dfshim.dll
2011-02-22 05:24:05 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2011-02-22 05:24:05 49472 ----a-w- c:\windows\system32\netfxperf.dll
2011-02-22 05:24:05 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2011-02-22 05:13:00 1547776 ----a-w- c:\windows\system32\WMVDECOD.DLL
2011-02-22 00:35:49 695578 ----a-w- c:\windows\system32\unins000.exe
2011-02-21 08:04:21 377344 ----a-w- c:\windows\system32\winhttp.dll
2011-02-21 06:41:12 23552 ----a-w- c:\windows\system32\lpk.dll
2011-02-21 06:41:12 10240 ----a-w- c:\windows\system32\dciman32.dll
2011-02-21 06:30:09 61440 ----a-w- c:\windows\system32\winipsec.dll
2011-02-21 06:30:08 272896 ----a-w- c:\windows\system32\polstore.dll
2011-02-21 06:14:45 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2011-02-21 06:14:45 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2011-02-21 06:14:44 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2011-02-21 06:14:44 105984 ----a-w- c:\windows\system32\netiohlp.dll
2011-02-21 06:14:43 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2011-02-21 06:14:43 19968 ----a-w- c:\windows\system32\ARP.EXE
2011-02-21 06:14:43 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2011-02-21 06:14:43 10240 ----a-w- c:\windows\system32\finger.exe
2011-02-21 06:07:41 127488 ----a-w- c:\windows\system32\L2SecHC.dll
2011-02-21 06:07:39 68096 ----a-w- c:\windows\system32\wlanhlp.dll
2011-02-21 06:07:39 65024 ----a-w- c:\windows\system32\wlanapi.dll
2011-02-21 06:07:38 513536 ----a-w- c:\windows\system32\wlansvc.dll
2011-02-21 06:07:38 302592 ----a-w- c:\windows\system32\wlansec.dll
2011-02-21 06:07:38 293376 ----a-w- c:\windows\system32\wlanmsm.dll
2011-02-21 06:07:28 15181 ----a-w- c:\windows\system32\gatherWirelessInfo.vbs
2011-02-21 06:04:03 1401856 ----a-w- c:\windows\system32\msxml6.dll
2011-02-21 06:03:55 2048 ----a-w- c:\windows\system32\msxml3r.dll
2011-02-21 06:03:50 2048 ----a-w- c:\windows\system32\msxml6r.dll
2011-02-21 06:01:16 218624 ----a-w- c:\windows\system32\msv1_0.dll
2011-02-21 05:54:23 53248 ----a-w- c:\windows\system32\rrinstaller.exe
2011-02-21 05:54:23 24576 ----a-w- c:\windows\system32\mfpmp.exe
2011-02-21 05:54:23 2048 ----a-w- c:\windows\system32\mferror.dll
2011-02-21 05:42:58 71680 ----a-w- c:\windows\system32\atl.dll
2011-02-21 05:30:20 160256 ----a-w- c:\windows\system32\wkssvc.dll
2011-02-21 05:28:19 136192 ----a-w- c:\windows\system32\aaclient.dll
2011-02-21 05:28:18 53248 ----a-w- c:\windows\system32\tsgqec.dll
2011-02-21 05:19:23 714240 ----a-w- c:\windows\system32\timedate.cpl
2011-02-21 05:06:40 69632 ----a-w- c:\windows\system32\Mpeg2Data.ax
2011-02-21 05:00:19 623616 ----a-w- c:\windows\system32\localspl.dll
2011-02-21 04:48:26 175104 ----a-w- c:\windows\system32\wdigest.dll
2011-02-21 04:48:25 499712 ----a-w- c:\windows\system32\kerberos.dll
2011-02-21 04:48:24 72704 ----a-w- c:\windows\system32\secur32.dll
2011-02-21 04:48:23 9728 ----a-w- c:\windows\system32\lsass.exe
2011-02-21 04:48:23 1259008 ----a-w- c:\windows\system32\lsasrv.dll
2011-02-21 04:42:59 3104768 ----a-w- c:\windows\system32\NlsData0049.dll
2011-02-21 04:37:28 6656 ----a-w- c:\windows\system32\kbd106n.dll
2011-02-21 04:33:03 62464 ----a-w- c:\windows\system32\l3codeca.acm
2011-02-21 04:33:03 220672 ----a-w- c:\windows\system32\l3codecp.acm
2011-02-21 04:30:09 200704 ----a-w- c:\windows\system32\iphlpsvc.dll
2011-02-21 04:09:22 37888 ----a-w- c:\windows\system32\printcom.dll
2011-02-21 04:06:18 14848 ----a-w- c:\windows\system32\wshrm.dll
2011-02-21 04:05:04 313344 ----a-w- c:\windows\system32\wmpdxm.dll
2011-02-21 04:05:04 18432 ----a-w- c:\windows\system32\amcompat.tlb
2011-02-21 04:05:03 43520 ----a-w- c:\windows\system32\msdxm.tlb
2011-02-21 04:05:01 7680 ----a-w- c:\windows\system32\spwmp.dll
2011-02-21 04:05:01 4096 ----a-w- c:\windows\system32\dxmasf.dll
2011-02-21 04:05:00 4096 ----a-w- c:\windows\system32\msdxm.ocx
2011-02-21 04:02:50 332288 ----a-w- c:\windows\system32\msdrm.dll
2011-02-21 04:02:49 347136 ----a-w- c:\windows\system32\RMActivate_ssp.exe
2011-02-21 04:02:49 152064 ----a-w- c:\windows\system32\secproc_ssp.dll
2011-02-21 04:02:47 346624 ----a-w- c:\windows\system32\RMActivate_ssp_isv.exe
2011-02-21 04:02:47 152576 ----a-w- c:\windows\system32\secproc_ssp_isv.dll
2011-02-21 04:02:43 471552 ----a-w- c:\windows\system32\secproc.dll
2011-02-21 04:02:41 518144 ----a-w- c:\windows\system32\RMActivate.exe
2011-02-21 04:02:37 526336 ----a-w- c:\windows\system32\RMActivate_isv.exe
2011-02-21 04:02:36 471552 ----a-w- c:\windows\system32\secproc_isv.dll
2011-02-21 03:12:48 2560 ----a-w- c:\windows\apppatch\AcRes.dll
2011-02-21 03:11:12 84480 ----a-w- c:\windows\system32\INETRES.dll
2011-02-21 03:10:47 60928 ----a-w- c:\windows\system32\msasn1.dll
2011-02-21 03:09:37 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2011-02-21 03:08:45 51712 ----a-w- c:\windows\system32\admwprox.dll
2011-02-21 03:08:45 153600 ----a-w- c:\windows\system32\iisRtl.dll
2011-02-21 03:08:44 27136 ----a-w- c:\windows\system32\ahadmin.dll
2011-02-21 03:08:44 10752 ----a-w- c:\windows\system32\wamregps.dll
2011-02-21 03:08:43 14848 ----a-w- c:\windows\system32\iisreset.exe
2011-02-21 03:08:42 8192 ----a-w- c:\windows\system32\iisrstap.dll
2011-02-21 03:08:36 30720 ----a-w- c:\windows\system32\httpapi.dll
2011-02-21 03:08:36 24064 ----a-w- c:\windows\system32\nshhttp.dll
2011-02-21 03:06:06 243712 ----a-w- c:\windows\system32\rastls.dll
2011-02-21 03:05:42 355328 ----a-w- c:\windows\system32\WSDApi.dll
2011-02-21 03:04:04 91136 ----a-w- c:\windows\system32\avifil32.dll
2011-02-21 03:04:04 82944 ----a-w- c:\windows\system32\mciavi32.dll
2011-02-21 03:04:04 65024 ----a-w- c:\windows\system32\avicap32.dll
2011-02-21 03:04:04 123904 ----a-w- c:\windows\system32\msvfw32.dll
2011-02-21 03:04:03 31744 ----a-w- c:\windows\system32\msvidc32.dll
2011-02-21 03:04:03 13312 ----a-w- c:\windows\system32\msrle32.dll
2011-02-21 03:04:03 1314816 ----a-w- c:\windows\system32\quartz.dll
2011-02-21 03:04:02 50176 ----a-w- c:\windows\system32\iyuv_32.dll
2011-02-21 03:04:02 22528 ----a-w- c:\windows\system32\msyuv.dll
2011-02-21 03:04:02 12288 ----a-w- c:\windows\system32\tsbyuv.dll
2011-02-21 03:03:24 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL
2011-02-21 03:02:45 310784 ----a-w- c:\windows\system32\unregmp2.exe
.
============= FINISH: 3:25:34.88 ===============





GMER 1.0.15.15572 - http://www.gmer.net
Rootkit scan 2011-05-03 03:34:42
Windows 6.0.6002 Service Pack 2 Harddisk1\DR1 -> \Device\Ide\IdePort3 ST3200822A rev.3.02
Running: gmer.exe; Driver: C:\Users\COMPAQ~1\AppData\Local\Temp\uwdoikob.sys


---- Kernel code sections - GMER 1.0.15 ----

? C:\Windows\system32\Drivers\PROCEXP113.SYS The system cannot find the file specified. !
? C:\Windows\system32\Drivers\PROCEXP141.SYS The system cannot find the file specified. !
? C:\Users\COMPAQ~1\AppData\Local\Temp\mbr.sys The system cannot find the file specified. !

---- User code sections - GMER 1.0.15 ----

.text C:\Windows\Explorer.EXE[2020] ntdll.dll!NtProtectVirtualMemory 773F4B84 5 Bytes JMP 0084000A
.text C:\Windows\Explorer.EXE[2020] ntdll.dll!NtWriteVirtualMemory 773F54C4 5 Bytes JMP 0085000A
.text C:\Windows\Explorer.EXE[2020] ntdll.dll!KiUserExceptionDispatcher 773F5BF8 5 Bytes JMP 0083000A
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2128] ntdll.dll!NtCreateFile + 6 773F422A 4 Bytes [28, 00, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2128] ntdll.dll!NtCreateFile + B 773F422F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2128] ntdll.dll!NtMapViewOfSection + 6 773F497A 1 Byte [28]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2128] ntdll.dll!NtMapViewOfSection + 6 773F497A 4 Bytes [28, 03, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2128] ntdll.dll!NtMapViewOfSection + B 773F497F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2128] ntdll.dll!NtOpenFile + 6 773F4A0A 4 Bytes [68, 00, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2128] ntdll.dll!NtOpenFile + B 773F4A0F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2128] ntdll.dll!NtOpenProcess + 6 773F4A8A 4 Bytes [A8, 01, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2128] ntdll.dll!NtOpenProcess + B 773F4A8F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2128] ntdll.dll!NtOpenProcessToken + B 773F4A9F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2128] ntdll.dll!NtOpenProcessTokenEx + 6 773F4AAA 4 Bytes [A8, 02, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2128] ntdll.dll!NtOpenProcessTokenEx + B 773F4AAF 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2128] ntdll.dll!NtOpenThread + 6 773F4AFA 4 Bytes [68, 01, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2128] ntdll.dll!NtOpenThread + B 773F4AFF 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2128] ntdll.dll!NtOpenThreadToken + 6 773F4B0A 4 Bytes [68, 02, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2128] ntdll.dll!NtOpenThreadToken + B 773F4B0F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2128] ntdll.dll!NtOpenThreadTokenEx + B 773F4B1F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2128] ntdll.dll!NtQueryAttributesFile + 6 773F4BAA 4 Bytes [A8, 00, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2128] ntdll.dll!NtQueryAttributesFile + B 773F4BAF 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2128] ntdll.dll!NtQueryFullAttributesFile + B 773F4C5F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2128] ntdll.dll!NtSetInformationFile + 6 773F513A 4 Bytes [28, 01, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2128] ntdll.dll!NtSetInformationFile + B 773F513F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2128] ntdll.dll!NtSetInformationThread + 6 773F518A 4 Bytes [28, 02, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2128] ntdll.dll!NtSetInformationThread + B 773F518F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2128] ntdll.dll!NtUnmapViewOfSection + 6 773F542A 1 Byte [68]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2128] ntdll.dll!NtUnmapViewOfSection + 6 773F542A 4 Bytes [68, 03, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2128] ntdll.dll!NtUnmapViewOfSection + B 773F542F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2528] ntdll.dll!NtCreateFile + 6 773F422A 4 Bytes [28, 00, 16, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2528] ntdll.dll!NtCreateFile + B 773F422F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2528] ntdll.dll!NtMapViewOfSection + 6 773F497A 1 Byte [28]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2528] ntdll.dll!NtMapViewOfSection + 6 773F497A 4 Bytes [28, 03, 16, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2528] ntdll.dll!NtMapViewOfSection + B 773F497F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2528] ntdll.dll!NtOpenFile + 6 773F4A0A 4 Bytes [68, 00, 16, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2528] ntdll.dll!NtOpenFile + B 773F4A0F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2528] ntdll.dll!NtOpenProcess + 6 773F4A8A 4 Bytes [A8, 01, 16, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2528] ntdll.dll!NtOpenProcess + B 773F4A8F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2528] ntdll.dll!NtOpenProcessToken + B 773F4A9F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2528] ntdll.dll!NtOpenProcessTokenEx + 6 773F4AAA 4 Bytes [A8, 02, 16, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2528] ntdll.dll!NtOpenProcessTokenEx + B 773F4AAF 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2528] ntdll.dll!NtOpenThread + 6 773F4AFA 4 Bytes [68, 01, 16, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2528] ntdll.dll!NtOpenThread + B 773F4AFF 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2528] ntdll.dll!NtOpenThreadToken + 6 773F4B0A 4 Bytes [68, 02, 16, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2528] ntdll.dll!NtOpenThreadToken + B 773F4B0F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2528] ntdll.dll!NtOpenThreadTokenEx + B 773F4B1F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2528] ntdll.dll!NtQueryAttributesFile + 6 773F4BAA 4 Bytes [A8, 00, 16, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2528] ntdll.dll!NtQueryAttributesFile + B 773F4BAF 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2528] ntdll.dll!NtQueryFullAttributesFile + B 773F4C5F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2528] ntdll.dll!NtSetInformationFile + 6 773F513A 4 Bytes [28, 01, 16, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2528] ntdll.dll!NtSetInformationFile + B 773F513F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2528] ntdll.dll!NtSetInformationThread + 6 773F518A 4 Bytes [28, 02, 16, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2528] ntdll.dll!NtSetInformationThread + B 773F518F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2528] ntdll.dll!NtUnmapViewOfSection + 6 773F542A 1 Byte [68]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2528] ntdll.dll!NtUnmapViewOfSection + 6 773F542A 4 Bytes [68, 03, 16, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[2528] ntdll.dll!NtUnmapViewOfSection + B 773F542F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3324] ntdll.dll!NtCreateFile + 6 773F422A 4 Bytes [28, 00, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3324] ntdll.dll!NtCreateFile + B 773F422F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3324] ntdll.dll!NtMapViewOfSection + 6 773F497A 1 Byte [28]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3324] ntdll.dll!NtMapViewOfSection + 6 773F497A 4 Bytes [28, 03, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3324] ntdll.dll!NtMapViewOfSection + B 773F497F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3324] ntdll.dll!NtOpenFile + 6 773F4A0A 4 Bytes [68, 00, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3324] ntdll.dll!NtOpenFile + B 773F4A0F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3324] ntdll.dll!NtOpenProcess + 6 773F4A8A 4 Bytes [A8, 01, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3324] ntdll.dll!NtOpenProcess + B 773F4A8F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3324] ntdll.dll!NtOpenProcessToken + B 773F4A9F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3324] ntdll.dll!NtOpenProcessTokenEx + 6 773F4AAA 4 Bytes [A8, 02, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3324] ntdll.dll!NtOpenProcessTokenEx + B 773F4AAF 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3324] ntdll.dll!NtOpenThread + 6 773F4AFA 4 Bytes [68, 01, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3324] ntdll.dll!NtOpenThread + B 773F4AFF 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3324] ntdll.dll!NtOpenThreadToken + 6 773F4B0A 4 Bytes [68, 02, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3324] ntdll.dll!NtOpenThreadToken + B 773F4B0F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3324] ntdll.dll!NtOpenThreadTokenEx + B 773F4B1F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3324] ntdll.dll!NtQueryAttributesFile + 6 773F4BAA 4 Bytes [A8, 00, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3324] ntdll.dll!NtQueryAttributesFile + B 773F4BAF 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3324] ntdll.dll!NtQueryFullAttributesFile + B 773F4C5F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3324] ntdll.dll!NtSetInformationFile + 6 773F513A 4 Bytes [28, 01, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3324] ntdll.dll!NtSetInformationFile + B 773F513F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3324] ntdll.dll!NtSetInformationThread + 6 773F518A 4 Bytes [28, 02, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3324] ntdll.dll!NtSetInformationThread + B 773F518F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3324] ntdll.dll!NtUnmapViewOfSection + 6 773F542A 1 Byte [68]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3324] ntdll.dll!NtUnmapViewOfSection + 6 773F542A 4 Bytes [68, 03, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3324] ntdll.dll!NtUnmapViewOfSection + B 773F542F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3688] ntdll.dll!NtCreateFile + 6 773F422A 4 Bytes [28, 00, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3688] ntdll.dll!NtCreateFile + B 773F422F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3688] ntdll.dll!NtMapViewOfSection + 6 773F497A 1 Byte [28]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3688] ntdll.dll!NtMapViewOfSection + 6 773F497A 4 Bytes [28, 03, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3688] ntdll.dll!NtMapViewOfSection + B 773F497F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3688] ntdll.dll!NtOpenFile + 6 773F4A0A 4 Bytes [68, 00, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3688] ntdll.dll!NtOpenFile + B 773F4A0F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3688] ntdll.dll!NtOpenProcess + 6 773F4A8A 4 Bytes [A8, 01, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3688] ntdll.dll!NtOpenProcess + B 773F4A8F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3688] ntdll.dll!NtOpenProcessToken + B 773F4A9F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3688] ntdll.dll!NtOpenProcessTokenEx + 6 773F4AAA 4 Bytes [A8, 02, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3688] ntdll.dll!NtOpenProcessTokenEx + B 773F4AAF 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3688] ntdll.dll!NtOpenThread + 6 773F4AFA 4 Bytes [68, 01, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3688] ntdll.dll!NtOpenThread + B 773F4AFF 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3688] ntdll.dll!NtOpenThreadToken + 6 773F4B0A 4 Bytes [68, 02, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3688] ntdll.dll!NtOpenThreadToken + B 773F4B0F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3688] ntdll.dll!NtOpenThreadTokenEx + B 773F4B1F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3688] ntdll.dll!NtQueryAttributesFile + 6 773F4BAA 4 Bytes [A8, 00, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3688] ntdll.dll!NtQueryAttributesFile + B 773F4BAF 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3688] ntdll.dll!NtQueryFullAttributesFile + B 773F4C5F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3688] ntdll.dll!NtSetInformationFile + 6 773F513A 4 Bytes [28, 01, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3688] ntdll.dll!NtSetInformationFile + B 773F513F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3688] ntdll.dll!NtSetInformationThread + 6 773F518A 4 Bytes [28, 02, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3688] ntdll.dll!NtSetInformationThread + B 773F518F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3688] ntdll.dll!NtUnmapViewOfSection + 6 773F542A 1 Byte [68]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3688] ntdll.dll!NtUnmapViewOfSection + 6 773F542A 4 Bytes [68, 03, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[3688] ntdll.dll!NtUnmapViewOfSection + B 773F542F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[5612] ntdll.dll!NtCreateFile + 6 773F422A 4 Bytes [28, 00, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[5612] ntdll.dll!NtCreateFile + B 773F422F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[5612] ntdll.dll!NtMapViewOfSection + 6 773F497A 1 Byte [28]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[5612] ntdll.dll!NtMapViewOfSection + 6 773F497A 4 Bytes [28, 03, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[5612] ntdll.dll!NtMapViewOfSection + B 773F497F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[5612] ntdll.dll!NtOpenFile + 6 773F4A0A 4 Bytes [68, 00, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[5612] ntdll.dll!NtOpenFile + B 773F4A0F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[5612] ntdll.dll!NtOpenProcess + 6 773F4A8A 4 Bytes [A8, 01, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[5612] ntdll.dll!NtOpenProcess + B 773F4A8F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[5612] ntdll.dll!NtOpenProcessToken + B 773F4A9F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[5612] ntdll.dll!NtOpenProcessTokenEx + 6 773F4AAA 4 Bytes [A8, 02, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[5612] ntdll.dll!NtOpenProcessTokenEx + B 773F4AAF 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[5612] ntdll.dll!NtOpenThread + 6 773F4AFA 4 Bytes [68, 01, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[5612] ntdll.dll!NtOpenThread + B 773F4AFF 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[5612] ntdll.dll!NtOpenThreadToken + 6 773F4B0A 4 Bytes [68, 02, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[5612] ntdll.dll!NtOpenThreadToken + B 773F4B0F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[5612] ntdll.dll!NtOpenThreadTokenEx + B 773F4B1F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[5612] ntdll.dll!NtQueryAttributesFile + 6 773F4BAA 4 Bytes [A8, 00, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[5612] ntdll.dll!NtQueryAttributesFile + B 773F4BAF 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[5612] ntdll.dll!NtQueryFullAttributesFile + B 773F4C5F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[5612] ntdll.dll!NtSetInformationFile + 6 773F513A 4 Bytes [28, 01, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[5612] ntdll.dll!NtSetInformationFile + B 773F513F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[5612] ntdll.dll!NtSetInformationThread + 6 773F518A 4 Bytes [28, 02, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[5612] ntdll.dll!NtSetInformationThread + B 773F518F 1 Byte [E2]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[5612] ntdll.dll!NtUnmapViewOfSection + 6 773F542A 1 Byte [68]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[5612] ntdll.dll!NtUnmapViewOfSection + 6 773F542A 4 Bytes [68, 03, 06, 00]
.text C:\Users\Compaq_Owner\AppData\Local\Google\Chrome\Application\chrome.exe[5612] ntdll.dll!NtUnmapViewOfSection + B 773F542F 1 Byte [E2]
.text C:\Windows\system32\svchost.exe[5996] ntdll.dll!NtProtectVirtualMemory 773F4B84 5 Bytes JMP 0082000A
.text C:\Windows\system32\svchost.exe[5996] ntdll.dll!NtWriteVirtualMemory 773F54C4 5 Bytes JMP 0083000A
.text C:\Windows\system32\svchost.exe[5996] ntdll.dll!KiUserExceptionDispatcher 773F5BF8 5 Bytes JMP 0081000A
.text C:\Windows\system32\svchost.exe[5996] ole32.dll!CoCreateInstance 770F9F3E 5 Bytes JMP 0099000A

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch@Epoch 1446

---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk1\DR1 sector 00: rootkit-like behavior

---- EOF - GMER 1.0.15 ----

Hello and welcome to the forums!

My secret agent name on the forums is SweetTech (you can call me ST for short), it's a pleasure to meet you.

I am very sorry for the delay in responding, but as you can see we are at the moment being flooded with logs which, when paired with the never-ending shortage of helpers, resulted in the delayed responding to your thread.

I would be glad to take a look at your log and help you with solving any malware problems.

If you have since resolved the issues you were originally experiencing, or have received help elsewhere, please inform me so that this topic can be closed.

If you have not, please adhere to the guidelines below and then follow instructions as outlined further below:

• Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forums.
  
  
• Please make sure to carefully read any instruction that I give you. Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.
  
  
• If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
  
  
• In Windows Vista and Windows 7, all tools need to be started by right clicking and selecting Run as Administrator!
  
  
• If I instruct you to download a specific tool in which you already have, please delete the copy that you have and re-download the tool. The reason I ask you to do this is because these tools are updated fairly regularly.
  
  
• Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
  
  
• Please do not use the Attachment feature for any log file. Do a Copy/Paste of the entire contents of the log file and submit it inside your post.
  
  
• I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together ;)
  Because of this, you must reply within three days failure to reply will result in the topic being closed!
  
  
• Please do not PM me directly for help. If you have any questions, post them in this topic.
  
  
• Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
  Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.

____________________________________________________

Running TDSSKiller

Please read carefully and follow these steps.

• Download TDSSKiller and save it to your Desktop.
  
• Extract its contents to your desktop.
  
• Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  
  
  
  
  
  
• If an infected file is detected, the default action will be Cure, click on Continue.
  
  
  
  
  
  
• If a suspicious file is detected, the default action will be Skip, click on Continue.
  
  
  
  
  
  
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  
  
  
  
  
  
• If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
  
• If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

NEXT:



Running OTL

We need to create an OTL Report

• Please download OTL from one of the following mirrors:
  • This is THE Mirror
  
  
• Save it to your desktop.
  
• Double click on the icon on your desktop.
  
• Click the "Scan All Users" checkbox.
  
• Push the button.
  
• Two reports will open, copy and paste them in a reply here:
  • OTL.txt <-- Will be opened
    
  • Extra.txt <-- Will be minimized

NEXT:


Please provide an update on how things are running in your next reply.

Hi ST,

Thanks so much for getting back to me. I can see that you guys are flooded with issues right now.

As of the moment of writing, I am no longer experiencing the problems I had. Here's what happened:

I admit that i finally gave up waiting. I tried running Symantec's FixTDSS since it was yet another tool that promised results, and I hadn't tried it yet.

It spotted something and said it needed to reboot to fix - upon reboot it looked like this tool might be getting the right idea, since it was absolutely the first thing to run once windows opened, however, it didn't fix the problem, coming back instead with an error.

I figured I would try again, and this time when it rebooted, it couldn't find it's own driver, Windows promptly crashed, and now wouldn't reboot at all, giving the error that a critical driver was missing, you guessed it, FixTDSS.sys - my only option now was to do a Windows Recover/Repair using my Windows disk, as suggested by the Microsoft Boot Manager.

Here's where it gets weird - IT WORKED. The only thing that I thought from all my reading wouldn't be worth a damn as a fix turned out to be the one thing that worked. Once it was finished it reported replacing several damaged files, I wish I had taken notes but don't remember them all, it also said Defender had spotted and removed some threats. After Windows booted back up, it was able to quickly complete it's updates, and everything seems fine.

I have always had pretty solid Anit-Malware protection, and I have replaced it all at it's pre-infection levels, all updated, etc. I wish I knew how I caught this one, I guess I missed something, but I'll be watching.

Thanks for getting back to me - now you can move on to someone less fortunate than myself!!

Andy

Andy,

Thanks for posting back to let me know you no longer need assistance.

Please take care.

Kindest Regards,
ST.

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.