BleepingComputer.com: 0x7B MBR Virus

I posted in the other forum and was told to re-post here. (Sorry bout that)

Here's the link to the other topic: http://www.bleepingcomputer.com/forums/topic427794.html

I've attached my ComboFix log and the TDSS Killer log. Just FYI I can't boot into Windows, I had to use a LiveCD to get those two off the C:/ drive.

Thanks for y'alls help!!

Welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Please refrain from running tools or applying updates other than those we suggest while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process. Please also continue to work with me until I give you the all clear. Even if your computer appears to act better, you may still be infected.

Even if you have already provided information about your PC, we need a new log to see what has changed since you originally posted your problem.

Once we start working together, please reply back within 3 days or this thread may be closed so we can help others who are waiting.

Normally, I'd ask for logs, but a BSOD kind of prevents that, doesn't it?

We can get this computer booting again. Just reply back and let me know if you still need help and if the current status has changed.

Well thank you very much, but the person who I was repairing the computer for just contacted me and said she no longer wants me to repair it. Thank you for your time!

Thanks for letting us know!

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.

reopened at OP's request.

OK to answer the questions in the PM: Yes it still is giving me the 0x7B STOP screen, and yes I have a USB key

Hello, A Future Pilot.
Try this please. You will need a USB drive.

Download http://unetbootin.sourceforge.net/unetbootin-xpud-windows-latest.exe & http://noahdfear.net/downloads/bootable/xPUD/xpud-0.9.2.iso to the desktop of your clean computer

• Insert your USB drive
  
• Press Start > My Computer > right click your USB drive > choose Format > Quick format
  
• Double click the unetbootin-xpud-windows-387.exe that you just downloaded
  
• Press Run then OK
  
• Select the DiskImage option then click the browse button located on the right side of the textbox field.
  
• Browse to and select the xpud-0.9.2.iso file you downloaded
  
• Verify the correct drive letter is selected for your USB device then click OK
  
• It will install a little bootable OS on your USB device
  
• Once the files have been written to the device you will be prompted to reboot ~ do not reboot and instead just Exit the UNetbootin interface
  
• After it has completed do not choose to reboot the clean computer simply close the installer
  
• Next download http://noahdfear.net/downloads/driver.sh to your USB
  
• Remove the USB and insert it in the sick computer
  
• Boot the Sick computer
  
• Press F12 and choose to boot from the USB
  
• Follow the prompts
  
• A Welcome to xPUD screen will appear
  
• Press File
  
• Expand mnt
  
• sda1,2...usually corresponds to your HDD
  
• sdb1 is likely your USB
  
• Click on the folder that represents your USB drive (sdb1 ?)
  
• Confirm that you see driver.sh that you downloaded there
  
• Press Tool at the top
  
• Choose Open Terminal
  
• Type bash driver.sh
  
• Press Enter
  
• After it has finished a report will be located on your USB drive named report.txt
  
• Remove the USB drive and insert back in your working computer and navigate to report.txt
  
  Please note - all text entries are case sensitive

Copy and paste the report.txt for my review

etavares

OK here it is:

Wed Nov 23 13:01:43 UTC 2011
Driver report for /mnt/sda3/Windows/System32/drivers NISx64/1008030.006/BHDrvx64.sys has NO Company Name! NISx64/1008030.006/cchpx64.sys has NO Company Name! NISx64/1008030.006/srtsp64.sys has NO Company Name! NISx64/1008030.006/srtspx64.sys has NO Company Name! NISx64/1008030.006/SymEFA64.sys has NO Company Name! NISx64/1008030.006/symfw.sys has NO Company Name! NISx64/1008030.006/symids.sys has NO Company Name! NISx64/1008030.006/symndis.sys has NO Company Name! NISx64/1008030.006/symndisv.sys has NO Company Name! NISx64/1008030.006/symtdi.sys has NO Company Name!

64edd3f59db321947969fdf1dd747323  1394bus.sys
Microsoft Corporation

1b00662092f9f9568b995902f0cc40d5  1394ohci.sys
Microsoft Corporation

63b05a0420ce4bf0e4af6dcc7cada254  acpipmi.sys
Microsoft Corporation

6f11e88748cdefd2f76aa215f97ddfe5  acpi.sys
Microsoft Corporation

2f6b34b83843f0c5118b63ac634f5bf4  adp94xx.sys
Adaptec

597f78224ee9224ea1a13d6350ced962  adpahci.sys
Adaptec

e109549c90f62fb570b9540c4b148e54  adpu320.sys
Adaptec

6ef20ddf3172e97d69f596fb90602f29  afd.sys
Microsoft Corporation

7ecff9b22276b73f43a99a15a6094e90  agilevpn.sys
Microsoft Corporation

608c14dba7299d8cb6ed035a68a15799  AGP440.sys
Microsoft Corporation

5812713a477a3ad7363c7438ca2ee038  aliide.sys
Acer Laboratories

1ff8b4431c353ce385c875f194924c0c  amdide.sys
Microsoft Corporation

7024f087cff1833a806193ef9d22cda9  amdk8.sys
Microsoft Corporation

1e56388b3fe0d031c44144eb8c4d6217  amdppm.sys
Microsoft Corporation

7a4b413614c055935567cf88a9734d38  amdsata.sys
Advanced Micro Devices

f67f933e79241ed32ff46a4f29b5120b  amdsbs.sys
AMD Technologies

b4ad0cacbab298671dd6f6ef7e20679d  amdxata.sys
Advanced Micro Devices

56bd886820c4aedf493cfcdf1ccfb004  Apfiltr.sys
Alps Electric

42fd751b27fa0e9c69bb39f39e409594  appid.sys
Microsoft Corporation

019af6924aefe7839f61c830227fe79c  arcsas.sys
Adaptec

c130bc4a51b1382b2be8e44579ec4c0a  ArcSoftKsUFilter.sys
bH`VS_VERSION_INFO?baStringFileInfob(bCommentsForX<CompanyNameArcSoft,Inc.bFileDescriptionForXtFileVersion...JInternalNameArcSoftKsUFilter.sysf!LegalCopyrightCopyright(C)ArcSoft,Inc.(LegalTrademarksROriginalFilenameArcSoftKsUFilter.sysPrivateBuildProductNameArcSoftMagic-iVisualEffecttProductVersion...SpecialBuildDVarFileInfo$Translationt

c484f8ceb1717c540242531db7845c4e  arc.sys
Adaptec

769765ce2cc62867468cea93969b2242  asyncmac.sys
Microsoft Corporation

02062c0b390b7729edc9e69c680a6f3c  atapi.sys
Microsoft Corporation

aa2186f7944104a16d6ed176ed462cec  ataport.sys
Microsoft Corporation

5d4529ac4156e16bedb01441ae0cf984  athrx.sys
Atheros Communications

de0ede41bc530f1759c6fffcb8c7a0cf  atikmdag.sys
ATI Technologies

b5ace6968304a3900eeb1ebfd9622df2  b57nd60a.sys
Broadcom Corporation

f4de2ae7a9e1badac70bc71ea2c17612  battc.sys
Microsoft Corporation

16a47ce2decc9b099349a5f840654746  beep.sys
Microsoft Corporation

61583ee3c3a17003c4acd0475646b4d3  blbdrive.sys
Microsoft Corporation

19d20159708e152267e53b66677a4995  bowser.sys
Microsoft Corporation

f09eee9edc320b5e1501f749fde686c8  BrFiltLo.sys
Brother Industries

b114d3098e9bdb8bea8b053685831be6  BrFiltUp.sys
Brother Industries

5c2f352a4e961d72518261257aae204b  bridge.sys
Microsoft Corporation

43bea8d483bf1870f018e2d02e06a5bd  BrSerId.sys
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries
Brother Industries

a6eca2151b08a09caceca35c07f05b42  BrSerWdm.sys
Brother Industries

b79968002c277e869cf38bd22cd61524  BrUsbMdm.sys
Brother Industries

a87528880231c54e75ea7a44943b38bf  BrUsbSer.sys
Brother Industries

cf98190a94f62e405c8cb255018b2315  bthenum.sys
Microsoft Corporation

9da669f11d1f894ab4eb69bf546a42e8  bthmodem.sys
Microsoft Corporation

02dd601b708dd0667e1331fa8518e9ff  bthpan.sys
Microsoft Corporation

a51fa9d0e85d5adabef72e67f386309c  bthport.sys
Microsoft Corporation

f740b9a16b2c06700f2130e19986bf3b  BTHUSB.SYS
Microsoft Corporation

3e5b191307609f7514148c6832bb0842  bxvbda.sys
Broadcom Corporation

a6ea7a3fc4b00f48535b506db1e86efd  CAX_CNXT.sys
Conexant

26c5d00321937e49b6bc91029947d094  CAX_DPV.sys
Conexant

d1787e11c6a0078ddeaf8cf3ee2ab293  CAXHWAZL.sys
Conexant

b8bd2bb284668c84865658c77574381a  cdfs.sys
Microsoft Corporation

283817071a184798a4998055fac68b82  cdr4_xp.sys
Sonic Solutions

8637e1839b0e4a1ec4266dfae26b82f9  cdralw2k.sys
Sonic Solutions

83d2d75e1efb81b3450c18131443f7db  cdrom.sys
Microsoft Corporation

d7cd5c4e1b71fa62050515314cfb52cf  circlass.sys
Microsoft Corporation

62f1ed63f0cb0b5a2f65d15a6490c2fd  Classpnp.sys
Microsoft Corporation

0840155d0bddf1190f84a663c284bd33  CmBatt.sys
Microsoft Corporation

e19d3f095812725d88f9001985b94edd  cmdide.sys
CMD Technology

f95fd4cb7da00ba2a63ce9f6b5c053e1  cng.sys
Microsoft Corporation

102de219c3f61415f964c88e9085ad14  compbatt.sys
Microsoft Corporation

f26b3a86f6fa87ca360b879581ab4123  CompositeBus.sys
Microsoft Corporation

3e588b60ec061686ba05d33574a344c6  crashdmp.sys
Microsoft Corporation

1c827878a998c18847245fe1f34ee597  crcdisk.sys
Microsoft Corporation

9c253ce7311ca60fc11c774692a13208  dfsc.sys
Microsoft Corporation

13096b05847ec78f0977f2c0f79e9ab3  discache.sys
Microsoft Corporation

77a4b22c0be4568872521dd5e4279cee  Diskdump.sys
Microsoft Corporation

9819eee8b5ea3784ec4af3b137a5244c  disk.sys
Microsoft Corporation

85135ad27e79b689335c08167d917cde  Dot4Prt.sys
Microsoft Corporation

b42ed0320c6e41102fde0005154849bb  Dot4.sys
Microsoft Corporation

fd05a02b0370bc3000f402e543ca5814  Dot4usb.sys
Microsoft Corporation

9b19f34400d24df84c858a421c205754  drmkaud.sys
Microsoft Corporation

21d26064aedb4988f785bb4a3a2c051e  drmk.sys
Microsoft Corporation

839b5fe3d48e9f35b22c21a3d5103f6c  Dumpata.sys
Microsoft Corporation

814db88f2641691575a455cf25354098  dumpfve.sys
Microsoft Corporation

bf24d6f2ed97fe830bfd52b246f98e67  dxapi.sys
Microsoft Corporation

1633b9abf52784a1331476397a48cbef  dxgkrnl.sys
Microsoft Corporation

3238b9078e0766ab5e62dc737a809adb  dxgmms1.sys
Microsoft Corporation

fede0629ecb23650d48989517d4914da  dxg.sys
Microsoft Corporation

0e5da5369a0fcaea12456dd852545184  elxstor.sys
Emulex

34a3c54752046e79a126e15c51db409b  errdev.sys
Microsoft Corporation

dc5d737f51be844d8c82c695eb17372f  evbda.sys
Broadcom Corporation

a510c654ec00c1e9bdd91eeb3a59823b  exfat.sys
Microsoft Corporation

0adc83218b66a6db380c330836f3e36d  fastfat.sys
Microsoft Corporation

d765d19cd8ef61f650c384f62fac00ab  fdc.sys
Microsoft Corporation

655661be46b5f5f3fd454e2c3095b930  fileinfo.sys
Microsoft Corporation

5f671ab5bc87eea04ec38a6cd5962a47  filetrace.sys
Microsoft Corporation

00940c5e43282206994659d16b4ac412  FixTDSS.sys
Symantec Corporation

c172a0f53008eaeb8ea33fe10e177af5  flpydisk.sys
Microsoft Corporation

f7866af72abbaf84b1fa5aa195378c59  fltMgr.sys
Microsoft Corporation

d43703496149971890703b4b1b723eac  fsdepends.sys
Microsoft Corporation

e95ef8547de20cf0603557c0cf7a9462  fs_rec.sys
Microsoft Corporation

b8b2a6e1558f8f5de5ce431c5b2c7b09  fvevol.sys
Microsoft Corporation

50555005e22a56aef10be607472d0bdc  FWPKCLNT.SYS
Microsoft Corporation

8c778d335c9d272cfd3298ab02abe3b6  GAGP30KX.SYS
Microsoft Corporation

e403aacf8c7bb11375122d2464560311  GEARAspiWDM.sys
GEAR Software

f2523ef6460fc42405b12248338ab2f0  hcw85cir.sys
Hauppauge Computer Works

0a49913402747a0b67de940fb42cbdbb  hdaudbus.sys
Microsoft Corporation

6410f6f415b2a5a9037224c41da8bf12  HdAudio.sys
Microsoft Corporation

78e86380454a7b10a5eb255dc44a355f  hidbatt.sys
Microsoft Corporation

7fd2a313f7afe5c4dab14798c48dd104  hidbth.sys
Microsoft Corporation

685fec2407fc121eb937cb658b3c0f35  hidclass.sys
Microsoft Corporation

0a77d29f311b88cfae3b13f9c1a73825  hidir.sys
Microsoft Corporation

49ee2e52e6cd03947dad72f65367be06  hidparse.sys
Microsoft Corporation

b3bf6b5b50006def50b66306d99fcf6f  hidusb.sys
Microsoft Corporation

0886d440058f203eba0e1825e4355914  HpSAMD.sys
Hewlett-Packard

cee049cac4efa7f4e1e4ad014414a5d4  http.sys
Microsoft Corporation

f17766a19145f111856378df337a5d79  hwpolicy.sys
Microsoft Corporation

fa55c73d4affa7ee23ac4be53b4592d3  i8042prt.sys
Microsoft Corporation

1d004cb1da6323b1f55caef7f94b61d9  iaStor.sys
Intel Corporation

d83efb6fd45df9d55e9a1afc63640d50  iaStorV.sys
Intel Corporation

dfeaf0a1d98d397035012c8e28d1520f  igdkmd64.sys
Intel Corporation

5c18831c61933628f5bb0ea2675b9d21  iirsp.sys
Intel Corp

88a20fa54c73ded4e8dac764e9130ae9  IntcHdmi.sys
Intel Corporation

f00f20e70c6ec3aa366910083a0518aa  intelide.sys
Microsoft Corporation

ada036632c664caa754079041cf1f8c1  intelppm.sys
Microsoft Corporation

722dd294df62483cecaae6e094b4d695  ipfltdrv.sys
Microsoft Corporation

e2b4a4494db7cb9b89b55ca268c337c5  IPMIDrv.sys
Microsoft Corporation

af9b39a7e7b6caa203b3862582e9f2d0  ipnat.sys
Microsoft Corporation

05360b1ea5a2abf620d1d96ebd8bd8f1  irda.sys
Microsoft Corporation

3abf5e7213eb28966d55d58b515d5ce9  irenum.sys
Microsoft Corporation

2f7b28dc3e1183e5eb418df55c204f38  isapnp.sys
Microsoft Corporation

bc02336f1cba7dcc7d1213bb588a68a5  kbdclass.sys
Microsoft Corporation

6def98f8541e1b5dceb2c822a11f7323  kbdhid.sys
Microsoft Corporation

e8b6fcc9c83535c67f835d407620bd27  ksecdd.sys
Microsoft Corporation

a8c63880ef6f4d3fec7b616b9c060215  ksecpkg.sys
Microsoft Corporation

3e099cc843c4233e5af147c8ea8ba32b  ks.sys
Microsoft Corporation

6869281e78cb31a43e969f06b57347c4  ksthunk.sys
Microsoft Corporation

1538831cf8ad2979a04c423779465827  lltdio.sys
Microsoft Corporation

1a93e54eb0ece102495a51266dcdb6a6  lsi_fc.sys
LSI Corporation

30f5c0de1ee8b5bc9306c1f0e4a75f93  lsi_sas2.sys
LSI Corporation

1047184a9fdc8bdbff857175875ee810  lsi_sas.sys
LSI Corporation

0504eacaff0d3c8aed161c4b0d369d4a  lsi_scsi.sys
LSI Corporation

43d0f98e1d56ccddb0d5254cff7b356e  luafv.sys
Microsoft Corporation

23a854450dab5c9b7a42ab9be6f2e4bd  mbam.sys
Malwarebytes Corporation

3c9f072f9dca856b9fb7a20cbd4281ac  mcd.sys
Microsoft Corporation

e4f44ec214b3e381e1fc844a02926666  mdmxsdk.sys
Conexant

a55805f747c6edb6a9080d7c633bd0f4  megasas.sys
LSI Corporation

baf74ce0072480c3b6b7c13b2a94d6b3  MegaSR.sys
LSI Corporation

800ba92f7010378b09f9ed9270f07137  modem.sys
Microsoft Corporation

b03d591dc7da45ece20b3b467e6aadaa  monitor.sys
Microsoft Corporation

7d27ea49f3c1f687d357e77a470aea99  mouclass.sys
Microsoft Corporation

d3bf052c40b0c4166d9fd86a4288c1e6  mouhid.sys
Microsoft Corporation

791af66c4d0e7c90a3646066386fb571  mountmgr.sys
Microsoft Corporation

c177a7ebf5e8a0b596f618870516cab8  MpFilter.sys
Microsoft Corporation

609d1d87649ecc19796f4d76d4c15cea  mpio.sys
Microsoft Corporation

8fbf6b31fe8af1833d93c5913d5b4d55  MpNWMon.sys
Microsoft Corporation

6c38c9e45ae0ea2fa5e551f2ed5e978f  mpsdrv.sys
Microsoft Corporation

30524261bb51d96d6fcbac20c810183c  mrxdav.sys
Microsoft Corporation

f0067552f8f9b33d7c59403ab808a3cb  mrxsmb10.sys
Microsoft Corporation

3c142d31de9f2f193218a53fe2632051  mrxsmb20.sys
Microsoft Corporation

040d62a9d8ad28922632137acdd984f2  mrxsmb.sys
Microsoft Corporation

5c37497276e3b3a5488b23a326a754b7  msahci.sys
Microsoft Corporation

8d27b597229aed79430fb9db3bcbfbd0  msdsm.sys
Microsoft Corporation

aa3fb40e17ce1388fa1bedab50ea8f96  msfs.sys
Microsoft Corporation

f9d215a46a8b9753f61767fa72a20326  mshidkmdf.sys
Microsoft Corporation

d916874bbd4f8b07bfb7fa9b3ccae29d  msisadrv.sys
Microsoft Corporation

fa4d2557de56d45b0a346f93564be6e1  msiscsi.sys
Microsoft Corporation

49ccf2c4fea34ffad8b1b59d49439366  mskssrv.sys
Microsoft Corporation

bdd71ace35a232104ddd349ee70e1ab3  mspclock.sys
Microsoft Corporation

4ed981241db27c3383d72092b618a1d0  mspqm.sys
Microsoft Corporation

89cb141aa8616d8c6a4610fa26c60964  msrpc.sys
Microsoft Corporation

0eed230e37515a0eaee3c2e1bc97b288  mssmbios.sys
Microsoft Corporation

2e66f9ecb30b4221a318c92ac2250779  mstee.sys
Microsoft Corporation

7ea404308934e675bffde8edf0757bcd  MTConfig.sys
Microsoft Corporation

f9a18612fd3526fe473c1bda678d61c8  mup.sys
Microsoft Corporation

9f9a1f53aad7da4d6fef5bb73ab811ac  ndiscap.sys
Microsoft Corporation

cad515dbd07d082bb317d9928ce8962c  ndis.sys
Microsoft Corporation

30639c932d9fef22b31268fe25a1b6e5  ndistapi.sys
Microsoft Corporation

f105ba1e22bf1f2ee8f005d4305e4bec  ndisuio.sys
Microsoft Corporation

557dfab9ca1fcb036ac77564c010dad3  ndiswan.sys
Microsoft Corporation

659b74fb74b86228d6338d643cd3e3cf  ndproxy.sys
Microsoft Corporation

86743d9f5d2b1048062b14b1d84501c4  netbios.sys
Microsoft Corporation

9162b273a44ab9dce5b44362731d062a  netbt.sys
Microsoft Corporation

02903eb9d9308541d032417acdfb975c  netio.sys
Microsoft Corporation

64428dfdaf6e88366cb51f45a79c5f69  netw5v64.sys
Intel Corporation

77889813be4d166cdab78ddba990da92  nfrd960.sys
IBM Corp

5f7d72cbcdd025af1f38fdeee5646968  NisDrvWFP.sys
Microsoft Corporation

4d7f8401eae7eaa4ef702fa6f4153269  NISx64/1008030.006/BHDrvx64.sys
Symantec Corporation

a2e6ab452b9393ca8d11d28827e0e1a1  NISx64/1008030.006/cchpx64.sys
Symantec Corporation

9e399476e5d5e0d3c8822c857a7e9a9a  NISx64/1008030.006/srtsp64.sys
Symantec Corporation

3d7717b582f0365e75071556936e5a6b  NISx64/1008030.006/srtspx64.sys
Symantec Corporation

4f87bb5389a93778ebc363b28271a65b  NISx64/1008030.006/SymEFA64.sys
Symantec Corporation

b4af6633ecd674b74bd4e80788299d2a  NISx64/1008030.006/symfw.sys
Symantec Corporation

87f4bfc9e1547340499b6b46dea0cae3  NISx64/1008030.006/symids.sys
Symantec Corporation

937f51bdf1196593e8ba59d390fa469e  NISx64/1008030.006/symndis.sys
Symantec Corporation

d451a05f7e7b9d1f9f8fb76b2a16d786  NISx64/1008030.006/symndisv.sys
Symantec Corporation

33b37cb0a74f1f4b78a665ece9184095  NISx64/1008030.006/symtdi.sys
Symantec Corporation

1e4c4ab5c9b8dd13179bbdc75a2a01f7  npfs.sys
Microsoft Corporation

e7f5ae18af4168178a642a9247c63001  nsiproxy.sys
Microsoft Corporation

356698a13c4630d5b31c37378d469196  ntfs.sys
Microsoft Corporation

9899284589f75fa8724ff3d16aed75c1  null.sys
Microsoft Corporation

270d7cd42d6e3979f6dd0146650f0e05  NV_AGP.SYS
Microsoft Corporation

3e38712941e9bb4ddbee00affe3fed3d  nvraid.sys
NVIDIA Corporation

477dc4d6deb99be37084c9ac6d013da1  nvstor.sys
NVIDIA Corporation

1ea3749c4114db3e3161156ffffa6b33  nwifi.sys
Microsoft Corporation

3589478e4b22ce21b41fa1bfc0b8b8a0  ohci1394.sys
Microsoft Corporation

ee992183bd8eaefd9973f352e587a299  pacer.sys
Microsoft Corporation

0086431c29c35be1dbc43f52cc273887  parport.sys
Microsoft Corporation

7daa117143316c4a1537e074a5a9eaf0  partmgr.sys
Microsoft Corporation

b5b8b5ef2e5cb34df8dcf8831e3534fa  pciide.sys
Microsoft Corporation

144497daa145ba0f7be896064146c058  pciidex.sys
Microsoft Corporation

f36f6504009f2fb0dfd1b17a116ad74b  pci.sys
Microsoft Corporation

b2e81d4e87ce48589f98cb8c05b01f2f  pcmcia.sys
Microsoft Corporation

d6b9c2e1a11a3a4b26a182ffef18f603  pcw.sys
Microsoft Corporation

68769c3356b3be5d1c732c97b9a80d6e  PEAuth.sys
Microsoft Corporation

32e11315b5126921ffd9074840ef13d3  portcls.sys
Microsoft Corporation

0d922e23c041efb1c3fac2a6f943c9bf  processr.sys
Microsoft Corporation

aed797cca02783296c68aa10d0cff8a9  PxHlpa64.sys
Sonic Solutions

a53a15a11ebfd21077463ee2c7afeef0  ql2300.sys
QLogic Corporation

4f6d12b51de1aaeff7dc58c4d75423c8  ql40xx.sys
QLogic Corporation

76707bb36430888d9ce9d705398adb6c  qwavedrv.sys
Microsoft Corporation

5a0da8ad5762fa2d91678a8a01311704  rasacd.sys
Microsoft Corporation

87a6e852a22991580d6d39adc4790463  rasl2tp.sys
Microsoft Corporation

855c9b1cd4756c5e9a2aa58a15f58c25  raspppoe.sys
Microsoft Corporation

27cc19e81ba5e3403c48302127bda717  raspptp.sys
Microsoft Corporation

e8b1e447b008d07ff47d016c2b0eeecb  rassstp.sys
Microsoft Corporation

3bac8142102c15d59a87757c1d41dce5  rdbss.sys
Microsoft Corporation

302da2a0539f2cf54d7c6cc30c1f2d8d  rdpbus.sys
Microsoft Corporation

cea6cc257fc9b7715f1c2b4849286d24  RDPCDD.sys
Microsoft Corporation

bb5971a4f00659529a5c44831af22365  RDPENCDD.sys
Microsoft Corporation

216f3fa57533d98e1f74ded70113177a  RDPREFMP.sys
Microsoft Corporation

8a3e6bea1c53ea6177fe2b6eba2c80d7  rdpwd.sys
Microsoft Corporation

634b9a2181d98f15941236886164ec8b  rdyboost.sys
Microsoft Corporation

3dd798846e2c28102b922c56e71b7932  rfcomm.sys
Microsoft Corporation

0de22421179d5a8440b68517ddf2b051  RimSerial_AMD64.sys
Research in Motion

258aadb43e3f3468b5cf8cb0f84872c2  rimssn64.sys
Ricoh Company

5790bca445cc40df8b38c2c48608aac2  RimUsb_AMD64.sys
tH`jTTVS_VERSION_INFO?StringFileInfobVCompanyNameResearchInMotionLimitedZFileDescriptionBlackBerryDeviceDriverbFileVersion....aInternalNameRimUsbx*LegalCopyrightCopyrightResearchInMotionLimited(LegalTrademarks<nOriginalFilenameRimUsb.rcRProductNameBlackBerryDeviceDriverbProductVersion...DVarFileInfo$Translationt*

71e182a0de1cecb3f912960716345405  risdsn64.sys
Ricoh Company

77b3b747eb2413072b8e4306018d0c9b  rmcast.sys
Microsoft Corporation

fc6d5c50d846b795335deb3fce8b33f3  RNDISMP.sys
Microsoft Corporation

388d3dd1a6457280f3badba9f3acd6b1  rootmdm.sys
Microsoft Corporation

ddc86e4f8e7456261e637e3552e804ff  rspndr.sys
Microsoft Corporation

34f05c417f038ffa3bef69b798d7d7dd  RtHDMIVX.sys
Realtek Semiconductor

b16fc828ce7a76a8f1ce682e6ead2627  RTKVHD64.sys
Realtek Semiconductor

e3bbb89983daf5622c1d50cf49f28227  sbp2port.sys
Microsoft Corporation

c94da20c7e3ba1dca269bc8460d98387  scfilter.sys
Microsoft Corporation

ad3a6838a059d65fb55d2f61cf0a6c1f  scsiport.sys
Microsoft Corporation

54e47ad086782d3ae9417c155cdceb9b  sdbus.sys
Microsoft Corporation

3ea8a16169c26afbeb544e0e48421186  secdrv.sys
Macrovision Corporation

cb624c0035412af0debec78c41f5ca1b  serenum.sys
Microsoft Corporation

c1d8e28b2c2adfaec4ba89e9fda69bd6  serial.sys
Microsoft Corporation

1c545a7d0691cc4a027396535691c3e3  sermouse.sys
Microsoft Corporation

70f9c476b62de4f2823e918a6c181ade  SFEP.sys
Sony Corporation

a554811bcd09279536440c964ae35bbf  sffdisk.sys
Microsoft Corporation

ff414f0baefeba59bc6c04b3db0b87bf  sffp_mmc.sys
Microsoft Corporation

5588b8c6193eb1522490c122eb94dffa  sffp_sd.sys
Microsoft Corporation

a9d601643a1647211a1ee2ec4e433ff4  sfloppy.sys
Microsoft Corporation

843caf1e5fde1ffd5ff768f23a51e2e1  sisraid2.sys
Silicon Integrated Systems

6a6c106d42e9ffff8b9fcb4f754f6da4  sisraid4.sys
Silicon Integrated Systems

548260a7b8654e024dc30bf8a7c5baa4  smb.sys
Microsoft Corporation

a80348ba03e96c70852959655ca3e084  smclib.sys
Microsoft Corporation

b9e31e5cacdfe584f34f730a677803f9  spldr.sys
Microsoft Corporation

fff95479c7ab1550f0750a5d01744211  spsys.sys
Microsoft Corporation

76548f7b818881b47d8d1ae1be9c11f8  srv2.sys
Microsoft Corporation

0af6e19d39c70844c5caa8fb0183c36e  srvnet.sys
Microsoft Corporation

2408c0366d96bcdf63e8f1c78e4a29c5  srv.sys
Microsoft Corporation

f3817967ed533d08327dc73bc4d5542a  stexstor.sys
Promise Technology

141e6f0b54da421b8de146f5ad947760  storport.sys
Microsoft Corporation

001cc10fa5e71ae1119115e126c8750d  stream.sys
Microsoft Corporation

d01ec09b6711a5f8e7e6564a4d0fbc90  swenum.sys
Microsoft Corporation

7e4d281982e19abd06728c7ee9ac40a8  SYMEVENT64x86.SYS
Symantec Corporation

212bbf5a964513980d5de9397381534f  SymIMV.sys
Symantec Corporation

6e316c01cba8b785fe495f5cc4f48c6f  tape.sys
Microsoft Corporation

76d078af6f587b162d50210f761eb9ed  tcpipreg.sys
Microsoft Corporation

f18f56efc0bfb9c87ba01c37b27f4da5  tcpip.sys
Microsoft Corporation

0ca6fe26acc7ffee1bd0463f40835f32  tdi.sys
Microsoft Corporation

3371d21011695b16333a3934340c4e7c  tdpipe.sys
Microsoft Corporation

e4245bda3190a582d55ed09e137401a9  tdtcp.sys
Microsoft Corporation

079125c4b17b01fcaeebce0bcb290c0f  tdx.sys
Microsoft Corporation

c448651339196c0e869a355171875522  termdd.sys
Microsoft Corporation

61b96c26131e37b24e93327a0bd1fb95  tssecsrv.sys
Microsoft Corporation

3836171a2cdf3af8ef10856db9835a70  tunnel.sys
Microsoft Corporation

b4dd609bd7e282bfc683cec7eaaaad67  UAGP35.SYS
Microsoft Corporation

d47baead86c65d4f4069d7ce0a4edceb  udfs.sys
Microsoft Corporation

4bfe1bc28391222894cbf1e7d0e42320  ULIAGPKX.SYS
Microsoft Corporation

eab6c35e62b1b0db0d1b48b671d3a117  umbus.sys
Microsoft Corporation

b2e8e8cb557b156da5493bbddcc1474d  umpass.sys
Microsoft Corporation

d0fe8cb5f84303e73ff0754437fad3d1  usb8023.sys
Microsoft Corporation

aa33fc47ed58c34e6e9261e4f850b7eb  usbaapl64.sys
Apple

faec06c1d24e2770ecc4f7c37659824d  USBCAMD2.sys
Microsoft Corporation

b26afb54a534d634523c4fb66765b026  usbccgp.sys
Microsoft Corporation

af0892a803fdda7492f595368e3b68e7  usbcir.sys
Microsoft Corporation

63c8d74bed9f80f4dd0aa7a3101eb639  usbd.sys
Microsoft Corporation

2ea4aff7be7eb4632e3aa8595b0803b5  usbehci.sys
Microsoft Corporation

4c9042b8df86c1e8e6240c218b99b39b  usbhub.sys
Microsoft Corporation

58e546bbaf87664fc57e0f6081e4f609  usbohci.sys
Microsoft Corporation

a91291136d1e70966645252f6b828711  usbport.sys
Microsoft Corporation

73188f58fb384e75c4063d29413cee3d  usbprint.sys
Microsoft Corporation

8f0d9d2ea6cfed2730b5bafb9b5b11c2  usbrpm.sys
Microsoft Corporation

aaa2513c8aed8b54b189fd0c6b1634c0  usbscan.sys
Microsoft Corporation

080d3820da6c046be82fc8b45a893e83  USBSTOR.SYS
Microsoft Corporation

81fb2216d3a60d1284455d511797db3d  usbuhci.sys
Microsoft Corporation

d501e12614b00a3252073101d6a1a74b  usbvideo.sys
Microsoft Corporation

c5c876ccfc083ff3b128f933823e87bd  vdrvroot.sys
Microsoft Corporation

da4da3f5e02943c2dc8c6ed875de68dd  vgapnp.sys
Microsoft Corporation

53e92a310193cb3c03bea963de7d9cfc  vga.sys
Microsoft Corporation

c82e748660f62a242b2dfac1442f22a4  vhdmp.sys
Microsoft Corporation

e5689d93ffe4e5d66c0178761240dd54  viaide.sys
VIA Technologies

e7353d59c9842bc7299faeb7e7e09340  videoprt.sys
Microsoft Corporation

2b1a3dae2b4e70dbba822b7a03fbd4a3  volmgr.sys
Microsoft Corporation

99b0cbb569ca79acaed8c91461d765fb  volmgrx.sys
Microsoft Corporation

58f82eed8ca24b461441f9c3e4f0bf5c  volsnap.sys
Microsoft Corporation

5e2016ea6ebaca03c04feac5f330d997  vsmraid.sys
VIA Technologies

0c4540311e11664b245a263e1154cef8  VSTAZL6.SYS
Conexant

18e40c245dbfaf36fd0134a7ef2df396  VSTCNXT6.SYS
Conexant

02071d207a9858fbe3a48cbfd59c4a04  VSTDPV6.SYS
Conexant

36d4720b72b5c5d9cb2b9c29e9df67a1  vwifibus.sys
Microsoft Corporation

6a3d66263414ff0d6fa754c646612f3f  vwififlt.sys
Microsoft Corporation

6a638fc4bfddc4d9b186c28c91bd1a01  vwifimp.sys
Microsoft Corporation

4e9440f4f152a7b944cb1663d3935a3e  wacompen.sys
Microsoft Corporation

47ca49400643effd3f1c9a27e1d69324  wanarp.sys
Microsoft Corporation

fc438d1430b28618e2d0c7c332a710ad  watchdog.sys
Microsoft Corporation

441bd2d7b4f98134c3a4f9fa570fd250  Wdf01000.sys
Microsoft Corporation

1b409454d7a00110fdb06f7e0f155a88  WdfLdr.sys
Microsoft Corporation

72889e16ff12ba0f235467d6091b17dc  wd.sys
Microsoft Corporation

611b23304bf067451a9fdee01fbdd725  wfplwf.sys
Microsoft Corporation

05ecaec3e4529a7153b3136ceb49f0ec  wimmount.sys
Microsoft Corporation

817eaff5d38674edd7713b9dfb8e9791  winusb.sys
Microsoft Corporation

f6ff8944478594d0e414d3f048f0d778  wmiacpi.sys
Microsoft Corporation

fc146f46872d4c5b529b89a5131fd1e6  wmilib.sys
Microsoft Corporation

6bcc1d7d2fd2453957c5479a32364e52  ws2ifsl.sys
Microsoft Corporation

7cadc74271dd6461c452c271b30bd378  WUDFPf.sys
Microsoft Corporation

3b197af0fff08aa66b6b2241ca538d64  WUDFRd.sys
Microsoft Corporation

e8f3fa126a06f8e7088f63757112a186  XAudio64.sys
Conexant

6affd75c6807b3dd3ab018e27b88ef95  yk62x64.sys
Marvell

Nothing major there.

Do you know the partition setup of this computer? I see windows is in the 3rd partition. Did you slave the hard drive to your computer? Do you know what the rest of the partitions are? Are they running a dual boot system? All this is important to know with this kind of boot error.

Also, please try boot logging. Boot the infected computer and tap F8 when you see the BIOS beging to load. Select Enable Boot Logging. and let it try to boot Windows. When it fails and you get the BSOD, boot the infected computer from xPud and navigate to mnt\sda3\windows\Ntbtlog.txt and copy it to your flash drive and post in your reply. If it's not there, let me know.

I can't attach or paste ntbtlog.txt cause it's too long/big so i uploaded it on my webserver: http://www.obliqueducators.com/ntbtlog.txt



I'm not sure about the partitioning scheme...like I said it's someone else's computer. sda1 and sda2 both appear to be some type of boot drives...here's the output to 'ls' in each of them:

sda1:

Autorun
Autorun.inf
boot
bootmgr
bootmgr.efi
ComboFix.txt
data
EFI
etfsboot.com
_FS_SWRINFO
HDD
idf
Kaspersky Rescue Disk 10.0
Recovery
snyhdrcv.ini
sony
sources
System Volume Information
TDSSKiller.2.6.18.0_11.11.2011_23.23.25_log.txt

sda2:

Boot
bootmgr
System Volume Information

This post has been edited by A Future Pilot: 23 November 2011 - 03:07 PM

Can you please attach the file ComboFix.txt from sda1? Please also attach the TDSSKiller.2.6.18.0_11.11.2011_23.23.25_log.txt from the same directory.

The BSOD is a typical error when a TDL rootkit is found. Tracking it down can be difficult. The 7B is usually when a patched driver can't load; or when the antivirus removed a critical file. I didn't see that in the boot logging, although several important drivers didn't load. We'll also dump the MBR to get a head start...there's several different kinds of TDL.

• Remove the USB and insert it in the sick computer
  
• Boot the Sick computer
  
• Press F12 and choose to boot from the USB
  
• Follow the prompts
  
• A Welcome to xPUD screen will appear
  
• Press File
  
• Expand mnt
  
• sda1,2...usually corresponds to your HDD
  
• sdb1 is likely your USB
  
• Click on the folder that represents your USB drive (sdb1 ?)
  
• Press Tool at the top
  
• Choose Open Terminal
  
• Copy/paste the following command and press enter:
  
  dd if=/dev/sda of=mbr.txt bs=512 count=1
  
  
• When done a file, mbr.txt, will be created on your USB drive. Please attach that file to your reply.

Please note - all text entries are case sensitive

etavares

Please dont' miss my post above. BTW...would you expect Chinese to be in the boot log? Haven't seen that before in many logs.

No I wouldn't expect it...not sure why it's there.

I attached the requested files.

Sorry for the dleay. Is there a file name when you get the blue screen with the 0x7B error?