BleepingComputer.com: Possible rootkit after with browser redict

Jump to content

Forum Guidelines

Posted Image Read the following topic before creating a new topic in this forum. It contains instructions on the what we would like you to post, which will enable us to help you more quickly.

Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help


Posted Image Unfortunately, with the amount of logs we receive per day, the average response time is 5 days. I want to assure you, though, that your topic will be looked at and responded to. So please be patient.


Posted Image DO NOT RUN ComboFix unless requested to.


Posted Image Only members of the Malware Response Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log.


Posted Image When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc.


Posted Image Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.
Page 1 of 1
  • You cannot start a new topic
  • This topic is locked

Possible rootkit after with browser redict

#1 User is offline   bmack36 

  • New Member
  • Pip
  • Find Topics
  • Group: Members
  • Posts: 1
  • Joined: 15-September 11

Posted 15 September 2011 - 07:02 PM

My Wife managed to get a virus on her computer. I ran spybot, but it did not detect anything. I ran panda activescan which found a virus and i was able to remove it. The computer still appeared to be having issues so i installed malwarebytes. malwarebytes did not find anything, but it keeps on popping up blocked access to potentially malicious website messages and a svchost.exe is using a lot of memory and processor. I ran DDS and here is my log. I also ran gmer but it keeps on bluescreening on me. I attached as much as i could get from the gmer log. I will try and get a more complete log. This laptop is running windows vista.

DDS log

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 7.0.6000.16982 BrowserJavaVersion: 1.6.0_26
Run by Regan at 18:45:55 on 2011-09-15
Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1252.1.1033.18.2038.996 [GMT -4:00]
.
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Windows\System32\WLTRYSVC.EXE
C:\Windows\System32\bcmwltry.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
C:\Windows\system32\Dwm.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\STacSV.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Symantec AntiVirus\VPTray.exe
C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\Taskmgr.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\Downloaded Program Files\FP_AX_CAB_INSTALLER.exe
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uWindow Title = Internet Explorer provided by Dell
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
mRun: [Apoint] c:\program files\delltpad\Apoint.exe
mRun: [SigmatelSysTrayApp] c:\program files\sigmatel\c-major audio\wdm\sttray.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [PCMService] "c:\program files\dell\mediadirect\PCMService.exe"
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [vptray] c:\progra~1\symant~1\VPTray.exe
mRun: [USBToolTip] c:\progra~1\pinnacle\shared~1\programs\usbtip\USBTip.exe
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
mRun: [MSConfig] "c:\windows\system32\msconfig.exe" /auto
uPolicies-explorer: HideSCAHealth = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{8A807E17-9170-4D21-83C6-7EC8F58318C3} : DhcpNameServer = 163.244.112.71 10.101.101.100 163.244.101.69 163.244.100.254 163.244.112.254 10.101.101.254
TCP: Interfaces\{D7D75328-54D6-4485-9506-BEDCE8491202} : DhcpNameServer = 192.168.1.1
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
Notify: igfxcui - igfxdev.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\regan\appdata\roaming\mozilla\firefox\profiles\7wnnxc7v.regan\
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPTURNMED.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPUploader.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprpchromebrowserrecordext.dll
FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
FF - plugin: c:\users\regan\appdata\local\google\update\1.3.21.69\npGoogleUpdate3.dll
FF - plugin: c:\users\regan\appdata\roaming\facebook\npfbplugin_1_0_1.dll
FF - plugin: c:\users\regan\appdata\roaming\facebook\npfbplugin_1_0_3.dll
FF - plugin: c:\users\regan\appdata\roaming\move networks\plugins\npqmp071503000010.dll
FF - plugin: c:\users\regan\appdata\roaming\move networks\plugins\npqmp071701000002.dll
.
============= SERVICES / DRIVERS ===============
.
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2011-9-7 28552]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-22 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-12 67664]
R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCore.exe [2011-8-11 116608]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-9-13 366152]
R2 Symantec AntiVirus;Symantec AntiVirus;c:\program files\symantec antivirus\Rtvscan.exe [2006-11-28 1962136]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2007-8-1 179712]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2011-8-5 105592]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-9-13 22216]
S3 SavRoam;SAVRoam;c:\program files\symantec antivirus\SavRoam.exe [2006-11-28 122008]
S4 Seagate Sync Service;Seagate Sync Service;c:\program files\seagate\sync\SeaSyncServices.exe [2007-1-18 24120]
.
=============== Created Last 30 ================
.
2011-09-15 21:54:19 -------- d-----w- c:\users\regan\appdata\roaming\SUPERAntiSpyware.com
2011-09-15 21:53:48 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2011-09-15 21:53:48 -------- d-----w- c:\program files\SUPERAntiSpyware
2011-09-14 22:28:16 -------- d-----w- c:\users\regan\Pavark
2011-09-14 11:50:44 396800 ----a-w- c:\windows\system32\drivers\http.sys
2011-09-14 11:50:43 31232 ----a-w- c:\windows\system32\httpapi.dll
2011-09-14 11:50:43 24064 ----a-w- c:\windows\system32\nshhttp.dll
2011-09-14 11:49:41 378368 ----a-w- c:\windows\system32\winhttp.dll
2011-09-14 03:01:39 58368 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2011-09-14 03:01:39 211968 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-09-14 03:01:39 102400 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-09-14 03:00:41 171520 ----a-w- c:\windows\system32\wintrust.dll
2011-09-14 02:59:50 494592 ----a-w- c:\windows\system32\kerberos.dll
2011-09-14 02:59:49 272384 ----a-w- c:\windows\system32\schannel.dll
2011-09-14 02:58:59 549888 ----a-w- c:\windows\system32\rpcss.dll
2011-09-14 02:58:55 24576 ----a-w- c:\windows\system32\printfilterpipelineprxy.dll
2011-09-14 02:58:54 654336 ----a-w- c:\windows\system32\printfilterpipelinesvc.exe
2011-09-14 02:58:53 501760 ----a-w- c:\windows\system32\wbem\WmiPrvSD.dll
2011-09-14 02:58:53 247296 ----a-w- c:\windows\system32\wbem\WmiPrvSE.exe
2011-09-14 02:58:53 130560 ----a-w- c:\windows\system32\wbem\WmiDcPrv.dll
2011-09-14 02:58:52 614912 ----a-w- c:\windows\system32\wbem\fastprox.dll
2011-09-14 02:58:51 53248 ----a-w- c:\windows\system32\iasads.dll
2011-09-14 02:58:51 37888 ----a-w- c:\windows\system32\iasdatastore.dll
2011-09-14 02:58:50 97280 ----a-w- c:\windows\system32\iasrecst.dll
2011-09-14 02:58:50 158720 ----a-w- c:\windows\system32\sdohlp.dll
2011-09-14 02:57:58 62464 ----a-w- c:\windows\system32\l3codeca.acm
2011-09-14 02:57:58 220672 ----a-w- c:\windows\system32\l3codecp.acm
2011-09-14 02:56:38 25600 ----a-w- c:\windows\system32\amxread.dll
2011-09-14 02:56:38 14848 ----a-w- c:\windows\system32\apilogen.dll
2011-09-14 02:55:44 97792 ----a-w- c:\windows\system32\cabview.dll
2011-09-14 02:55:09 441856 ----a-w- c:\windows\system32\win32spl.dll
2011-09-14 02:55:09 37376 ----a-w- c:\windows\system32\printcom.dll
2011-09-14 02:54:28 2031104 ----a-w- c:\windows\system32\win32k.sys
2011-09-14 02:53:15 8147968 ----a-w- c:\windows\system32\wmploc.DLL
2011-09-14 02:53:12 7680 ----a-w- c:\windows\system32\spwmp.dll
2011-09-14 02:53:12 4096 ----a-w- c:\windows\system32\dxmasf.dll
2011-09-14 02:53:12 168960 ----a-w- c:\program files\windows media player\wmplayer.exe
2011-09-14 02:53:12 107520 ----a-w- c:\program files\windows media player\wmpshare.exe
2011-09-14 02:53:11 4096 ----a-w- c:\windows\system32\msdxm.ocx
2011-09-14 02:53:11 107520 ----a-w- c:\program files\windows media player\wmpconfig.exe
2011-09-14 02:53:05 313344 ----a-w- c:\windows\system32\wmpdxm.dll
2011-09-14 02:53:04 43520 ----a-w- c:\windows\system32\msdxm.tlb
2011-09-14 02:53:04 18432 ----a-w- c:\windows\system32\amcompat.tlb
2011-09-14 02:45:28 622080 ----a-w- c:\windows\system32\icardagt.exe
2011-09-14 02:45:28 11264 ----a-w- c:\windows\system32\icardres.dll
2011-09-14 02:45:27 97800 ----a-w- c:\windows\system32\infocardapi.dll
2011-09-14 02:45:27 37384 ----a-w- c:\windows\system32\infocardcpl.cpl
2011-09-14 02:45:14 105016 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2011-09-14 02:45:10 781344 ----a-w- c:\windows\system32\PresentationNative_v0300.dll
2011-09-14 02:45:10 43544 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2011-09-14 02:45:10 326160 ----a-w- c:\windows\system32\PresentationHost.exe
2011-09-14 02:18:48 788992 ----a-w- c:\windows\system32\rpcrt4.dll
2011-09-14 01:55:08 156672 ----a-w- c:\windows\system32\t2embed.dll
2011-09-14 01:55:07 72704 ----a-w- c:\windows\system32\fontsub.dll
2011-09-14 01:55:07 34304 ----a-w- c:\windows\system32\atmlib.dll
2011-09-14 01:55:07 289792 ----a-w- c:\windows\system32\atmfd.dll
2011-09-14 01:55:07 24064 ----a-w- c:\windows\system32\lpk.dll
2011-09-14 01:55:07 10240 ----a-w- c:\windows\system32\dciman32.dll
2011-09-14 01:51:15 84992 ----a-w- c:\windows\system32\drivers\srvnet.sys
2011-09-14 01:51:14 306688 ----a-w- c:\windows\system32\drivers\srv.sys
2011-09-14 01:50:32 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2011-09-14 01:50:32 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2011-09-14 01:50:32 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2011-09-14 01:50:32 19968 ----a-w- c:\windows\system32\ARP.EXE
2011-09-14 01:50:32 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2011-09-14 01:50:32 15360 ----a-w- c:\windows\system32\netevent.dll
2011-09-14 01:50:32 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2011-09-14 01:50:32 103936 ----a-w- c:\windows\system32\netiohlp.dll
2011-09-14 01:50:32 10240 ----a-w- c:\windows\system32\finger.exe
2011-09-14 01:49:29 123904 ----a-w- c:\windows\system32\L2SecHC.dll
2011-09-14 01:49:28 67584 ----a-w- c:\windows\system32\wlanhlp.dll
2011-09-14 01:49:28 502272 ----a-w- c:\windows\system32\wlansvc.dll
2011-09-14 01:49:28 47104 ----a-w- c:\windows\system32\wlanapi.dll
2011-09-14 01:49:28 290816 ----a-w- c:\windows\system32\wlanmsm.dll
2011-09-14 01:49:27 297984 ----a-w- c:\windows\system32\wlansec.dll
2011-09-14 01:48:41 2048 ----a-w- c:\windows\system32\msxml3r.dll
2011-09-14 01:48:41 1260032 ----a-w- c:\windows\system32\msxml3.dll
2011-09-14 01:48:40 2048 ----a-w- c:\windows\system32\msxml6r.dll
2011-09-14 01:48:40 1406464 ----a-w- c:\windows\system32\msxml6.dll
2011-09-14 01:47:52 7680 ----a-w- c:\windows\system32\lsass.exe
2011-09-14 01:47:52 72704 ----a-w- c:\windows\system32\secur32.dll
2011-09-14 01:47:52 408136 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2011-09-14 01:47:52 216576 ----a-w- c:\windows\system32\msv1_0.dll
2011-09-14 01:47:52 175104 ----a-w- c:\windows\system32\wdigest.dll
2011-09-14 01:47:52 1233920 ----a-w- c:\windows\system32\lsasrv.dll
2011-09-14 01:47:09 2855424 ----a-w- c:\windows\system32\mf.dll
2011-09-14 01:47:08 98816 ----a-w- c:\windows\system32\mfps.dll
2011-09-14 01:47:08 52736 ----a-w- c:\windows\system32\rrinstaller.exe
2011-09-14 01:47:08 24576 ----a-w- c:\windows\system32\mfpmp.exe
2011-09-14 01:47:08 2048 ----a-w- c:\windows\system32\mferror.dll
2011-09-14 01:46:22 3502480 ----a-w- c:\windows\system32\ntkrnlpa.exe
2011-09-14 01:46:21 3468168 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-09-14 01:45:04 434176 ----a-w- c:\windows\system32\vbscript.dll
2011-09-14 01:44:27 71680 ----a-w- c:\windows\system32\atl.dll
2011-09-14 01:43:53 297472 ----a-w- c:\windows\system32\gdi32.dll
2011-09-14 01:42:16 500736 ----a-w- c:\windows\system32\msdtcprx.dll
2011-09-14 01:42:16 30208 ----a-w- c:\windows\system32\xolehlp.dll
2011-09-14 01:41:40 156160 ----a-w- c:\windows\system32\wkssvc.dll
2011-09-14 01:41:03 36352 ----a-w- c:\windows\system32\tsgqec.dll
2011-09-14 01:41:03 1871872 ----a-w- c:\windows\system32\mstscax.dll
2011-09-14 01:41:03 116736 ----a-w- c:\windows\system32\aaclient.dll
2011-09-14 01:40:20 303616 ----a-w- c:\windows\system32\wmpeffects.dll
2011-09-14 01:38:26 150016 ----a-w- c:\program files\movie maker\MOVIEMK.exe
2011-09-14 01:38:25 23040 ----a-w- c:\program files\movie maker\WMM2EXT.dll
2011-09-14 01:38:25 195072 ----a-w- c:\program files\movie maker\WMM2AE.dll
2011-09-14 01:38:25 10922496 ----a-w- c:\program files\movie maker\MOVIEMK.dll
2011-09-14 01:35:24 2048 ----a-w- c:\windows\system32\tzres.dll
2011-09-14 01:34:38 696832 ----a-w- c:\windows\system32\localspl.dll
2011-09-14 01:33:59 2923520 ----a-w- c:\windows\explorer.exe
2011-09-14 01:32:00 25088 ----a-w- c:\windows\system32\drivers\tunnel.sys
2011-09-14 01:32:00 179712 ----a-w- c:\windows\system32\iphlpsvc.dll
2011-09-14 01:32:00 15360 ----a-w- c:\windows\system32\drivers\TUNMP.SYS
2011-09-14 01:31:59 815104 ----a-w- c:\windows\system32\drivers\tcpip.sys
2011-09-14 01:31:59 22016 ----a-w- c:\windows\system32\netiougc.exe
2011-09-14 01:31:59 213592 ----a-w- c:\windows\system32\drivers\netio.sys
2011-09-14 01:31:59 167424 ----a-w- c:\windows\system32\tcpipcfg.dll
2011-09-14 01:12:49 96760 ----a-w- c:\windows\system32\dfshim.dll
2011-09-14 01:12:48 41984 ----a-w- c:\windows\system32\netfxperf.dll
2011-09-14 01:12:46 282112 ----a-w- c:\windows\system32\mscoree.dll
2011-09-14 01:12:46 158720 ----a-w- c:\windows\system32\mscorier.dll
2011-09-14 01:12:45 83968 ----a-w- c:\windows\system32\mscories.dll
2011-09-14 01:05:13 996352 ----a-w- c:\windows\system32\WMNetMgr.dll
2011-09-14 01:05:13 94720 ----a-w- c:\windows\system32\logagent.exe
2011-09-14 01:04:53 60928 ----a-w- c:\windows\system32\msasn1.dll
2011-09-14 01:04:47 130048 ----a-w- c:\windows\system32\drivers\srv2.sys
2011-09-14 01:04:28 274432 ----a-w- c:\windows\system32\raschap.dll
2011-09-14 01:04:27 232960 ----a-w- c:\windows\system32\rastls.dll
2011-09-14 01:04:20 321536 ----a-w- c:\windows\system32\WSDApi.dll
2011-09-14 01:03:37 50176 ----a-w- c:\windows\system32\iyuv_32.dll
2011-09-14 01:03:37 22528 ----a-w- c:\windows\system32\msyuv.dll
2011-09-14 01:03:37 11776 ----a-w- c:\windows\system32\tsbyuv.dll
2011-09-14 01:03:36 88576 ----a-w- c:\windows\system32\avifil32.dll
2011-09-14 01:03:36 82944 ----a-w- c:\windows\system32\mciavi32.dll
2011-09-14 01:03:36 65024 ----a-w- c:\windows\system32\avicap32.dll
2011-09-14 01:03:36 31232 ----a-w- c:\windows\system32\msvidc32.dll
2011-09-14 01:03:36 13312 ----a-w- c:\windows\system32\msrle32.dll
2011-09-14 01:03:36 1327616 ----a-w- c:\windows\system32\quartz.dll
2011-09-14 01:03:36 123904 ----a-w- c:\windows\system32\msvfw32.dll
2011-09-14 01:03:17 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL
2011-09-14 00:54:12 388096 ----a-r- c:\users\regan\appdata\roaming\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2011-09-14 00:54:11 -------- d-----w- c:\program files\Trend Micro
2011-09-13 23:49:19 -------- d-----w- c:\users\regan\appdata\roaming\Malwarebytes
2011-09-13 23:49:09 -------- d-----w- c:\programdata\Malwarebytes
2011-09-13 23:49:05 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-09-13 23:49:05 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-09-07 22:35:36 28552 ----a-w- c:\windows\system32\drivers\pavboot.sys
2011-09-07 22:29:57 -------- d-----w- c:\users\regan\appdata\local\Google
2011-09-07 00:24:29 9216 ----a-w- c:\windows\system32\regedt32 - Copy.com
2011-09-06 01:28:54 0 ----a-w- c:\programdata\thmx.exe
2011-09-06 01:28:54 0 ----a-w- c:\programdata\rqxl.exe
2011-09-06 01:28:54 0 ----a-w- c:\programdata\oxhq.exe
2011-09-06 01:28:54 0 ----a-w- c:\programdata\ccyu.exe
2011-08-29 22:30:09 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-08-28 22:58:03 -------- d-----w- c:\program files\iPod
2011-08-28 22:57:43 -------- d-----w- c:\program files\iTunes
.
==================== Find3M ====================
.
2011-09-14 02:56:38 40960 ----a-w- c:\windows\apppatch\apihex86.dll
2011-09-14 01:53:41 72704 ----a-w- c:\windows\system32\admparse.dll
2011-09-14 01:53:39 832512 ----a-w- c:\windows\system32\wininet.dll
2011-09-14 01:53:39 52736 ----a-w- c:\windows\apppatch\iebrshim.dll
2011-09-14 01:53:34 389120 ----a-w- c:\windows\system32\html.iec
2011-09-14 01:53:33 78336 ----a-w- c:\windows\system32\ieencode.dll
2011-09-14 01:53:33 48128 ----a-w- c:\windows\system32\mshtmler.dll
2011-09-14 01:53:32 1383424 ----a-w- c:\windows\system32\mshtml.tlb
2011-09-14 01:53:29 1830912 ----a-w- c:\windows\system32\inetcpl.cpl
2011-09-14 01:53:27 26624 ----a-w- c:\windows\system32\ieUnatt.exe
2011-09-14 01:53:24 56320 ----a-w- c:\windows\system32\iesetup.dll
2011-08-04 22:44:36 342 ----a-w- c:\windows\system32\lsprst7.dll
2011-07-05 22:37:00 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2011-07-05 22:37:00 69632 ----a-w- c:\windows\system32\QuickTime.qts
.
============= FINISH: 18:48:42.74 ===============

The GMER log is attached as temp.txt

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-09-15 19:45:40
Windows 6.0.6000 Harddisk0\DR0 -> \Device\Ide\iaStor0 TOSHIBA_ rev.DL14
Running: gmer.exe; Driver: C:\Users\Regan\AppData\Local\Temp\pgrdqpob.sys


---- System - GMER 1.0.15 ----

SSDT 872144D8 ZwAlertResumeThread
SSDT 87214598 ZwAlertThread
SSDT 8720F830 ZwAllocateVirtualMemory
SSDT 8723F620 ZwConnectPort
SSDT 87224D18 ZwCreateMutant
SSDT 8719CB18 ZwCreateThread
SSDT 87237798 ZwFreeVirtualMemory
SSDT 8719D330 ZwImpersonateAnonymousToken
SSDT 8719D3F0 ZwImpersonateThread
SSDT 8720D6B8 ZwMapViewOfSection
SSDT 8719D208 ZwOpenEvent
SSDT 87239050 ZwOpenProcessToken
SSDT 87222738 ZwOpenThreadToken
SSDT 872238F0 ZwResumeThread
SSDT 872126F0 ZwSetContextThread
SSDT 8719A370 ZwSetInformationProcess
SSDT 87222F48 ZwSetInformationThread
SSDT 8719D148 ZwSuspendProcess
SSDT 871FE008 ZwSuspendThread
SSDT \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS ZwTerminateProcess [0x8CC0C640]
SSDT 8718E998 ZwTerminateThread
SSDT 8724F198 ZwUnmapViewOfSection
SSDT 8720F7A0 ZwWriteVirtualMemory

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwCallbackReturn + 2DC 820807E8 2 Bytes [D8, 44]
.text ntkrnlpa.exe!ZwCallbackReturn + 73C 82080C48 2 Bytes [F0, 26]
PAGE CI.dll!CiInitialize + 3340 807EDBAA 1 Byte [C4]
PAGE CI.dll!CiInitialize + 3340 807EDBAA 3 Bytes [C4, 00, 00]

---- User code sections - GMER 1.0.15 ----

.text C:\Windows\Explorer.EXE[968] ntdll.dll!NtProtectVirtualMemory 77A1FD74 5 Bytes JMP 012F000A
.text C:\Windows\Explorer.EXE[968] ntdll.dll!NtWriteVirtualMemory 77A206F4 5 Bytes JMP 0130000A
.text C:\Windows\Explorer.EXE[968] ntdll.dll!KiUserExceptionDispatcher 77A20E88 5 Bytes JMP 012C000A
.text C:\Windows\system32\svchost.exe[1024] ntdll.dll!NtProtectVirtualMemory 77A1FD74 5 Bytes JMP 005A000A
.text C:\Windows\system32\svchost.exe[1024] ntdll.dll!NtWriteVirtualMemory 77A206F4 5 Bytes JMP 005B000A
.text C:\Windows\system32\svchost.exe[1024] ntdll.dll!KiUserExceptionDispatcher 77A20E88 5 Bytes JMP 0058000A
.text C:\Windows\system32\wuauclt.exe[1692] ntdll.dll!NtProtectVirtualMemory 77A1FD74 5 Bytes JMP 00B2000A
.text C:\Windows\system32\wuauclt.exe[1692] ntdll.dll!NtWriteVirtualMemory 77A206F4 5 Bytes JMP 00B3000A
.text C:\Windows\system32\wuauclt.exe[1692] ntdll.dll!KiUserExceptionDispatcher 77A20E88 5 Bytes JMP 0021000A

---- Devices - GMER 1.0.15 ----

Device Ntfs.sys (NT File System Driver/Microsoft Corporation)
Device fastfat.SYS (Fast FAT File System Driver/Microsoft Corporation)

AttachedDevice \Driver\tdx \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\tdx \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b 0x2E 0xE8 0xE1 0x00 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b 0x6A 0x9C 0xD6 0x61 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016 0xFF 0x7C 0x85 0xE0 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48 0x86 0x8C 0x21 0x01 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472 0xF5 0x1D 0x4D 0x73 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d 0xB0 0x18 0xED 0xA7 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b 0x31 0x77 0xE1 0xBA ...
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d 0x83 0x6C 0x56 0x8B ...
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3 0x51 0xFA 0x6E 0x91 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b 0x3D 0xCE 0xEA 0x26 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6 0x2A 0xB7 0xCC 0xB5 ...
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ C:\Windows\system32\OLE32.DLL
Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2 0x6C 0x43 0x2D 0x1E ...

---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 TDL4@MBR code has been found <-- ROOTKIT !!!
Disk \Device\Harddisk0\DR0 sector 00: rootkit-like behavior

Attached File(s)

  • Attached File  temp.txt (14.29K)
    Number of downloads: 0

This post has been edited by bmack36: 15 September 2011 - 07:03 PM

#2 User is offline   HelpBot 

  • Bleepin' Binary Bot
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Bots
  • Posts: 5,607
  • Joined: 05-October 07
  • Gender:Male

Posted 20 September 2011 - 07:05 PM

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:

***************************************************

Posted Image In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/419150 <<< CLICK THIS LINK

If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.

***************************************************

Posted Image If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

  • If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
  • A new DDS and GMER log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
    • Please do this even if you have previously posted logs for us.
    • If you were unable to produce the logs originally please try once more.
    • If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    • If you are unsure about any of these characteristics just post what you can and we will guide you.

  • Please tell us if you have your original Windows CD/DVD available.
  • Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.


Thank you for your patience, and again sorry for the delay.

***************************************************

We need to see some information about what is happening in your machine. Please perform the following scan again:

  • Download DDS by sUBs from one of the following links if you no longer have it available. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE


We also need a new log from the GMER anti-rootkit Scanner.

Please note that if you are running a 64-bit version of Windows you will not be able to run GMER and you may skip this step.

Please first disable any CD emulation programs using the steps found in this topic:

Why we request you disable CD Emulation when receiving Malware Removal Advice

Then create another GMER log and post it as an attachment to the reply where you post your new DDS log. Instructions on how to properly create a GMER log can be found here:

How to create a GMER log


As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

#3 User is offline   HelpBot 

  • Bleepin' Binary Bot
  • PipPipPipPipPipPip
  • Find Topics
  • Group: Bots
  • Posts: 5,607
  • Joined: 05-October 07
  • Gender:Male

Posted 20 September 2011 - 07:08 PM

You have stated that you no longer need help with this issue, therefore I am closing this topic. If that is not the case and you need or wish to continue with this topic, please send any Moderator a Personal Message (PM) that you would like this topic re-opened.

As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

Share this topic:


Page 1 of 1
  • You cannot start a new topic
  • This topic is locked

1 User(s) are reading this topic
0 members, 1 guests, 0 anonymous users