Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Constant redirects in all browsers


  • This topic is locked This topic is locked
7 replies to this topic

#1 opto88

opto88

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:06:36 PM

Posted 17 August 2010 - 09:55 PM

Hi,

About 6 days ago I started to get redirects in the search results of Google, FF and IE. I had AVG running at the time. Since then, I have run Aviara Anti Vir, Super AntiSpyware, Sophos Rootkit killer, Rootkit Buster, TDSSKiller, Spybot S&D,Ad-aware, CCleaner,Advanced SystemCare,Threatfire, UniBlue Registry Cleaner and Registry mechanic. I've been busy and very frustrated. All these programs found various minor problems but none solved the redirect problem. It is now super annoying.
I am running Windows 7 (DAZ loader 1.9.1) with 2 gb of memory and 1TB WD drive. Using an NVidia 8400 GS graphics card.

Hope someone can find an answer to this frustrating problem. Otherwise I may have to resort to Linux (only kidding although it may not be a bad idea :-) ).

Thanks in advance.

Edited by Pandy, 17 August 2010 - 10:21 PM.
Moved from Malware removal as there are no logs included and the Prep guide not followed ~Pandy


BC AdBot (Login to Remove)

 


#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,490 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:36 PM

Posted 18 August 2010 - 07:39 AM

It's possible that you have an infected Master Boot Record (MBR) so lets check it to be sure.

Please download bootkit_remover.rar and save it to your Desktop. <-Important!!!

You will need to extract the remover.exe file using a program capable of extracing RAR compressed files. If you don't have an extraction program, you can downlaod, install and use 7-zip.
  • Right-click on the bootkit_remover.rar file and select "extract/unzip here".
  • This will create two readme files and a file named remover.exe on your desktop.
  • Double-click on remover.exe.
    Note: Vista/Windows 7 users right-click and select Run As Administrator.
  • A command window will open with a black screen and some data on it.
  • Right-click on the screen and choose Select All.
  • The screen will turn white. Press CTRL+C to copy the data on that screen.
  • Open Notepad and press CTRL+V, or click on the Edit tab and choose Paste.
  • Copy and paste the output from Notepad in your next reply.
  • Clcik on the black screen and Press any key on the keyboard to exit.

I have run UniBlue Registry Cleaner and Registry mechanic

Bleeping Computer DOES NOT recommend the use of registry cleaners/optimizers for several reasons:

:inlove: Registry cleaners are extremely powerful applications that can damage the registry by using aggressive cleaning routines and cause your computer to become unbootable.

The Windows registry is a central repository (database) for storing configuration data, user settings and machine-dependent settings, and options for the operating system. It contains information and settings for all hardware, software, users, and preferences. Whenever a user makes changes to settings, file associations, system policies, or installed software, the changes are reflected and stored in this repository. The registry is a crucial component because it is where Windows "remembers" all this information, how it works together, how Windows boots the system and what files it uses when it does. The registry is also a vulnerable subsystem, in that relatively small changes done incorrectly can render the system inoperable. For a more detailed explanation, read Understanding The Registry.

:flowers: Not all registry cleaners are created equal. There are a number of them available but they do not all work entirely the same way. Each vendor uses different criteria as to what constitutes a "bad entry". One cleaner may find entries on your system that will not cause problems when removed, another may not find the same entries, and still another may want to remove entries required for a program to work.

:thumbsup: Not all registry cleaners create a backup of the registry before making changes. If the changes prevent the system from booting up, then there is no backup available to restore it in order to regain functionality. A backup of the registry is essential BEFORE making any changes to the registry.

:trumpet: Improperly removing registry entries can hamper malware disinfection and make the removal process more difficult if your computer becomes infected. For example, removing malware related registry entries before the infection is properly identified can contribute to system instability and even make the malware undetectable to removal tools.

:huh: The usefulness of cleaning the registry is highly overrated and can be dangerous. In most cases, using a cleaner to remove obsolete, invalid, and erroneous entries does not affect system performance but it can result in "unpredictable results".

Unless you have a particular problem that requires a registry edit to correct it, I would suggest you leave the registry alone. Using registry cleaning tools unnecessarily or incorrectly could lead to disastrous effects on your operating system such as preventing it from ever starting again. For routine use, the benefits to your computer are negligible while the potential risks are great.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 opto88

opto88
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:06:36 PM

Posted 18 August 2010 - 11:12 AM

Here is thew notepad copy of Remover you requested:


Bootkit Remover
© 2009 eSage Lab
www.esagelab.com

Program version: 1.1.0.0
OS Version: Microsoft Windows 7 Ultimate Edition (build 7600), 32-bit

System volume is \\.\G:
\\.\G: -> \\.\PhysicalDrive0 at offset 0x00000000`00007e00
Boot sector MD5 is: bb4f1627d8b9beda49ac0d010229f3ff

Size Device Name MBR Status
--------------------------------------------
931 GB \\.\PhysicalDrive0 OK (DOS/Win32 Boot code found)


Done;
Press any key to quit...

#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,490 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:36 PM

Posted 18 August 2010 - 11:50 AM

That log looks ok so an infected Master Boot Record is not the source of your issues.

Please post the complete results of your TDSSkiller scan for review.

After running TDSSkiller, a log file named TDSSKiller_version_date_time_log.txt (i.e. TDSSKiller.2.4.0.0_27.07.2010_09.o7.26_log.txt) will have been created and saved to the root directory (usually Local Disk C:). Open that file in notepad, then copy and paste the contents of that file in your next reply.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#5 opto88

opto88
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:06:36 PM

Posted 18 August 2010 - 02:31 PM

2010/08/18 12:28:47.0198 TDSS rootkit removing tool 2.4.1.2 Aug 16 2010 09:46:23
2010/08/18 12:28:47.0198 ================================================================================
2010/08/18 12:28:47.0198 SystemInfo:
2010/08/18 12:28:47.0198
2010/08/18 12:28:47.0198 OS Version: 6.1.7600 ServicePack: 0.0
2010/08/18 12:28:47.0198 Product type: Workstation
2010/08/18 12:28:47.0199 ComputerName: MARTY-PC
2010/08/18 12:28:47.0199 UserName: Marty
2010/08/18 12:28:47.0199 Windows directory: G:\Windows
2010/08/18 12:28:47.0199 System windows directory: G:\Windows
2010/08/18 12:28:47.0199 Processor architecture: Intel x86
2010/08/18 12:28:47.0199 Number of processors: 2
2010/08/18 12:28:47.0200 Page size: 0x1000
2010/08/18 12:28:47.0200 Boot type: Normal boot
2010/08/18 12:28:47.0200 ================================================================================
2010/08/18 12:28:48.0757 Initialize success
2010/08/18 12:28:52.0791 ================================================================================
2010/08/18 12:28:52.0791 Scan started
2010/08/18 12:28:52.0791 Mode: Manual;
2010/08/18 12:28:52.0791 ================================================================================
2010/08/18 12:28:53.0702 1394ohci (6d2aca41739bfe8cb86ee8e85f29697d) G:\Windows\system32\DRIVERS\1394ohci.sys
2010/08/18 12:28:53.0727 ACPI (f0e07d144c8685b8774bc32fc8da4df0) G:\Windows\system32\DRIVERS\ACPI.sys
2010/08/18 12:28:53.0760 AcpiPmi (98d81ca942d19f7d9153b095162ac013) G:\Windows\system32\DRIVERS\acpipmi.sys
2010/08/18 12:28:53.0809 adp94xx (21e785ebd7dc90a06391141aac7892fb) G:\Windows\system32\DRIVERS\adp94xx.sys
2010/08/18 12:28:53.0837 adpahci (0c676bc278d5b59ff5abd57bbe9123f2) G:\Windows\system32\DRIVERS\adpahci.sys
2010/08/18 12:28:53.0862 adpu320 (7c7b5ee4b7b822ec85321fe23a27db33) G:\Windows\system32\DRIVERS\adpu320.sys
2010/08/18 12:28:53.0929 afcdp (ef1afa9752e468013584585666a3b119) G:\Windows\system32\DRIVERS\afcdp.sys
2010/08/18 12:28:53.0985 AFD (ddc040fdb01ef1712a6b13e52afb104c) G:\Windows\system32\drivers\afd.sys
2010/08/18 12:28:54.0018 agp440 (507812c3054c21cef746b6ee3d04dd6e) G:\Windows\system32\DRIVERS\agp440.sys
2010/08/18 12:28:54.0042 aic78xx (8b30250d573a8f6b4bd23195160d8707) G:\Windows\system32\DRIVERS\djsvs.sys
2010/08/18 12:28:54.0082 aliide (0d40bcf52ea90fc7df2aeab6503dea44) G:\Windows\system32\DRIVERS\aliide.sys
2010/08/18 12:28:54.0115 amdagp (3c6600a0696e90a463771c7422e23ab5) G:\Windows\system32\DRIVERS\amdagp.sys
2010/08/18 12:28:54.0144 amdide (cd5914170297126b6266860198d1d4f0) G:\Windows\system32\DRIVERS\amdide.sys
2010/08/18 12:28:54.0178 AmdK8 (00dda200d71bac534bf56a9db5dfd666) G:\Windows\system32\DRIVERS\amdk8.sys
2010/08/18 12:28:54.0202 AmdPPM (3cbf30f5370fda40dd3e87df38ea53b6) G:\Windows\system32\DRIVERS\amdppm.sys
2010/08/18 12:28:54.0234 amdsata (2101a86c25c154f8314b24ef49d7fbc2) G:\Windows\system32\DRIVERS\amdsata.sys
2010/08/18 12:28:54.0261 amdsbs (ea43af0c423ff267355f74e7a53bdaba) G:\Windows\system32\DRIVERS\amdsbs.sys
2010/08/18 12:28:54.0283 amdxata (b81c2b5616f6420a9941ea093a92b150) G:\Windows\system32\DRIVERS\amdxata.sys
2010/08/18 12:28:54.0303 AppID (feb834c02ce1e84b6a38f953ca067706) G:\Windows\system32\drivers\appid.sys
2010/08/18 12:28:54.0366 arc (2932004f49677bd84dbc72edb754ffb3) G:\Windows\system32\DRIVERS\arc.sys
2010/08/18 12:28:54.0388 arcsas (5d6f36c46fd283ae1b57bd2e9feb0bc7) G:\Windows\system32\DRIVERS\arcsas.sys
2010/08/18 12:28:54.0421 AsyncMac (add2ade1c2b285ab8378d2daaf991481) G:\Windows\system32\DRIVERS\asyncmac.sys
2010/08/18 12:28:54.0445 atapi (338c86357871c167a96ab976519bf59e) G:\Windows\system32\DRIVERS\atapi.sys
2010/08/18 12:28:54.0534 AvgLdx86 (b8c187439d27aba430dd69fdcf1fa657) G:\Windows\system32\Drivers\avgldx86.sys
2010/08/18 12:28:54.0571 AvgMfx86 (53b3f979930a786a614d29cafe99f645) G:\Windows\system32\Drivers\avgmfx86.sys
2010/08/18 12:28:54.0598 AvgTdiX (22e3b793c3e61720f03d3a22351af410) G:\Windows\system32\Drivers\avgtdix.sys
2010/08/18 12:28:54.0652 b06bdrv (1a231abec60fd316ec54c66715543cec) G:\Windows\system32\DRIVERS\bxvbdx.sys
2010/08/18 12:28:54.0683 b57nd60x (bd8869eb9cde6bbe4508d869929869ee) G:\Windows\system32\DRIVERS\b57nd60x.sys
2010/08/18 12:28:54.0733 Beep (505506526a9d467307b3c393dedaf858) G:\Windows\system32\drivers\Beep.sys
2010/08/18 12:28:54.0778 blbdrive (2287078ed48fcfc477b05b20cf38f36f) G:\Windows\system32\DRIVERS\blbdrive.sys
2010/08/18 12:28:54.0799 bowser (fcafaef6798d7b51ff029f99a9898961) G:\Windows\system32\DRIVERS\bowser.sys
2010/08/18 12:28:54.0824 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) G:\Windows\system32\DRIVERS\BrFiltLo.sys
2010/08/18 12:28:54.0849 BrFiltUp (56801ad62213a41f6497f96dee83755a) G:\Windows\system32\DRIVERS\BrFiltUp.sys
2010/08/18 12:28:54.0927 Brserid (845b8ce732e67f3b4133164868c666ea) G:\Windows\System32\Drivers\Brserid.sys
2010/08/18 12:28:54.0951 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) G:\Windows\System32\Drivers\BrSerWdm.sys
2010/08/18 12:28:54.0980 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) G:\Windows\System32\Drivers\BrUsbMdm.sys
2010/08/18 12:28:55.0010 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) G:\Windows\System32\Drivers\BrUsbSer.sys
2010/08/18 12:28:55.0031 BTHMODEM (ed3df7c56ce0084eb2034432fc56565a) G:\Windows\system32\DRIVERS\bthmodem.sys
2010/08/18 12:28:55.0079 cdfs (77ea11b065e0a8ab902d78145ca51e10) G:\Windows\system32\DRIVERS\cdfs.sys
2010/08/18 12:28:55.0107 cdrom (ba6e70aa0e6091bc39de29477d866a77) G:\Windows\system32\DRIVERS\cdrom.sys
2010/08/18 12:28:55.0146 circlass (3fe3fe94a34df6fb06e6418d0f6a0060) G:\Windows\system32\DRIVERS\circlass.sys
2010/08/18 12:28:55.0191 CLFS (635181e0e9bbf16871bf5380d71db02d) G:\Windows\system32\CLFS.sys
2010/08/18 12:28:55.0221 CmBatt (dea805815e587dad1dd2c502220b5616) G:\Windows\system32\DRIVERS\CmBatt.sys
2010/08/18 12:28:55.0247 cmdide (c537b1db64d495b9b4717b4d6d9edbf2) G:\Windows\system32\DRIVERS\cmdide.sys
2010/08/18 12:28:55.0285 CNG (1b675691ed940766149c93e8f4488d68) G:\Windows\system32\Drivers\cng.sys
2010/08/18 12:28:55.0316 Compbatt (a6023d3823c37043986713f118a89bee) G:\Windows\system32\DRIVERS\compbatt.sys
2010/08/18 12:28:55.0342 CompositeBus (f1724ba27e97d627f808fb0ba77a28a6) G:\Windows\system32\DRIVERS\CompositeBus.sys
2010/08/18 12:28:55.0377 crcdisk (2c4ebcfc84a9b44f209dff6c6e6c61d1) G:\Windows\system32\DRIVERS\crcdisk.sys
2010/08/18 12:28:55.0437 CSC (27c9490bdd0ae48911ab8cf1932591ed) G:\Windows\system32\drivers\csc.sys
2010/08/18 12:28:55.0494 DfsC (8e09e52ee2e3ceb199ef3dd99cf9e3fb) G:\Windows\system32\Drivers\dfsc.sys
2010/08/18 12:28:55.0525 discache (1a050b0274bfb3890703d490f330c0da) G:\Windows\system32\drivers\discache.sys
2010/08/18 12:28:55.0555 Disk (565003f326f99802e68ca78f2a68e9ff) G:\Windows\system32\DRIVERS\disk.sys
2010/08/18 12:28:55.0615 DKRtWrt (890b806894cd5c23dcec5a99b5f8abe2) G:\Windows\system32\DRIVERS\DKRtWrt.sys
2010/08/18 12:28:55.0697 drmkaud (b918e7c5f9bf77202f89e1a9539f2eb4) G:\Windows\system32\drivers\drmkaud.sys
2010/08/18 12:28:55.0725 DXGKrnl (39806cfeddcc55e686a49bccd2972f23) G:\Windows\System32\drivers\dxgkrnl.sys
2010/08/18 12:28:55.0809 ebdrv (024e1b5cac09731e4d868e64dbfb4ab0) G:\Windows\system32\DRIVERS\evbdx.sys
2010/08/18 12:28:55.0913 ElbyCDFL (ce37e3d51912e59c80c6d84337c0b4cd) G:\Windows\system32\Drivers\ElbyCDFL.sys
2010/08/18 12:28:55.0969 ElbyCDIO (44996a2addd2db7454f2ca40b67d8941) G:\Windows\system32\Drivers\ElbyCDIO.sys
2010/08/18 12:28:56.0007 elxstor (0ed67910c8c326796faa00b2bf6d9d3c) G:\Windows\system32\DRIVERS\elxstor.sys
2010/08/18 12:28:56.0031 ErrDev (8fc3208352dd3912c94367a206ab3f11) G:\Windows\system32\DRIVERS\errdev.sys
2010/08/18 12:28:56.0096 exfat (2dc9108d74081149cc8b651d3a26207f) G:\Windows\system32\drivers\exfat.sys
2010/08/18 12:28:56.0143 fastfat (7e0ab74553476622fb6ae36f73d97d35) G:\Windows\system32\drivers\fastfat.sys
2010/08/18 12:28:56.0180 fdc (e817a017f82df2a1f8cfdbda29388b29) G:\Windows\system32\DRIVERS\fdc.sys
2010/08/18 12:28:56.0226 FileInfo (6cf00369c97f3cf563be99be983d13d8) G:\Windows\system32\drivers\fileinfo.sys
2010/08/18 12:28:56.0280 Filetrace (42c51dc94c91da21cb9196eb64c45db9) G:\Windows\system32\drivers\filetrace.sys
2010/08/18 12:28:56.0308 flpydisk (87907aa70cb3c56600f1c2fb8841579b) G:\Windows\system32\DRIVERS\flpydisk.sys
2010/08/18 12:28:56.0348 FltMgr (7520ec808e0c35e0ee6f841294316653) G:\Windows\system32\drivers\fltmgr.sys
2010/08/18 12:28:56.0389 FsDepends (1a16b57943853e598cff37fe2b8cbf1d) G:\Windows\system32\drivers\FsDepends.sys
2010/08/18 12:28:56.0416 Fs_Rec (a574b4360e438977038aae4bf60d79a2) G:\Windows\system32\drivers\Fs_Rec.sys
2010/08/18 12:28:56.0448 fvevol (5592f5dba26282d24d2b080eb438a4d7) G:\Windows\system32\DRIVERS\fvevol.sys
2010/08/18 12:28:56.0491 gagp30kx (65ee0c7a58b65e74ae05637418153938) G:\Windows\system32\DRIVERS\gagp30kx.sys
2010/08/18 12:28:56.0524 hcw85cir (c44e3c2bab6837db337ddee7544736db) G:\Windows\system32\drivers\hcw85cir.sys
2010/08/18 12:28:56.0587 HdAudAddService (3530cad25deba7dc7de8bb51632cbc5f) G:\Windows\system32\drivers\HdAudio.sys
2010/08/18 12:28:56.0630 HDAudBus (717a2207fd6f13ad3e664c7d5a43c7bf) G:\Windows\system32\DRIVERS\HDAudBus.sys
2010/08/18 12:28:56.0653 HidBatt (1d58a7f3e11a9731d0eaaaa8405acc36) G:\Windows\system32\DRIVERS\HidBatt.sys
2010/08/18 12:28:56.0684 HidBth (89448f40e6df260c206a193a4683ba78) G:\Windows\system32\DRIVERS\hidbth.sys
2010/08/18 12:28:56.0761 HidIr (cf50b4cf4a4f229b9f3c08351f99ca5e) G:\Windows\system32\DRIVERS\hidir.sys
2010/08/18 12:28:56.0791 HidUsb (25072fb35ac90b25f9e4e3bacf774102) G:\Windows\system32\DRIVERS\hidusb.sys
2010/08/18 12:28:56.0867 hotcore3 (48ed16c0c98c950843e673eeee02ac94) G:\Windows\system32\DRIVERS\hotcore3.sys
2010/08/18 12:28:56.0893 HpSAMD (295fdc419039090eb8b49ffdbb374549) G:\Windows\system32\DRIVERS\HpSAMD.sys
2010/08/18 12:28:56.0925 HTTP (c531c7fd9e8b62021112787c4e2c5a5a) G:\Windows\system32\drivers\HTTP.sys
2010/08/18 12:28:56.0958 hwpolicy (8305f33cde89ad6c7a0763ed0b5a8d42) G:\Windows\system32\drivers\hwpolicy.sys
2010/08/18 12:28:56.0998 i8042prt (f151f0bdc47f4a28b1b20a0818ea36d6) G:\Windows\system32\DRIVERS\i8042prt.sys
2010/08/18 12:28:57.0041 iaStorV (934af4d7c5f457b9f0743f4299b77b67) G:\Windows\system32\DRIVERS\iaStorV.sys
2010/08/18 12:28:57.0105 iirsp (4173ff5708f3236cf25195fecd742915) G:\Windows\system32\DRIVERS\iirsp.sys
2010/08/18 12:28:57.0161 intelide (a0f12f2c9ba6c72f3987ce780e77c130) G:\Windows\system32\DRIVERS\intelide.sys
2010/08/18 12:28:57.0189 intelppm (3b514d27bfc4accb4037bc6685f766e0) G:\Windows\system32\DRIVERS\intelppm.sys
2010/08/18 12:28:57.0228 IpFilterDriver (709d1761d3b19a932ff0238ea6d50200) G:\Windows\system32\DRIVERS\ipfltdrv.sys
2010/08/18 12:28:57.0281 IPMIDRV (e4454b6c37d7ffd5649611f6496308a7) G:\Windows\system32\DRIVERS\IPMIDrv.sys
2010/08/18 12:28:57.0312 IPNAT (a5fa468d67abcdaa36264e463a7bb0cd) G:\Windows\system32\drivers\ipnat.sys
2010/08/18 12:28:57.0343 IRENUM (42996cff20a3084a56017b7902307e9f) G:\Windows\system32\drivers\irenum.sys
2010/08/18 12:28:57.0381 isapnp (1f32bb6b38f62f7df1a7ab7292638a35) G:\Windows\system32\DRIVERS\isapnp.sys
2010/08/18 12:28:57.0416 iScsiPrt (ed46c223ae46c6866ab77cdc41c404b7) G:\Windows\system32\DRIVERS\msiscsi.sys
2010/08/18 12:28:57.0447 kbdclass (adef52ca1aeae82b50df86b56413107e) G:\Windows\system32\DRIVERS\kbdclass.sys
2010/08/18 12:28:57.0475 kbdhid (3d9f0ebf350edcfd6498057301455964) G:\Windows\system32\DRIVERS\kbdhid.sys
2010/08/18 12:28:57.0511 KSecDD (e36a061ec11b373826905b21be10948f) G:\Windows\system32\Drivers\ksecdd.sys
2010/08/18 12:28:57.0561 KSecPkg (26c046977e85b95036453d7b88ba1820) G:\Windows\system32\Drivers\ksecpkg.sys
2010/08/18 12:28:57.0618 L8042Kbd (d8d3f1c1e82117a3776a2d320a7b3694) G:\Windows\system32\DRIVERS\L8042Kbd.sys
2010/08/18 12:28:57.0715 Lavasoft Kernexplorer (32da3fde01f1bb080c2e69521dd8881e) G:\Program Files\Lavasoft\Ad-Aware\KernExplorer.sys
2010/08/18 12:28:57.0744 Lbd (b7c19ec8b0dd7efa58ad41ffeb8b8cda) G:\Windows\system32\DRIVERS\Lbd.sys
2010/08/18 12:28:57.0791 LHidFilt (8b30311241f97b35167afe68d79e8530) G:\Windows\system32\DRIVERS\LHidFilt.Sys
2010/08/18 12:28:57.0817 lltdio (f7611ec07349979da9b0ae1f18ccc7a6) G:\Windows\system32\DRIVERS\lltdio.sys
2010/08/18 12:28:57.0873 LMouFilt (48d7422a6c4eec886b56ac534cfa3acf) G:\Windows\system32\DRIVERS\LMouFilt.Sys
2010/08/18 12:28:57.0912 LSI_FC (eb119a53ccf2acc000ac71b065b78fef) G:\Windows\system32\DRIVERS\lsi_fc.sys
2010/08/18 12:28:57.0946 LSI_SAS (8ade1c877256a22e49b75d1cc9161f9c) G:\Windows\system32\DRIVERS\lsi_sas.sys
2010/08/18 12:28:57.0983 LSI_SAS2 (dc9dc3d3daa0e276fd2ec262e38b11e9) G:\Windows\system32\DRIVERS\lsi_sas2.sys
2010/08/18 12:28:58.0036 LSI_SCSI (0a036c7d7cab643a7f07135ac47e0524) G:\Windows\system32\DRIVERS\lsi_scsi.sys
2010/08/18 12:28:58.0115 luafv (6703e366cc18d3b6e534f5cf7df39cee) G:\Windows\system32\drivers\luafv.sys
2010/08/18 12:28:58.0180 megasas (0fff5b045293002ab38eb1fd1fc2fb74) G:\Windows\system32\DRIVERS\megasas.sys
2010/08/18 12:28:58.0226 MegaSR (dcbab2920c75f390caf1d29f675d03d6) G:\Windows\system32\DRIVERS\MegaSR.sys
2010/08/18 12:28:58.0337 Modem (f001861e5700ee84e2d4e52c712f4964) G:\Windows\system32\drivers\modem.sys
2010/08/18 12:28:58.0407 monitor (79d10964de86b292320e9dfe02282a23) G:\Windows\system32\DRIVERS\monitor.sys
2010/08/18 12:28:58.0429 mouclass (fb18cc1d4c2e716b6b903b0ac0cc0609) G:\Windows\system32\DRIVERS\mouclass.sys
2010/08/18 12:28:58.0472 mouhid (2c388d2cd01c9042596cf3c8f3c7b24d) G:\Windows\system32\DRIVERS\mouhid.sys
2010/08/18 12:28:58.0520 mountmgr (921c18727c5920d6c0300736646931c2) G:\Windows\system32\drivers\mountmgr.sys
2010/08/18 12:28:58.0546 mpio (2af5997438c55fb79d33d015c30e1974) G:\Windows\system32\DRIVERS\mpio.sys
2010/08/18 12:28:58.0573 mpsdrv (ad2723a7b53dd1aacae6ad8c0bfbf4d0) G:\Windows\system32\drivers\mpsdrv.sys
2010/08/18 12:28:58.0618 MRxDAV (b1be47008d20e43da3adc37c24cdb89d) G:\Windows\system32\drivers\mrxdav.sys
2010/08/18 12:28:58.0652 mrxsmb (f4a054be78af7f410129c4b64b07dc9b) G:\Windows\system32\DRIVERS\mrxsmb.sys
2010/08/18 12:28:58.0685 mrxsmb10 (deffa295bd1895c6ed8e3078412ac60b) G:\Windows\system32\DRIVERS\mrxsmb10.sys
2010/08/18 12:28:58.0715 mrxsmb20 (24d76abe5dcad22f19d105f76fdf0ce1) G:\Windows\system32\DRIVERS\mrxsmb20.sys
2010/08/18 12:28:58.0756 msahci (4326d168944123f38dd3b2d9c37a0b12) G:\Windows\system32\DRIVERS\msahci.sys
2010/08/18 12:28:58.0789 msdsm (455029c7174a2dbb03dba8a0d8bddd9a) G:\Windows\system32\DRIVERS\msdsm.sys
2010/08/18 12:28:58.0829 Msfs (daefb28e3af5a76abcc2c3078c07327f) G:\Windows\system32\drivers\Msfs.sys
2010/08/18 12:28:58.0868 mshidkmdf (3e1e5767043c5af9367f0056295e9f84) G:\Windows\System32\drivers\mshidkmdf.sys
2010/08/18 12:28:58.0928 msisadrv (0a4e5757ae09fa9622e3158cc1aef114) G:\Windows\system32\DRIVERS\msisadrv.sys
2010/08/18 12:28:58.0973 MSKSSRV (8c0860d6366aaffb6c5bb9df9448e631) G:\Windows\system32\drivers\MSKSSRV.sys
2010/08/18 12:28:59.0006 MSPCLOCK (3ea8b949f963562cedbb549eac0c11ce) G:\Windows\system32\drivers\MSPCLOCK.sys
2010/08/18 12:28:59.0038 MSPQM (f456e973590d663b1073e9c463b40932) G:\Windows\system32\drivers\MSPQM.sys
2010/08/18 12:28:59.0078 MsRPC (0e008fc4819d238c51d7c93e7b41e560) G:\Windows\system32\drivers\MsRPC.sys
2010/08/18 12:28:59.0110 mssmbios (fc6b9ff600cc585ea38b12589bd4e246) G:\Windows\system32\DRIVERS\mssmbios.sys
2010/08/18 12:28:59.0163 MSTEE (b42c6b921f61a6e55159b8be6cd54a36) G:\Windows\system32\drivers\MSTEE.sys
2010/08/18 12:28:59.0203 MTConfig (33599130f44e1f34631cea241de8ac84) G:\Windows\system32\DRIVERS\MTConfig.sys
2010/08/18 12:28:59.0242 Mup (159fad02f64e6381758c990f753bcc80) G:\Windows\system32\Drivers\mup.sys
2010/08/18 12:28:59.0291 NativeWifiP (26384429fcd85d83746f63e798ab1480) G:\Windows\system32\DRIVERS\nwifi.sys
2010/08/18 12:28:59.0348 NDIS (23759d175a0a9baaf04d05047bc135a8) G:\Windows\system32\drivers\ndis.sys
2010/08/18 12:28:59.0377 NdisCap (0e1787aa6c9191d3d319e8bafe86f80c) G:\Windows\system32\DRIVERS\ndiscap.sys
2010/08/18 12:28:59.0401 NdisTapi (e4a8aec125a2e43a9e32afeea7c9c888) G:\Windows\system32\DRIVERS\ndistapi.sys
2010/08/18 12:28:59.0429 Ndisuio (b30ae7f2b6d7e343b0df32e6c08fce75) G:\Windows\system32\DRIVERS\ndisuio.sys
2010/08/18 12:28:59.0454 NdisWan (267c415eadcbe53c9ca873dee39cf3a4) G:\Windows\system32\DRIVERS\ndiswan.sys
2010/08/18 12:28:59.0484 NDProxy (af7e7c63dcef3f8772726f86039d6eb4) G:\Windows\system32\drivers\NDProxy.sys
2010/08/18 12:28:59.0509 NetBIOS (80b275b1ce3b0e79909db7b39af74d51) G:\Windows\system32\DRIVERS\netbios.sys
2010/08/18 12:28:59.0540 NetBT (dd52a733bf4ca5af84562a5e2f963b91) G:\Windows\system32\DRIVERS\netbt.sys
2010/08/18 12:28:59.0593 nfrd960 (1d85c4b390b0ee09c7a46b91efb2c097) G:\Windows\system32\DRIVERS\nfrd960.sys
2010/08/18 12:28:59.0628 Npfs (1db262a9f8c087e8153d89bef3d2235f) G:\Windows\system32\drivers\Npfs.sys
2010/08/18 12:28:59.0814 nsiproxy (e9a0a4d07e53d8fea2bb8387a3293c58) G:\Windows\system32\drivers\nsiproxy.sys
2010/08/18 12:28:59.0895 Ntfs (3795dcd21f740ee799fb7223234215af) G:\Windows\system32\drivers\Ntfs.sys
2010/08/18 12:28:59.0941 Null (f9756a98d69098dca8945d62858a812c) G:\Windows\system32\drivers\Null.sys
2010/08/18 12:28:59.0997 NVENETFD (b5e37e31c053bc9950455a257526514b) G:\Windows\system32\DRIVERS\nvm62x32.sys
2010/08/18 12:29:00.0211 nvlddmkm (377140a534d013bd661c69f1741de43c) G:\Windows\system32\DRIVERS\nvlddmkm.sys
2010/08/18 12:29:00.0385 nvraid (3f3d04b1d08d43c16ea7963954ec768d) G:\Windows\system32\DRIVERS\nvraid.sys
2010/08/18 12:29:00.0414 nvstor (c99f251a5de63c6f129cf71933aced0f) G:\Windows\system32\DRIVERS\nvstor.sys
2010/08/18 12:29:00.0453 nv_agp (5a0983915f02bae73267cc2a041f717d) G:\Windows\system32\DRIVERS\nv_agp.sys
2010/08/18 12:29:00.0490 ohci1394 (08a70a1f2cdde9bb49b885cb817a66eb) G:\Windows\system32\DRIVERS\ohci1394.sys
2010/08/18 12:29:00.0556 Parport (2ea877ed5dd9713c5ac74e8ea7348d14) G:\Windows\system32\DRIVERS\parport.sys
2010/08/18 12:29:00.0579 partmgr (ff4218952b51de44fe910953a3e686b9) G:\Windows\system32\drivers\partmgr.sys
2010/08/18 12:29:00.0611 Parvdm (eb0a59f29c19b86479d36b35983daadc) G:\Windows\system32\DRIVERS\parvdm.sys
2010/08/18 12:29:00.0650 pci (c858cb77c577780ecc456a892e7e7d0f) G:\Windows\system32\DRIVERS\pci.sys
2010/08/18 12:29:00.0674 pciide (afe86f419014db4e5593f69ffe26ce0a) G:\Windows\system32\DRIVERS\pciide.sys
2010/08/18 12:29:00.0708 pcmcia (f396431b31693e71e8a80687ef523506) G:\Windows\system32\DRIVERS\pcmcia.sys
2010/08/18 12:29:00.0749 PCTAppEvent (cc174f32cc9c18ea3109c4b0fc2ca8df) G:\Windows\system32\drivers\PCTAppEvent.sys
2010/08/18 12:29:00.0777 PCTFW-PacketFilter (4a7ef973fcd9c6cad6040ebb61262a5c) G:\Windows\system32\drivers\pctNdis-PacketFilter.sys
2010/08/18 12:29:00.0848 pctgntdi (39e8623f9f29dbc9e053a696d85f8ac6) G:\Windows\System32\drivers\pctgntdi.sys
2010/08/18 12:29:00.0886 pctNDIS (8bbe917bc4da64b0ba8db33d4c0e0b7d) G:\Windows\system32\DRIVERS\pctNdis.sys
2010/08/18 12:29:00.0926 pctplfw (6d74df36716a458619a62dd764fc4f8b) G:\Windows\System32\drivers\pctplfw.sys
2010/08/18 12:29:00.0947 pcw (250f6b43d2b613172035c6747aeeb19f) G:\Windows\system32\drivers\pcw.sys
2010/08/18 12:29:00.0973 PEAUTH (9e0104ba49f4e6973749a02bf41344ed) G:\Windows\system32\drivers\peauth.sys
2010/08/18 12:29:01.0110 PptpMiniport (631e3e205ad6d86f2aed6a4a8e69f2db) G:\Windows\system32\DRIVERS\raspptp.sys
2010/08/18 12:29:01.0138 Processor (85b1e3a0c7585bc4aae6899ec6fcf011) G:\Windows\system32\DRIVERS\processr.sys
2010/08/18 12:29:01.0190 Psched (6270ccae2a86de6d146529fe55b3246a) G:\Windows\system32\DRIVERS\pacer.sys
2010/08/18 12:29:01.0247 ql2300 (ab95ecf1f6659a60ddc166d8315b0751) G:\Windows\system32\DRIVERS\ql2300.sys
2010/08/18 12:29:01.0297 ql40xx (b4dd51dd25182244b86737dc51af2270) G:\Windows\system32\DRIVERS\ql40xx.sys
2010/08/18 12:29:01.0339 QWAVEdrv (584078ca1b95ca72df2a27c336f9719d) G:\Windows\system32\drivers\qwavedrv.sys
2010/08/18 12:29:01.0367 RasAcd (30a81b53c766d0133bb86d234e5556ab) G:\Windows\system32\DRIVERS\rasacd.sys
2010/08/18 12:29:01.0407 RasAgileVpn (57ec4aef73660166074d8f7f31c0d4fd) G:\Windows\system32\DRIVERS\AgileVpn.sys
2010/08/18 12:29:01.0441 Rasl2tp (d9f91eafec2815365cbe6d167e4e332a) G:\Windows\system32\DRIVERS\rasl2tp.sys
2010/08/18 12:29:01.0485 RasPppoe (0fe8b15916307a6ac12bfb6a63e45507) G:\Windows\system32\DRIVERS\raspppoe.sys
2010/08/18 12:29:01.0515 RasSstp (44101f495a83ea6401d886e7fd70096b) G:\Windows\system32\DRIVERS\rassstp.sys
2010/08/18 12:29:01.0545 rdbss (835d7e81bf517a3b72384bdcc85e1ce6) G:\Windows\system32\DRIVERS\rdbss.sys
2010/08/18 12:29:01.0571 rdpbus (0d8f05481cb76e70e1da06ee9f0da9df) G:\Windows\system32\DRIVERS\rdpbus.sys
2010/08/18 12:29:01.0603 RDPCDD (1e016846895b15a99f9a176a05029075) G:\Windows\system32\DRIVERS\RDPCDD.sys
2010/08/18 12:29:01.0659 RDPDR (c5ff95883ffef704d50c40d21cfb3ab5) G:\Windows\system32\drivers\rdpdr.sys
2010/08/18 12:29:01.0692 RDPENCDD (5a53ca1598dd4156d44196d200c94b8a) G:\Windows\system32\drivers\rdpencdd.sys
2010/08/18 12:29:01.0721 RDPREFMP (44b0a53cd4f27d50ed461dae0c0b4e1f) G:\Windows\system32\drivers\rdprefmp.sys
2010/08/18 12:29:01.0757 RDPWD (801371ba9782282892d00aadb08ee367) G:\Windows\system32\drivers\RDPWD.sys
2010/08/18 12:29:01.0790 rdyboost (4ea225bf1cf05e158853f30a99ca29a7) G:\Windows\system32\drivers\rdyboost.sys
2010/08/18 12:29:01.0881 rspndr (032b0d36ad92b582d869879f5af5b928) G:\Windows\system32\DRIVERS\rspndr.sys
2010/08/18 12:29:01.0912 s3cap (5423d8437051e89dd34749f242c98648) G:\Windows\system32\DRIVERS\vms3cap.sys
2010/08/18 12:29:01.0996 SASDIFSV (a3281aec37e0720a2bc28034c2df2a56) G:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
2010/08/18 12:29:02.0024 SASKUTIL (61db0d0756a99506207fd724e3692b25) G:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
2010/08/18 12:29:02.0049 sbp2port (34ee0c44b724e3e4ce2eff29126de5b5) G:\Windows\system32\DRIVERS\sbp2port.sys
2010/08/18 12:29:02.0123 SCDEmu (23aa53256ce05b975398b78a33474265) G:\Windows\system32\drivers\SCDEmu.sys
2010/08/18 12:29:02.0146 scfilter (a95c54b2ac3cc9c73fcdf9e51a1d6b51) G:\Windows\system32\DRIVERS\scfilter.sys
2010/08/18 12:29:02.0195 secdrv (90a3935d05b494a5a39d37e71f09a677) G:\Windows\system32\drivers\secdrv.sys
2010/08/18 12:29:02.0240 Serenum (9ad8b8b515e3df6acd4212ef465de2d1) G:\Windows\system32\DRIVERS\serenum.sys
2010/08/18 12:29:02.0266 Serial (5fb7fcea0490d821f26f39cc5ea3d1e2) G:\Windows\system32\DRIVERS\serial.sys
2010/08/18 12:29:02.0306 sermouse (79bffb520327ff916a582dfea17aa813) G:\Windows\system32\DRIVERS\sermouse.sys
2010/08/18 12:29:02.0386 sffdisk (9f976e1eb233df46fce808d9dea3eb9c) G:\Windows\system32\DRIVERS\sffdisk.sys
2010/08/18 12:29:02.0413 sffp_mmc (932a68ee27833cfd57c1639d375f2731) G:\Windows\system32\DRIVERS\sffp_mmc.sys
2010/08/18 12:29:02.0450 sffp_sd (4f1e5b0fe7c8050668dbfade8999aefb) G:\Windows\system32\DRIVERS\sffp_sd.sys
2010/08/18 12:29:02.0482 sfloppy (db96666cc8312ebc45032f30b007a547) G:\Windows\system32\DRIVERS\sfloppy.sys
2010/08/18 12:29:02.0531 sisagp (2565cac0dc9fe0371bdce60832582b2e) G:\Windows\system32\DRIVERS\sisagp.sys
2010/08/18 12:29:02.0565 SiSRaid2 (a9f0486851becb6dda1d89d381e71055) G:\Windows\system32\DRIVERS\SiSRaid2.sys
2010/08/18 12:29:02.0599 SiSRaid4 (3727097b55738e2f554972c3be5bc1aa) G:\Windows\system32\DRIVERS\sisraid4.sys
2010/08/18 12:29:02.0625 Smb (3e21c083b8a01cb70ba1f09303010fce) G:\Windows\system32\DRIVERS\smb.sys
2010/08/18 12:29:02.0693 snapman (5bceb1b306878035dacba6dd18366eda) G:\Windows\system32\DRIVERS\snapman.sys
2010/08/18 12:29:02.0731 SndTAudio (60a14bba5f00b6740eb555b563e1315b) G:\Windows\system32\drivers\SndTAudio.sys
2010/08/18 12:29:02.0764 SndTVideo (828ba90c62362c0312e3c098c04c21a1) G:\Windows\system32\DRIVERS\SndTVideo.sys
2010/08/18 12:29:02.0795 spldr (95cf1ae7527fb70f7816563cbc09d942) G:\Windows\system32\drivers\spldr.sys
2010/08/18 12:29:02.0856 srv (2ba4ebc7dfba845a1edbe1f75913be33) G:\Windows\system32\DRIVERS\srv.sys
2010/08/18 12:29:02.0892 srv2 (dce7e10feaabd4cae95948b3de5340bb) G:\Windows\system32\DRIVERS\srv2.sys
2010/08/18 12:29:02.0926 srvnet (b5665baa2120b8a54e22e9cd07c05106) G:\Windows\system32\DRIVERS\srvnet.sys
2010/08/18 12:29:02.0978 stexstor (db32d325c192b801df274bfd12a7e72b) G:\Windows\system32\DRIVERS\stexstor.sys
2010/08/18 12:29:03.0012 storflt (957e346ca948668f2496a6ccf6ff82cc) G:\Windows\system32\DRIVERS\vmstorfl.sys
2010/08/18 12:29:03.0048 storvsc (d5751969dc3e4b88bf482ac8ec9fe019) G:\Windows\system32\DRIVERS\storvsc.sys
2010/08/18 12:29:03.0075 swenum (e58c78a848add9610a4db6d214af5224) G:\Windows\system32\DRIVERS\swenum.sys
2010/08/18 12:29:03.0166 Tcpip (2cc3d75488abd3ec628bbb9a4fc84efc) G:\Windows\system32\drivers\tcpip.sys
2010/08/18 12:29:03.0228 TCPIP6 (2cc3d75488abd3ec628bbb9a4fc84efc) G:\Windows\system32\DRIVERS\tcpip.sys
2010/08/18 12:29:03.0273 tcpipreg (e64444523add154f86567c469bc0b17f) G:\Windows\system32\drivers\tcpipreg.sys
2010/08/18 12:29:03.0310 TDPIPE (1875c1490d99e70e449e3afae9fcbadf) G:\Windows\system32\drivers\tdpipe.sys
2010/08/18 12:29:03.0358 tdrpman258 (8de3e45000ba8c9ebb16737d3f83e216) G:\Windows\system32\DRIVERS\tdrpm258.sys
2010/08/18 12:29:03.0389 TDTCP (7551e91ea999ee9a8e9c331d5a9c31f3) G:\Windows\system32\drivers\tdtcp.sys
2010/08/18 12:29:03.0426 tdx (cb39e896a2a83702d1737bfd402b3542) G:\Windows\system32\DRIVERS\tdx.sys
2010/08/18 12:29:03.0457 TermDD (c36f41ee20e6999dbf4b0425963268a5) G:\Windows\system32\DRIVERS\termdd.sys
2010/08/18 12:29:03.0501 TfFsMon (95746e5b1473432f3d9458940dba6e3a) G:\Windows\system32\drivers\TfFsMon.sys
2010/08/18 12:29:03.0523 TfNetMon (02ffdd873e31c5c2d57ca87d11ec36af) G:\Windows\system32\drivers\TfNetMon.sys
2010/08/18 12:29:03.0557 TfSysMon (3b6020ebf2bbd64803574264091a4259) G:\Windows\system32\drivers\TfSysMon.sys
2010/08/18 12:29:03.0559 Suspicious file (Forged): G:\Windows\system32\drivers\TfSysMon.sys. Real md5: 3b6020ebf2bbd64803574264091a4259, Fake md5: f8bd92251ab439383c051ce907d78cce
2010/08/18 12:29:03.0568 TfSysMon - detected Rootkit.Win32.TDSS.tdl3 (0)
2010/08/18 12:29:03.0626 timounter (3e06987fedbcdfbff8e85ef8108565f9) G:\Windows\system32\DRIVERS\timntr.sys
2010/08/18 12:29:03.0681 tssecsrv (98ae6fa07d12cb4ec5cf4a9bfa5f4242) G:\Windows\system32\DRIVERS\tssecsrv.sys
2010/08/18 12:29:03.0723 tunnel (3e461d890a97f9d4c168f5fda36e1d00) G:\Windows\system32\DRIVERS\tunnel.sys
2010/08/18 12:29:03.0756 uagp35 (750fbcb269f4d7dd2e420c56b795db6d) G:\Windows\system32\DRIVERS\uagp35.sys
2010/08/18 12:29:03.0789 udfs (09cc3e16f8e5ee7168e01cf8fcbe061a) G:\Windows\system32\DRIVERS\udfs.sys
2010/08/18 12:29:03.0840 uliagpkx (44e8048ace47befbfdc2e9be4cbc8880) G:\Windows\system32\DRIVERS\uliagpkx.sys
2010/08/18 12:29:03.0872 umbus (049b3a50b3d646baeeee9eec9b0668dc) G:\Windows\system32\DRIVERS\umbus.sys
2010/08/18 12:29:03.0903 UmPass (7550ad0c6998ba1cb4843e920ee0feac) G:\Windows\system32\DRIVERS\umpass.sys
2010/08/18 12:29:04.0003 UnlockerDriver5 (d0cb75386d9e89c864d808d64ec9160f) G:\Marty'sPrograms\Unlocker1.8.9\Unlocker\UnlockerDriver5.sys
2010/08/18 12:29:04.0078 usbccgp (8455c4ed038efd09e99327f9d2d48ffa) G:\Windows\system32\DRIVERS\usbccgp.sys
2010/08/18 12:29:04.0112 usbcir (04ec7cec62ec3b6d9354eee93327fc82) G:\Windows\system32\DRIVERS\usbcir.sys
2010/08/18 12:29:04.0135 usbehci (1c333bfd60f2fed2c7ad5daf533cb742) G:\Windows\system32\DRIVERS\usbehci.sys
2010/08/18 12:29:04.0164 usbhub (ee6ef93ccfa94fae8c6ab298273d8ae2) G:\Windows\system32\DRIVERS\usbhub.sys
2010/08/18 12:29:04.0188 usbohci (a6fb7957ea7afb1165991e54ce934b74) G:\Windows\system32\DRIVERS\usbohci.sys
2010/08/18 12:29:04.0214 usbprint (797d862fe0875e75c7cc4c1ad7b30252) G:\Windows\system32\DRIVERS\usbprint.sys
2010/08/18 12:29:04.0257 usbscan (576096ccbc07e7c4ea4f5e6686d6888f) G:\Windows\system32\DRIVERS\usbscan.sys
2010/08/18 12:29:04.0292 USBSTOR (d8889d56e0d27e57ed4591837fe71d27) G:\Windows\system32\DRIVERS\USBSTOR.SYS
2010/08/18 12:29:04.0314 usbuhci (78780c3ebce17405b1ccd07a3a8a7d72) G:\Windows\system32\DRIVERS\usbuhci.sys
2010/08/18 12:29:04.0360 vdrvroot (a059c4c3edb09e07d21a8e5c0aabd3cb) G:\Windows\system32\DRIVERS\vdrvroot.sys
2010/08/18 12:29:04.0407 vga (17c408214ea61696cec9c66e388b14f3) G:\Windows\system32\DRIVERS\vgapnp.sys
2010/08/18 12:29:04.0437 VgaSave (8e38096ad5c8570a6f1570a61e251561) G:\Windows\System32\drivers\vga.sys
2010/08/18 12:29:04.0464 vhdmp (3be6e1f3a4f1afec8cee0d7883f93583) G:\Windows\system32\DRIVERS\vhdmp.sys
2010/08/18 12:29:04.0504 viaagp (c829317a37b4bea8f39735d4b076e923) G:\Windows\system32\DRIVERS\viaagp.sys
2010/08/18 12:29:04.0529 ViaC7 (e02f079a6aa107f06b16549c6e5c7b74) G:\Windows\system32\DRIVERS\viac7.sys
2010/08/18 12:29:04.0557 viaide (e43574f6a56a0ee11809b48c09e4fd3c) G:\Windows\system32\DRIVERS\viaide.sys
2010/08/18 12:29:04.0613 vmbus (379b349f65f453d2a6e75ea6b7448e49) G:\Windows\system32\DRIVERS\vmbus.sys
2010/08/18 12:29:04.0648 VMBusHID (ec2bbab4b84d0738c6c83d2234dc36fe) G:\Windows\system32\DRIVERS\VMBusHID.sys
2010/08/18 12:29:04.0674 volmgr (384e5a2aa49934295171e499f86ba6f3) G:\Windows\system32\DRIVERS\volmgr.sys
2010/08/18 12:29:04.0717 volmgrx (b5bb72067ddddbbfb04b2f89ff8c3c87) G:\Windows\system32\drivers\volmgrx.sys
2010/08/18 12:29:04.0745 volsnap (58df9d2481a56edde167e51b334d44fd) G:\Windows\system32\DRIVERS\volsnap.sys
2010/08/18 12:29:04.0811 vpcbus (33e74df34753fcaab06f6f2bdc8cabf5) G:\Windows\system32\DRIVERS\vpchbus.sys
2010/08/18 12:29:04.0858 vpcusb (625088d6ee9ede977fd03cf18d1cd5c5) G:\Windows\system32\DRIVERS\vpcusb.sys
2010/08/18 12:29:04.0906 vsmraid (9dfa0cc2f8855a04816729651175b631) G:\Windows\system32\DRIVERS\vsmraid.sys
2010/08/18 12:29:04.0951 VSTHWBS2 (682fcf7d2eb5158cd30408e976562408) G:\Windows\system32\DRIVERS\VSTBS23.SYS
2010/08/18 12:29:05.0000 VST_DPV (ceb4e3b6890e1e42dca6694d9e59e1a0) G:\Windows\system32\DRIVERS\VSTDPV3.SYS
2010/08/18 12:29:05.0038 vwifibus (90567b1e658001e79d7c8bbd3dde5aa6) G:\Windows\System32\drivers\vwifibus.sys
2010/08/18 12:29:05.0084 WacomPen (de3721e89c653aa281428c8a69745d90) G:\Windows\system32\DRIVERS\wacompen.sys
2010/08/18 12:29:05.0120 WANARP (692a712062146e96d28ba0b7d75de31b) G:\Windows\system32\DRIVERS\wanarp.sys
2010/08/18 12:29:05.0141 Wanarpv6 (692a712062146e96d28ba0b7d75de31b) G:\Windows\system32\DRIVERS\wanarp.sys
2010/08/18 12:29:05.0207 Wd (1112a9badacb47b7c0bb0392e3158dff) G:\Windows\system32\DRIVERS\wd.sys
2010/08/18 12:29:05.0239 Wdf01000 (9950e3d0f08141c7e89e64456ae7dc73) G:\Windows\system32\drivers\Wdf01000.sys
2010/08/18 12:29:05.0343 WfpLwf (8b9a943f3b53861f2bfaf6c186168f79) G:\Windows\system32\DRIVERS\wfplwf.sys
2010/08/18 12:29:05.0365 WIMMount (5cf95b35e59e2a38023836fff31be64c) G:\Windows\system32\drivers\wimmount.sys
2010/08/18 12:29:05.0415 winachsf (bc0c7ea89194c299f051c24119000e17) G:\Windows\system32\DRIVERS\VSTCNXT3.SYS
2010/08/18 12:29:05.0508 WmiAcpi (0217679b8fca58714c3bf2726d2ca84e) G:\Windows\system32\DRIVERS\wmiacpi.sys
2010/08/18 12:29:05.0577 ws2ifsl (6db3276587b853bf886b69528fdb048c) G:\Windows\system32\drivers\ws2ifsl.sys
2010/08/18 12:29:05.0642 WudfPf (6f9b6c0c93232cff47d0f72d6db1d21e) G:\Windows\system32\drivers\WudfPf.sys
2010/08/18 12:29:05.0673 WUDFRd (f91ff1e51fca30b3c3981db7d5924252) G:\Windows\system32\DRIVERS\WUDFRd.sys
2010/08/18 12:29:05.0732 ================================================================================
2010/08/18 12:29:05.0733 Scan finished
2010/08/18 12:29:05.0733 ================================================================================
2010/08/18 12:29:05.0751 Detected object count: 1
2010/08/18 12:29:14.0041 TfSysMon (3b6020ebf2bbd64803574264091a4259) G:\Windows\system32\drivers\TfSysMon.sys
2010/08/18 12:29:14.0042 Suspicious file (Forged): G:\Windows\system32\drivers\TfSysMon.sys. Real md5: 3b6020ebf2bbd64803574264091a4259, Fake md5: f8bd92251ab439383c051ce907d78cce
2010/08/18 12:29:14.0113 Backup copy found, using it..
2010/08/18 12:29:14.0146 G:\Windows\system32\drivers\TfSysMon.sys - processing error
2010/08/18 12:29:14.0146 Rootkit.Win32.TDSS.tdl3(TfSysMon) - User select action: Cure

#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,490 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:36 PM

Posted 18 August 2010 - 02:40 PM

This is the relevant part.

2010/08/18 12:29:03.0559 Suspicious file (Forged): G:\Windows\system32\drivers\TfSysMon.sys. Real md5: 3b6020ebf2bbd64803574264091a4259, Fake md5: f8bd92251ab439383c051ce907d78cce
2010/08/18 12:29:03.0568 TfSysMon - detected Rootkit.Win32.TDSS.tdl3 (0)

2010/08/18 12:29:05.0751 Detected object count: 1
2010/08/18 12:29:14.0041 TfSysMon (3b6020ebf2bbd64803574264091a4259) G:\Windows\system32\drivers\TfSysMon.sys
2010/08/18 12:29:14.0042 Suspicious file (Forged): G:\Windows\system32\drivers\TfSysMon.sys. Real md5: 3b6020ebf2bbd64803574264091a4259, Fake md5: f8bd92251ab439383c051ce907d78cce
2010/08/18 12:29:14.0113 Backup copy found, using it..
2010/08/18 12:29:14.0146 G:\Windows\system32\drivers\TfSysMon.sys - processing error
2010/08/18 12:29:14.0146 Rootkit.Win32.TDSS.tdl3(TfSysMon) - User select action: Cure

It found and removed the rootkit...in most cases that stops the redirects. Did you reboot afterwards?

If you are still getting them, then something else is going on and further investigation is needed. Before that can be done you will need you to create and post a DDS/HijackThis log.

Please read the pinned topic titled "Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help". If you cannot complete a step, then skip it and continue with the next. In Step 7 there are instructions for downloading and running DDS which will create a Pseudo HJT Report as part of its log.

When you have done that, post your log in the Virus, Trojan, Spyware, and Malware Removal Logs forum, NOT here, for assistance by the Malware Response Team Experts. A member of the Team will walk you through, step by step, on how to clean your computer. If you post your log back in this thread, the response from the Malware Response Team will be delayed because your post will have to be moved. This means it will fall in line behind any others posted that same day.

Start a new topic, give it a relevant title and post your log along with a brief description of your problem, a summary of any anti-malware tools you have used and a summary of any steps that you have performed on your own. An expert will analyze your log and reply with instructions advising you what to fix. After doing this, we would appreciate if you post a link to your log back here so we know that your getting help from the Malware Response Team.

Please be patient. It may take a while to get a response because the Malware Response Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have posted your log and are waiting, please DO NOT "bump" your post or make another reply until it has been responded to by a member of the Malware Response Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another Malware Response Team member is already assisting you and not open the thread to respond.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#7 opto88

opto88
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:06:36 PM

Posted 18 August 2010 - 03:15 PM

I rebooted and it still has the redirects. I will do what is requested prior to posting in the new forum.
I won't be able to do the GMER recommendation, as it has crashed my computer each time I tried it previously.

Thanks for your help

#8 Pandy

Pandy

    Bleepin'


  • Members
  • 9,559 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:09:36 PM

Posted 18 August 2010 - 05:51 PM

Hello,

Now that you have posted a log here: http://www.bleepingcomputer.com/forums/t/340967/unstoppable-and-constant-redirects/ you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a MRT Team member, nor should you ask for help elsewhere. Doing so can result in system changes which may not show in the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the MRT Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the MRT Team members are EXTREMELY busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the MRT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another MRT Team member is already assisting you and not open the thread to respond.

Please be patient. It may take several days to get a response but your log will be reviewed and answered as soon as possible. I advise checking your topic once a day for responses as the e-mail notification system is unreliable.

To avoid confusion, I am closing this topic. Good luck with your log.

Do not anticipate trouble, or worry about what may never happen. Keep in the sunlight.

Hide not your talents. They for use were made. What's a sundial in the shade?

~ Benjamin Franklin

I am a Bleeping Computer fan! Are you?

Facebook

Follow us on Twitter





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users