BleepingComputer.com: Malware infection Windows XP - "System Fix" and possible rootkit

A friend thinks that by clicking a link in a suspicious email message, she may have allowed this infection to exploit her Dell desktop PC. Ironically, I had installed Microsoft Security Essentials on the PC not long ago, but, at my friend's request, I tried to inactivate but NOT remove McAfee. I suspect that the clash between the two antivirus programs likely made it possible for the malware to invade in the first place. But, at any rate, I want to get my friend back up and running and online.

I've been able to get the malware to stop generating all of its fake warnings, regained control of the Windows XP desktop for the most part, and have been able to run the DDS and GMER scans successfully. I haven't connected to the net, I'm sneakernetting the executables and logs back and forth here. I need to unhide some files -- I can see the start menu but there appears to be nothing in most folders, and it still looks to me as if the infection is active, and is the HDD variant of problem == the disk drive is blinking like mad all of the time.

Here is theDDS log, and I am attaching the other two files requested. Thanks, in advance, for your advice and help!!:

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by Owner at 9:39:29 on 2011-12-29
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2037.1452 [GMT -5:00]
.
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Dell\DellDock\DockLogin.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Microsoft\BingBar\SeaPort.EXE
C:\Program Files\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\VERIZONDM\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\VERIZONDM\bin\tgsrvc.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Dell\DellDock\DellDock.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\Roxio\Roxio Burn\RoxioBurnLauncher.exe
C:\Program Files\VERIZONDM\bin\sprtcmd.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\program files\real\realplayer\update\realsched.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Documents and Settings\All Users\Application Data\bhUKOKk56TwBTG.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\wscntfy.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.aol.com/?mtmhp=acm50mtmhpunauthgreeting2
uSearch Page = hxxp://www.bing.com
uSearch Bar = hxxp://www.bing.com/sphome.aspx
mSearchAssistant = hxxp://www.bing.com/sphome.aspx
uURLSearchHooks: H - No File
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {27B4851A-3207-45A2-B947-BE8AFE6163AB} - No File
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Simppull Toolbar: {627af46b-2076-42ae-a2fd-8428734d3e74} - c:\program files\simppulltoolbar\simppulldx.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Updater For Simppull Toolbar: {c4b8bab4-1667-11df-a242-ba9455d89593} - c:\program files\simppulltoolbar\auxi\simppulltoolbAu.dll
BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "c:\program files\microsoft\bingbar\BingExt.dll"
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: {E4E6BF2A-1667-11DF-A01F-1F9655D89593} - No File
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Simppull Toolbar: {627af46b-2076-42ae-a2fd-8428734d3e74} - c:\program files\simppulltoolbar\simppulldx.dll
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "c:\program files\microsoft\bingbar\BingExt.dll"
TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Weather] c:\program files\aws\weatherbug\Weather.exe 1
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [bhUKOKk56TwBTG] c:\documents and settings\all users\application data\bhUKOKk56TwBTG.exe
uRun: [McAfee Update] c:\docume~1\owner\locals~1\temp\mcupdate_1325168965.exe /syncfin c:\docume~1\owner\locals~1\temp\mcupdate_1325168965.ini
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe"
mRun: [Desktop Disc Tool] "c:\program files\roxio\roxio burn\RoxioBurnLauncher.exe"
mRun: [VERIZONDM] "c:\program files\verizondm\bin\sprtcmd.exe" /P VERIZONDM
mRun: [Verizon_McciTrayApp] "c:\program files\verizon\McciTrayApp.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot
mRun: [jdiNQqhyasYS.exe] c:\documents and settings\all users\application data\jdiNQqhyasYS.exe
StartupFolder: c:\docume~1\owner\startm~1\programs\startup\delldo~1.lnk - c:\program files\dell\delldock\DellDock.exe
dPolicies-explorer: NoDesktop = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
Trusted Zone: internet
Trusted Zone: mcafee.com
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1284849525187
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
.
============= SERVICES / DRIVERS ===============
.
R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys --> c:\windows\system32\drivers\mfehidk.sys [?]
R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys --> c:\windows\system32\drivers\mfetdi2k.sys [?]
R2 BBUpdate;BBUpdate;c:\program files\microsoft\bingbar\SeaPort.EXE [2011-10-13 249648]
R2 DockLoginService;Dock Login Service;c:\program files\dell\delldock\DockLogin.exe [2009-6-9 155648]
R2 IHA_MessageCenter;IHA_MessageCenter;c:\program files\verizon\iha_messagecenter\bin\Verizon_IHAMessageCenter.exe [2011-10-28 286736]
R2 sprtsvc_verizondm;SupportSoft Sprocket Service (verizondm);c:\program files\verizondm\bin\sprtsvc.exe [2010-9-2 206120]
R2 tgsrvc_verizondm;SupportSoft Repair Service (verizondm);c:\program files\verizondm\bin\tgsrvc.exe [2010-9-2 185640]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys --> c:\windows\system32\drivers\mfeavfk.sys [?]
S1 MpKsl33855a5c;MpKsl33855a5c;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{b9f544e5-c0e5-4d94-b3f1-7d250c8beee8}\mpksl33855a5c.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{b9f544e5-c0e5-4d94-b3f1-7d250c8beee8}\MpKsl33855a5c.sys [?]
S1 MpKsl38130eec;MpKsl38130eec;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{00f7c8bd-3f72-4f47-93b2-506b9daed471}\mpksl38130eec.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{00f7c8bd-3f72-4f47-93b2-506b9daed471}\MpKsl38130eec.sys [?]
S1 MpKsl3f46fa51;MpKsl3f46fa51;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{00f7c8bd-3f72-4f47-93b2-506b9daed471}\mpksl3f46fa51.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{00f7c8bd-3f72-4f47-93b2-506b9daed471}\MpKsl3f46fa51.sys [?]
S1 MpKslfde405b7;MpKslfde405b7;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{eaa3c52d-20e0-47b2-8475-d8077af80ad6}\mpkslfde405b7.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{eaa3c52d-20e0-47b2-8475-d8077af80ad6}\MpKslfde405b7.sys [?]
S2 0037931325168934mcinstcleanup;McAfee Application Installer Cleanup (0037931325168934);c:\docume~1\owner\locals~1\temp\003793~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service --> c:\docume~1\owner\locals~1\temp\003793~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service [?]
S2 BBSvc;Bing Bar Update Service;c:\program files\microsoft\bingbar\BBSvc.EXE [2011-10-21 196176]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-12-19 136176]
S2 McShield;McAfee McShield;"c:\program files\common files\mcafee\systemcore\\mcshield.exe" --> c:\program files\common files\mcafee\systemcore\\mcshield.exe [?]
S2 mfefire;McAfee Firewall Core Service;"c:\program files\common files\mcafee\systemcore\\mfefire.exe" --> c:\program files\common files\mcafee\systemcore\\mfefire.exe [?]
S2 mfevtp;McAfee Validation Trust Protection Service;"c:\windows\system32\mfevtps.exe" --> c:\windows\system32\mfevtps.exe [?]
S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys --> c:\windows\system32\drivers\cfwids.sys [?]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-12-19 136176]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys --> c:\windows\system32\drivers\mfebopk.sys [?]
S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys --> c:\windows\system32\drivers\mfefirek.sys [?]
S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys --> c:\windows\system32\drivers\mfendisk.sys [?]
S3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys --> c:\windows\system32\drivers\mfendisk.sys [?]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys --> c:\windows\system32\drivers\mferkdet.sys [?]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2008-4-25 14336]
.
=============== Created Last 30 ================
.
2011-12-29 02:27:33 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-12-29 02:27:32 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-12-28 18:37:57 356608 ----a-w- c:\documents and settings\all users\application data\bhUKOKk56TwBTG.exe
2011-12-21 23:34:35 -------- d-----w- c:\windows\system32\wbem\repository\FS
2011-12-21 23:34:35 -------- d-----w- c:\windows\system32\wbem\Repository
2011-12-21 23:32:38 -------- d-----w- c:\program files\McAfee.com
2011-12-21 23:32:28 -------- d-----w- c:\program files\McAfee
2011-12-21 23:32:25 -------- d-----w- c:\program files\common files\Mcafee
2011-12-21 23:04:28 -------- d-----w- c:\program files\Spybot - Search & Destroy
2011-12-21 23:04:27 -------- d-----w- c:\windows\system32\appmgmt
2011-12-21 23:03:42 -------- d-----w- c:\documents and settings\owner\local settings\application data\Deployment
2011-12-21 21:59:11 -------- d-----w- c:\program files\McAfee(3)
2011-12-21 21:58:57 -------- d-----w- c:\documents and settings\all users\application data\McAfee(3)
2011-12-21 18:52:24 -------- d-----w- c:\windows\LastGood(2)
2011-12-20 04:07:00 -------- d-----w- c:\documents and settings\owner\application data\ElevatedDiagnostics
2011-12-19 23:32:15 -------- d-----w- c:\program files\common files\Mcafee(2)
2011-12-19 23:32:14 -------- d-----w- c:\program files\McAfee(2).com
2011-12-19 22:43:44 -------- d-----w- c:\documents and settings\owner\application data\McAfee
2011-12-19 22:43:19 -------- d-----w- c:\program files\McAfee(2)
2011-12-19 21:47:33 -------- d-----w- c:\documents and settings\all users\application data\Spybot - Search & Destroy
2011-12-19 18:52:10 -------- d-----w- c:\documents and settings\owner\application data\Malwarebytes
2011-12-19 18:51:39 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes
2011-12-19 17:38:59 -------- d-----w- c:\documents and settings\owner\local settings\application data\Google
2011-12-19 03:45:05 116224 -c--a-w- c:\windows\system32\dllcache\xrxwiadr.dll
2011-12-19 03:45:02 23040 -c--a-w- c:\windows\system32\dllcache\xrxwbtmp.dll
2011-12-19 03:45:02 18944 -c--a-w- c:\windows\system32\dllcache\xrxscnui.dll
2011-12-19 03:45:00 27648 -c--a-w- c:\windows\system32\dllcache\xrxftplt.exe
2011-12-19 03:43:59 9216 -c--a-w- c:\windows\system32\dllcache\wamps51.dll
2011-12-19 03:42:58 26624 -c--a-w- c:\windows\system32\dllcache\umaxu22.dll
2011-12-19 03:41:59 138528 -c--a-w- c:\windows\system32\dllcache\tgiulnt5.sys
2011-12-19 03:40:59 106584 -c--a-w- c:\windows\system32\dllcache\spdports.dll
2011-12-19 03:39:57 68608 -c--a-w- c:\windows\system32\dllcache\sis6306p.sys
2011-12-19 03:38:58 41216 -c--a-w- c:\windows\system32\dllcache\s3mt3d.sys
2011-12-19 03:37:58 35328 -c--a-w- c:\windows\system32\dllcache\psisload.dll
2011-12-19 03:36:59 28032 -c--a-w- c:\windows\system32\dllcache\ovcd.sys
2011-12-19 03:35:59 59104 -c--a-w- c:\windows\system32\dllcache\n9i128v2.dll
2011-12-19 03:34:57 7680 -c--a-w- c:\windows\system32\dllcache\migregdb.exe
2011-12-19 03:33:59 8704 -c--a-w- c:\windows\system32\dllcache\kbdjpn.dll
2011-12-19 03:32:59 9216 -c--a-w- c:\windows\system32\dllcache\ibmsgnet.dll
2011-12-19 03:31:59 2688 -c--a-w- c:\windows\system32\dllcache\hidswvd.sys
2011-12-19 03:30:59 174464 -c--a-w- c:\windows\system32\dllcache\es198x.sys
2011-12-19 03:29:59 102484 -c--a-w- c:\windows\system32\dllcache\digiinf.dll
2011-12-19 03:28:59 236032 -c--a-w- c:\windows\system32\dllcache\camext20.dll
2011-12-19 03:27:58 3775 -c--a-w- c:\windows\system32\dllcache\adv11nt5.dll
2011-12-19 01:48:17 -------- d-sh--w- c:\documents and settings\owner\IECompatCache
2011-12-18 23:53:45 -------- d-----w- c:\documents and settings\all users\application data\Citrix
2011-12-18 23:43:25 -------- d-----w- c:\documents and settings\owner\local settings\application data\Citrix
2011-12-18 23:42:21 0 ----a-w- c:\documents and settings\owner\GoToAssistDownloadHelper.exe
2011-12-17 22:57:53 -------- d-----w- c:\windows\system32\NtmsData
2011-12-01 17:50:27 260 ----a-w- c:\windows\system32\cmdVBS.vbs
2011-12-01 17:50:27 256 ----a-w- c:\windows\system32\MSIevent.bat
.
==================== Find3M ====================
.
2011-11-23 13:29:56 1868544 ----a-w- c:\windows\system32\win32k.sys
2011-11-04 19:20:51 916992 ----a-w- c:\windows\system32\wininet.dll
2011-11-04 19:20:51 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-11-04 19:20:51 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-11-04 11:23:59 385024 ----a-w- c:\windows\system32\html.iec
2011-11-01 16:07:10 1288704 ----a-w- c:\windows\system32\ole32.dll
2011-10-28 05:31:48 33280 ----a-w- c:\windows\system32\csrsrv.dll
2011-10-25 13:37:08 2148864 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-10-25 12:52:02 2027008 ----a-w- c:\windows\system32\ntkrnlpa.exe
2011-10-18 19:32:30 150856 ----a-w- c:\windows\system32\mfevtps.exe.d0ce.deleteme
2011-10-18 11:13:22 186880 ----a-w- c:\windows\system32\encdec.dll
2011-10-10 14:22:41 692736 ----a-w- c:\windows\system32\inetcomm.dll
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: ST3320418AS rev.CC45 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A49D49F]<<
_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x8a4a4738]; MOV EAX, [0x8a4a48ac]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
1 ntkrnlpa!IofCallDriver[0x804EF1A6] -> \Device\Harddisk0\DR0[0x8ADDFAB8]
3 CLASSPNP[0xBA0F8FD7] -> ntkrnlpa!IofCallDriver[0x804EF1A6] -> \Device\00000072[0x8AE251B0]
5 ACPI[0xB9F7F620] -> ntkrnlpa!IofCallDriver[0x804EF1A6] -> [0x8AE4CC80]
\Driver\atapi[0x8ACD3B10] -> IRP_MJ_CREATE -> 0x8A49D49F
error: Read A device attached to the system is not functioning.
kernel: MBR read successfully
_asm { MOV AX, 0x0; MOV SS, AX; MOV SP, 0x7c00; MOV DS, AX; CLD ; MOV CX, 0x80; MOV SI, SP; MOV DI, 0x600; MOV ES, AX; REP MOVSD ; JMP FAR 0x0:0x62d; }
detected disk devices:
detected hooks:
\Driver\atapi DriverStartIo -> 0x8A49D2C6
user & kernel MBR OK
Warning: possible TDL3 rootkit infection !
.
============= FINISH: 9:41:15.21 ===============

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:

***************************************************

In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/435183 <<< CLICK THIS LINK

If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.

***************************************************

If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

• If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
  
• A new DDS and GMER log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
  
  • Please do this even if you have previously posted logs for us.
    
  • If you were unable to produce the logs originally please try once more.
    
  • If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    
  • If you are unsure about any of these characteristics just post what you can and we will guide you.
  
  
• Please tell us if you have your original Windows CD/DVD available.
  
• Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.

Thank you for your patience, and again sorry for the delay.

***************************************************

We need to see some information about what is happening in your machine. Please perform the following scan again:

• Download DDS by sUBs from one of the following links if you no longer have it available. Save it to your desktop.
  • DDS.scr
    
  • DDS.pif
  
  
• Double click on the DDS icon, allow it to run.
  
• A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  
• Notepad will open with the results.
  
• Follow the instructions that pop up for posting the results.
  
• Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE


We also need a new log from the GMER anti-rootkit Scanner.

Please note that if you are running a 64-bit version of Windows you will not be able to run GMER and you may skip this step.

Please first disable any CD emulation programs using the steps found in this topic:


Then create another GMER log and post it as an attachment to the reply where you post your new DDS log. Instructions on how to properly create a GMER log can be found here:



As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

Hi and Thank You! I can see how busy the forum and the volunteers are! I will work on a clear description of the problem and the new logs and get them up here as soon as I can. I appreciate the help, and I know my friend is deeply grateful also. There apparently was a call made to McAfee for help, which I have a couple of notes from -- this was done by another person before I was called in, but did not seem to resolve any of the issues.

Thank you, BC and its volunteer team are amazing!

L

Initially, my friend said that windows kept popping up all across her display, and I think that she said she finally just pulled the plug out of the wall! When I went over to see what was up, the PC would boot into Windows, and then a window appeared offering System Fix scans. Also, popups did appear cascading down the screen complaining about one critical error or another. We were not able to shut the PC down, and attempts to shut the System Fix program down also were unsuccessful. We could not get to AOL over the internet, nor could we access any local files. McAfee antivirus was not detecting any problems. Finally we hit the system unit's power button to turn it off.

I brought it home, collected system CDs (one reinstallation CD for MS Windows XP Pro SP 3; several others that may be for other family machines). I downloaded Malbytes' detection tool, ran that, and ran the shareware removal tool which identified 3 infected files and 2 bad registry keys. It removed the files and corrected the keys, but didn't seem to help. I found a blog offering a hacked email address/registration code for System Fix and somewhat desperately tried it, and it did work to quiet System Fix down so that it's possible to limp along and get a command run every now and then. I ran those preparation scans for BC and submitted them and turned the PC off until today.

Then today, I powered it on, got one POST beep, the DELL logo and Windows XP splash screen, then the login prompt. I entered the password and the desktop came up, the Dell Tool Dock loaded, and things looked reasonably good. But on the start menu, I found most program groups were "empty," and there is a start menu entry for System Fix. Partway through the DDS scan, the System Fix window opened, but I ignored it, aside from clicking on the DDS window to be sure it had focus.

The DDS file is below, and attached. I don't have an internet connection for this machine where I have it set up.

I ran GMER. It opened a warning window - "Warning!!! GMER has found system modification caused by ROOTKIT activity." I clicked ok and saved the final report.

Trying to stop and remove the thumb drive results in "Problem ejecting USB Mass Storage Device" The device 'SanDisk Cruzer Mini USB Device' cannot be stopped because a program is still accessing it.

And the system's disk light is still pretty madly active.

Thank you for your help and advice with this, it's maddening!

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by Owner at 19:13:07 on 2012-01-03
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2037.1464 [GMT -5:00]
.
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Dell\DellDock\DockLogin.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Microsoft\BingBar\BBSvc.EXE
C:\Program Files\Microsoft\BingBar\SeaPort.EXE
C:\Program Files\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\VERIZONDM\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\VERIZONDM\bin\tgsrvc.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Dell\DellDock\DellDock.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\Roxio\Roxio Burn\RoxioBurnLauncher.exe
C:\Program Files\VERIZONDM\bin\sprtcmd.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\program files\real\realplayer\update\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Documents and Settings\All Users\Application Data\bhUKOKk56TwBTG.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\mcupdate_1325168965.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\attrib.exe
C:\WINDOWS\system32\attrib.exe
C:\WINDOWS\system32\attrib.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.aol.com/?mtmhp=acm50mtmhpunauthgreeting2
uSearch Page = hxxp://www.bing.com
uSearch Bar = hxxp://www.bing.com/sphome.aspx
mSearchAssistant = hxxp://www.bing.com/sphome.aspx
uURLSearchHooks: H - No File
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {27B4851A-3207-45A2-B947-BE8AFE6163AB} - No File
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Updater For Simppull Toolbar: {c4b8bab4-1667-11df-a242-ba9455d89593} - c:\program files\simppulltoolbar\auxi\simppulltoolbAu.dll
BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "c:\program files\microsoft\bingbar\BingExt.dll"
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: {E4E6BF2A-1667-11DF-A01F-1F9655D89593} - No File
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - "c:\program files\microsoft\bingbar\BingExt.dll"
TB: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Weather] c:\program files\aws\weatherbug\Weather.exe 1
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [bhUKOKk56TwBTG] c:\documents and settings\all users\application data\bhUKOKk56TwBTG.exe
uRun: [McAfee Update] c:\docume~1\owner\locals~1\temp\mcupdate_1325168965.exe /syncfin c:\docume~1\owner\locals~1\temp\mcupdate_1325168965.ini
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe"
mRun: [Desktop Disc Tool] "c:\program files\roxio\roxio burn\RoxioBurnLauncher.exe"
mRun: [VERIZONDM] "c:\program files\verizondm\bin\sprtcmd.exe" /P VERIZONDM
mRun: [Verizon_McciTrayApp] "c:\program files\verizon\McciTrayApp.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot
mRun: [jdiNQqhyasYS.exe] c:\documents and settings\all users\application data\jdiNQqhyasYS.exe
StartupFolder: c:\docume~1\owner\startm~1\programs\startup\delldo~1.lnk - c:\program files\dell\delldock\DellDock.exe
dPolicies-explorer: NoDesktop = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
Trusted Zone: internet
Trusted Zone: mcafee.com
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1284849525187
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
.
============= SERVICES / DRIVERS ===============
.
R2 BBSvc;Bing Bar Update Service;c:\program files\microsoft\bingbar\BBSvc.EXE [2011-10-21 196176]
R2 BBUpdate;BBUpdate;c:\program files\microsoft\bingbar\SeaPort.EXE [2011-10-13 249648]
R2 DockLoginService;Dock Login Service;c:\program files\dell\delldock\DockLogin.exe [2009-6-9 155648]
R2 IHA_MessageCenter;IHA_MessageCenter;c:\program files\verizon\iha_messagecenter\bin\Verizon_IHAMessageCenter.exe [2011-10-28 286736]
R2 sprtsvc_verizondm;SupportSoft Sprocket Service (verizondm);c:\program files\verizondm\bin\sprtsvc.exe [2010-9-2 206120]
R2 tgsrvc_verizondm;SupportSoft Repair Service (verizondm);c:\program files\verizondm\bin\tgsrvc.exe [2010-9-2 185640]
S1 MpKsl33855a5c;MpKsl33855a5c;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{b9f544e5-c0e5-4d94-b3f1-7d250c8beee8}\mpksl33855a5c.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{b9f544e5-c0e5-4d94-b3f1-7d250c8beee8}\MpKsl33855a5c.sys [?]
S1 MpKsl38130eec;MpKsl38130eec;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{00f7c8bd-3f72-4f47-93b2-506b9daed471}\mpksl38130eec.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{00f7c8bd-3f72-4f47-93b2-506b9daed471}\MpKsl38130eec.sys [?]
S1 MpKsl3f46fa51;MpKsl3f46fa51;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{00f7c8bd-3f72-4f47-93b2-506b9daed471}\mpksl3f46fa51.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{00f7c8bd-3f72-4f47-93b2-506b9daed471}\MpKsl3f46fa51.sys [?]
S1 MpKslfde405b7;MpKslfde405b7;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{eaa3c52d-20e0-47b2-8475-d8077af80ad6}\mpkslfde405b7.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{eaa3c52d-20e0-47b2-8475-d8077af80ad6}\MpKslfde405b7.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-12-19 136176]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-12-19 136176]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2008-4-25 14336]
.
=============== Created Last 30 ================
.
2011-12-29 15:00:47 -------- d-----w- c:\documents and settings\owner\application data\simppulltoolbar
2011-12-29 02:27:33 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-12-29 02:27:32 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-12-28 18:37:57 356608 ----a-w- c:\documents and settings\all users\application data\bhUKOKk56TwBTG.exe
2011-12-21 23:34:35 -------- d-----w- c:\windows\system32\wbem\repository\FS
2011-12-21 23:34:35 -------- d-----w- c:\windows\system32\wbem\Repository
2011-12-21 23:32:28 -------- d-----w- c:\program files\McAfee
2011-12-21 23:04:28 -------- d-----w- c:\program files\Spybot - Search & Destroy
2011-12-21 23:04:27 -------- d-----w- c:\windows\system32\appmgmt
2011-12-21 23:03:42 -------- d-----w- c:\documents and settings\owner\local settings\application data\Deployment
2011-12-21 21:59:11 -------- d-----w- c:\program files\McAfee(3)
2011-12-21 21:58:57 -------- d-----w- c:\documents and settings\all users\application data\McAfee(3)
2011-12-21 18:52:24 -------- d-----w- c:\windows\LastGood(2)
2011-12-20 04:07:00 -------- d-----w- c:\documents and settings\owner\application data\ElevatedDiagnostics
2011-12-19 23:32:15 -------- d-----w- c:\program files\common files\Mcafee(2)
2011-12-19 23:32:14 -------- d-----w- c:\program files\McAfee(2).com
2011-12-19 22:43:44 -------- d-----w- c:\documents and settings\owner\application data\McAfee
2011-12-19 22:43:19 -------- d-----w- c:\program files\McAfee(2)
2011-12-19 21:47:33 -------- d-----w- c:\documents and settings\all users\application data\Spybot - Search & Destroy
2011-12-19 18:52:10 -------- d-----w- c:\documents and settings\owner\application data\Malwarebytes
2011-12-19 18:51:39 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes
2011-12-19 17:38:59 -------- d-----w- c:\documents and settings\owner\local settings\application data\Google
2011-12-19 03:45:05 116224 -c--a-w- c:\windows\system32\dllcache\xrxwiadr.dll
2011-12-19 03:45:02 23040 -c--a-w- c:\windows\system32\dllcache\xrxwbtmp.dll
2011-12-19 03:45:02 18944 -c--a-w- c:\windows\system32\dllcache\xrxscnui.dll
2011-12-19 03:45:00 27648 -c--a-w- c:\windows\system32\dllcache\xrxftplt.exe
2011-12-19 03:43:59 9216 -c--a-w- c:\windows\system32\dllcache\wamps51.dll
2011-12-19 03:42:58 26624 -c--a-w- c:\windows\system32\dllcache\umaxu22.dll
2011-12-19 03:41:59 138528 -c--a-w- c:\windows\system32\dllcache\tgiulnt5.sys
2011-12-19 03:40:59 106584 -c--a-w- c:\windows\system32\dllcache\spdports.dll
2011-12-19 03:39:57 68608 -c--a-w- c:\windows\system32\dllcache\sis6306p.sys
2011-12-19 03:38:58 41216 -c--a-w- c:\windows\system32\dllcache\s3mt3d.sys
2011-12-19 03:37:58 35328 -c--a-w- c:\windows\system32\dllcache\psisload.dll
2011-12-19 03:36:59 28032 -c--a-w- c:\windows\system32\dllcache\ovcd.sys
2011-12-19 03:35:59 59104 -c--a-w- c:\windows\system32\dllcache\n9i128v2.dll
2011-12-19 03:34:57 7680 -c--a-w- c:\windows\system32\dllcache\migregdb.exe
2011-12-19 03:33:59 8704 -c--a-w- c:\windows\system32\dllcache\kbdjpn.dll
2011-12-19 03:32:59 9216 -c--a-w- c:\windows\system32\dllcache\ibmsgnet.dll
2011-12-19 03:31:59 2688 -c--a-w- c:\windows\system32\dllcache\hidswvd.sys
2011-12-19 03:30:59 174464 -c--a-w- c:\windows\system32\dllcache\es198x.sys
2011-12-19 03:29:59 102484 -c--a-w- c:\windows\system32\dllcache\digiinf.dll
2011-12-19 03:28:59 236032 -c--a-w- c:\windows\system32\dllcache\camext20.dll
2011-12-19 03:27:58 3775 -c--a-w- c:\windows\system32\dllcache\adv11nt5.dll
2011-12-19 01:48:17 -------- d-sh--w- c:\documents and settings\owner\IECompatCache
2011-12-18 23:53:45 -------- d-----w- c:\documents and settings\all users\application data\Citrix
2011-12-18 23:43:25 -------- d-----w- c:\documents and settings\owner\local settings\application data\Citrix
2011-12-18 23:42:21 0 ----a-w- c:\documents and settings\owner\GoToAssistDownloadHelper.exe
2011-12-17 22:57:53 -------- d-----w- c:\windows\system32\NtmsData
.
==================== Find3M ====================
.
2011-12-01 17:50:27 260 ----a-w- c:\windows\system32\cmdVBS.vbs
2011-12-01 17:50:27 256 ----a-w- c:\windows\system32\MSIevent.bat
2011-11-23 13:29:56 1868544 ----a-w- c:\windows\system32\win32k.sys
2011-11-04 19:20:51 916992 ----a-w- c:\windows\system32\wininet.dll
2011-11-04 19:20:51 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-11-04 19:20:51 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-11-04 11:23:59 385024 ----a-w- c:\windows\system32\html.iec
2011-11-01 16:07:10 1288704 ----a-w- c:\windows\system32\ole32.dll
2011-10-28 05:31:48 33280 ----a-w- c:\windows\system32\csrsrv.dll
2011-10-25 13:37:08 2148864 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-10-25 12:52:02 2027008 ----a-w- c:\windows\system32\ntkrnlpa.exe
2011-10-18 11:13:22 186880 ----a-w- c:\windows\system32\encdec.dll
2011-10-10 14:22:41 692736 ----a-w- c:\windows\system32\inetcomm.dll
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: ST3320418AS rev.CC45 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A6B149F]<<
_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x8a6b8738]; MOV EAX, [0x8a6b88ac]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
1 ntkrnlpa!IofCallDriver[0x804EF1A6] -> \Device\Harddisk0\DR0[0x8AB9FAB8]
3 CLASSPNP[0xBA0E8FD7] -> ntkrnlpa!IofCallDriver[0x804EF1A6] -> \Device\00000070[0x8ABF03E0]
5 ACPI[0xB9F7F620] -> ntkrnlpa!IofCallDriver[0x804EF1A6] -> [0x8ABA5378]
\Driver\atapi[0x8AA7B5A8] -> IRP_MJ_CREATE -> 0x8A6B149F
error: Read A device attached to the system is not functioning.
kernel: MBR read successfully
_asm { MOV AX, 0x0; MOV SS, AX; MOV SP, 0x7c00; MOV DS, AX; CLD ; MOV CX, 0x80; MOV SI, SP; MOV DI, 0x600; MOV ES, AX; REP MOVSD ; JMP FAR 0x0:0x62d; }
detected disk devices:
detected hooks:
\Driver\atapi DriverStartIo -> 0x8A6B12C6
user & kernel MBR OK
Warning: possible TDL3 rootkit infection !
.
============= FINISH: 19:18:35.35 ===============

Hello and Welcome to the forums!

My name is Gringo and I'll be glad to help you with your computer problems.

Somethings to remember while we are working together.

• Do not run any other tool untill instructed to do so!
  
• please Do not Attach logs or put in code boxes.
  
• Tell me about any problems that have occurred during the fix.
  
• Tell me of any other symptoms you may be having as these can help also.
  
• Do not run anything while running a fix.
  
• Do not run any other tool untill instructed to do so!

Click on the Watch Topic Button and select Immediate Notification and click on proceed, this will help you to get notified faster when I have replied and make the cleaning process faster.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links.

Link 1
Link 2
Link 3

1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following


• Log from Combofix
  
• let me know of any problems you may have had
  
• How is the computer doing now?

Gringo

Thank you SO much for your patience and help Gringo! I am Linda.

You asked for

Log from ComboFix

ComboFix 12-01-05.01 - Owner 01/05/2012 12:31:15.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2037.1524 [GMT -5:00]
Running from: E:\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\~bhUKOKk56TwBTG
c:\documents and settings\All Users\Application Data\bhUKOKk56TwBTG
c:\documents and settings\All Users\Application Data\bhUKOKk56TwBTG.exe
c:\documents and settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\System Fix.lnk
c:\documents and settings\Owner\Application Data\PriceGong
c:\documents and settings\Owner\Desktop\System Fix.lnk
c:\documents and settings\Owner\g2mdlhlpx.exe
c:\documents and settings\Owner\GoToAssistDownloadHelper.exe
c:\documents and settings\Owner\My Documents\~WRL3531.tmp
c:\documents and settings\Owner\Start Menu\Programs\System Fix
c:\documents and settings\Owner\Start Menu\Programs\System Fix\System Fix.lnk
c:\documents and settings\Owner\Start Menu\Programs\System Fix\Uninstall System Fix.lnk
c:\windows\system32\SET5B.tmp
c:\windows\system32\SET5F.tmp
c:\windows\system32\SET67.tmp
c:\windows\TEMP\5065376.013584906.tmp
.
.
((((((((((((((((((((((((( Files Created from 2011-12-05 to 2012-01-05 )))))))))))))))))))))))))))))))
.
.
2011-12-29 15:00 . 2011-12-29 15:00 -------- d-----w- c:\documents and settings\Owner\Application Data\simppulltoolbar
2011-12-29 02:27 . 2011-08-31 22:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-12-29 02:27 . 2011-12-29 14:05 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-12-28 19:09 . 2011-12-28 19:09 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2011-12-21 23:34 . 2011-12-21 23:34 -------- d-----w- c:\windows\system32\wbem\Repository
2011-12-19 18:52 . 2011-12-19 18:52 -------- d-----w- c:\documents and settings\Owner\Application Data\Malwarebytes
2011-12-19 18:51 . 2011-12-19 18:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-12-19 17:38 . 2011-12-21 21:58 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Google
2011-12-19 04:38 . 2012-01-04 00:10 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2011-12-19 03:45 . 2008-04-14 10:42 116224 -c--a-w- c:\windows\system32\dllcache\xrxwiadr.dll
2011-12-19 03:45 . 2008-04-14 10:42 18944 -c--a-w- c:\windows\system32\dllcache\xrxscnui.dll
2011-12-19 03:45 . 2001-08-18 03:36 23040 -c--a-w- c:\windows\system32\dllcache\xrxwbtmp.dll
2011-12-19 03:45 . 2001-08-18 03:37 27648 -c--a-w- c:\windows\system32\dllcache\xrxftplt.exe
2011-12-19 03:43 . 2008-04-14 12:00 9216 -c--a-w- c:\windows\system32\dllcache\wamps51.dll
2011-12-19 03:42 . 2001-08-18 03:36 26624 -c--a-w- c:\windows\system32\dllcache\umaxu22.dll
2011-12-19 03:41 . 2001-08-17 17:51 138528 -c--a-w- c:\windows\system32\dllcache\tgiulnt5.sys
2011-12-19 03:40 . 2001-08-18 03:36 106584 -c--a-w- c:\windows\system32\dllcache\spdports.dll
2011-12-19 03:39 . 2001-08-17 17:50 68608 -c--a-w- c:\windows\system32\dllcache\sis6306p.sys
2011-12-19 03:38 . 2001-08-17 17:50 41216 -c--a-w- c:\windows\system32\dllcache\s3mt3d.sys
2011-12-19 03:37 . 2001-08-18 03:36 35328 -c--a-w- c:\windows\system32\dllcache\psisload.dll
2011-12-19 03:36 . 2001-08-17 19:05 28032 -c--a-w- c:\windows\system32\dllcache\ovcd.sys
2011-12-19 03:35 . 2001-08-18 03:36 59104 -c--a-w- c:\windows\system32\dllcache\n9i128v2.dll
2011-12-19 03:34 . 2008-04-14 12:00 7680 -c--a-w- c:\windows\system32\dllcache\migregdb.exe
2011-12-19 03:33 . 2001-08-18 03:36 8704 -c--a-w- c:\windows\system32\dllcache\kbdjpn.dll
2011-12-19 03:32 . 2001-08-18 03:34 9216 -c--a-w- c:\windows\system32\dllcache\ibmsgnet.dll
2011-12-19 03:31 . 2008-04-14 05:15 19200 -c--a-w- c:\windows\system32\dllcache\hidir.sys
2011-12-19 03:30 . 2001-08-17 17:19 174464 -c--a-w- c:\windows\system32\dllcache\es198x.sys
2011-12-19 03:29 . 2001-08-18 03:36 102484 -c--a-w- c:\windows\system32\dllcache\digiinf.dll
2011-12-19 03:28 . 2001-08-18 03:36 236032 -c--a-w- c:\windows\system32\dllcache\camext20.dll
2011-12-19 03:27 . 2008-04-14 10:41 3775 -c--a-w- c:\windows\system32\dllcache\adv11nt5.dll
2011-12-19 01:48 . 2011-12-19 01:48 -------- d-sh--w- c:\documents and settings\Owner\IECompatCache
2011-12-18 23:53 . 2011-12-18 23:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Citrix
2011-12-18 23:43 . 2011-12-18 23:43 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Citrix
2011-12-17 22:57 . 2011-12-21 22:53 -------- d-----w- c:\windows\system32\NtmsData
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-01 17:50 . 2011-12-01 17:50 260 ----a-w- c:\windows\system32\cmdVBS.vbs
2011-12-01 17:50 . 2011-12-01 17:50 256 ----a-w- c:\windows\system32\MSIevent.bat
2011-11-23 13:29 . 2008-04-25 16:16 1868544 ----a-w- c:\windows\system32\win32k.sys
2011-11-04 19:20 . 2008-04-25 16:16 916992 ----a-w- c:\windows\system32\wininet.dll
2011-11-04 19:20 . 2008-04-25 16:16 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-11-04 19:20 . 2008-04-25 16:16 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-11-04 11:23 . 2008-04-25 16:16 385024 ----a-w- c:\windows\system32\html.iec
2011-11-01 16:07 . 2008-04-25 16:16 1288704 ----a-w- c:\windows\system32\ole32.dll
2011-10-28 05:31 . 2008-04-25 16:16 33280 ----a-w- c:\windows\system32\csrsrv.dll
2011-10-25 13:37 . 2008-04-25 16:16 2148864 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-10-25 12:52 . 2008-04-14 00:01 2027008 ----a-w- c:\windows\system32\ntkrnlpa.exe
2011-10-18 11:13 . 2008-04-25 16:16 186880 ----a-w- c:\windows\system32\encdec.dll
2011-10-10 14:22 . 2008-04-25 21:27 692736 ----a-w- c:\windows\system32\inetcomm.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2009-01-13 17421824]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-01-12 142104]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-01-12 162584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-01-12 138008]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-12-29 140520]
"Desktop Disc Tool"="c:\program files\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [2009-10-15 498160]
"VERIZONDM"="c:\program files\VERIZONDM\bin\sprtcmd.exe" [2010-09-02 206120]
"Verizon_McciTrayApp"="c:\program files\Verizon\McciTrayApp.exe" [2010-03-17 1565696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2011-07-01 273544]
.
c:\documents and settings\Administrator\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-12-15 1324384]
.
c:\documents and settings\Owner\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-12-15 1324384]
.
c:\documents and settings\Default User\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-12-15 1324384]
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-12-15 1324384]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
"50000:UDP"= 50000:UDP:IHA_MessageCenter
.
R2 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [10/21/2011 3:23 PM 196176]
R2 BBUpdate;BBUpdate;c:\program files\Microsoft\BingBar\SeaPort.EXE [10/13/2011 5:21 PM 249648]
R2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [6/9/2009 9:11 AM 155648]
R2 IHA_MessageCenter;IHA_MessageCenter;c:\program files\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe [10/28/2011 6:20 PM 286736]
R2 sprtsvc_verizondm;SupportSoft Sprocket Service (verizondm);c:\program files\VERIZONDM\bin\sprtsvc.exe [9/2/2010 4:46 AM 206120]
R2 tgsrvc_verizondm;SupportSoft Repair Service (verizondm);c:\program files\VERIZONDM\bin\tgsrvc.exe [9/2/2010 4:46 AM 185640]
S1 MpKsl33855a5c;MpKsl33855a5c;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B9F544E5-C0E5-4D94-B3F1-7D250C8BEEE8}\MpKsl33855a5c.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B9F544E5-C0E5-4D94-B3F1-7D250C8BEEE8}\MpKsl33855a5c.sys [?]
S1 MpKsl38130eec;MpKsl38130eec;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{00F7C8BD-3F72-4F47-93B2-506B9DAED471}\MpKsl38130eec.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{00F7C8BD-3F72-4F47-93B2-506B9DAED471}\MpKsl38130eec.sys [?]
S1 MpKsl3f46fa51;MpKsl3f46fa51;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{00F7C8BD-3F72-4F47-93B2-506B9DAED471}\MpKsl3f46fa51.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{00F7C8BD-3F72-4F47-93B2-506B9DAED471}\MpKsl3f46fa51.sys [?]
S1 MpKslfde405b7;MpKslfde405b7;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{EAA3C52D-20E0-47B2-8475-D8077AF80AD6}\MpKslfde405b7.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{EAA3C52D-20E0-47B2-8475-D8077AF80AD6}\MpKslfde405b7.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [12/19/2011 1:12 PM 136176]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [12/19/2011 1:12 PM 136176]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [4/25/2008 11:16 AM 14336]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-12-19 18:12]
.
2012-01-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-12-19 18:12]
.
2012-01-05 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1869539286-965687749-1612913337-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 14:47]
.
2012-01-05 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1869539286-965687749-1612913337-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 14:47]
.
2011-12-28 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1869539286-965687749-1612913337-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 14:47]
.
2011-12-25 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1869539286-965687749-1612913337-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 14:47]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.aol.com/?mtmhp=acm50mtmhpunauthgreeting2
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
Trusted Zone: internet
Trusted Zone: mcafee.com
TCP: DhcpNameServer = 192.168.0.1
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - (no file)
BHO-{C4B8BAB4-1667-11DF-A242-BA9455D89593} - c:\program files\simppulltoolbar\auxi\simppulltoolbAu.dll
BHO-{E4E6BF2A-1667-11DF-A01F-1F9655D89593} - (no file)
HKCU-Run-Weather - c:\program files\AWS\WeatherBug\Weather.exe
HKCU-Run-bhUKOKk56TwBTG - c:\documents and settings\All Users\Application Data\bhUKOKk56TwBTG.exe
HKLM-Run-jdiNQqhyasYS.exe - c:\documents and settings\All Users\Application Data\jdiNQqhyasYS.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-01-05 12:50
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: ST3320418AS rev.CC45 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
.
device: opened successfully
user: MBR read successfully
error: Read A device attached to the system is not functioning.
kernel: MBR read successfully
detected disk devices:
detected hooks:
\Driver\atapi DriverStartIo -> 0x8A3252C6
user & kernel MBR OK
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(716)
c:\windows\system32\WININET.dll
.
- - - - - - - > 'lsass.exe'(776)
c:\windows\system32\WININET.dll
.
- - - - - - - > 'explorer.exe'(2864)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Motive\McciCMService.exe
c:\windows\system32\HPZipm12.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\system32\wscntfy.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\igfxsrvc.exe
c:\windows\system32\SearchProtocolHost.exe
c:\windows\system32\SearchFilterHost.exe
.
**************************************************************************
.
Completion time: 2012-01-05 12:55:57 - machine was rebooted
ComboFix-quarantined-files.txt 2012-01-05 17:55
.
Pre-Run: 225,462,161,408 bytes free
Post-Run: 226,961,989,632 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - D70693A19D72AC374F2D83AAC2EFCE1D


Any problems I had?

I had this machine powered off until hearing from you. When I first booted I had a blue display, so I shut down, resecured cables, and rebooted, and the display came up fine. (Sorry, I know I am verbose but I don't want to miss anything either). It booted up and looked pretty normal, although the "System Fix" and "System Fix License" icons are still showing on the desktop. We compulsively and slightly paranoiacally disconnected or secured all of the devices on our network and connected this PC to it and ComboFix ran and successfully installed the Windows Recovery Console, then started its scan, reporting that this could take a considerably long time. So I walked away for maybe 10 or 15 minutes. When I returned, the cmd window had closed, the icons had all disappeared from the desktop, and in place of the task bar there was a white bar. The mouse still would function, and that darn hard disk light continued to blink, and the USB stick access light was still on. I gave it maybe 5 more minutes to see whether anything would show up, then used the power button to down the PC. I attempted a reboot, and it booted up okay, although there looks to be a system screen that flashes by that might offer boot options -- it's much too fast to read or hope to make a selection on, however. The USB drive was running and ComboFix resumed, with the desktop looking normal and the icons re-appeared. HD activity looked high but more normally random -- before, it kind of looked like a heart rate monitor, it was so regular! ComboFix completed and the log window appeared. Windows Explorer can now see My Documents and My Computer shows all of the drives. The Start Menu items are still mostly empty (I've never tried running unhide on this PC). IE connects normally, it looks like. I thought that the problem with the USB drive not disconnecting might have been user error, but this time I made sure none of our windows were open, nothing I ran was using the drive, and it still won't disconnect, and the only thing I can do is shut down the machine, which I did. Oh, and also, the USB disconnects properly from this machine, my own.

So I think things are a lot more back to normal but not entirely out of the woods, yet!

Thank you for your time and help!

Linda

Hello

I want you to run this tool for me next.

tdsskiller:

Please read carefully and follow these steps.

• Download TDSSKiller and save it to your Desktop.
  
• doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  
• If an infected file is detected, the default action will be Cure, click on Continue.
  
• If a suspicious file is detected, the default action will be Skip, click on Continue.
  
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  
• If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
  
• If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

Gringo

22:09:28.0156 0276 TDSS rootkit removing tool 2.6.25.0 Dec 23 2011 14:51:16
22:09:28.0171 0276 ============================================================
22:09:28.0171 0276 Current date / time: 2012/01/05 22:09:28.0171
22:09:28.0171 0276 SystemInfo:
22:09:28.0171 0276
22:09:28.0171 0276 OS Version: 5.1.2600 ServicePack: 3.0
22:09:28.0171 0276 Product type: Workstation
22:09:28.0171 0276 ComputerName: DDTJMLM1
22:09:28.0171 0276 UserName: Owner
22:09:28.0171 0276 Windows directory: C:\WINDOWS
22:09:28.0171 0276 System windows directory: C:\WINDOWS
22:09:28.0171 0276 Processor architecture: Intel x86
22:09:28.0171 0276 Number of processors: 2
22:09:28.0171 0276 Page size: 0x1000
22:09:28.0171 0276 Boot type: Normal boot
22:09:28.0171 0276 ============================================================
22:09:29.0593 0276 Initialize success
22:09:46.0140 2208 ============================================================
22:09:46.0140 2208 Scan started
22:09:46.0140 2208 Mode: Manual;
22:09:46.0140 2208 ============================================================
22:09:46.0421 2208 Abiosdsk - ok
22:09:46.0515 2208 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
22:09:46.0515 2208 abp480n5 - ok
22:09:46.0609 2208 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
22:09:46.0625 2208 ACPI - ok
22:09:46.0671 2208 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
22:09:46.0671 2208 ACPIEC - ok
22:09:46.0703 2208 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys
22:09:46.0703 2208 adpu160m - ok
22:09:46.0750 2208 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
22:09:46.0765 2208 aec - ok
22:09:46.0796 2208 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
22:09:46.0796 2208 AFD - ok
22:09:46.0796 2208 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
22:09:46.0796 2208 agp440 - ok
22:09:46.0812 2208 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
22:09:46.0812 2208 agpCPQ - ok
22:09:46.0828 2208 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys
22:09:46.0828 2208 Aha154x - ok
22:09:46.0828 2208 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys
22:09:46.0828 2208 aic78u2 - ok
22:09:46.0843 2208 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys
22:09:46.0843 2208 aic78xx - ok
22:09:46.0859 2208 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
22:09:46.0859 2208 AliIde - ok
22:09:46.0859 2208 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\system32\DRIVERS\alim1541.sys
22:09:46.0859 2208 alim1541 - ok
22:09:46.0890 2208 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys
22:09:46.0890 2208 amdagp - ok
22:09:46.0906 2208 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys
22:09:46.0906 2208 amsint - ok
22:09:46.0921 2208 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys
22:09:46.0921 2208 asc - ok
22:09:46.0921 2208 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys
22:09:46.0937 2208 asc3350p - ok
22:09:46.0937 2208 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys
22:09:46.0937 2208 asc3550 - ok
22:09:46.0968 2208 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
22:09:46.0968 2208 AsyncMac - ok
22:09:47.0015 2208 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
22:09:47.0015 2208 atapi - ok
22:09:47.0031 2208 Atdisk - ok
22:09:47.0046 2208 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
22:09:47.0046 2208 Atmarpc - ok
22:09:47.0093 2208 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
22:09:47.0093 2208 audstub - ok
22:09:47.0109 2208 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
22:09:47.0109 2208 Beep - ok
22:09:47.0109 2208 catchme - ok
22:09:47.0125 2208 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
22:09:47.0125 2208 cbidf - ok
22:09:47.0140 2208 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
22:09:47.0140 2208 cbidf2k - ok
22:09:47.0156 2208 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
22:09:47.0156 2208 cd20xrnt - ok
22:09:47.0156 2208 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
22:09:47.0156 2208 Cdaudio - ok
22:09:47.0171 2208 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
22:09:47.0171 2208 Cdfs - ok
22:09:47.0171 2208 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
22:09:47.0187 2208 Cdrom - ok
22:09:47.0187 2208 Changer - ok
22:09:47.0234 2208 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys
22:09:47.0234 2208 CmdIde - ok
22:09:47.0250 2208 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys
22:09:47.0250 2208 Cpqarray - ok
22:09:47.0265 2208 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
22:09:47.0281 2208 dac2w2k - ok
22:09:47.0281 2208 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys
22:09:47.0281 2208 dac960nt - ok
22:09:47.0296 2208 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
22:09:47.0296 2208 Disk - ok
22:09:47.0343 2208 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
22:09:47.0343 2208 dmboot - ok
22:09:47.0375 2208 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
22:09:47.0375 2208 dmio - ok
22:09:47.0390 2208 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
22:09:47.0390 2208 dmload - ok
22:09:47.0406 2208 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
22:09:47.0406 2208 DMusic - ok
22:09:47.0421 2208 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys
22:09:47.0421 2208 dpti2o - ok
22:09:47.0468 2208 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
22:09:47.0468 2208 drmkaud - ok
22:09:47.0515 2208 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
22:09:47.0515 2208 Fastfat - ok
22:09:47.0531 2208 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
22:09:47.0531 2208 Fdc - ok
22:09:47.0546 2208 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
22:09:47.0546 2208 Fips - ok
22:09:47.0546 2208 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
22:09:47.0546 2208 Flpydisk - ok
22:09:47.0562 2208 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
22:09:47.0562 2208 FltMgr - ok
22:09:47.0578 2208 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
22:09:47.0578 2208 Fs_Rec - ok
22:09:47.0593 2208 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
22:09:47.0593 2208 Ftdisk - ok
22:09:47.0640 2208 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
22:09:47.0640 2208 Gpc - ok
22:09:47.0687 2208 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
22:09:47.0687 2208 HDAudBus - ok
22:09:47.0703 2208 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
22:09:47.0703 2208 hidusb - ok
22:09:47.0750 2208 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys
22:09:47.0750 2208 hpn - ok
22:09:47.0781 2208 HPZid412 (9f1d80908658eb7f1bf70809e0b51470) C:\WINDOWS\system32\DRIVERS\HPZid412.sys
22:09:47.0781 2208 HPZid412 - ok
22:09:47.0781 2208 HPZipr12 (f7e3e9d50f9cd3de28085a8fdaa0a1c3) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
22:09:47.0781 2208 HPZipr12 - ok
22:09:47.0796 2208 HPZius12 (cf1b7951b4ec8d13f3c93b74bb2b461b) C:\WINDOWS\system32\DRIVERS\HPZius12.sys
22:09:47.0796 2208 HPZius12 - ok
22:09:47.0843 2208 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
22:09:47.0843 2208 HTTP - ok
22:09:47.0859 2208 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys
22:09:47.0859 2208 i2omgmt - ok
22:09:47.0875 2208 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\system32\DRIVERS\i2omp.sys
22:09:47.0875 2208 i2omp - ok
22:09:47.0906 2208 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
22:09:47.0906 2208 i8042prt - ok
22:09:48.0046 2208 ialm (28423512370705aeda6a652fedb25468) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
22:09:48.0187 2208 ialm - ok
22:09:48.0234 2208 iaStor (8ef427c54497c5f8a7a645990e4278c7) C:\WINDOWS\system32\drivers\iaStor.sys
22:09:48.0250 2208 iaStor - ok
22:09:48.0250 2208 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
22:09:48.0250 2208 Imapi - ok
22:09:48.0265 2208 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys
22:09:48.0281 2208 ini910u - ok
22:09:48.0390 2208 IntcAzAudAddService (42f3eba72f97ceb7ce49ae9a928ee54c) C:\WINDOWS\system32\drivers\RtkHDAud.sys
22:09:48.0437 2208 IntcAzAudAddService - ok
22:09:48.0453 2208 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys
22:09:48.0453 2208 IntelIde - ok
22:09:48.0468 2208 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
22:09:48.0468 2208 intelppm - ok
22:09:48.0484 2208 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
22:09:48.0484 2208 Ip6Fw - ok
22:09:48.0500 2208 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
22:09:48.0500 2208 IpFilterDriver - ok
22:09:48.0500 2208 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
22:09:48.0500 2208 IpInIp - ok
22:09:48.0593 2208 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
22:09:48.0625 2208 IpNat - ok
22:09:48.0656 2208 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
22:09:48.0656 2208 IPSec - ok
22:09:48.0671 2208 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
22:09:48.0671 2208 IRENUM - ok
22:09:48.0703 2208 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
22:09:48.0703 2208 isapnp - ok
22:09:48.0718 2208 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
22:09:48.0718 2208 Kbdclass - ok
22:09:48.0718 2208 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
22:09:48.0718 2208 kbdhid - ok
22:09:48.0765 2208 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
22:09:48.0765 2208 kmixer - ok
22:09:48.0781 2208 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
22:09:48.0796 2208 KSecDD - ok
22:09:48.0812 2208 lbrtfdc - ok
22:09:48.0843 2208 MBAMSwissArmy - ok
22:09:48.0890 2208 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
22:09:48.0890 2208 mnmdd - ok
22:09:48.0921 2208 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
22:09:48.0921 2208 Modem - ok
22:09:48.0937 2208 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
22:09:48.0937 2208 Mouclass - ok
22:09:48.0953 2208 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
22:09:48.0968 2208 mouhid - ok
22:09:48.0968 2208 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
22:09:48.0984 2208 MountMgr - ok
22:09:49.0046 2208 MpKsl33855a5c - ok
22:09:49.0062 2208 MpKsl38130eec - ok
22:09:49.0062 2208 MpKsl3f46fa51 - ok
22:09:49.0093 2208 MpKslfde405b7 - ok
22:09:49.0125 2208 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys
22:09:49.0125 2208 mraid35x - ok
22:09:49.0234 2208 MREMP50 (9bd4dcb5412921864a7aacdedfbd1923) C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS
22:09:49.0234 2208 MREMP50 - ok
22:09:49.0234 2208 MREMPR5 - ok
22:09:49.0234 2208 MRENDIS5 - ok
22:09:49.0265 2208 MRESP50 (07c02c892e8e1a72d6bf35004f0e9c5e) C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS
22:09:49.0265 2208 MRESP50 - ok
22:09:49.0312 2208 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
22:09:49.0312 2208 MRxDAV - ok
22:09:49.0343 2208 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
22:09:49.0343 2208 MRxSmb - ok
22:09:49.0359 2208 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
22:09:49.0359 2208 Msfs - ok
22:09:49.0406 2208 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
22:09:49.0406 2208 MSKSSRV - ok
22:09:49.0421 2208 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
22:09:49.0421 2208 MSPCLOCK - ok
22:09:49.0437 2208 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
22:09:49.0437 2208 MSPQM - ok
22:09:49.0468 2208 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
22:09:49.0468 2208 mssmbios - ok
22:09:49.0500 2208 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
22:09:49.0500 2208 Mup - ok
22:09:49.0531 2208 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
22:09:49.0546 2208 NDIS - ok
22:09:49.0578 2208 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
22:09:49.0578 2208 NdisTapi - ok
22:09:49.0578 2208 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
22:09:49.0593 2208 Ndisuio - ok
22:09:49.0593 2208 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
22:09:49.0609 2208 NdisWan - ok
22:09:49.0625 2208 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
22:09:49.0625 2208 NDProxy - ok
22:09:49.0640 2208 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
22:09:49.0640 2208 NetBIOS - ok
22:09:49.0656 2208 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
22:09:49.0656 2208 NetBT - ok
22:09:49.0687 2208 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
22:09:49.0687 2208 Npfs - ok
22:09:49.0734 2208 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
22:09:49.0750 2208 Ntfs - ok
22:09:49.0781 2208 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
22:09:49.0781 2208 Null - ok
22:09:49.0812 2208 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
22:09:49.0812 2208 NwlnkFlt - ok
22:09:49.0859 2208 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
22:09:49.0875 2208 NwlnkFwd - ok
22:09:49.0921 2208 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys
22:09:49.0921 2208 Parport - ok
22:09:49.0921 2208 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
22:09:49.0921 2208 PartMgr - ok
22:09:49.0937 2208 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
22:09:49.0937 2208 ParVdm - ok
22:09:49.0953 2208 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
22:09:49.0953 2208 PCI - ok
22:09:49.0953 2208 PCIDump - ok
22:09:49.0968 2208 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
22:09:49.0968 2208 PCIIde - ok
22:09:49.0984 2208 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
22:09:49.0984 2208 Pcmcia - ok
22:09:50.0000 2208 PDCOMP - ok
22:09:50.0000 2208 PDFRAME - ok
22:09:50.0015 2208 PDRELI - ok
22:09:50.0031 2208 PDRFRAME - ok
22:09:50.0046 2208 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys
22:09:50.0046 2208 perc2 - ok
22:09:50.0062 2208 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys
22:09:50.0062 2208 perc2hib - ok
22:09:50.0093 2208 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
22:09:50.0109 2208 PptpMiniport - ok
22:09:50.0125 2208 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
22:09:50.0125 2208 PSched - ok
22:09:50.0156 2208 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
22:09:50.0156 2208 Ptilink - ok
22:09:50.0187 2208 PxHelp20 (40fedd328f98245ad201cf5f9f311724) C:\WINDOWS\system32\Drivers\PxHelp20.sys
22:09:50.0187 2208 PxHelp20 - ok
22:09:50.0203 2208 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys
22:09:50.0203 2208 ql1080 - ok
22:09:50.0203 2208 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
22:09:50.0203 2208 Ql10wnt - ok
22:09:50.0218 2208 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys
22:09:50.0218 2208 ql12160 - ok
22:09:50.0234 2208 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys
22:09:50.0234 2208 ql1240 - ok
22:09:50.0250 2208 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys
22:09:50.0250 2208 ql1280 - ok
22:09:50.0281 2208 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
22:09:50.0281 2208 RasAcd - ok
22:09:50.0296 2208 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
22:09:50.0296 2208 Rasl2tp - ok
22:09:50.0312 2208 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
22:09:50.0312 2208 RasPppoe - ok
22:09:50.0312 2208 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
22:09:50.0312 2208 Raspti - ok
22:09:50.0328 2208 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
22:09:50.0343 2208 Rdbss - ok
22:09:50.0359 2208 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
22:09:50.0359 2208 RDPCDD - ok
22:09:50.0375 2208 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
22:09:50.0375 2208 rdpdr - ok
22:09:50.0421 2208 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
22:09:50.0421 2208 RDPWD - ok
22:09:50.0453 2208 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
22:09:50.0453 2208 redbook - ok
22:09:50.0484 2208 RTLE8023xp (a1ad65718870dbf2bcb81e3c1406469e) C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys
22:09:50.0484 2208 RTLE8023xp - ok
22:09:50.0515 2208 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
22:09:50.0515 2208 Secdrv - ok
22:09:50.0546 2208 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\drivers\Serial.sys
22:09:50.0546 2208 Serial - ok
22:09:50.0562 2208 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
22:09:50.0562 2208 Sfloppy - ok
22:09:50.0578 2208 Simbad - ok
22:09:50.0593 2208 sisagp (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\system32\DRIVERS\sisagp.sys
22:09:50.0593 2208 sisagp - ok
22:09:50.0609 2208 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys
22:09:50.0609 2208 Sparrow - ok
22:09:50.0640 2208 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
22:09:50.0640 2208 splitter - ok
22:09:50.0656 2208 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
22:09:50.0671 2208 sr - ok
22:09:50.0703 2208 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
22:09:50.0718 2208 Srv - ok
22:09:50.0734 2208 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
22:09:50.0734 2208 swenum - ok
22:09:50.0750 2208 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
22:09:50.0750 2208 swmidi - ok
22:09:50.0765 2208 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys
22:09:50.0765 2208 symc810 - ok
22:09:50.0781 2208 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys
22:09:50.0781 2208 symc8xx - ok
22:09:50.0796 2208 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys
22:09:50.0796 2208 sym_hi - ok
22:09:50.0812 2208 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys
22:09:50.0812 2208 sym_u3 - ok
22:09:50.0828 2208 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
22:09:50.0843 2208 sysaudio - ok
22:09:50.0890 2208 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
22:09:50.0890 2208 Tcpip - ok
22:09:50.0906 2208 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
22:09:50.0906 2208 TDPIPE - ok
22:09:50.0921 2208 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
22:09:50.0937 2208 TDTCP - ok
22:09:50.0953 2208 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
22:09:50.0953 2208 TermDD - ok
22:09:50.0968 2208 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys
22:09:50.0984 2208 TosIde - ok
22:09:51.0015 2208 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
22:09:51.0015 2208 Udfs - ok
22:09:51.0031 2208 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys
22:09:51.0031 2208 ultra - ok
22:09:51.0062 2208 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
22:09:51.0062 2208 Update - ok
22:09:51.0093 2208 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
22:09:51.0093 2208 usbccgp - ok
22:09:51.0140 2208 usbehci (4bac8df07f1d8434fc640e677a62204e) C:\WINDOWS\system32\DRIVERS\usbehci.sys
22:09:51.0140 2208 usbehci - ok
22:09:51.0171 2208 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
22:09:51.0171 2208 usbhub - ok
22:09:51.0203 2208 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
22:09:51.0203 2208 usbprint - ok
22:09:51.0218 2208 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
22:09:51.0218 2208 usbscan - ok
22:09:51.0234 2208 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
22:09:51.0250 2208 USBSTOR - ok
22:09:51.0265 2208 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
22:09:51.0265 2208 usbuhci - ok
22:09:51.0281 2208 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
22:09:51.0281 2208 VgaSave - ok
22:09:51.0296 2208 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys
22:09:51.0312 2208 viaagp - ok
22:09:51.0312 2208 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
22:09:51.0328 2208 ViaIde - ok
22:09:51.0343 2208 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
22:09:51.0343 2208 VolSnap - ok
22:09:51.0375 2208 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
22:09:51.0375 2208 Wanarp - ok
22:09:51.0390 2208 WDICA - ok
22:09:51.0406 2208 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
22:09:51.0406 2208 wdmaud - ok
22:09:51.0437 2208 WmiAcpi (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
22:09:51.0437 2208 WmiAcpi - ok
22:09:51.0453 2208 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
22:09:51.0453 2208 WS2IFSL - ok
22:09:51.0500 2208 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
22:09:51.0500 2208 WudfPf - ok
22:09:51.0531 2208 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
22:09:51.0546 2208 WudfRd - ok
22:09:51.0562 2208 MBR (0x1B8) (658f04914a2bc526ccb0898f9310b57c) \Device\Harddisk0\DR0
22:09:51.0593 2208 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - infected
22:09:51.0593 2208 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.b (0)
22:09:51.0593 2208 MBR (0x1B8) (e5fa06aca0d60ba9c870d0ef3d9898c9) \Device\Harddisk1\DR4
22:09:51.0609 2208 \Device\Harddisk1\DR4 - ok
22:09:51.0625 2208 Boot (0x1200) (80e9fd047222640b9127fcafb4074c9a) \Device\Harddisk0\DR0\Partition0
22:09:51.0625 2208 \Device\Harddisk0\DR0\Partition0 - ok
22:09:51.0640 2208 Boot (0x1200) (436f3f13c4b54671b0c9a949525f8a8e) \Device\Harddisk1\DR4\Partition0
22:09:51.0640 2208 \Device\Harddisk1\DR4\Partition0 - ok
22:09:51.0640 2208 ============================================================
22:09:51.0640 2208 Scan finished
22:09:51.0640 2208 ============================================================
22:09:51.0640 2116 Detected object count: 1
22:09:51.0640 2116 Actual detected object count: 1
22:10:04.0906 2116 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - will be cured on reboot
22:10:04.0906 2116 \Device\Harddisk0\DR0 - ok
22:10:04.0906 2116 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - User select action: Cure
22:10:10.0046 0464 Deinitialize success

Greetings

Good That cleaned up some bad guys but I see some other stuff that we need to go after, so I want you to run this custom script for me.

:Run CFScript:

Open Notepad and copy/paste the text in the box into the window:

 ClearJavaCache:: 

Save it to your desktop as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe

This will let ComboFix run again.
Restart if you have to.
Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

"information and logs"

In your next post I need the following


• report from Combofix
  
• let me know of any problems you may have had
  
• How is the computer doing now after running the script?

Gringo

ComboFix 12-01-05.01 - Owner 01/05/2012 23:25:32.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2037.1393 [GMT -5:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
.
.
((((((((((((((((((((((((( Files Created from 2011-12-06 to 2012-01-06 )))))))))))))))))))))))))))))))
.
.
2011-12-29 15:00 . 2011-12-29 15:00 -------- d-----w- c:\documents and settings\Owner\Application Data\simppulltoolbar
2011-12-29 02:27 . 2011-08-31 22:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-12-29 02:27 . 2011-12-29 14:05 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-12-28 19:09 . 2011-12-28 19:09 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2011-12-21 23:34 . 2011-12-21 23:34 -------- d-----w- c:\windows\system32\wbem\Repository
2011-12-19 18:52 . 2011-12-19 18:52 -------- d-----w- c:\documents and settings\Owner\Application Data\Malwarebytes
2011-12-19 18:51 . 2011-12-19 18:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-12-19 17:38 . 2011-12-21 21:58 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Google
2011-12-19 04:38 . 2012-01-04 00:10 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2011-12-19 03:45 . 2008-04-14 10:42 116224 -c--a-w- c:\windows\system32\dllcache\xrxwiadr.dll
2011-12-19 03:45 . 2008-04-14 10:42 18944 -c--a-w- c:\windows\system32\dllcache\xrxscnui.dll
2011-12-19 03:45 . 2001-08-18 03:36 23040 -c--a-w- c:\windows\system32\dllcache\xrxwbtmp.dll
2011-12-19 03:45 . 2001-08-18 03:37 27648 -c--a-w- c:\windows\system32\dllcache\xrxftplt.exe
2011-12-19 03:43 . 2008-04-14 12:00 9216 -c--a-w- c:\windows\system32\dllcache\wamps51.dll
2011-12-19 03:42 . 2001-08-18 03:36 26624 -c--a-w- c:\windows\system32\dllcache\umaxu22.dll
2011-12-19 03:41 . 2001-08-17 17:51 138528 -c--a-w- c:\windows\system32\dllcache\tgiulnt5.sys
2011-12-19 03:40 . 2001-08-18 03:36 106584 -c--a-w- c:\windows\system32\dllcache\spdports.dll
2011-12-19 03:39 . 2001-08-17 17:50 68608 -c--a-w- c:\windows\system32\dllcache\sis6306p.sys
2011-12-19 03:38 . 2001-08-17 17:50 41216 -c--a-w- c:\windows\system32\dllcache\s3mt3d.sys
2011-12-19 03:37 . 2001-08-18 03:36 35328 -c--a-w- c:\windows\system32\dllcache\psisload.dll
2011-12-19 03:36 . 2001-08-17 19:05 28032 -c--a-w- c:\windows\system32\dllcache\ovcd.sys
2011-12-19 03:35 . 2001-08-18 03:36 59104 -c--a-w- c:\windows\system32\dllcache\n9i128v2.dll
2011-12-19 03:34 . 2008-04-14 12:00 7680 -c--a-w- c:\windows\system32\dllcache\migregdb.exe
2011-12-19 03:33 . 2001-08-18 03:36 8704 -c--a-w- c:\windows\system32\dllcache\kbdjpn.dll
2011-12-19 03:32 . 2001-08-18 03:34 9216 -c--a-w- c:\windows\system32\dllcache\ibmsgnet.dll
2011-12-19 03:31 . 2008-04-14 05:15 19200 -c--a-w- c:\windows\system32\dllcache\hidir.sys
2011-12-19 03:30 . 2001-08-17 17:19 174464 -c--a-w- c:\windows\system32\dllcache\es198x.sys
2011-12-19 03:29 . 2001-08-18 03:36 102484 -c--a-w- c:\windows\system32\dllcache\digiinf.dll
2011-12-19 03:28 . 2001-08-18 03:36 236032 -c--a-w- c:\windows\system32\dllcache\camext20.dll
2011-12-19 03:27 . 2008-04-14 10:41 3775 -c--a-w- c:\windows\system32\dllcache\adv11nt5.dll
2011-12-19 01:48 . 2011-12-19 01:48 -------- d-sh--w- c:\documents and settings\Owner\IECompatCache
2011-12-18 23:53 . 2011-12-18 23:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Citrix
2011-12-18 23:43 . 2011-12-18 23:43 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Citrix
2011-12-17 22:57 . 2011-12-21 22:53 -------- d-----w- c:\windows\system32\NtmsData
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-01 17:50 . 2011-12-01 17:50 260 ----a-w- c:\windows\system32\cmdVBS.vbs
2011-12-01 17:50 . 2011-12-01 17:50 256 ----a-w- c:\windows\system32\MSIevent.bat
2011-11-23 13:29 . 2008-04-25 16:16 1868544 ----a-w- c:\windows\system32\win32k.sys
2011-11-04 19:20 . 2008-04-25 16:16 916992 ----a-w- c:\windows\system32\wininet.dll
2011-11-04 19:20 . 2008-04-25 16:16 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-11-04 19:20 . 2008-04-25 16:16 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-11-04 11:23 . 2008-04-25 16:16 385024 ----a-w- c:\windows\system32\html.iec
2011-11-01 16:07 . 2008-04-25 16:16 1288704 ----a-w- c:\windows\system32\ole32.dll
2011-10-28 05:31 . 2008-04-25 16:16 33280 ----a-w- c:\windows\system32\csrsrv.dll
2011-10-25 13:37 . 2008-04-25 16:16 2148864 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-10-25 12:52 . 2008-04-14 00:01 2027008 ----a-w- c:\windows\system32\ntkrnlpa.exe
2011-10-18 11:13 . 2008-04-25 16:16 186880 ----a-w- c:\windows\system32\encdec.dll
2011-10-10 14:22 . 2008-04-25 21:27 692736 ----a-w- c:\windows\system32\inetcomm.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-01-05_17.50.27 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-01-06 03:11 . 2012-01-06 03:11 16384 c:\windows\Temp\Perflib_Perfdata_6c0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2009-01-13 17421824]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-01-12 142104]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-01-12 162584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-01-12 138008]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-12-29 140520]
"Desktop Disc Tool"="c:\program files\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [2009-10-15 498160]
"VERIZONDM"="c:\program files\VERIZONDM\bin\sprtcmd.exe" [2010-09-02 206120]
"Verizon_McciTrayApp"="c:\program files\Verizon\McciTrayApp.exe" [2010-03-17 1565696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"TkBellExe"="c:\program files\real\realplayer\update\realsched.exe" [2011-07-01 273544]
.
c:\documents and settings\Administrator\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-12-15 1324384]
.
c:\documents and settings\Owner\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-12-15 1324384]
.
c:\documents and settings\Default User\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-12-15 1324384]
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-12-15 1324384]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
"50000:UDP"= 50000:UDP:IHA_MessageCenter
.
R2 BBUpdate;BBUpdate;c:\program files\Microsoft\BingBar\SeaPort.EXE [10/13/2011 5:21 PM 249648]
R2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [6/9/2009 9:11 AM 155648]
R2 IHA_MessageCenter;IHA_MessageCenter;c:\program files\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe [10/28/2011 6:20 PM 286736]
R2 sprtsvc_verizondm;SupportSoft Sprocket Service (verizondm);c:\program files\VERIZONDM\bin\sprtsvc.exe [9/2/2010 4:46 AM 206120]
R2 tgsrvc_verizondm;SupportSoft Repair Service (verizondm);c:\program files\VERIZONDM\bin\tgsrvc.exe [9/2/2010 4:46 AM 185640]
S1 MpKsl33855a5c;MpKsl33855a5c;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B9F544E5-C0E5-4D94-B3F1-7D250C8BEEE8}\MpKsl33855a5c.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{B9F544E5-C0E5-4D94-B3F1-7D250C8BEEE8}\MpKsl33855a5c.sys [?]
S1 MpKsl38130eec;MpKsl38130eec;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{00F7C8BD-3F72-4F47-93B2-506B9DAED471}\MpKsl38130eec.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{00F7C8BD-3F72-4F47-93B2-506B9DAED471}\MpKsl38130eec.sys [?]
S1 MpKsl3f46fa51;MpKsl3f46fa51;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{00F7C8BD-3F72-4F47-93B2-506B9DAED471}\MpKsl3f46fa51.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{00F7C8BD-3F72-4F47-93B2-506B9DAED471}\MpKsl3f46fa51.sys [?]
S1 MpKslfde405b7;MpKslfde405b7;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{EAA3C52D-20E0-47B2-8475-D8077AF80AD6}\MpKslfde405b7.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{EAA3C52D-20E0-47B2-8475-D8077AF80AD6}\MpKslfde405b7.sys [?]
S2 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [10/21/2011 3:23 PM 196176]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [12/19/2011 1:12 PM 136176]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [12/19/2011 1:12 PM 136176]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [4/25/2008 11:16 AM 14336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-12-19 18:12]
.
2012-01-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-12-19 18:12]
.
2012-01-06 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1869539286-965687749-1612913337-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 14:47]
.
2012-01-06 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1869539286-965687749-1612913337-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 14:47]
.
2012-01-05 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1869539286-965687749-1612913337-1005.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 14:47]
.
2011-12-25 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1869539286-965687749-1612913337-1006.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 14:47]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.aol.com/?mtmhp=acm50mtmhpunauthgreeting2
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
Trusted Zone: internet
Trusted Zone: mcafee.com
TCP: DhcpNameServer = 192.168.0.1
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-01-05 23:30
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(3192)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2012-01-05 23:32:16
ComboFix-quarantined-files.txt 2012-01-06 04:32
ComboFix2.txt 2012-01-05 17:56
.
Pre-Run: 226,862,841,856 bytes free
Post-Run: 226,856,398,848 bytes free
.
- - End Of File - - 35BAF32017448962B64160D6E791214C


It looks better. I looked at a couple of files and they seemed to be associated with the right application programs, and opened and looked reasonable. The desktop itself looks back to normal. Boot-up still speeds through the screen at which you can choose a partition to boot from but it's probably about as fast as it was normally (I have only seen this PC boot up a couple of times before this incident but it's a pretty new PC). Only the start menu seems still to be missing the program entries in the various program groups. And the USB drive still would not let go of the device unless I shut down.

Nice work! I have to admit that even I was close to despair a few days ago, I was thinking we needed to start keeping an eye out for new systems -- or at least a new hard disk. And there is a LOT of work product of my friend's on this hard drive! (Plus, she's just been diagnosed with a pretty serious condition, and I know it must seem to her as though, everything is conspiring against her. She likely has NO idea how much work this is, but I DO! Thank you so much for the help!!!!)

Adobe offered an update after ComboFix began running this time, I moved that window out of the way and just let everything keep on trucking. I didn't see anything else suspicious though!

Linda

Hello


Now that we are pretty much out of the woods

Only the start menu seems still to be missing the program entries in the various program groups.
Explain this to me a little bit better

And the USB drive still would not let go of the device unless I shut down.
This I have not heard of before and if by the time we are finished and it has not cleared up you may need to ask in the windows forum - but I will do some research on it



gringo

Thanks Gringo!

About the Start Menu - when I click on Start and open the main menu there, and hover on one of the entries listed in it, the submenu that shows up reads "(Empty)" for most, except for Verizon and a very few others. On my own machine, if I select QuickTime's main entry, the submenu comes up and lists "About QuickTime," "PictureViewer," and "QuickTime Player" and a few other items. On my friend's PC, if I select the QuickTime line, there would be the little arrow indicating there should be a submenu, but rather than it containing individual program entries, it would say "(Empty)" Does that make better sense?

We don't know how the USB behaved before the infection, on this machine, so it's definitely possible that the USB driver has never worked quite right. I appreciate everything you've done! This was a really nasty "fix" we were in and without your help, I really don't know what we could have done!

Linda

BTW, I made a modest donation, too. Wish it could be bigger! I'm really impressed with BC!

Hello

lets try this for the start menu

http://download.bleepingcomputer.com/grinler/unhide.exe


gringo

Hi!

Unhide didn't change the Start Menu items, though I ran it twice. After the first execution, I noticed that Spybot SD-resident, which I guess was installed by an earlier effort to help with this incident, was running, and so I exited that. But rerunning unhide seems to have made no changes.

I would like to remove McAfee completely and install Microsoft Security Essentials once again, before connecting to the internet from this machine. Let me know please, if you think that now would be okay to do this?

I will talk with my friend to see whether she remembers if she used the Start Menu. I do not know whether she uses the Dell Dock, which offers access to Word, PowerPoint and Excel that work fine. I don't know that she uses the computer for much except Word and the internet. I also know that she hasn't been thoughtful about creating or managing files and directories -- there are multiple groups of "My Documents" and there is what looks like an entire copy of the disk in a "Microcenter Data Back Ups" directory, which looks a lot like an older machine that she had which my husband has been trying to get straightened out while you and I have been attacking this virus and rootkit on this machine.

IE and Word are okay right on the main level of the Start menu, so she's good to go with those programs. I wouldn't be at all surprised if unhide were pretty careful about things when there are several copies of executables sprinkled across a drive!

I will post back when I have some more information.

Thanks again, you seem to be a night owl, like my husband!! I am the "morning person"
Linda