Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Firefox and Internet Explorer Hijacked


  • This topic is locked This topic is locked
2 replies to this topic

#1 T.Tiger

T.Tiger

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:03:22 PM

Posted 15 August 2010 - 04:13 AM

Hello all...long time guest and first time poster..in light of my dilemma.Well its simple i have a root kit problem redirecting most links in browsers and my computer stalls under heavy load as well..usually can take care of things myself but this wont go away and if it does it comes back.Please Help!! DDS (Ver_10-03-17.01) - NTFSx86
Run by omnip0tent at 1:42:45.56 on Sun 08/15/2010
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_18
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2047.1451 [GMT -7:00]

AV: ESET Smart Security 4.2 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET Personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\WINDOWS\System32\PnkBstrA.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\omnip0tent\My Documents\Downloads\dds.scr

============== Pseudo HJT Report ===============

uInternet Settings,ProxyOverride = <local>
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [SpywareTerminatorUpdate] "c:\program files\spyware terminator\SpywareTerminatorUpdate.exe"
mRun: [RivaTunerStartupDaemon] "c:\program files\rivatuner v2.24 msi master overclocking arena 2009 edition\RivaTuner.exe" /S
mRun: [SoundMan] "SOUNDMAN.EXE"
mRun: [egui] "c:\program files\eset\eset smart security\egui.exe" /hide /waitservice
uPolicies-explorer: NoSMBalloonTip = 1 (0x1)
uPolicies-explorer: MemCheckBoxInRunDlg = 0 (0x0)
uPolicies-explorer: NoResolveTrack = 0 (0x0)
uPolicies-explorer: NoWelcomeScreen = 1 (0x1)
uPolicies-explorer: NoRecentDocsNetHood = 1 (0x1)
uPolicies-explorer: NoDesktopCleanupWizard = 1 (0x1)
uPolicies-explorer: NoInstrumentation = 1 (0x1)
mPolicies-explorer: NoStrCmpLogical = 1 (0x1)
mPolicies-system: SynchronousMachineGroupPolicy = 0 (0x0)
mPolicies-system: SynchronousUserGroupPolicy = 0 (0x0)
mPolicies-system: DisableCAD = 1 (0x1)
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
Notify: ComPlusSetup - c:\windows\system32\catsrvut.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\omnip0~1\applic~1\mozilla\firefox\profiles\rx9cbh86.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\documents and settings\all users\application data\id software\quakelive\npquakezero.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: yahoo.ytff.general.dontshowhpoffer - truec:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [2009-4-21 29808]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2010-4-28 114984]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2010-8-12 142592]
R2 ekrn;ESET Service;c:\program files\eset\eset smart security\ekrn.exe [2010-6-24 810144]
S0 iwfgv;iwfgv;c:\windows\system32\drivers\gvjtm.sys --> c:\windows\system32\drivers\gvjtm.sys [?]
S3 SBRE;SBRE;\??\c:\windows\system32\drivers\sbredrv.sys --> c:\windows\system32\drivers\SBREdrv.sys [?]
S4 WebrootSpySweeperService;Webroot Spy Sweeper Engine;c:\program files\webroot\webrootsecurity\SpySweeper.exe [2009-4-21 4048240]

=============== Created Last 30 ================

2010-08-14 17:45:42 47616 ---ha-w- c:\windows\system32\cacluery.dll
2010-08-14 17:45:38 116736 ----a-w- c:\windows\file.exe
2010-08-13 07:54:40 0 d-----w- c:\docume~1\omnip0~1\applic~1\ESET
2010-08-13 07:53:12 0 d-----w- c:\program files\ESET
2010-08-12 12:00:19 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2010-08-12 12:00:18 0 d-----w- c:\docume~1\omnip0~1\applic~1\Spyware Terminator
2010-08-12 12:00:16 0 d-----w- c:\program files\Spyware Terminator
2010-08-12 12:00:16 0 d-----w- c:\docume~1\alluse~1\applic~1\Spyware Terminator
2010-08-12 11:26:01 134464 ----a-w- c:\windows\system32\LnkProtect.dll
2010-08-12 11:09:13 98816 ----a-w- c:\windows\sed.exe
2010-08-12 11:09:13 77312 ----a-w- c:\windows\MBR.exe
2010-08-12 11:09:13 256512 ----a-w- c:\windows\PEV.exe
2010-08-12 11:09:13 161792 ----a-w- c:\windows\SWREG.exe
2010-08-12 10:37:38 0 d-----w- c:\program files\CCleaner
2010-08-12 07:51:38 0 d-----w- c:\program files\MSSOAP
2010-08-12 07:51:20 0 d-----w- c:\program files\Webroot
2010-08-12 07:51:20 0 d-----w- c:\docume~1\alluse~1\applic~1\Webroot
2010-08-12 04:57:24 0 d-----w- c:\program files\Trend Micro
2010-08-11 12:24:43 0 d-----w- c:\docume~1\alluse~1\applic~1\fssg
2010-08-11 12:24:39 0 d-----w- c:\docume~1\alluse~1\applic~1\F-Secure
2010-08-11 12:14:06 161296 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2010-08-11 11:18:15 0 d-----w- c:\windows\system32\wbem\Repository.001
2010-08-11 11:18:05 380416 ------w- c:\windows\system32\irprops.cpl
2010-08-11 11:18:04 162304 ------w- c:\windows\system32\wuaucpl.cpl
2010-08-11 11:16:34 19528 ----a-w- c:\windows\002688_.tmp
2010-08-10 11:22:59 0 d-----w- c:\docume~1\alluse~1\applic~1\id Software
2010-08-04 12:13:57 92416 -c--a-w- c:\windows\system32\dllcache\mga.sys
2010-08-04 12:12:59 19456 -c--a-w- c:\windows\system32\dllcache\agt0804.dll
2010-08-04 12:11:41 488 ---ha-r- c:\windows\system32\logonui.exe.manifest
2010-08-04 12:10:14 68608 ----a-w- c:\windows\system32\access.cpl
2010-08-04 12:08:45 6400 ----a-w- c:\windows\system32\drivers\splitter.sys
2010-08-04 12:08:44 52864 ----a-w- c:\windows\system32\drivers\dmusic.sys
2010-08-04 12:08:32 57472 ----a-w- c:\windows\system32\drivers\redbook.sys
2010-08-04 12:06:02 606684 ----a-w- c:\windows\system32\drivers\ltmdmnt.sys
2010-08-04 12:05:29 40840 ----a-w- c:\windows\system32\drivers\termdd.sys
2010-08-04 12:05:29 196864 ----a-w- c:\windows\system32\drivers\rdpdr.sys
2010-07-29 13:02:34 0 d-----w- c:\docume~1\omnip0~1\applic~1\Malwarebytes
2010-07-29 13:02:23 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-07-29 12:43:58 12872 ----a-w- c:\windows\system32\bootdelete.exe
2010-07-29 12:41:30 16968 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2010-07-29 12:41:10 0 d-----w- c:\docume~1\alluse~1\applic~1\Hitman Pro
2010-07-29 12:41:09 0 d-----w- c:\program files\Hitman Pro 3.5
2010-07-29 11:24:10 0 d-----w- c:\windows\ERUNT
2010-07-25 13:24:48 0 d-----w- c:\program files\Spybot - Search & Destroy
2010-07-25 13:24:48 0 d-----w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2010-07-19 18:40:17 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-07-19 17:47:26 120 ----a-w- c:\windows\Lsamo.dat
2010-07-19 17:47:26 0 ----a-w- c:\windows\Rbuyimafeyuteze.bin
2010-07-19 17:45:55 150 ----a-w- C:\zrpt.xml
2010-07-16 12:16:34 0 d-----w- c:\windows\system32\appmgmt

==================== Find3M ====================

2010-08-14 09:33:37 139336 -c--a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-08-14 09:33:05 214720 -c--a-w- c:\windows\system32\PnkBstrB.exe
2010-08-10 11:22:59 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-08-10 11:22:59 2373712 -c--a-w- c:\windows\system32\pbsvc.exe
2010-08-04 12:10:24 22720 -c--a-w- c:\windows\system32\emptyregdb.dat
2010-07-03 00:29:31 47360 ----a-w- c:\windows\system32\drivers\pcouffin.sys
2010-07-03 00:29:31 47360 ----a-w- c:\docume~1\omnip0~1\applic~1\pcouffin.sys
2010-06-24 16:27:22 55256 ----a-w- c:\windows\system32\drivers\epfwtdi.sys
2010-06-24 16:26:24 140752 ----a-w- c:\windows\system32\drivers\eamon.sys
2010-06-23 19:31:54 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-06-09 00:18:54 315392 -c--a-w- c:\windows\HideWin.exe
2010-06-06 14:43:17 107888 -c--a-w- c:\windows\system32\CmdLineExt.dll

============= FINISH: 1:52:13.43 ===============
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-08-12 04:54:19
Windows 5.1.2600 Service Pack 2
Running: mgfg0fs1.exe; Driver: C:\DOCUME~1\OMNIP0~1\LOCALS~1\Temp\uxlyqpod.sys


---- System - GMER 1.0.15 ----

SSDT 89D7D668 ZwAllocateVirtualMemory
SSDT 89DD64A8 ZwCreateKey
SSDT 89D7DB90 ZwCreateProcess
SSDT 89D7DB18 ZwCreateProcessEx
SSDT 89D7D938 ZwCreateThread
SSDT 89D720A8 ZwDeleteKey
SSDT 89D7DC08 ZwDeleteValueKey
SSDT 89D7D6E0 ZwQueueApcThread
SSDT 89D7D578 ZwReadVirtualMemory
SSDT 89D710A8 ZwRenameKey
SSDT 89D7D7D0 ZwSetContextThread
SSDT 89D690A8 ZwSetInformationKey
SSDT 89D7DA28 ZwSetInformationProcess
SSDT 89D7D848 ZwSetInformationThread
SSDT 89D7DC80 ZwSetValueKey
SSDT 89D7D9B0 ZwSuspendProcess
SSDT 89D7D758 ZwSuspendThread
SSDT 89D7DAA0 ZwTerminateProcess
SSDT 89D7D8C0 ZwTerminateThread
SSDT 89D7D5F0 ZwWriteVirtualMemory

Code \??\C:\DOCUME~1\OMNIP0~1\LOCALS~1\Temp\catchme.sys pIofCallDriver

---- Kernel code sections - GMER 1.0.15 ----

.text C:\WINDOWS\System32\DRIVERS\nv4_mini.sys section is writeable [0xB67C1360, 0x3E57A5, 0xE8000020]
? C:\DOCUME~1\OMNIP0~1\LOCALS~1\Temp\mbr.sys The system cannot find the file specified. !
? C:\DOCUME~1\OMNIP0~1\LOCALS~1\Temp\catchme.sys The system cannot find the file specified. !
? C:\WINDOWS\system32\Drivers\PROCEXP113.SYS The system cannot find the file specified. !

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\Mozilla Firefox\firefox.exe[508] ntdll.dll!NtProtectVirtualMemory 7C90DEB6 5 Bytes JMP 0102000A
.text C:\Program Files\Mozilla Firefox\firefox.exe[508] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 0103000A
.text C:\Program Files\Mozilla Firefox\firefox.exe[508] ntdll.dll!KiUserExceptionDispatcher 7C90EAEC 5 Bytes JMP 0101000C
.text C:\Program Files\Mozilla Firefox\firefox.exe[508] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 004013F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)
.text C:\WINDOWS\System32\svchost.exe[1120] ntdll.dll!NtProtectVirtualMemory 7C90DEB6 5 Bytes JMP 0082000A
.text C:\WINDOWS\System32\svchost.exe[1120] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 0083000A
.text C:\WINDOWS\System32\svchost.exe[1120] ntdll.dll!KiUserExceptionDispatcher 7C90EAEC 5 Bytes JMP 0081000C
.text C:\WINDOWS\System32\svchost.exe[1120] USER32.dll!GetCursorPos 77D4C566 5 Bytes JMP 015D000A
.text C:\WINDOWS\System32\svchost.exe[1120] ole32.dll!CoCreateInstance 77526009 5 Bytes JMP 00A5000A
.text C:\WINDOWS\explorer.exe[1860] ntdll.dll!NtProtectVirtualMemory 7C90DEB6 5 Bytes JMP 00A0000A
.text C:\WINDOWS\explorer.exe[1860] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 00AE000A
.text C:\WINDOWS\explorer.exe[1860] ntdll.dll!KiUserExceptionDispatcher 7C90EAEC 5 Bytes JMP 009F000C

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT \SystemRoot\System32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisDeregisterProtocol] 89D7D308
IAT \SystemRoot\System32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisRegisterProtocol] 89D7D400
IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol] 89D7D400
IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisDeregisterProtocol] 89D7D308
IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisDeregisterProtocol] 89D7D308
IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisRegisterProtocol] 89D7D400
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol] 89D7D400
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisDeregisterProtocol] 89D7D308
IAT \SystemRoot\System32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] 89D7D400
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol] 89D7D308
IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] 89D7D400
IAT \SystemRoot\System32\DRIVERS\arp1394.sys[NDIS.SYS!NdisDeregisterProtocol] 89D7D308
IAT \SystemRoot\System32\DRIVERS\arp1394.sys[NDIS.SYS!NdisRegisterProtocol] 89D7D400
IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol] 89D7D400
IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisDeregisterProtocol] 89D7D308

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs ssfs0bbc.sys (Spy Sweeper FileSystem Filter Driver/Webroot Software, Inc. (www.webroot.com))

Device \Driver\Tcpip \Device\Ip 89B3B348
Device \Driver\Tcpip \Device\Ip 89C85D10
Device \Driver\Tcpip \Device\Ip 8973E468
Device \Driver\Tcpip \Device\Tcp 89B3B348
Device \Driver\Tcpip \Device\Tcp 89C85D10
Device \Driver\Tcpip \Device\Tcp 8973E468
Device \Driver\Tcpip \Device\Udp 89B3B348
Device \Driver\Tcpip \Device\Udp 89C85D10
Device \Driver\Tcpip \Device\Udp 8973E468
Device \Driver\Tcpip \Device\RawIp 89B3B348
Device \Driver\Tcpip \Device\RawIp 89C85D10
Device \Driver\Tcpip \Device\RawIp 8973E468
Device \Driver\Tcpip \Device\IPMULTICAST 89B3B348
Device \Driver\Tcpip \Device\IPMULTICAST 89C85D10
Device \Driver\Tcpip \Device\IPMULTICAST 8973E468

---- EOF - GMER 1.0.15 ----


BC AdBot (Login to Remove)

 


#2 Blind Faith

Blind Faith

  • Malware Response Team
  • 4,101 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:11:22 PM

Posted 21 August 2010 - 03:19 PM

Hello and welcome to Bleeping Computer! welcome.gif

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.

Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explaination about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

We also need a new log from the GMER anti-rootkit scanner. Please first disable any CD emulation programs using the steps found in this topic:

Why we request you disable CD Emulation when receiving Malware Removal Advice

Then create another GMER log and post it as an attachment to the reply where you post your new DDS log. Instructions on how to properly create a GMER log can be found here:

How to create a GMER log





Elle
Can you hear it?It's all around!

Tomar ki manè acchè?
Yadi thakè, tahalè
Ki kshama kartè paro
?



If I haven't replied in 48 hours, please feel free to send me a PM.



Posted Image

#3 thcbytes

thcbytes

  • Malware Response Team
  • 14,790 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:03:22 PM

Posted 26 August 2010 - 09:54 AM

Due to the lack of feedback this Topic is closed.

If you need this topic reopened, please request this by sending the moderating team a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic
Proud member - Unified Network of Instructors and Trained Eliminators
Posted Image

I do not accept personal donations for assistance provided. I would ask that you instead consider donating the greatest gift - Organ Donation. Your organs are of no use to you when your gone. You will save a life that would otherwise be lost!

http://donatelife.net/register-now/




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users