BSOD DRIVER_IRQL_NOT_LESS_OR_EQUAL

Hello,

There doesn't seem to be any reason why, but BSOD randomly happens with the error of DRIVER_IRQL_NOT_LESS_OR_EQUAL. I have run malwarebytes and superantispyware and cleaned up all malware they found. I can't start disk check - error says it can't start it. Also system restore and disk defrag are not working. I did a hijack this log but wasn't sure if I needed to post this or not?

Please help! I'm running Win XP.

Thank you.

Ray

Hi kiho, and to BleepingComputer!

Do NOT post a HijackThis log or anything like that here!! That will result in this topic being moved to the misplaced logs section. HJT logs are not allowed outside the HJT forum.

Because a BSOD can have all kind of causes, we have to start looking what can cause them.

First of all, can you please post me the logs of Malwarebytes antimalware and Super Antispyware (not new ones, but the ones in which I can see what malware was removed).

For the MBAM log, please open Malwarebytes Antimalware, and look on the logs tab. Please post me the log that shows what malware was removed.

For the SAS log, please open Super Antispyware. Click Preferences, then click the Statistics/Logs tab.
Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
If there are several logs, click the log in which removed/detected items are listed and press View log. A text file will open in your default text editor.

Please click start > run, and type devmgmt.msc in the box that opens, press enter.
Look in the list that opens if there are any devices that have an ! or an ? in front of them and post them here.


We Need to check for Rootkits with RootRepeal

• Download RootRepeal from the following location and save it to your desktop.
  • Zip Mirrors (Recommended)
    
    • Primary Mirror
    • Secondary Mirror
    • Secondary Mirror
  • Rar Mirrors - Only if you know what a RAR is and can extract it.
    
    • Primary Mirror
    • Secondary Mirror
    • Secondary Mirror
• Extract RootRepeal.exe from the archive.
• Open on your desktop.
• Click the tab.
• Click the button.
• Check all seven boxes:
• Push Ok
• Check the box for your main system drive (Usually C:), and press Ok.
• Allow RootRepeal to run a scan of your system. This may take some time.
• Once the scan completes, push the button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your next reply, please.

In your next reply, please include the following

• MBAM log
• SAS log
• Description of ! or ? in device management
• RootRepeal report

Thank you Elise here are the logs you requested,

Malwarebytes' Anti-Malware 1.40
Database version: 2551
Windows 5.1.2600 Service Pack 2

8/8/2009 10:50:03 PM
mbam-log-2009-08-08 (22-50-03).txt

Scan type: Quick Scan
Objects scanned: 120226
Time elapsed: 14 minute(s), 16 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 7
Registry Values Infected: 3
Registry Data Items Infected: 3
Folders Infected: 1
Files Infected: 7

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{90b8b761-df2b-48ac-bbe0-bcc03a819b3b} (Adware.Zango) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msupdate (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.FakeAlert) -> Data: c:\windows\system32\sdra64.exe -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.FakeAlert) -> Data: system32\sdra64.exe -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.Userinit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,) Good: (Userinit.exe) -> Quarantined and deleted successfully.

Folders Infected:
C:\WINDOWS\system32\lowsec (Stolen.data) -> Delete on reboot.

Files Infected:
C:\WINDOWS\system32\lowsec\local.ds (Stolen.data) -> Delete on reboot.
C:\WINDOWS\system32\lowsec\user.ds (Stolen.data) -> Delete on reboot.
C:\WINDOWS\msupdate.exe (Fake.Dropped.Malware) -> Delete on reboot.
C:\WINDOWS\system32\sdra64.exe (Trojan.FakeAlert) -> Delete on reboot.
C:\install.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\rdlB.tmp.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\rdlD.tmp.exe (Trojan.Dropper) -> Quarantined and deleted successfully.



SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 08/09/2009 at 00:01 AM

Application Version : 4.27.1002

Core Rules Database Version : 4046
Trace Rules Database Version: 1980

Scan type : Quick Scan
Total Scan Time : 00:13:20

Memory items scanned : 466
Memory threats detected : 0
Registry items scanned : 447
Registry threats detected : 28
File items scanned : 8059
File threats detected : 22

Adware.Tracking Cookie
C:\Documents and Settings\User\Cookies\user@ads.bridgetrack[1].txt
C:\Documents and Settings\User\Cookies\user@ar.atwola[3].txt
C:\Documents and Settings\User\Cookies\user@serving-sys[2].txt
C:\Documents and Settings\User\Cookies\user@adbrite[2].txt
C:\Documents and Settings\User\Cookies\user@amlocalhost.trymedia[1].txt
C:\Documents and Settings\User\Cookies\user@apmebf[1].txt
C:\Documents and Settings\User\Cookies\user@atwola[1].txt
C:\Documents and Settings\User\Cookies\user@ad.yieldmanager[2].txt
C:\Documents and Settings\User\Cookies\user@revsci[1].txt
C:\Documents and Settings\User\Cookies\user@questionmarket[1].txt
C:\Documents and Settings\User\Cookies\user@atdmt[1].txt
C:\Documents and Settings\User\Cookies\user@microsoftwlmessengermkt.112.2o7[1].txt
C:\Documents and Settings\User\Cookies\user@ads.pointroll[1].txt
C:\Documents and Settings\User\Cookies\user@ar.atwola[1].txt
C:\Documents and Settings\User\Cookies\user@bs.serving-sys[1].txt
C:\Documents and Settings\User\Cookies\user@at.atwola[1].txt
C:\Documents and Settings\User\Cookies\user@specificmedia[1].txt
C:\Documents and Settings\User\Cookies\user@doubleclick[1].txt
C:\Documents and Settings\User\Cookies\user@mediaplex[1].txt
C:\Documents and Settings\User\Cookies\user@specificclick[2].txt
C:\Documents and Settings\User\Cookies\user@cdn.at.atwola[1].txt
C:\Documents and Settings\User\Cookies\user@advertising[2].txt

Rogue.Component/Trace
HKLM\Software\Microsoft\78B68C04
HKLM\Software\Microsoft\78B68C04#78b68c04
HKLM\Software\Microsoft\78B68C04#Version
HKLM\Software\Microsoft\78B68C04#78b62184
HKLM\Software\Microsoft\78B68C04#78b64861
HKU\S-1-5-21-658334163-3564147418-4196139480-1003\Software\Microsoft\FIAS4018

Rootkit.TDSServ
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys#start
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys#type
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys#imagepath
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys#group
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules#TDSSserv
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules#TDSSl
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules#tdssservers
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules#tdssmain
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules#tdsslog
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules#tdssadw
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules#tdssinit
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules#tdssurls
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules#tdsspanels
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules#tdsserrors
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\modules#TDSSproc
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\Enum
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\Enum#0
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\Enum#Count
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\Enum#NextInstance
HKLM\SYSTEM\CurrentControlSet\Services\TDSSserv.sys\Enum#INITSTARTFAILED




ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/08/09 10:17
Program Version: Version 1.3.3.0
Windows Version: Windows XP SP2
==================================================

Drivers
-------------------
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xEDE13000 Size: 98304 File Visible: No Signed: -
Status: -

Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF7B41000 Size: 8192 File Visible: No Signed: -
Status: -

Name: PCI_PNP3602
Image Path: \Driver\PCI_PNP3602
Address: 0x00000000 Size: 0 File Visible: No Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xEC92E000 Size: 49152 File Visible: No Signed: -
Status: -

Name: SKYNETglhuxhbt.sys
Image Path: C:\WINDOWS\system32\drivers\SKYNETglhuxhbt.sys
Address: 0xEE0CE000 Size: 151552 File Visible: - Signed: -
Status: Hidden from the Windows API!

Name: spls.sys
Image Path: spls.sys
Address: 0xF74A8000 Size: 1048576 File Visible: No Signed: -
Status: -

Name: sptd
Image Path: \Driver\sptd
Address: 0x00000000 Size: 0 File Visible: No Signed: -
Status: -

Hidden/Locked Files
-------------------
Path: C:\WINDOWS\system32\SKYNETecxabdnx.dat
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\SKYNETfkjmamyo.dat
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\SKYNETwmqigexh.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\SKYNETyquipyek.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\drivers\SKYNETglhuxhbt.sys
Status: Invisible to the Windows API!

Path: c:\documents and settings\user\local settings\application data\mozilla\firefox\profiles\kaucmddk.default\cache\20f50ac4d01
Status: Size mismatch (API: 122456, Raw: 122429)

Stealth Objects
-------------------
Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: winlogon.exe (PID: 692) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: services.exe (PID: 756) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: lsass.exe (PID: 776) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETyquipyek.dll]
Process: svchost.exe (PID: 1008) Address: 0x00740000 Size: 53248

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: svchost.exe (PID: 1008) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: svchost.exe (PID: 1096) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: svchost.exe (PID: 1204) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: svchost.exe (PID: 1284) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: svchost.exe (PID: 1464) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: spoolsv.exe (PID: 1640) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: AppleMobileDeviceService.exe (PID: 1812) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: avgwdsvc.exe (PID: 1848) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: mDNSResponder.exe (PID: 1876) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: svchost.exe (PID: 220) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: avgrsx.exe (PID: 276) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: avgnsx.exe (PID: 296) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: jqs.exe (PID: 352) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: ngctw32.exe (PID: 496) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: Explorer.EXE (PID: 428) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: PDVDServ.exe (PID: 1144) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: ngtray.exe (PID: 1152) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: WLANmon.exe (PID: 1168) Address: 0x00e00000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: WZCSLDR2.exe (PID: 1252) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: Monitor.exe (PID: 1300) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: hkcmd.exe (PID: 1256) Address: 0x00890000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: igfxpers.exe (PID: 820) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: jusched.exe (PID: 832) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: avgtray.exe (PID: 1388) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: realsched.exe (PID: 1404) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: RIMAutoUpdate.exe (PID: 1424) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: iTunesHelper.exe (PID: 1944) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: ctfmon.exe (PID: 2024) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: msmsgs.exe (PID: 2080) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: ISUSPM.exe (PID: 2236) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: WMPNSCFG.exe (PID: 2248) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: SUPERAntiSpyware.exe (PID: 2328) Address: 0x04ca0000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: svchost.exe (PID: 3232) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: ViewpointService.exe (PID: 3324) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: WMPNetwk.exe (PID: 3408) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: avgemc.exe (PID: 3508) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: avgcsrvx.exe (PID: 3688) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: wscntfy.exe (PID: 3160) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: iPodService.exe (PID: 3056) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: alg.exe (PID: 2916) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: osk.exe (PID: 1772) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: MSSWCHX.EXE (PID: 3660) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: rundll32.exe (PID: 3892) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: msnmsgr.exe (PID: 3984) Address: 0x10000000 Size: 32768

Object: Hidden Handle [Index: 4952, Type: Event]
Process: msnmsgr.exe (PID: 3984) Address: 0x83905250 Size: -

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: usnsvc.exe (PID: 2976) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: igfxsrvc.exe (PID: 4004) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: firefox.exe (PID: 2704) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: WinRAR.exe (PID: 2260) Address: 0x10000000 Size: 32768

Object: Hidden Module [Name: SKYNETwmqigexh.dll]
Process: RootRepeal.exe (PID: 1712) Address: 0x10000000 Size: 32768

Object: Hidden Code [Driver: Ntfs, IRP_MJ_CREATE]
Process: System Address: 0x83b691f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLOSE]
Process: System Address: 0x83b691f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_READ]
Process: System Address: 0x83b691f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_WRITE]
Process: System Address: 0x83b691f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x83b691f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x83b691f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_EA]
Process: System Address: 0x83b691f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_EA]
Process: System Address: 0x83b691f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x83b691f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x83b691f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_VOLUME_INFORMATION]
Process: System Address: 0x83b691f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x83b691f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x83b691f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x83b691f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_SHUTDOWN]
Process: System Address: 0x83b691f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x83b691f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLEANUP]
Process: System Address: 0x83b691f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_SECURITY]
Process: System Address: 0x83b691f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_SECURITY]
Process: System Address: 0x83b691f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_QUOTA]
Process: System Address: 0x83b691f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_QUOTA]
Process: System Address: 0x83b691f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_PNP]
Process: System Address: 0x83b691f8 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_CREATE]
Process: System Address: 0x832c1500 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_CLOSE]
Process: System Address: 0x832c1500 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_READ]
Process: System Address: 0x832c1500 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_WRITE]
Process: System Address: 0x832c1500 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x832c1500 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x832c1500 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_QUERY_EA]
Process: System Address: 0x832c1500 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_SET_EA]
Process: System Address: 0x832c1500 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x832c1500 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x832c1500 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_SET_VOLUME_INFORMATION]
Process: System Address: 0x832c1500 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x832c1500 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x832c1500 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x832c1500 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_SHUTDOWN]
Process: System Address: 0x832c1500 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x832c1500 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_CLEANUP]
Process: System Address: 0x832c1500 Size: 121

Object: Hidden Code [Driver: Fastfat, IRP_MJ_PNP]
Process: System Address: 0x832c1500 Size: 121

Object: Hidden Code [Driver: atapi, IRP_MJ_CREATE]
Process: System Address: 0x83b6a1f8 Size: 121

Object: Hidden Code [Driver: atapi, IRP_MJ_CLOSE]
Process: System Address: 0x83b6a1f8 Size: 121

Object: Hidden Code [Driver: atapi, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x83b6a1f8 Size: 121

Object: Hidden Code [Driver: atapi, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x83b6a1f8 Size: 121

Object: Hidden Code [Driver: atapi, IRP_MJ_POWER]
Process: System Address: 0x83b6a1f8 Size: 121

Object: Hidden Code [Driver: atapi, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x83b6a1f8 Size: 121

Object: Hidden Code [Driver: atapi, IRP_MJ_PNP]
Process: System Address: 0x83b6a1f8 Size: 121

Object: Hidden Code [Driver: Cdrom, IRP_MJ_CREATE]
Process: System Address: 0x839811f8 Size: 121

Object: Hidden Code [Driver: Cdrom, IRP_MJ_CLOSE]
Process: System Address: 0x839811f8 Size: 121

Object: Hidden Code [Driver: Cdrom, IRP_MJ_READ]
Process: System Address: 0x839811f8 Size: 121

Object: Hidden Code [Driver: Cdrom, IRP_MJ_WRITE]
Process: System Address: 0x839811f8 Size: 121

Object: Hidden Code [Driver: Cdrom, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x839811f8 Size: 121

Object: Hidden Code [Driver: Cdrom, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x839811f8 Size: 121

Object: Hidden Code [Driver: Cdrom, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x839811f8 Size: 121

Object: Hidden Code [Driver: Cdrom, IRP_MJ_SHUTDOWN]
Process: System Address: 0x839811f8 Size: 121

Object: Hidden Code [Driver: Cdrom, IRP_MJ_POWER]
Process: System Address: 0x839811f8 Size: 121

Object: Hidden Code [Driver: Cdrom, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x839811f8 Size: 121

Object: Hidden Code [Driver: Cdrom, IRP_MJ_PNP]
Process: System Address: 0x839811f8 Size: 121

Object: Hidden Code [Driver: dmio, IRP_MJ_CREATE]
Process: System Address: 0x83bd91f8 Size: 121

Object: Hidden Code [Driver: dmio, IRP_MJ_CLOSE]
Process: System Address: 0x83bd91f8 Size: 121

Object: Hidden Code [Driver: dmio, IRP_MJ_READ]
Process: System Address: 0x83bd91f8 Size: 121

Object: Hidden Code [Driver: dmio, IRP_MJ_WRITE]
Process: System Address: 0x83bd91f8 Size: 121

Object: Hidden Code [Driver: dmio, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x83bd91f8 Size: 121

Object: Hidden Code [Driver: dmio, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x83bd91f8 Size: 121

Object: Hidden Code [Driver: dmio, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x83bd91f8 Size: 121

Object: Hidden Code [Driver: dmio, IRP_MJ_SHUTDOWN]
Process: System Address: 0x83bd91f8 Size: 121

Object: Hidden Code [Driver: dmio, IRP_MJ_POWER]
Process: System Address: 0x83bd91f8 Size: 121

Object: Hidden Code [Driver: dmio, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x83bd91f8 Size: 121

Object: Hidden Code [Driver: dmio, IRP_MJ_PNP]
Process: System Address: 0x83bd91f8 Size: 121

Object: Hidden Code [Driver: usbuhci, IRP_MJ_CREATE]
Process: System Address: 0x839db1f8 Size: 121

Object: Hidden Code [Driver: usbuhci, IRP_MJ_CLOSE]
Process: System Address: 0x839db1f8 Size: 121

Object: Hidden Code [Driver: usbuhci, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x839db1f8 Size: 121

Object: Hidden Code [Driver: usbuhci, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x839db1f8 Size: 121

Object: Hidden Code [Driver: usbuhci, IRP_MJ_POWER]
Process: System Address: 0x839db1f8 Size: 121

Object: Hidden Code [Driver: usbuhci, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x839db1f8 Size: 121

Object: Hidden Code [Driver: usbuhci, IRP_MJ_PNP]
Process: System Address: 0x839db1f8 Size: 121

Object: Hidden Code [Driver: Ftdisk, IRP_MJ_CREATE]
Process: System Address: 0x83b6b1f8 Size: 121

Object: Hidden Code [Driver: Ftdisk, IRP_MJ_READ]
Process: System Address: 0x83b6b1f8 Size: 121

Object: Hidden Code [Driver: Ftdisk, IRP_MJ_WRITE]
Process: System Address: 0x83b6b1f8 Size: 121

Object: Hidden Code [Driver: Ftdisk, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x83b6b1f8 Size: 121

Object: Hidden Code [Driver: Ftdisk, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x83b6b1f8 Size: 121

Object: Hidden Code [Driver: Ftdisk, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x83b6b1f8 Size: 121

Object: Hidden Code [Driver: Ftdisk, IRP_MJ_SHUTDOWN]
Process: System Address: 0x83b6b1f8 Size: 121

Object: Hidden Code [Driver: Ftdisk, IRP_MJ_CLEANUP]
Process: System Address: 0x83b6b1f8 Size: 121

Object: Hidden Code [Driver: Ftdisk, IRP_MJ_POWER]
Process: System Address: 0x83b6b1f8 Size: 121

Object: Hidden Code [Driver: Ftdisk, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x83b6b1f8 Size: 121

Object: Hidden Code [Driver: Ftdisk, IRP_MJ_PNP]
Process: System Address: 0x83b6b1f8 Size: 121

Object: Hidden Code [Driver: NetBT, IRP_MJ_CREATE]
Process: System Address: 0x83791500 Size: 121

Object: Hidden Code [Driver: NetBT, IRP_MJ_CLOSE]
Process: System Address: 0x83791500 Size: 121

Object: Hidden Code [Driver: NetBT, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x83791500 Size: 121

Object: Hidden Code [Driver: NetBT, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x83791500 Size: 121

Object: Hidden Code [Driver: NetBT, IRP_MJ_CLEANUP]
Process: System Address: 0x83791500 Size: 121

Object: Hidden Code [Driver: NetBT, IRP_MJ_PNP]
Process: System Address: 0x83791500 Size: 121

Object: Hidden Code [Driver: usbehci, IRP_MJ_CREATE]
Process: System Address: 0x839ad340 Size: 121

Object: Hidden Code [Driver: usbehci, IRP_MJ_CLOSE]
Process: System Address: 0x839ad340 Size: 121

Object: Hidden Code [Driver: usbehci, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x839ad340 Size: 121

Object: Hidden Code [Driver: usbehci, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x839ad340 Size: 121

Object: Hidden Code [Driver: usbehci, IRP_MJ_POWER]
Process: System Address: 0x839ad340 Size: 121

Object: Hidden Code [Driver: usbehci, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x839ad340 Size: 121

Object: Hidden Code [Driver: usbehci, IRP_MJ_PNP]
Process: System Address: 0x839ad340 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE]
Process: System Address: 0x8338a1f8 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE_NAMED_PIPE]
Process: System Address: 0x8338a1f8 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CLOSE]
Process: System Address: 0x8338a1f8 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_READ]
Process: System Address: 0x8338a1f8 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_WRITE]
Process: System Address: 0x8338a1f8 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x8338a1f8 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x8338a1f8 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_EA]
Process: System Address: 0x8338a1f8 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_EA]
Process: System Address: 0x8338a1f8 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x8338a1f8 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x8338a1f8 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_VOLUME_INFORMATION]
Process: System Address: 0x8338a1f8 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x8338a1f8 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x8338a1f8 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8338a1f8 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x8338a1f8 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SHUTDOWN]
Process: System Address: 0x8338a1f8 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x8338a1f8 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CLEANUP]
Process: System Address: 0x8338a1f8 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE_MAILSLOT]
Process: System Address: 0x8338a1f8 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_SECURITY]
Process: System Address: 0x8338a1f8 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_SECURITY]
Process: System Address: 0x8338a1f8 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_POWER]
Process: System Address: 0x8338a1f8 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x8338a1f8 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DEVICE_CHANGE]
Process: System Address: 0x8338a1f8 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_QUOTA]
Process: System Address: 0x8338a1f8 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_QUOTA]
Process: System Address: 0x8338a1f8 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_PNP]
Process: System Address: 0x8338a1f8 Size: 121

Object: Hidden Code [Driver: Cdfsࠅ
䵃慄ࠁఏ䵃慄
歶N, IRP_MJ_CREATE]
Process: System Address: 0x838fb1f8 Size: 121

Object: Hidden Code [Driver: Cdfsࠅ
䵃慄ࠁఏ䵃慄
歶N, IRP_MJ_CLOSE]
Process: System Address: 0x838fb1f8 Size: 121

Object: Hidden Code [Driver: Cdfsࠅ
䵃慄ࠁఏ䵃慄
歶N, IRP_MJ_READ]
Process: System Address: 0x838fb1f8 Size: 121

Object: Hidden Code [Driver: Cdfsࠅ
䵃慄ࠁఏ䵃慄
歶N, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x838fb1f8 Size: 121

Object: Hidden Code [Driver: Cdfsࠅ
䵃慄ࠁఏ䵃慄
歶N, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x838fb1f8 Size: 121

Object: Hidden Code [Driver: Cdfsࠅ
䵃慄ࠁఏ䵃慄
歶N, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x838fb1f8 Size: 121

Object: Hidden Code [Driver: Cdfsࠅ
䵃慄ࠁఏ䵃慄
歶N, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x838fb1f8 Size: 121

Object: Hidden Code [Driver: Cdfsࠅ
䵃慄ࠁఏ䵃慄
歶N, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x838fb1f8 Size: 121

Object: Hidden Code [Driver: Cdfsࠅ
䵃慄ࠁఏ䵃慄
歶N, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x838fb1f8 Size: 121

Object: Hidden Code [Driver: Cdfsࠅ
䵃慄ࠁఏ䵃慄
歶N, IRP_MJ_SHUTDOWN]
Process: System Address: 0x838fb1f8 Size: 121

Object: Hidden Code [Driver: Cdfsࠅ
䵃慄ࠁఏ䵃慄
歶N, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x838fb1f8 Size: 121

Object: Hidden Code [Driver: Cdfsࠅ
䵃慄ࠁఏ䵃慄
歶N, IRP_MJ_CLEANUP]
Process: System Address: 0x838fb1f8 Size: 121

Object: Hidden Code [Driver: Cdfsࠅ
䵃慄ࠁఏ䵃慄
歶N, IRP_MJ_PNP]
Process: System Address: 0x838fb1f8 Size: 121

Hidden Services
-------------------
Service Name: SKYNETrxlaqhkd
Image Path: C:\WINDOWS\system32\drivers\SKYNETglhuxhbt.sys

==EOF==



Also there are no ! or ? under the device manager screen.

Hi again, that scored quite some hits! On the first sight, I think your BSODs are caused by TDSS rootkit. Luckily RootRepeal sees it, so we can try to wipe the driver.

Please re-run RootRepeal and select the Driver tab. Click the Scan button.
After the results appear, find the following entry
C:\WINDOWS\system32\drivers\SKYNETglhuxhbt.sys

Right click this file and select Wipe

Now reboot immediately, start MBAM, update it to the latest definitions and run a full scan.

Post the results back here please.

Malwarebytes' Anti-Malware 1.40
Database version: 2586
Windows 5.1.2600 Service Pack 2

8/9/2009 12:13:52 PM
mbam-log-2009-08-09 (12-13-52).txt

Scan type: Full Scan (C:\|)
Objects scanned: 178976
Time elapsed: 1 hour(s), 3 minute(s), 4 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 7

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\User\Application Data\.BitTornado\kernell32.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\3OPB0Z6Y\load[1].php (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\SKYNETecxabdnx.dat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\SKYNETfkjmamyo.dat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\SKYNETwmqigexh.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\SKYNETyquipyek.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\SKYNETglhuxhbt.sys (Trojan.Agent) -> Quarantined and deleted successfully.

Okay, that went nicely! Did you have any more BSODs?

Please rerun rootrepeal, go to the Hidden services tab, click Scan and after the results are shown, see if the following entry is there
Service Name: SKYNETrxlaqhkd
Image Path: C:\WINDOWS\system32\drivers\SKYNETglhuxhbt.sys
If there, right click and Wipe


P2P WARNING
-------------------
Going over your logs I noticed that you have/had BitTornado installed.

• Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.
• They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites.
• Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users.
• The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.

It is pretty much certain that if you continue to use P2P programs, you will get infected again.
I would recommend that you uninstall BitTornado, however that choice is up to you. If you choose to remove these programs, you can do so via Start > Control Panel > Add/Remove Programs.

If you wish to keep it, please do not use it until your computer is cleaned.


ATF-CLEANER
------------------
Please download ATF Cleaner by Atribune. (This program is for XP and Windows 2000 only)Double-click ATF-Cleaner.exe to run the program.
Under Main "Select Files to Delete" choose: Select All.
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.


DR. WEB CUREIT
----------------------
Please download Dr.Web CureIt and save it to your desktop. DO NOT perform a scan yet.
alternate download link
Note: The file will be randomly named (i.e. 5mkuvc4z.exe).

Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in Safe Mode.

Scan with Dr.Web CureIt as follows:

• Double-click on the randomly named file to open the program and click Start. (There is no need to update if you just downloaded the most current version
• Read the Virus check by DrWeb scanner prompt and click Ok where asked to Start scan now? Allow the setup.exe to load if asked by any of your security programs.
• The Express scan will automatically begin.
  (This is a short scan of files currently running in memory, boot sectors, and targeted folders).
• If prompted to dowload the Full version Free Trial, ignore and click the X to close the window.
• If an infected object is found, you will be prompted to move anything that cannot be cured. Click Yes to All. (This will move any detected files to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if they can't be cured)
• After the Express Scan is finished, put a check next to Complete scan to scan all local disks and removable media.
• In the top menu, click Settings > Change settings, and uncheck "Heuristic analysis" under the "Scanning" tab, then click Apply, Ok.
• Back at the main window, click the green arrow "Start Scanning" button on the right under the Dr.Web logo.
• Please be patient as this scan could take a long time to complete.
• When the scan has finished, a message will be displayed at the bottom indicating if any viruses were found.
• Click Select All, then choose Cure > Move incurable.
• In the top menu, click file and choose save report list.
• Save the DrWeb.csv report to your desktop.
• Exit Dr.Web Cureit when done.
• Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
• After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)

After you have done all these steps, please make a new RootRepeal report (for steps see my first post) and post it here.

EDIT2: Also, a quick note - I'm getting a lot of questions about exactly what a "Hidden Service" entry means. It only means that the registry entry is either present and hidden, or present and locked. Seeing a hidden service entry does not mean that the associated file is present. The "Delete Registry Key" tool in RootRepeal can be used to remove keys with corrupt permissions (such as the TDSS rootkit creates). Keys with corrupted/removed permissions will still show up as a "Hidden Service" as they are no longer accessible to most users.

a_d_13

http://forum.sysinternals.com/forum_posts....=12914&PN=3

when I tried to wipe that file with rootrepeal it says "could not find file on disk"

Thats all right kiho, since we deleted the actual driver already.
Please proceed with the other steps!

k I tried to F8 and boot into safe mode twice and it gave me a bsod both times but didnt give a IRQL

Okay, try to run it in normal mode.

scan is almost done.

mitfraudFix.exe\SmitfraudFix\Process.exe;C:\Documents and Settings\Ray\Desktop\SmitfraudFix.exe;Tool.Prockill;;
SmitfraudFix.exe\SmitfraudFix\restart.exe;C:\Documents and Settings\Ray\Desktop\SmitfraudFix.exe;Tool.ShutDown.14;;
SmitfraudFix.exe;C:\Documents and Settings\Ray\Desktop;Archive contains infected objects;Moved.;
A0017031.exe\SmitfraudFix\Process.exe;C:\System Volume Information\_restore{D60EC54C-4479-4054-9015-91943B371ACE}\RP167\A0017031.exe;Tool.Prockill;;
A0017031.exe\SmitfraudFix\restart.exe;C:\System Volume Information\_restore{D60EC54C-4479-4054-9015-91943B371ACE}\RP167\A0017031.exe;Tool.ShutDown.14;;
A0017031.exe;C:\System Volume Information\_restore{D60EC54C-4479-4054-9015-91943B371ACE}\RP167;Archive contains infected objects;Moved.;

Hi kiho, thats looking better!

Lets do another scan with Super Antispyware as well. Please start the program and update it

• In the Main Menu, click the Preferences... button.
• Click the "General and Startup" tab, and under Start-up Options, make sure "Start SUPERAntiSpyware when Windows starts" box is unchecked.
• Click the "Scanning Control" tab, and under Scanner Options, make sure the following are checked (leave all others unchecked):
  • Close browsers before scanning.
  • Scan for tracking cookies.
  • Terminate memory threats before quarantining.
• Click the "Close" button to leave the control center screen.
• Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
• On the left, make sure you check C:\Fixed Drive.
• On the right, under "Complete Scan", choose Perform Complete Scan and click "Next".
• After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
• Make sure everything has a checkmark next to it and click "Next".
• A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
• If asked if you want to reboot, click "Yes" and reboot normally.
• To retrieve the removal information after reboot, launch SUPERAntispyware again.
  • Click Preferences, then click the Statistics/Logs tab.
  • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
  • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
  • Please copy and paste the Scan Log results in your next reply.
• Click Close to exit the program.

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 08/09/2009 at 04:44 PM

Application Version : 4.27.1002

Core Rules Database Version : 4040
Trace Rules Database Version: 1980

Scan type : Complete Scan
Total Scan Time : 00:57:28

Memory items scanned : 495
Memory threats detected : 0
Registry items scanned : 5655
Registry threats detected : 19
File items scanned : 14669
File threats detected : 5

Adware.Tracking Cookie
C:\Documents and Settings\User\Cookies\user@atdmt[1].txt
C:\Documents and Settings\User\Cookies\user@ads.pointroll[1].txt
C:\Documents and Settings\User\Cookies\user@doubleclick[1].txt

Rootkit.Agent/Gen
HKLM\System\CURRENTCONTROLSET\SERVICES\SKYNETRXLAQHKD
HKLM\System\CURRENTCONTROLSET\SERVICES\SKYNETRXLAQHKD#start
HKLM\System\CURRENTCONTROLSET\SERVICES\SKYNETRXLAQHKD#type
HKLM\System\CURRENTCONTROLSET\SERVICES\SKYNETRXLAQHKD#group
HKLM\System\CURRENTCONTROLSET\SERVICES\SKYNETRXLAQHKD#imagepath
HKLM\System\CURRENTCONTROLSET\SERVICES\SKYNETRXLAQHKD\main
HKLM\System\CURRENTCONTROLSET\SERVICES\SKYNETRXLAQHKD\main#aid
HKLM\System\CURRENTCONTROLSET\SERVICES\SKYNETRXLAQHKD\main#sid
HKLM\System\CURRENTCONTROLSET\SERVICES\SKYNETRXLAQHKD\main#cmddelay
HKLM\System\CURRENTCONTROLSET\SERVICES\SKYNETRXLAQHKD\main\delete
HKLM\System\CURRENTCONTROLSET\SERVICES\SKYNETRXLAQHKD\main\injector
HKLM\System\CURRENTCONTROLSET\SERVICES\SKYNETRXLAQHKD\main\injector#*
HKLM\System\CURRENTCONTROLSET\SERVICES\SKYNETRXLAQHKD\main\tasks
HKLM\System\CURRENTCONTROLSET\SERVICES\SKYNETRXLAQHKD\modules
HKLM\System\CURRENTCONTROLSET\SERVICES\SKYNETRXLAQHKD\modules#SKYNETrk.sys
HKLM\System\CURRENTCONTROLSET\SERVICES\SKYNETRXLAQHKD\modules#SKYNETcmd.dll
HKLM\System\CURRENTCONTROLSET\SERVICES\SKYNETRXLAQHKD\modules#SKYNETlog.dat
HKLM\System\CURRENTCONTROLSET\SERVICES\SKYNETRXLAQHKD\modules#SKYNETwsp.dll
HKLM\System\CURRENTCONTROLSET\SERVICES\SKYNETRXLAQHKD\modules#SKYNET.dat

Rootkit.TDSServ-Trace
C:\WINDOWS\SYSTEM32\TDSSNRSR.DAT
C:\WINDOWS\SYSTEM32\TDSSOSVD.DAT