Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

XP Antivirus 2010 infection


  • This topic is locked This topic is locked
25 replies to this topic

#1 Andrew4

Andrew4

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:02:16 PM

Posted 07 February 2010 - 05:15 AM

My daughter's laptop went down with this yesterday. It's crippled IE by redirecting everything to a fake warning page, and is doing the usual constant false alerts.

I downloaded malwarebytes mbam onto my pc & copied over with an SD card (which I won't be using again in case it's been infected!), but it wouldn't install. I did avast at the same time (which I use on my pc) and installed that, but it didn't find anything.

I found several instructions for removing it by hand, but these don't work as none of the executables (av2010.exe etc) or registry settings mentioned in the instructions exist.

Eventually I managed to get mbam to install by renaming it & running it through a DOS command box - but it didn't find anything.

I've since copied over DDS & gmer and run them. I then copied firefox over, got that installed, so I can at least use the internet on the laptop. Just as well - I'm out of old SD cards!

I went through the control panel to check on the firewall - when you click on the properties button on the connection it displays the fake XP Antivirus 2010 screen. I hope she had the firewall running, but I'm not sure.

I've attached the other logs as requested.

Any help would be greatly appreciated,
regards,
Andrew


This is the DDS log:



DDS (Ver_09-12-01.01) - NTFSx86
Run by IBM at 21:15:07.91 on 06/02/2010
Internet Explorer: 6.0.2900.2180
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.255.13 [GMT 0:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: avast! Antivirus *On-access scanning enabled* (Outdated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

============== Running Processes ===============

C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
svchost.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\Documents and Settings\IBM\Local Settings\Application Data\av.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
svchost.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\explorer.exe
C:\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.co.uk/
uInternet Connection Wizard,ShellNext = hxxp://www.gocyberlink.com/registration/registration1.asp?SoftWare=POWERDVD&Version_Num=3.0&Cd_Key=DV17631263675648&Company=.&FName=.&Lang=Enu
uURLSearchHooks: FCToolbarURLSearchHook Class: {5aa14397-d310-447d-8548-2dd90218a07d} - c:\program files\coolchaser layout auto insert\Helper.dll
uURLSearchHooks: H - No File
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
BHO: BrowserHelper Class: {8a9d74f9-560b-4fe7-abeb-3b2e638e5cd6} - c:\program files\mtwbsa\SearchAssistant.dll
BHO: Search Assistant: {f0626a63-410b-45e2-99a1-3f2475b2d695} - c:\program files\mtwbsa\BHO.dll
BHO: Freecause Toolbar BHO: {fc78e410-0efa-4bec-b283-d1db1922f420} - c:\program files\coolchaser layout auto insert\Toolbar.dll
BHO: Fast Browser Search Toolbar Helper: {fcbccb87-9224-4b8d-b117-f56d924beb18} - c:\program files\fast browser search\ie\FBStoolbar.dll
TB: CoolChaser Layout Auto Insert: {b0208007-27c1-4bcd-93ef-eff5db61fc22} - c:\program files\coolchaser layout auto insert\Toolbar.dll
TB: Fast Browser Search: {d7293762-9884-48e2-b836-e0195b9d91d0} - c:\program files\fast browser search\ie\FBStoolbar.dll
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
mRun: [TrackPointSrv] tp4mon.exe
mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
mRun: [SoundMAXPnP] c:\program files\analog devices\soundmax\SMax4PNP.exe
mRun: [SoundMAX] c:\program files\analog devices\soundmax\Smax4.exe /tray
mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
mRun: [AGRSMMSG] AGRSMMSG.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_07\bin\jusched.exe"
mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
mRun: [FBSearch] c:\program files\fast browser search\ie\fbsProtection.exe
mRun: [avast5] c:\progra~1\alwils~1\avast5\avastUI.exe /nogui
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
StartupFolder: c:\docume~1\ibm\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
Notify: AtiExtEvent - Ati2evxx.dll
Notify: avgrsstarter - avgrsstx.dll

============= SERVICES / DRIVERS ===============

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-2-6 163280]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-1-11 333192]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-1-11 28424]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-1-11 360584]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-2-6 19024]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-2-6 40384]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\avg\avg9\avgemc.exe [2010-1-11 906520]
R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-1-11 285392]
R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-2-6 40384]
R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-2-6 40384]

=============== Created Last 30 ================


==================== Find3M ====================

2010-01-11 11:06:35 21640 ----a-w- c:\windows\system32\emptyregdb.dat

============= FINISH: 21:15:45.53 ===============


Attached Files



BC AdBot (Login to Remove)

 


#2 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:09:16 AM

Posted 09 February 2010 - 09:12 PM

Hello Andrew4 smile.gif Welcome to the BC HijackThis Log and Analysis forum. I will be assisting you in cleaning up your system.


I ask that you refrain from running tools other than those we suggest while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.



In the upper right hand corner of the topic you will see a button called Options. If you click on this in the drop-down menu you can choose Track this topic. By doing this and then choosing Immediate E-Mail notification and then clicking on Proceed you will be advised when we respond the your topic and facilitate the cleaning of your machine.


Please keep in mind that we have a large backlog of users just like yourself waiting to be helped so try to be as timely as possible in your replies. Since we do this on a part-time voluntary basis we are limited on how many logs we can respond to and keep open due to time restraints. If you have to be away or can't answer for some other reason just let me know. Thank you for your understanding.



After 5 days if a topic is not replied to we assume it has been abandoned and it is closed.




You have two antivirus programs running and that can cause conflicts on your computer. Since the Avast is showing as outdated you need to go ahead and take it off so we don't run into any problems with it.


Next let's do the following:


Please download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Instruction can be found HERE
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.




Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:





Click on Yes, to continue scanning for malware.

When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply.













Note: Please post the log in the reply window and do not make it an attachment. Do this with all subsequent replies unless I ask otherwise.







Thanks,



thewall





If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#3 Andrew4

Andrew4
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:02:16 PM

Posted 10 February 2010 - 03:00 AM

Thanks thewall,

I've just picked this up. I'm off to work now, and won't be home this evening. I'll go through your instructions tomorrow evening (11th).

Andrew

#4 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:09:16 AM

Posted 10 February 2010 - 11:41 AM

Sounds good!
If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#5 Andrew4

Andrew4
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:02:16 PM

Posted 11 February 2010 - 03:00 PM

This is ridiculous!

I just uninstalled the avast that I put on there. Now I can't run anything at all, except explorer (ie clicking on "my computer"). Everything else I click on comes up with "windows cannot access the specified device, path , or file. You may not have the appropriate permissions to access the item".

It even happens when I click on start->run & type "cmd" - I can't even get a command box!

I can get Control panel to display, but every item in it shows the same message when I click on it.

Any ideas?


On the bright side, the virus isn't running either...


EDIT>>>>>>>>>>>>>>> got it in safe mode now. It seems a little healthier.

Edited by Andrew4, 11 February 2010 - 03:05 PM.


#6 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:09:16 AM

Posted 11 February 2010 - 03:51 PM

This can be a real aggravating infection. Let me know how it goes.
If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#7 Andrew4

Andrew4
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:02:16 PM

Posted 11 February 2010 - 04:03 PM

Aggravating isn't the word for it!
It only runs in safe mode now.
In normal mode the virus has taken over explorer - you just get the wallpaper, no icons, nothing. I tried running programs through task manager->file->run, and eithernothing happens or it pops up the fake virus alert screen.

Anyway, I installed combofix in safe mode and ran it. This is the log:

ComboFix 10-02-11.02 - Administrator 11/02/2010 20:52:30.1.1 - x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.255.166 [GMT 0:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\IBM\Local Settings\Application Data\av.exe
c:\documents and settings\IBM\Local Settings\Temporary Internet Files\025mx36Po.jpg
c:\documents and settings\IBM\Local Settings\Temporary Internet Files\57Ka0151.jpg
c:\documents and settings\IBM\Local Settings\Temporary Internet Files\B1BM7ApN.jpg
c:\documents and settings\IBM\Local Settings\Temporary Internet Files\lJmbj6.jpg
c:\program files\Fast Browser Search
c:\program files\Fast Browser Search\IE\about.html
c:\program files\Fast Browser Search\IE\affid.dat
c:\program files\Fast Browser Search\IE\basis.xml
c:\program files\Fast Browser Search\IE\basis_br.xml
c:\program files\Fast Browser Search\IE\basis_de.xml
c:\program files\Fast Browser Search\IE\basis_en.xml
c:\program files\Fast Browser Search\IE\basis_es.xml
c:\program files\Fast Browser Search\IE\basis_fr.xml
c:\program files\Fast Browser Search\IE\basis_it.xml
c:\program files\Fast Browser Search\IE\basis_nr.xml
c:\program files\Fast Browser Search\IE\basis_pt.xml
c:\program files\Fast Browser Search\IE\basis_ru.xml
c:\program files\Fast Browser Search\IE\basis_tr.xml
c:\program files\Fast Browser Search\IE\BHO.dll
c:\program files\Fast Browser Search\IE\ClearRecycleBin.exe
c:\program files\Fast Browser Search\IE\error.html
c:\program files\Fast Browser Search\IE\FBSPlugin.dll
c:\program files\Fast Browser Search\IE\FBSProtection.exe
c:\program files\Fast Browser Search\IE\FbsSearchProvider.xml
c:\program files\Fast Browser Search\IE\FbsSearchProviderIE8.exe
c:\program files\Fast Browser Search\IE\FBStoolbar.dll
c:\program files\Fast Browser Search\IE\icons.bmp
c:\program files\Fast Browser Search\IE\info.txt
c:\program files\Fast Browser Search\IE\local.xml
c:\program files\Fast Browser Search\IE\logobg.bmp
c:\program files\Fast Browser Search\IE\MTWBtoolbar.html
c:\program files\Fast Browser Search\IE\search.bmp
c:\program files\Fast Browser Search\IE\search_br.bmp
c:\program files\Fast Browser Search\IE\search_de.bmp
c:\program files\Fast Browser Search\IE\search_es.bmp
c:\program files\Fast Browser Search\IE\search_fr.bmp
c:\program files\Fast Browser Search\IE\search_it.bmp
c:\program files\Fast Browser Search\IE\search_pt.bmp
c:\program files\Fast Browser Search\IE\search_ru.bmp
c:\program files\Fast Browser Search\IE\SearchAssistant.dll
c:\program files\Fast Browser Search\IE\tbhelper.dll
c:\program files\Fast Browser Search\IE\tbs_include_script_003175.js
c:\program files\Fast Browser Search\IE\tbs_include_script_005064.js
c:\program files\Fast Browser Search\IE\tbs_include_script_012817.js
c:\program files\Fast Browser Search\IE\Toolbar Help.htm
c:\program files\Fast Browser Search\IE\uninstall.exe
c:\program files\Fast Browser Search\IE\update.exe
c:\program files\Fast Browser Search\IE\version.txt

.
((((((((((((((((((((((((( Files Created from 2010-01-11 to 2010-02-11 )))))))))))))))))))))))))))))))
.

2010-02-11 20:20 . 2010-02-11 20:20 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-02-11 20:19 . 2010-02-11 20:19 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2010-02-07 09:47 . 2010-02-07 09:47 5115824 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-02-07 09:04 . 2010-02-07 09:04 0 ----a-w- c:\windows\nsreg.dat
2010-02-07 09:04 . 2010-02-07 09:04 -------- d-----w- c:\documents and settings\IBM\Local Settings\Application Data\Mozilla
2010-02-06 21:14 . 2010-02-06 21:10 524288 ----a-w- C:\dds.scr
2010-02-06 21:14 . 2010-02-06 21:11 293376 ----a-w- C:\gmer.exe
2010-02-06 20:09 . 2010-02-06 20:09 -------- d-----w- c:\documents and settings\IBM\Application Data\Malwarebytes
2010-02-06 20:08 . 2009-12-30 14:55 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-06 20:08 . 2010-02-06 20:08 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-06 20:08 . 2009-12-30 14:54 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-06 20:08 . 2010-02-07 09:45 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-06 20:06 . 2010-02-06 15:22 5061512 ----a-w- C:\hgfgf.exe
2010-02-06 15:35 . 2010-02-06 15:35 -------- d-----w- c:\program files\Alwil Software
2010-02-06 15:35 . 2010-02-06 15:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-02-06 14:28 . 2010-02-06 14:28 16504 ----a-w- c:\documents and settings\IBM\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-25 00:30 . 2010-01-25 00:30 -------- d-----w- c:\windows\Sun
2010-01-23 13:46 . 2010-01-23 13:46 -------- d-----w- c:\documents and settings\IBM\Local Settings\Application Data\Identities
2010-01-14 11:21 . 2010-02-06 22:26 -------- d-----w- c:\program files\MTWBSA
2010-01-14 11:20 . 2010-01-14 11:20 -------- d-----w- C:\users
2010-01-13 23:17 . 2010-01-18 19:27 1260800 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgfrw.exe
2010-01-13 23:17 . 2010-01-18 19:27 3777280 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\setup.exe
2010-01-13 23:17 . 2010-01-13 23:16 3966744 ----a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgcorex.dll
2010-01-13 20:05 . 2010-01-13 20:05 -------- d-s---w- c:\documents and settings\IBM\UserData
2010-01-13 19:09 . 2010-01-13 19:22 -------- d-----w- C:\files
2010-01-13 19:06 . 2010-01-29 22:15 1 ----a-w- c:\documents and settings\IBM\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-01-13 19:02 . 2010-01-13 19:02 -------- d-----w- c:\documents and settings\IBM\Application Data\OpenOffice.org

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-11 20:07 . 2010-01-11 13:55 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2010-01-13 21:04 . 2010-01-13 21:04 -------- d-----w- c:\documents and settings\IBM\Application Data\FCTB000060531
2010-01-13 21:04 . 2010-01-13 21:04 115512 ----a-w- c:\documents and settings\IBM\Application Data\FCTB000060531\Toolbar\Uninst.exe
2010-01-13 21:04 . 2010-01-13 21:04 -------- d-----w- c:\program files\CoolChaser Layout Auto Insert
2010-01-13 21:04 . 2010-01-13 21:04 1445888 ----a-w- c:\documents and settings\IBM\Application Data\FCTB000060531\Toolbar\Toolbar.dll
2010-01-13 21:04 . 2010-01-13 21:04 242688 ----a-w- c:\documents and settings\IBM\Application Data\FCTB000060531\Toolbar\Helper.dll
2010-01-11 14:00 . 2010-01-11 14:00 -------- d-----w- c:\program files\CyberLink
2010-01-11 13:55 . 2010-01-11 13:55 -------- d-----w- c:\program files\AVG
2010-01-11 13:44 . 2010-01-11 13:44 -------- d-----w- c:\program files\JRE
2010-01-11 13:44 . 2010-01-11 13:44 -------- d-----w- c:\program files\OpenOffice.org 3
2010-01-11 13:43 . 2010-01-11 13:43 -------- d-----w- c:\program files\Java
2010-01-11 13:43 . 2010-01-11 13:43 -------- d-----w- c:\program files\Common Files\Java
2010-01-11 13:31 . 2010-01-11 13:31 -------- d-----w- c:\program files\Lenovo
2010-01-11 13:31 . 2010-01-11 13:31 21275 ----a-w- c:\windows\system32\drivers\AegisP.sys
2010-01-11 13:31 . 2010-01-11 13:24 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-11 13:31 . 2010-01-11 13:31 -------- d-----w- c:\program files\ThinkPad
2010-01-11 13:31 . 2010-01-11 13:31 -------- d-----w- c:\program files\ltmoh
2010-01-11 13:27 . 2010-01-11 13:27 -------- d-----w- c:\program files\ATI Technologies
2010-01-11 13:26 . 2010-01-11 13:24 -------- d-----w- c:\program files\Common Files\InstallShield
2010-01-11 13:24 . 2010-01-11 13:24 -------- d-----w- c:\program files\Analog Devices
2010-01-11 11:37 . 2010-01-11 11:09 87263 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-01-11 11:11 . 2010-01-11 11:11 -------- d-----w- c:\program files\microsoft frontpage
2010-01-11 11:06 . 2010-01-11 11:06 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2010-01-06 22:39 . 2010-01-13 21:04 1477 ----a-w- c:\documents and settings\IBM\Application Data\FCTB000060531\Toolbar\patch.bat
2009-12-03 01:11 . 2010-01-13 21:04 394240 ----a-w- c:\documents and settings\IBM\Application Data\FCTB000060531\Toolbar\emailchecker_plugin.dll
2009-11-27 23:36 . 2010-01-13 21:04 371200 ----a-w- c:\documents and settings\IBM\Application Data\FCTB000060531\Toolbar\RSSReader_plugin.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FC78E410-0EFA-4BEC-B283-D1DB1922F420}]
2010-01-13 21:04 1445888 ----a-w- c:\program files\CoolChaser Layout Auto Insert\Toolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{B0208007-27C1-4BCD-93EF-EFF5DB61FC22}"= "c:\program files\CoolChaser Layout Auto Insert\Toolbar.dll" [2010-01-13 1445888]

[HKEY_CLASSES_ROOT\clsid\{b0208007-27c1-4bcd-93ef-eff5db61fc22}]
[HKEY_CLASSES_ROOT\FCTB000060531.IEToolbar.3]
[HKEY_CLASSES_ROOT\TypeLib\{80E55E64-0B78-4AA3-B48A-6CBF0536832A}]
[HKEY_CLASSES_ROOT\FCTB000060531.IEToolbar]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TrackPointSrv"="tp4mon.exe" [2004-08-04 82432]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-12 110592]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2007-02-06 344064]
"AGRSMMSG"="AGRSMMSG.exe" [2003-06-27 88363]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-12-30 1389904]

c:\documents and settings\IBM\Start Menu\Programs\Startup\
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-12-15 384000]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CoolChaser Layout Auto Insert\\TroubleShooter.exe"=
"c:\\Program Files\\CoolChaser Layout Auto Insert\\ToolbarUpdate.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [06/02/2010 20:08 38224]
.
.
------- Supplementary Scan -------
.
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\o8k2vtuv.default\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -

BHO-{8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - c:\program files\MTWBSA\SearchAssistant.dll
BHO-{F0626A63-410B-45E2-99A1-3F2475B2D695} - c:\program files\MTWBSA\BHO.dll
Toolbar-{D7293762-9884-48E2-B836-E0195B9D91D0} - c:\program files\Fast Browser Search\IE\FBStoolbar.dll
HKLM-Run-FBSearch - c:\program files\Fast Browser Search\IE\fbsProtection.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-11 20:56
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
FBSearch = c:\program files\Fast Browser Search\IE\fbsProtection.exe??????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(612)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2010-02-11 20:57:48
ComboFix-quarantined-files.txt 2010-02-11 20:57

Pre-Run: 36,261,744,640 bytes free
Post-Run: 36,356,009,984 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 0DCE5CF642E2829CFB758DC7EAD0AC15



#8 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:09:16 AM

Posted 11 February 2010 - 04:12 PM

Can you run in normal mode now?
If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#9 Andrew4

Andrew4
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:02:16 PM

Posted 11 February 2010 - 04:17 PM

Sort of...

I get the normal screen with the various icons. However, if I try to run firefox, it comes up with the box you get when it doesn't know what to do with a file type. I doesn't know what to do with a .exe file!

same with all the .exe files

Andrew


#10 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:09:16 AM

Posted 11 February 2010 - 04:32 PM

Try this in normal mode: Run the following and then see if it will let you open MalwareBytes, update it and then run a Quick Scan. If it won't update but you can open it try running a scan anyway.


RKill by Grinler
Link #1
Link #2
Link #3
Link #4
  • Download Link #1.
  • Save it to your Desktop.
  • Double click the RKill desktop icon.
    If you are using Vista please right click and run as Admin!
  • A black screen will briefly flash indicating a successful run.
  • If this does not occur please delete that application and download Link #2.
  • Continue process until the tool runs.
  • If the tool does not run from any of the links tell me about it.

If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#11 Andrew4

Andrew4
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:02:16 PM

Posted 11 February 2010 - 04:43 PM

It ran, and the malwarebytes ran. The fast scan didn't find anything.

I've reassociated the .exe extension to "application", so stuff runs.

I was also able to access the firewall - it was off, so I switched it on.

#12 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:09:16 AM

Posted 11 February 2010 - 05:00 PM

This is kind of a long shot but let's give it a try:

  • Download TDSSKiller and save it to your Desktop.
  • Extract its contents to your desktop and make sure TDSSKiller.exe (the contents of the zipped file) is on the Desktop itself, not within a folder on the desktop.
  • Go to Start > Run (Or you can hold down your Windows key and press R) and copy and paste the following into the text field. (make sure you include the quote marks) Then press OK.

    "%userprofile%\Desktop\TDSSKiller.exe" -l C:\TDSSKiller.txt -v

  • If it says "Hidden service detected" DO NOT type anything in. Just press Enter on your keyboard to not do anything to the file.
  • When it is done, a log file should be created on your C: drive called "TDSSKiller.txt" please copy and paste the contents of that file here.

If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#13 Andrew4

Andrew4
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:02:16 PM

Posted 11 February 2010 - 05:12 PM

It ran OK, but I don't think it found anything.

This is the log:

22:07:28:222 0564 TDSS rootkit removing tool 2.2.3 Feb 4 2010 14:34:00
22:07:28:222 0564 ================================================================================
22:07:28:222 0564 SystemInfo:

22:07:28:222 0564 OS Version: 5.1.2600 ServicePack: 2.0
22:07:28:222 0564 Product type: Workstation
22:07:28:222 0564 ComputerName: 180FBB16563C452
22:07:28:222 0564 UserName: IBM
22:07:28:222 0564 Windows directory: C:\WINDOWS
22:07:28:222 0564 Processor architecture: Intel x86
22:07:28:222 0564 Number of processors: 1
22:07:28:222 0564 Page size: 0x1000
22:07:28:232 0564 Boot type: Normal boot
22:07:28:232 0564 ================================================================================
22:07:28:232 0564 UnloadDriverW: NtUnloadDriver error 2
22:07:28:232 0564 ForceUnloadDriverW: UnloadDriverW(klmd21) error 2
22:07:28:302 0564 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\drivers\klmd.sys) returned status 00000000
22:07:28:512 0564 UtilityInit: KLMD drop and load success
22:07:28:512 0564 KLMD_OpenDevice: Trying to open KLMD Device(KLMD201010)
22:07:28:512 0564 UtilityInit: KLMD open success
22:07:28:512 0564 UtilityInit: Initialize success
22:07:28:512 0564
22:07:28:512 0564 Scanning Services ...
22:07:28:512 0564 CreateRegParser: Registry parser init started
22:07:28:512 0564 DisableWow64Redirection: GetProcAddress(Wow64DisableWow64FsRedirection) error 127
22:07:28:512 0564 CreateRegParser: DisableWow64Redirection error
22:07:28:512 0564 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\system
22:07:28:512 0564 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\config\system) returned status C0000043
22:07:28:512 0564 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
22:07:28:512 0564 wfopen_ex: Trying to KLMD file open
22:07:28:512 0564 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\config\system
22:07:28:512 0564 wfopen_ex: File opened ok (Flags 2)
22:07:28:512 0564 CreateRegParser: HIVE_ADAPTER(C:\WINDOWS\system32\config\system) init success: 9C4DE8
22:07:28:512 0564 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\software
22:07:28:512 0564 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\config\software) returned status C0000043
22:07:28:512 0564 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
22:07:28:512 0564 wfopen_ex: Trying to KLMD file open
22:07:28:512 0564 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\config\software
22:07:28:512 0564 wfopen_ex: File opened ok (Flags 2)
22:07:28:512 0564 CreateRegParser: HIVE_ADAPTER(C:\WINDOWS\system32\config\software) init success: 9C4CD8
22:07:28:512 0564 EnableWow64Redirection: GetProcAddress(Wow64RevertWow64FsRedirection) error 127
22:07:28:512 0564 CreateRegParser: EnableWow64Redirection error
22:07:28:512 0564 CreateRegParser: RegParser init completed
22:07:29:053 0564 GetAdvancedServicesInfo: Raw services enum returned 292 services
22:07:29:053 0564 fclose_ex: Trying to close file C:\WINDOWS\system32\config\system
22:07:29:053 0564 fclose_ex: Trying to close file C:\WINDOWS\system32\config\software
22:07:29:053 0564
22:07:29:053 0564 Scanning Kernel memory ...
22:07:29:063 0564 KLMD_GetSystemObjectAddressByNameW: Trying to get system object address by name \Driver\Disk
22:07:29:063 0564 DetectCureTDL3: \Driver\Disk PDRIVER_OBJECT: 812D1F38
22:07:29:063 0564 DetectCureTDL3: KLMD_GetDeviceObjectList returned 2 DevObjects
22:07:29:063 0564
22:07:29:063 0564 DetectCureTDL3: DEVICE_OBJECT: 812BF030
22:07:29:063 0564 KLMD_GetLowerDeviceObject: Trying to get lower device object for 812BF030
22:07:29:063 0564 KLMD_ReadMem: Trying to ReadMemory 0x812BF030[0x38]
22:07:29:063 0564 DetectCureTDL3: DRIVER_OBJECT: 812D1F38
22:07:29:063 0564 KLMD_ReadMem: Trying to ReadMemory 0x812D1F38[0xA8]
22:07:29:063 0564 KLMD_ReadMem: Trying to ReadMemory 0xE1490508[0x18]
22:07:29:063 0564 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
22:07:29:063 0564 DetectCureTDL3: IrpHandler (0) addr: F92C6C30
22:07:29:063 0564 DetectCureTDL3: IrpHandler (1) addr: 805025E4
22:07:29:063 0564 DetectCureTDL3: IrpHandler (2) addr: F92C6C30
22:07:29:063 0564 DetectCureTDL3: IrpHandler (3) addr: F92C0D9B
22:07:29:063 0564 DetectCureTDL3: IrpHandler (4) addr: F92C0D9B
22:07:29:063 0564 DetectCureTDL3: IrpHandler (5) addr: 805025E4
22:07:29:063 0564 DetectCureTDL3: IrpHandler (6) addr: 805025E4
22:07:29:063 0564 DetectCureTDL3: IrpHandler (7) addr: 805025E4
22:07:29:063 0564 DetectCureTDL3: IrpHandler (8) addr: 805025E4
22:07:29:063 0564 DetectCureTDL3: IrpHandler (9) addr: F92C1366
22:07:29:063 0564 DetectCureTDL3: IrpHandler (10) addr: 805025E4
22:07:29:063 0564 DetectCureTDL3: IrpHandler (11) addr: 805025E4
22:07:29:063 0564 DetectCureTDL3: IrpHandler (12) addr: 805025E4
22:07:29:063 0564 DetectCureTDL3: IrpHandler (13) addr: 805025E4
22:07:29:063 0564 DetectCureTDL3: IrpHandler (14) addr: F92C144D
22:07:29:063 0564 DetectCureTDL3: IrpHandler (15) addr: F92C4FC3
22:07:29:063 0564 DetectCureTDL3: IrpHandler (16) addr: F92C1366
22:07:29:063 0564 DetectCureTDL3: IrpHandler (17) addr: 805025E4
22:07:29:063 0564 DetectCureTDL3: IrpHandler (18) addr: 805025E4
22:07:29:063 0564 DetectCureTDL3: IrpHandler (19) addr: 805025E4
22:07:29:063 0564 DetectCureTDL3: IrpHandler (20) addr: 805025E4
22:07:29:063 0564 DetectCureTDL3: IrpHandler (21) addr: 805025E4
22:07:29:063 0564 DetectCureTDL3: IrpHandler (22) addr: F92C2EF3
22:07:29:063 0564 DetectCureTDL3: IrpHandler (23) addr: F92C7A24
22:07:29:063 0564 DetectCureTDL3: IrpHandler (24) addr: 805025E4
22:07:29:063 0564 DetectCureTDL3: IrpHandler (25) addr: 805025E4
22:07:29:063 0564 DetectCureTDL3: IrpHandler (26) addr: 805025E4
22:07:29:063 0564 TDL3_FileDetect: Processing driver: Disk
22:07:29:063 0564 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\disk.sys
22:07:29:063 0564 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\disk.sys
22:07:29:103 0564 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean
22:07:29:103 0564
22:07:29:103 0564 DetectCureTDL3: DEVICE_OBJECT: 812D18C8
22:07:29:103 0564 KLMD_GetLowerDeviceObject: Trying to get lower device object for 812D18C8
22:07:29:103 0564 DetectCureTDL3: DEVICE_OBJECT: 812D2F18
22:07:29:103 0564 KLMD_GetLowerDeviceObject: Trying to get lower device object for 812D2F18
22:07:29:103 0564 DetectCureTDL3: DEVICE_OBJECT: 812E62F8
22:07:29:103 0564 KLMD_GetLowerDeviceObject: Trying to get lower device object for 812E62F8
22:07:29:103 0564 KLMD_ReadMem: Trying to ReadMemory 0x812E62F8[0x38]
22:07:29:103 0564 DetectCureTDL3: DRIVER_OBJECT: 812E6B30
22:07:29:103 0564 KLMD_ReadMem: Trying to ReadMemory 0x812E6B30[0xA8]
22:07:29:103 0564 KLMD_ReadMem: Trying to ReadMemory 0xE148D078[0x1A]
22:07:29:103 0564 DetectCureTDL3: DRIVER_OBJECT name: \Driver\atapi, Driver Name: atapi
22:07:29:103 0564 DetectCureTDL3: IrpHandler (0) addr: F91B5572
22:07:29:103 0564 DetectCureTDL3: IrpHandler (1) addr: 805025E4
22:07:29:103 0564 DetectCureTDL3: IrpHandler (2) addr: F91B5572
22:07:29:103 0564 DetectCureTDL3: IrpHandler (3) addr: 805025E4
22:07:29:103 0564 DetectCureTDL3: IrpHandler (4) addr: 805025E4
22:07:29:103 0564 DetectCureTDL3: IrpHandler (5) addr: 805025E4
22:07:29:103 0564 DetectCureTDL3: IrpHandler (6) addr: 805025E4
22:07:29:103 0564 DetectCureTDL3: IrpHandler (7) addr: 805025E4
22:07:29:103 0564 DetectCureTDL3: IrpHandler (8) addr: 805025E4
22:07:29:103 0564 DetectCureTDL3: IrpHandler (9) addr: 805025E4
22:07:29:103 0564 DetectCureTDL3: IrpHandler (10) addr: 805025E4
22:07:29:103 0564 DetectCureTDL3: IrpHandler (11) addr: 805025E4
22:07:29:103 0564 DetectCureTDL3: IrpHandler (12) addr: 805025E4
22:07:29:103 0564 DetectCureTDL3: IrpHandler (13) addr: 805025E4
22:07:29:103 0564 DetectCureTDL3: IrpHandler (14) addr: F91B5592
22:07:29:103 0564 DetectCureTDL3: IrpHandler (15) addr: F91B17B4
22:07:29:103 0564 DetectCureTDL3: IrpHandler (16) addr: 805025E4
22:07:29:103 0564 DetectCureTDL3: IrpHandler (17) addr: 805025E4
22:07:29:103 0564 DetectCureTDL3: IrpHandler (18) addr: 805025E4
22:07:29:103 0564 DetectCureTDL3: IrpHandler (19) addr: 805025E4
22:07:29:103 0564 DetectCureTDL3: IrpHandler (20) addr: 805025E4
22:07:29:103 0564 DetectCureTDL3: IrpHandler (21) addr: 805025E4
22:07:29:103 0564 DetectCureTDL3: IrpHandler (22) addr: F91B55BC
22:07:29:103 0564 DetectCureTDL3: IrpHandler (23) addr: F91BC164
22:07:29:103 0564 DetectCureTDL3: IrpHandler (24) addr: 805025E4
22:07:29:103 0564 DetectCureTDL3: IrpHandler (25) addr: 805025E4
22:07:29:103 0564 DetectCureTDL3: IrpHandler (26) addr: 805025E4
22:07:29:103 0564 KLMD_ReadMem: Trying to ReadMemory 0xF91B27C6[0x400]
22:07:29:103 0564 TDL3_StartIoHookDetect: CheckParameters: 0, 00000000, 0
22:07:29:103 0564 TDL3_FileDetect: Processing driver: atapi
22:07:29:103 0564 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\atapi.sys
22:07:29:103 0564 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\atapi.sys
22:07:29:113 0564 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\atapi.sys - Verdict: Clean
22:07:29:113 0564
22:07:29:113 0564 Completed
22:07:29:113 0564
22:07:29:113 0564 Results:
22:07:29:113 0564 Memory objects infected / cured / cured on reboot: 0 / 0 / 0
22:07:29:113 0564 Registry objects infected / cured / cured on reboot: 0 / 0 / 0
22:07:29:113 0564 File objects infected / cured / cured on reboot: 0 / 0 / 0
22:07:29:123 0564
22:07:29:123 0564 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\drivers\klmd.sys) returned status 00000000
22:07:29:123 0564 UtilityDeinit: KLMD(ARK) unloaded successfully



I've got to go to bed now. Thanks for the help this evening. I'll get back to it tomorrow after work,
Andrew


#14 thewall

thewall

  • Malware Response Team
  • 6,425 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:09:16 AM

Posted 11 February 2010 - 05:27 PM

OK, just let me know when you get back and we'll go from there.
If I have helped you then please consider donating so I can continue the fight against malware Posted Image
All donations go directly to the helper

Posted Image

Due to the large amount of backlogs we have I cannot respond to PMs for help unless I am already working with you

#15 Andrew4

Andrew4
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:02:16 PM

Posted 12 February 2010 - 02:17 PM

Right, I'm back on.

I've booted the machine, and it seems OK. There's no visible sign of the malware - I've got TaskManager up and am going through all the exes to see if there is anyting suspicious.

Any chance we got rid of it, and just need to do a clean-up?

Andrew

Edited by Andrew4, 12 February 2010 - 02:26 PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users