Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Firefox Redirect Malware


  • This topic is locked This topic is locked
25 replies to this topic

#1 Carl Berger

Carl Berger

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:07:09 PM

Posted 27 September 2010 - 02:22 PM

Hi all,
I appreciate any help you have to offer.

I've done a lot of searching for fixes to this problem and have even found posts on this forum about it, but no suggestion thus far has worked for me.

Firefox is my default browser and has recently been redirecting me to various ad/search websites. Sometimes the redirect occurs in Google, and sometimes it happens spontaneously when I open a folder on my computer or move a file. I can't seem to pin down what is causing new tabs to open and take me to these shady websites. I did notice that when clicking on a HijackThis download link it redirected me EVERY time, whereas with most Google links it might happen 1/5 times. So, I navigated to FileHippo manually and obtained the program (log file attached).

Okay, here are some things I have already done:
  • Comodo Antivirus Full Scan (log attached)
  • Malware Bytes (also ran in Safe Mode)
  • Sysinternals Rootkit Revealer
  • Avast Antirootkit (log attached)
  • Super AntiSpyware
  • Spybot Search & Destroy (Also ran in Safe Mode)
  • Full uninstall of Firefox + Reinstall
  • JavaRa uninstall of Java and Installation of latest version
  • Disabled all addons and plugins in Firefox
  • Windows Malware Removal Tool
  • Goored Fix (log attached)
  • ATF-Cleaner
  • Hijack-This (log attached)

Sadly the problem still persists. Whatever the issue is, it's very insidious. NOTE: GMER doesn't work on my computer.

OS: Windows 7 Professional 64 bit

Attached Files



BC AdBot (Login to Remove)

 


#2 Blind Faith

Blind Faith

  • Malware Response Team
  • 4,101 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:03:09 AM

Posted 01 October 2010 - 04:19 PM

Hello and welcome to Bleeping Computer! welcome.gif

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.

Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explaination about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

We also need a new log from the GMER anti-rootkit scanner. Please first disable any CD emulation programs using the steps found in this topic:

Why we request you disable CD Emulation when receiving Malware Removal Advice

Then create another GMER log and post it as an attachment to the reply where you post your new DDS log. Instructions on how to properly create a GMER log can be found here:

How to create a GMER log





Elle
Can you hear it?It's all around!

Tomar ki manè acchè?
Yadi thakè, tahalè
Ki kshama kartè paro
?



If I haven't replied in 48 hours, please feel free to send me a PM.



Posted Image

#3 Carl Berger

Carl Berger
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:07:09 PM

Posted 04 October 2010 - 01:06 PM

Hello! Thank you for replying! I completely understand the delay. I did not expect a fast solution.

I ran both DDS.scr and GMER.exe, however GMER.exe gives the following error on startup:
QUOTE
C:\Windows\system32\config\system: The system cannot find the file specified.

It will not let me put a check next to anything except for Services, Registry, and Files. Additionally it generates a blank log file.

Also, I have found a workaround (not a fix) for this malware. I completely uninstalled Firefox and did the same for Google Chrome. I also uninstalled Internet Explorer by turning it off in the Windows Components section of "Programs and Features". I then installed Internet Explorer 9 Beta and bumped up the security settings. I reinstalled Firefox in order to translate a .json bookmark backup into HTML for importation into IE9. Upon doing this I was able to confirm that the malware was still present and could still affect Firefox (I was redirected to seedy ad sites, same as before). I uninstalled Firefox again, and deleted all of its folders and data. IE9 beta has been giving me no trouble and seems to be immune to the redirection malware. However, for obvious reasons I would still like to isolate and remove the file(s) responsible for this redirection problem.

Here is my DDS log.


DDS (Ver_10-03-17.01) - NTFSX64
Run by JENOVA at 13:44:24.23 on Mon 10/04/2010
Internet Explorer: 9.0.7930.16406
Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.4608.3018 [GMT -4:00]

SP: Spybot - Search and Destroy *enabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\atieclxx.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Program Files (x86)\Bonjour\mDNSResponder.exe
C:\Windows\system32\Dwm.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k HsfXAudioService
C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\Common Files\Logishrd\LVMVFM\LVPrS64H.exe
C:\Windows\system32\Pen_Tablet.exe
C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\WTablet\Pen_TabletUser.exe
C:\Windows\system32\Pen_Tablet.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\RAVCpl64.exe
C:\Program Files (x86)\ATI Tray Tools\atitray.exe
C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
D:\Windows 7 Programs\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Windows\splwow64.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\JENOVA\Desktop\Clean PC\dds.scr
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
mLocal Page = c:\windows\syswow64\blank.htm
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~2\spybot~1\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: {DBC80044-A445-435b-BC74-9C25C1C588A9} - No File
TB: Contribute Toolbar: {517bdde4-e3a7-4570-b21e-2b52b6139fc7} - d:\program files (x86)\adobe\/Adobe Contribute CS3/contributeieplugin.dll
uRun: [AtiTrayTools] "c:\program files (x86)\ati tray tools\atitray.exe"
uRun: [SpybotSD TeaTimer] c:\program files (x86)\spybot - search & destroy\TeaTimer.exe
mRun: [<NO NAME>]
mRun: [Adobe Reader Speed Launcher] "c:\program files (x86)\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files (x86)\common files\adobe\arm\1.0\AdobeARM.exe"
StartupFolder: c:\users\jenova\appdata\roaming\micros~1\windows\startm~1\programs\startup\autoru~1\dropbox.lnk - c:\users\jenova\appdata\roaming\dropbox\bin\Dropbox.exe
StartupFolder: c:\users\jenova\appdata\roaming\micros~1\windows\startm~1\programs\startup\autoru~1\logite~1.lnk - c:\program files\logitech\logitech webcam software\eReg.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-explorer: ForceActiveDesktopOn = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: E&xport to Microsoft Excel - d:\window~1\micros~1\office11\EXCEL.EXE/3000
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - d:\window~1\micros~1\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~2\spybot~1\SDHelper.dll
TCP: {8B34DF19-3B01-4E60-B2CE-14CB9E5F7FCC} = 156.154.70.22,156.154.71.22
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~2\common~1\skype\SKYPE4~1.DLL
AppInit_DLLs:
STS: Windows DreamScene: {e31004d1-a431-41b8-826f-e902f9d95c81} - %SystemRoot%\SysWow64\DreamScene.dll
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll
mRun-x64: [Skytel] Skytel.exe
mRun-x64: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\cfp.exe" -h
mRun-x64: [RtHDVCpl] RAVCpl64.exe
AppInit_DLLs-X64:
Hosts: 127.0.0.1 www.spywareinfo.com

============= SERVICES / DRIVERS ===============

R0 PxHlpa64;PxHlpa64;c:\windows\system32\drivers\PxHlpa64.sys [2009-9-12 54480]
R1 cmderd;COMODO Internet Security Eradication Driver;c:\windows\system32\drivers\cmderd.sys [2010-9-10 20864]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [2010-9-10 249496]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2010-9-10 33208]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-8-25 203264]
R2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe -k HsfXAudioService [2009-7-13 27136]
R2 LVPrcS64;Process Monitor;c:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe [2010-5-7 197976]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\spybot - search & destroy\SDWinSec.exe [2010-9-26 1153368]
R2 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe [2010-8-22 5556520]
R3 amdkmdag;amdkmdag;c:\windows\system32\drivers\atikmdag.sys [2010-8-25 7767040]
R3 amdkmdap;amdkmdap;c:\windows\system32\drivers\atikmpag.sys [2010-8-25 279040]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2010-7-15 116240]
R3 CAXHWBS2;CAXHWBS2;c:\windows\system32\drivers\CAXHWBS2.sys [2009-2-13 411136]
R3 LVPr2M64;Logitech LVPr2M64 Driver;c:\windows\system32\drivers\LVPr2M64.sys [2010-5-7 30304]
R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\drivers\lvrs64.sys [2010-5-14 329952]
R3 LVUVC64;Logitech QuickCam Pro 9000(UVC);c:\windows\system32\drivers\lvuvc64.sys [2010-5-14 6465760]
S2 !SASCORE;SAS Core Service;"c:\program files\superantispyware\sascore64.exe" --> c:\program files\superantispyware\SASCORE64.EXE [?]
S2 gupdate;Google Update Service (gupdate);c:\program files (x86)\google\update\GoogleUpdate.exe [2009-10-10 133104]
S3 StorSvc;Storage Service;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 27136]
S3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\drivers\usbaapl64.sys [2010-4-19 50688]
S3 VST64_DPV;VST64_DPV;c:\windows\system32\drivers\VSTDPV6.SYS [2009-7-13 1485312]
S3 VST64HWBS2;VST64HWBS2;c:\windows\system32\drivers\VSTBS26.SYS [2009-7-13 411136]
S3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\drivers\wacmoumonitor.sys [2009-11-10 18216]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-4-17 1255736]
S4 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [2010-2-13 19912]
S4 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [2010-2-13 13264]
S4 ScreamBAudioSvc;ScreamBee Audio;c:\windows\system32\drivers\ScreamingBAudio64.sys [2009-11-26 38992]
S4 WTouchService;WTouch Service;c:\program files\wtouch\WTouchService.exe [2010-8-22 127784]

=============== Created Last 30 ================

2010-10-01 21:42:54 468480 ----a-w- c:\windows\system32\deployJava1.dll
2010-10-01 21:42:49 0 d-----w- c:\program files\Java
2010-10-01 02:39:20 257024 ----a-w- c:\windows\system32\mfreadwrite.dll
2010-10-01 02:38:44 1863680 ----a-w- c:\windows\system32\ExplorerFrame.dll
2010-10-01 02:38:43 1495040 ----a-w- c:\windows\syswow64\ExplorerFrame.dll
2010-10-01 02:38:06 0 d-----w- c:\program files (x86)\Feedback Tool
2010-09-30 21:22:46 2248 ----a-w- c:\windows\system32\drivers\kgpcpy.cfg
2010-09-30 21:16:37 0 d-----w- c:\programdata\SITEguard
2010-09-30 21:16:00 0 d-----w- c:\programdata\STOPzilla!
2010-09-30 21:16:00 0 d-----w- c:\program files (x86)\common files\iS3
2010-09-29 19:29:05 243712 ----a-w- c:\windows\system32\drivers\ks.sys
2010-09-29 19:29:05 184832 ----a-w- c:\windows\system32\drivers\usbvideo.sys
2010-09-29 17:50:50 2048 ----a-w- c:\windows\syswow64\tzres.dll
2010-09-29 17:50:50 2048 ----a-w- c:\windows\system32\tzres.dll
2010-09-28 15:26:57 0 d-----w- c:\programdata\SUPERAntiSpyware.com
2010-09-28 15:26:52 0 d-----w- c:\programdata\!SASCORE
2010-09-27 18:16:11 0 d-----w- c:\program files (x86)\Trend Micro
2010-09-27 17:55:21 0 d-----w- c:\program files (x86)\CCleaner
2010-09-27 07:01:54 0 d-----w- c:\program files (x86)\SquareEnix
2010-09-27 06:09:18 0 d-----w- c:\programdata\Sun
2010-09-27 06:09:09 423656 ----a-w- c:\windows\syswow64\deployJava1.dll
2010-09-27 03:28:42 0 d-----w- c:\programdata\ATI
2010-09-26 17:05:10 0 d--h--w- C:\VritualRoot
2010-09-26 16:32:59 0 d-----w- c:\programdata\Comodo
2010-09-26 05:55:34 0 d-----w- c:\programdata\Spybot - Search & Destroy
2010-09-26 05:55:34 0 d-----w- c:\program files (x86)\Spybot - Search & Destroy
2010-09-26 02:38:42 0 d-----w- c:\users\jenova\appdata\roaming\Malwarebytes
2010-09-26 02:38:27 24664 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-26 02:38:27 0 d-----w- c:\programdata\Malwarebytes
2010-09-26 02:38:27 0 d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2010-09-15 03:33:15 558592 ----a-w- c:\windows\system32\spoolsv.exe
2010-09-11 03:41:40 362784 ----a-w- c:\windows\system32\guard64.dll
2010-09-11 03:41:40 285480 ----a-w- c:\windows\syswow64\guard32.dll
2010-09-11 03:40:44 33208 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2010-09-11 03:40:44 249496 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
2010-09-11 03:40:42 20864 ----a-w- c:\windows\system32\drivers\cmderd.sys
2010-09-09 12:49:09 0 d-----w- c:\users\jenova\appdata\roaming\Elluminate
2010-09-07 20:37:02 378 ----a-w- c:\windows\system32\Pen_Tablet.dat

==================== Find3M ====================

2010-09-27 00:15:20 1474832 ----a-w- c:\windows\system32\drivers\sfi.dat
2010-09-06 08:06:16 234240 ---ha-w- c:\windows\syswow64\mlfcache.dat
2010-09-01 04:55:48 460088 ----a-w- c:\windows\syswow64\iedkcs32.dll
2010-09-01 04:47:30 10199040 ----a-w- c:\windows\syswow64\mshtml.dll
2010-09-01 04:46:36 1355264 ----a-w- c:\windows\syswow64\jscript9.dll
2010-09-01 04:45:42 12348928 ----a-w- c:\windows\syswow64\ieframe.dll
2010-09-01 04:44:24 1122304 ----a-w- c:\windows\syswow64\wininet.dll
2010-09-01 04:44:22 441856 ----a-w- c:\windows\syswow64\ieapfltr.dll
2010-09-01 04:44:16 1097728 ----a-w- c:\windows\syswow64\urlmon.dll
2010-09-01 04:44:06 424960 ----a-w- c:\windows\syswow64\vbscript.dll
2010-09-01 04:43:34 208384 ----a-w- c:\windows\syswow64\webcheck.dll
2010-09-01 04:43:26 128000 ----a-w- c:\windows\syswow64\occache.dll
2010-09-01 04:43:24 166400 ----a-w- c:\windows\syswow64\msrating.dll
2010-09-01 04:43:22 23552 ----a-w- c:\windows\syswow64\licmgr10.dll
2010-09-01 04:43:22 109568 ----a-w- c:\windows\syswow64\url.dll
2010-09-01 04:43:18 65024 ----a-w- c:\windows\syswow64\jsproxy.dll
2010-09-01 04:43:12 142848 ----a-w- c:\windows\syswow64\ieUnatt.exe
2010-09-01 04:43:12 114176 ----a-w- c:\windows\syswow64\iesysprep.dll
2010-09-01 04:43:10 76800 ----a-w- c:\windows\syswow64\SetIEInstalledDate.exe
2010-09-01 04:43:10 74752 ----a-w- c:\windows\syswow64\RegisterIEPKEYs.exe
2010-09-01 04:43:04 227840 ----a-w- c:\windows\syswow64\ieaksie.dll
2010-09-01 04:43:00 130560 ----a-w- c:\windows\syswow64\ieakeng.dll
2010-09-01 04:41:56 601088 ----a-w- c:\windows\system32\vbscript.dll
2010-09-01 04:40:40 215552 ----a-w- c:\windows\system32\msls31.dll
2010-09-01 03:50:12 372736 ----a-w- c:\windows\syswow64\IJL15.DLL
2010-08-26 03:37:26 7767040 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2010-08-26 02:14:12 20736000 ----a-w- c:\windows\system32\atio6axx.dll
2010-08-26 02:01:14 143360 ----a-w- c:\windows\system32\atiapfxx.exe
2010-08-26 02:01:04 528384 ----a-w- c:\windows\syswow64\aticfx32.dll
2010-08-26 02:00:02 616960 ----a-w- c:\windows\system32\aticfx64.dll
2010-08-26 01:57:58 450560 ----a-w- c:\windows\system32\ATIDEMGX.dll
2010-08-26 01:57:50 462336 ----a-w- c:\windows\system32\atieclxx.exe
2010-08-26 01:57:14 203264 ----a-w- c:\windows\system32\atiesrxx.exe
2010-08-26 01:56:06 120320 ----a-w- c:\windows\system32\atitmm64.dll
2010-08-26 01:55:50 421376 ----a-w- c:\windows\system32\atipdl64.dll
2010-08-26 01:55:48 15830016 ----a-w- c:\windows\syswow64\atioglxx.dll
2010-08-26 01:55:42 356352 ----a-w- c:\windows\syswow64\atipdlxx.dll
2010-08-26 01:55:32 278528 ----a-w- c:\windows\syswow64\Oemdspif.dll
2010-08-26 01:55:28 12288 ----a-w- c:\windows\system32\atimuixx.dll
2010-08-26 01:55:22 59392 ----a-w- c:\windows\system32\atiedu64.dll
2010-08-26 01:55:18 43520 ----a-w- c:\windows\syswow64\ati2edxx.dll
2010-08-26 01:52:22 3914240 ----a-w- c:\windows\syswow64\atidxx32.dll
2010-08-26 01:43:28 4602880 ----a-w- c:\windows\system32\atidxx64.dll
2010-08-26 01:34:38 51200 ----a-w- c:\windows\system32\aticalrt64.dll
2010-08-26 01:34:36 46080 ----a-w- c:\windows\syswow64\aticalrt.dll
2010-08-26 01:34:28 44544 ----a-w- c:\windows\system32\aticalcl64.dll
2010-08-26 01:34:26 44032 ----a-w- c:\windows\syswow64\aticalcl.dll
2010-08-26 01:34:16 5425664 ----a-w- c:\windows\system32\aticaldd64.dll
2010-08-26 01:33:52 4032512 ----a-w- c:\windows\syswow64\atiumdag.dll
2010-08-26 01:33:08 4375552 ----a-w- c:\windows\syswow64\aticaldd.dll
2010-08-26 01:33:02 3147264 ----a-w- c:\windows\system32\atiumd6a.dll
2010-08-26 01:27:58 57344 ----a-w- c:\windows\system32\coinst.dll
2010-08-26 01:27:54 5202944 ----a-w- c:\windows\system32\atiumd64.dll
2010-08-26 01:25:58 3392000 ----a-w- c:\windows\syswow64\atiumdva.dll
2010-08-26 01:21:24 338432 ----a-w- c:\windows\system32\atiadlxx.dll
2010-08-26 01:21:18 241664 ----a-w- c:\windows\syswow64\atiadlxy.dll
2010-08-26 01:21:08 14848 ----a-w- c:\windows\system32\atig6pxx.dll
2010-08-26 01:21:06 12800 ----a-w- c:\windows\syswow64\atiglpxx.dll
2010-08-26 01:21:06 12800 ----a-w- c:\windows\system32\atiglpxx.dll
2010-08-26 01:21:02 21504 ----a-w- c:\windows\system32\atig6txx.dll
2010-08-26 01:21:00 19968 ----a-w- c:\windows\syswow64\atigktxx.dll
2010-08-26 01:20:56 279040 ----a-w- c:\windows\system32\drivers\atikmpag.sys
2010-08-26 01:20:14 39424 ----a-w- c:\windows\system32\atiuxp64.dll
2010-08-26 01:20:08 30208 ----a-w- c:\windows\syswow64\atiuxpag.dll
2010-08-26 01:20:04 37376 ----a-w- c:\windows\system32\atiu9p64.dll
2010-08-26 01:19:56 28160 ----a-w- c:\windows\syswow64\atiu9pag.dll
2010-08-26 01:19:28 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2010-08-26 01:13:22 53760 ----a-w- c:\windows\system32\atimpc64.dll
2010-08-26 01:13:22 53760 ----a-w- c:\windows\system32\amdpcom64.dll
2010-08-26 01:13:16 52736 ----a-w- c:\windows\syswow64\atimpc32.dll
2010-08-26 01:13:16 52736 ----a-w- c:\windows\syswow64\amdpcom32.dll
2010-08-16 06:50:45 1137664 ----a-w- c:\windows\system32\FntCache.dll
2010-08-16 06:50:43 1543168 ----a-w- c:\windows\system32\DWrite.dll
2010-08-16 06:50:42 899072 ----a-w- c:\windows\system32\d2d1.dll
2010-08-16 06:50:42 320512 ----a-w- c:\windows\system32\d3d10_1core.dll
2010-08-16 06:50:42 1844224 ----a-w- c:\windows\system32\d3d10warp.dll
2010-08-16 06:14:36 1076224 ----a-w- c:\windows\syswow64\DWrite.dll
2010-08-16 06:14:24 737280 ----a-w- c:\windows\syswow64\d2d1.dll
2010-08-16 06:14:24 218624 ----a-w- c:\windows\syswow64\d3d10_1core.dll
2010-08-16 06:14:24 1172480 ----a-w- c:\windows\syswow64\d3d10warp.dll
2010-08-02 18:50:00 3695400 ----a-w- c:\windows\syswow64\ieapfltr.dat
2010-07-29 06:30:34 82944 ----a-w- c:\windows\syswow64\iccvid.dll
2010-07-27 14:03:24 12867584 ----a-w- c:\windows\syswow64\shell32.dll
2009-07-14 05:37:38 31548 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2009-07-14 05:37:38 31548 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2009-07-14 05:37:38 291294 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2009-07-14 05:37:38 291294 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2009-07-14 04:54:24 174 --sha-w- c:\program files\desktop.ini
2009-07-14 04:54:24 174 --sha-w- c:\program files (x86)\desktop.ini
2009-07-14 01:00:34 291294 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2009-07-14 01:00:34 291294 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2009-07-14 01:00:32 31548 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2009-07-14 01:00:32 31548 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
2009-06-10 20:44:08 9633792 --sha-r- c:\windows\fonts\StaticCache.dat
2009-07-14 01:39:53 398848 --sha-w- c:\windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_4d4d1f2f696639a2\WinMail.exe
2009-07-14 01:14:45 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe

============= FINISH: 13:46:55.72 ===============


#4 Carl Berger

Carl Berger
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:07:09 PM

Posted 10 October 2010 - 02:47 PM

UPDATE: Sorry for posting after myself, but I don't have the ability to edit my old post at the moment. I have learned something new and important about this malware. As I said, IE9 Beta seems immune to the malware, however, it seems that only the 64-bit edition on my computer is immune. Previously I was having trouble getting the 32-bit version to run, but I was recently able to fix this and to my horror I found that IE9 was being redirected as well! So, 32-bit browsers seem to be affected, while 64-bit IE9 Beta is not.

#5 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:09 PM

Posted 13 October 2010 - 06:18 PM

Hello, Carl Berger.
My name is etavares and I will be helping you with this log.

Here are some guidelines to ensure we are able to get your machine back under your control.
  • Please do not run any unsupervised scans, fixes, etc. We can work against each other and end up in a worse place.
  • Please subscribe to this topic if you have not already done so. Please check back just in case, as the email system can fail at times.
  • Just because your machine is running better does not mean it is completely cleaned. Please wait for the 'all clear' from me to say when we are done.
  • Please reply within 3 days to be fair to other people asking for help.
  • When in doubt, please stop and ask first. There's no harm in asking questions!






Registry Cleaner Warning


I also see that you have a Ccleaner installed. It is a great tool that I use. However, be careful of the registry cleaning functionality (versus file cleaning), Here at BC, we do not recommend using registry cleaners as they don't speed up your computer and they can do more harm than good if they remove a legitimate entry. If you do use it, make sure to use a tool like ERUNT to back up your registry first. Merely backing it up yourself via regedit wont' help you if you can't boot up as a result!

See here for more information:
http://www.bleepingcomputer.com/forums/ind...p;#entry1326578








GMER will not run on x64 systems, so that's the error you're getting.



Step 1

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan.
  • If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  • Exit MBAM when done.
Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.



Step 2

Please make sure that you can view all hidden files. Instructions on how to do this can be found here:

How to see hidden files in Windows

Please click this link-->Jotti

When the jotti page has finished loading, click the Browse button and navigate to the following file and click Submit.

C:\windows\explorer.exe

Please post back the results of the scan in your next post.

If Jotti is busy, try the same at Virustotal: http://www.virustotal.com/



Step 3
  1. Download TDSSKiller.exe and save it to your desktop.
  2. Double-click TDSSKiller.exe to run it.
  3. Under "Objects to scan" ensure both "Services and Drivers" and "Boot Sectors" are checked.
  4. Click Start scan and allow it to scan for Malicious objects.
  5. If malicious objects are found, the default action will be Cure, ensure Cure is selected then click Continue.
  6. If suspicious objects are detected, the default action will be Skip, ensure Skip is selected then click Continue.
  7. It may ask you to reboot the computer to complete the process. Click on Reboot Now and allow the computer to reboot.
  8. A log will be created on your root (usually C:) drive. The log is like UtilityName.Version_Date_Time_log.txt.
    for example, C:\TDSSKiller.2.4.1.2_20.04.2010_15.31.43_log.txt
  9. If no reboot is required, click on Report. A log file should appear.
  10. Please post the contents of the logfile in your next reply

etavares


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


#6 Carl Berger

Carl Berger
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:07:09 PM

Posted 13 October 2010 - 11:58 PM

Malwarebytes' Anti-Malware Log

QUOTE
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4818

Windows 6.1.7600
Internet Explorer 9.0.7930.16406

10/14/2010 12:02:28 AM
mbam-log-2010-10-14 (00-02-28).txt

Scan type: Quick scan
Objects scanned: 155964
Time elapsed: 5 minute(s), 16 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)



Virustotal Checksum
QUOTE
MD5: 9aaaec8dac27aa17b053e6352ad233ae
Date first seen: 2010-01-11 14:55:23 (UTC)
Date last seen: 2010-10-13 23:49:37 (UTC)
Detection ratio: 0/43



TDSS actually found one thing, and when I told it to CURE and clicked "Reboot Now" I got the dreaded BSOD. When the computer started back up, I booted Windows 7 normally and ran the scan again. The malicious software was still there so I told it to CURE again and clicked "Reboot Now". This time everything ran smoothly and I did not get the BSOD. I ran the scan a third time to confirm that the malicious software was removed. It seems to be gone. The log below is from the second run (the one that successfully removed the file).

TDSS Rootkit Removal Tool Log
QUOTE
2010/10/14 00:37:06.0568 TDSS rootkit removing tool 2.4.4.0 Oct 4 2010 09:06:59
2010/10/14 00:37:06.0568 ================================================================================
2010/10/14 00:37:06.0568 SystemInfo:
2010/10/14 00:37:06.0568
2010/10/14 00:37:06.0568 OS Version: 6.1.7600 ServicePack: 0.0
2010/10/14 00:37:06.0568 Product type: Workstation
2010/10/14 00:37:06.0568 ComputerName: JENOVA-BIRTH
2010/10/14 00:37:06.0568 UserName: JENOVA
2010/10/14 00:37:06.0568 Windows directory: C:\Windows
2010/10/14 00:37:06.0568 System windows directory: C:\Windows
2010/10/14 00:37:06.0568 Running under WOW64
2010/10/14 00:37:06.0568 Processor architecture: Intel x64
2010/10/14 00:37:06.0568 Number of processors: 4
2010/10/14 00:37:06.0568 Page size: 0x1000
2010/10/14 00:37:06.0568 Boot type: Normal boot
2010/10/14 00:37:06.0568 ================================================================================
2010/10/14 00:37:06.0568 Utility is running under WOW64
2010/10/14 00:37:07.0816 Initialize success
2010/10/14 00:38:13.0680 ================================================================================
2010/10/14 00:38:13.0680 Scan started
2010/10/14 00:38:13.0680 Mode: Manual;
2010/10/14 00:38:13.0680 ================================================================================
2010/10/14 00:38:21.0199 1394ohci (1b00662092f9f9568b995902f0cc40d5) C:\Windows\system32\DRIVERS\1394ohci.sys
2010/10/14 00:38:21.0386 ACPI (6f11e88748cdefd2f76aa215f97ddfe5) C:\Windows\system32\DRIVERS\ACPI.sys
2010/10/14 00:38:21.0542 AcpiPmi (63b05a0420ce4bf0e4af6dcc7cada254) C:\Windows\system32\DRIVERS\acpipmi.sys
2010/10/14 00:38:21.0870 adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
2010/10/14 00:38:22.0072 adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
2010/10/14 00:38:22.0291 adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
2010/10/14 00:38:22.0400 AFD (b9384e03479d2506bc924c16a3db87bc) C:\Windows\system32\drivers\afd.sys
2010/10/14 00:38:22.0447 agp440 (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\DRIVERS\agp440.sys
2010/10/14 00:38:22.0494 aliide (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\DRIVERS\aliide.sys
2010/10/14 00:38:22.0540 amdide (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\DRIVERS\amdide.sys
2010/10/14 00:38:22.0587 AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
2010/10/14 00:38:22.0930 amdkmdag (538b0a6e89aca1929668f9eb95d3c0bc) C:\Windows\system32\DRIVERS\atikmdag.sys
2010/10/14 00:38:23.0258 amdkmdap (977286b382fe0920f379a69c351a7af4) C:\Windows\system32\DRIVERS\atikmpag.sys
2010/10/14 00:38:23.0367 AmdPPM (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
2010/10/14 00:38:23.0414 amdsata (7a4b413614c055935567cf88a9734d38) C:\Windows\system32\DRIVERS\amdsata.sys
2010/10/14 00:38:23.0586 amdsbs (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
2010/10/14 00:38:23.0710 amdxata (b4ad0cacbab298671dd6f6ef7e20679d) C:\Windows\system32\DRIVERS\amdxata.sys
2010/10/14 00:38:23.0866 AppID (42fd751b27fa0e9c69bb39f39e409594) C:\Windows\system32\drivers\appid.sys
2010/10/14 00:38:24.0007 arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
2010/10/14 00:38:24.0054 arcsas (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
2010/10/14 00:38:24.0210 AsyncMac (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
2010/10/14 00:38:24.0288 atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\DRIVERS\atapi.sys
2010/10/14 00:38:24.0397 AtiHDAudioService (cbe5f8b3e54198f5dfe403a55a95de08) C:\Windows\system32\drivers\AtihdW76.sys
2010/10/14 00:38:24.0459 AtiHdmiService (fb7602c5c508be281368aae0b61b51c6) C:\Windows\system32\drivers\AtiHdmi.sys
2010/10/14 00:38:24.0834 atikmdag (538b0a6e89aca1929668f9eb95d3c0bc) C:\Windows\system32\DRIVERS\atikmdag.sys
2010/10/14 00:38:24.0974 b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
2010/10/14 00:38:25.0052 b57nd60a (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
2010/10/14 00:38:25.0114 Beep (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
2010/10/14 00:38:25.0177 blbdrive (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
2010/10/14 00:38:25.0224 bowser (91ce0d3dc57dd377e690a2d324022b08) C:\Windows\system32\DRIVERS\bowser.sys
2010/10/14 00:38:25.0270 BrFiltLo (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
2010/10/14 00:38:25.0302 BrFiltUp (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
2010/10/14 00:38:25.0395 Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
2010/10/14 00:38:25.0442 BrSerWdm (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
2010/10/14 00:38:25.0473 BrUsbMdm (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
2010/10/14 00:38:25.0520 BrUsbSer (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
2010/10/14 00:38:25.0567 BTHMODEM (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
2010/10/14 00:38:25.0660 CAXHWBS2 (46f088d1247e825b313200254edd9e5b) C:\Windows\system32\DRIVERS\CAXHWBS2.sys
2010/10/14 00:38:25.0723 cdfs (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
2010/10/14 00:38:25.0770 cdrom (83d2d75e1efb81b3450c18131443f7db) C:\Windows\system32\DRIVERS\cdrom.sys
2010/10/14 00:38:25.0816 circlass (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
2010/10/14 00:38:25.0848 CLFS (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
2010/10/14 00:38:25.0941 CmBatt (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
2010/10/14 00:38:25.0988 cmderd (df06defb91d5898d34a4bd35f8c46079) C:\Windows\system32\DRIVERS\cmderd.sys
2010/10/14 00:38:26.0019 cmdGuard (bc61eee90fce989ab61b582b3a4b2357) C:\Windows\system32\DRIVERS\cmdguard.sys
2010/10/14 00:38:26.0113 cmdHlp (3d373d57ccac4a46f6c7191604a5b838) C:\Windows\system32\DRIVERS\cmdhlp.sys
2010/10/14 00:38:26.0206 cmdide (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\DRIVERS\cmdide.sys
2010/10/14 00:38:26.0269 CNG (f95fd4cb7da00ba2a63ce9f6b5c053e1) C:\Windows\system32\Drivers\cng.sys
2010/10/14 00:38:26.0331 Compbatt (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
2010/10/14 00:38:26.0440 CompositeBus (f26b3a86f6fa87ca360b879581ab4123) C:\Windows\system32\DRIVERS\CompositeBus.sys
2010/10/14 00:38:26.0659 crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
2010/10/14 00:38:26.0971 CSC (4a6173c2279b498cd8f57cae504564cb) C:\Windows\system32\drivers\csc.sys
2010/10/14 00:38:27.0158 DfsC (3f1dc527070acb87e40afe46ef6da749) C:\Windows\system32\Drivers\dfsc.sys
2010/10/14 00:38:27.0314 discache (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
2010/10/14 00:38:27.0517 Disk (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
2010/10/14 00:38:28.0047 drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
2010/10/14 00:38:28.0344 DXGKrnl (ebce0b0924835f635f620d19f0529dce) C:\Windows\System32\drivers\dxgkrnl.sys
2010/10/14 00:38:28.0936 ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
2010/10/14 00:38:29.0560 elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
2010/10/14 00:38:29.0935 ErrDev (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\DRIVERS\errdev.sys
2010/10/14 00:38:30.0340 exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
2010/10/14 00:38:30.0668 fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
2010/10/14 00:38:30.0808 fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
2010/10/14 00:38:30.0949 FileInfo (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
2010/10/14 00:38:31.0074 Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
2010/10/14 00:38:31.0183 flpydisk (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
2010/10/14 00:38:31.0323 FltMgr (f7866af72abbaf84b1fa5aa195378c59) C:\Windows\system32\drivers\fltmgr.sys
2010/10/14 00:38:31.0432 FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
2010/10/14 00:38:31.0464 Fs_Rec (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
2010/10/14 00:38:31.0666 fvevol (ae87ba80d0ec3b57126ed2cdc15b24ed) C:\Windows\system32\DRIVERS\fvevol.sys
2010/10/14 00:38:31.0963 gagp30kx (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
2010/10/14 00:38:32.0212 GEARAspiWDM (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
2010/10/14 00:38:32.0446 hcw85cir (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
2010/10/14 00:38:32.0618 HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\Windows\system32\drivers\HdAudio.sys
2010/10/14 00:38:32.0946 HDAudBus (0a49913402747a0b67de940fb42cbdbb) C:\Windows\system32\DRIVERS\HDAudBus.sys
2010/10/14 00:38:33.0070 HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
2010/10/14 00:38:33.0195 HidBth (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
2010/10/14 00:38:33.0289 HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
2010/10/14 00:38:33.0414 HidUsb (b3bf6b5b50006def50b66306d99fcf6f) C:\Windows\system32\DRIVERS\hidusb.sys
2010/10/14 00:38:33.0476 HpSAMD (0886d440058f203eba0e1825e4355914) C:\Windows\system32\DRIVERS\HpSAMD.sys
2010/10/14 00:38:33.0710 HSF_DP (64667d9808fd09fabedccf62e8f52662) C:\Windows\system32\DRIVERS\CAX_DP.sys
2010/10/14 00:38:33.0897 HTTP (cee049cac4efa7f4e1e4ad014414a5d4) C:\Windows\system32\drivers\HTTP.sys
2010/10/14 00:38:33.0975 hwpolicy (f17766a19145f111856378df337a5d79) C:\Windows\system32\drivers\hwpolicy.sys
2010/10/14 00:38:34.0038 i8042prt (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys
2010/10/14 00:38:34.0084 iaStorV (d83efb6fd45df9d55e9a1afc63640d50) C:\Windows\system32\DRIVERS\iaStorV.sys
2010/10/14 00:38:34.0131 iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
2010/10/14 00:38:34.0272 inspect (5166c05937e2744c340e0c959754b4dc) C:\Windows\system32\DRIVERS\inspect.sys
2010/10/14 00:38:34.0755 IntcAzAudAddService (2c62599e693372a9221c262b8040e3ac) C:\Windows\system32\drivers\RTKVHD64.sys
2010/10/14 00:38:34.0974 intelide (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\DRIVERS\intelide.sys
2010/10/14 00:38:35.0161 intelppm (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
2010/10/14 00:38:35.0239 IpFilterDriver (722dd294df62483cecaae6e094b4d695) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2010/10/14 00:38:35.0286 IPMIDRV (e2b4a4494db7cb9b89b55ca268c337c5) C:\Windows\system32\DRIVERS\IPMIDrv.sys
2010/10/14 00:38:35.0348 IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
2010/10/14 00:38:35.0426 IRENUM (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
2010/10/14 00:38:35.0457 isapnp (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\DRIVERS\isapnp.sys
2010/10/14 00:38:35.0629 iScsiPrt (fa4d2557de56d45b0a346f93564be6e1) C:\Windows\system32\DRIVERS\msiscsi.sys
2010/10/14 00:38:36.0237 kbdclass (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys
2010/10/14 00:38:36.0658 kbdhid (6def98f8541e1b5dceb2c822a11f7323) C:\Windows\system32\DRIVERS\kbdhid.sys
2010/10/14 00:38:37.0142 KSecDD (e8b6fcc9c83535c67f835d407620bd27) C:\Windows\system32\Drivers\ksecdd.sys
2010/10/14 00:38:37.0345 KSecPkg (a8c63880ef6f4d3fec7b616b9c060215) C:\Windows\system32\Drivers\ksecpkg.sys
2010/10/14 00:38:37.0423 ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
2010/10/14 00:38:37.0516 lltdio (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
2010/10/14 00:38:37.0626 LSI_FC (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
2010/10/14 00:38:37.0688 LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
2010/10/14 00:38:37.0813 LSI_SAS2 (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
2010/10/14 00:38:38.0016 LSI_SCSI (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
2010/10/14 00:38:38.0374 luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
2010/10/14 00:38:38.0640 LVPr2M64 (b3944d06eb4b64d57bd7e5fe89415f58) C:\Windows\system32\DRIVERS\LVPr2M64.sys
2010/10/14 00:38:38.0671 LVPr2Mon (b3944d06eb4b64d57bd7e5fe89415f58) C:\Windows\system32\DRIVERS\LVPr2M64.sys
2010/10/14 00:38:38.0780 LVRS64 (a43a6cbea073990a784603ef065a281b) C:\Windows\system32\DRIVERS\lvrs64.sys
2010/10/14 00:38:40.0075 LVUVC64 (4350876ab0d0c77d0b40a1c85935c96b) C:\Windows\system32\DRIVERS\lvuvc64.sys
2010/10/14 00:38:40.0605 MarvinBus (024da28053d57e9e32bee52600576bbb) C:\Windows\system32\DRIVERS\MarvinBus64.sys
2010/10/14 00:38:40.0746 mdmxsdk (e4f44ec214b3e381e1fc844a02926666) C:\Windows\system32\DRIVERS\mdmxsdk.sys
2010/10/14 00:38:40.0824 megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
2010/10/14 00:38:40.0948 MegaSR (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
2010/10/14 00:38:41.0120 Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
2010/10/14 00:38:41.0198 monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
2010/10/14 00:38:41.0276 mouclass (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
2010/10/14 00:38:41.0354 mouhid (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
2010/10/14 00:38:41.0510 mountmgr (791af66c4d0e7c90a3646066386fb571) C:\Windows\system32\drivers\mountmgr.sys
2010/10/14 00:38:41.0588 mpio (609d1d87649ecc19796f4d76d4c15cea) C:\Windows\system32\DRIVERS\mpio.sys
2010/10/14 00:38:41.0682 mpsdrv (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
2010/10/14 00:38:41.0728 MRxDAV (30524261bb51d96d6fcbac20c810183c) C:\Windows\system32\drivers\mrxdav.sys
2010/10/14 00:38:41.0838 mrxsmb (767a4c3bcf9410c286ced15a2db17108) C:\Windows\system32\DRIVERS\mrxsmb.sys
2010/10/14 00:38:41.0900 mrxsmb10 (920ee0ff995fcfdeb08c41605a959e1c) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2010/10/14 00:38:41.0978 mrxsmb20 (740d7ea9d72c981510a5292cf6adc941) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2010/10/14 00:38:42.0025 msahci (5c37497276e3b3a5488b23a326a754b7) C:\Windows\system32\DRIVERS\msahci.sys
2010/10/14 00:38:42.0056 msdsm (8d27b597229aed79430fb9db3bcbfbd0) C:\Windows\system32\DRIVERS\msdsm.sys
2010/10/14 00:38:42.0118 Msfs (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
2010/10/14 00:38:42.0165 mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
2010/10/14 00:38:42.0212 msisadrv (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\DRIVERS\msisadrv.sys
2010/10/14 00:38:42.0274 MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
2010/10/14 00:38:42.0337 MSPCLOCK (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
2010/10/14 00:38:42.0399 MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
2010/10/14 00:38:42.0493 MsRPC (89cb141aa8616d8c6a4610fa26c60964) C:\Windows\system32\drivers\MsRPC.sys
2010/10/14 00:38:42.0602 mssmbios (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys
2010/10/14 00:38:42.0649 MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
2010/10/14 00:38:42.0696 MTConfig (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
2010/10/14 00:38:42.0742 Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
2010/10/14 00:38:42.0836 NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
2010/10/14 00:38:43.0023 NDIS (cad515dbd07d082bb317d9928ce8962c) C:\Windows\system32\drivers\ndis.sys
2010/10/14 00:38:43.0132 NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
2010/10/14 00:38:43.0195 NdisTapi (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
2010/10/14 00:38:43.0210 Ndisuio (f105ba1e22bf1f2ee8f005d4305e4bec) C:\Windows\system32\DRIVERS\ndisuio.sys
2010/10/14 00:38:43.0257 NdisWan (557dfab9ca1fcb036ac77564c010dad3) C:\Windows\system32\DRIVERS\ndiswan.sys
2010/10/14 00:38:43.0366 NDProxy (659b74fb74b86228d6338d643cd3e3cf) C:\Windows\system32\drivers\NDProxy.sys
2010/10/14 00:38:43.0429 NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
2010/10/14 00:38:43.0569 NetBT (9162b273a44ab9dce5b44362731d062a) C:\Windows\system32\DRIVERS\netbt.sys
2010/10/14 00:38:43.0647 nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
2010/10/14 00:38:43.0694 Npfs (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
2010/10/14 00:38:43.0788 nsiproxy (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
2010/10/14 00:38:44.0240 Ntfs (356698a13c4630d5b31c37378d469196) C:\Windows\system32\drivers\Ntfs.sys
2010/10/14 00:38:44.0490 Null (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
2010/10/14 00:38:44.0568 NVENETFD (a85b4f2ef3a7304a5399ef0526423040) C:\Windows\system32\DRIVERS\nvm62x64.sys
2010/10/14 00:38:44.0614 nvraid (3e38712941e9bb4ddbee00affe3fed3d) C:\Windows\system32\DRIVERS\nvraid.sys
2010/10/14 00:38:44.0661 nvstor (477dc4d6deb99be37084c9ac6d013da1) C:\Windows\system32\DRIVERS\nvstor.sys
2010/10/14 00:38:44.0724 nv_agp (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\DRIVERS\nv_agp.sys
2010/10/14 00:38:44.0802 ohci1394 (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\DRIVERS\ohci1394.sys
2010/10/14 00:38:44.0942 Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
2010/10/14 00:38:45.0004 partmgr (7daa117143316c4a1537e074a5a9eaf0) C:\Windows\system32\drivers\partmgr.sys
2010/10/14 00:38:45.0285 pci (f36f6504009f2fb0dfd1b17a116ad74b) C:\Windows\system32\DRIVERS\pci.sys
2010/10/14 00:38:45.0504 pciide (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\DRIVERS\pciide.sys
2010/10/14 00:38:45.0784 pcmcia (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
2010/10/14 00:38:45.0925 pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
2010/10/14 00:38:46.0393 PEAUTH (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
2010/10/14 00:38:47.0079 PptpMiniport (27cc19e81ba5e3403c48302127bda717) C:\Windows\system32\DRIVERS\raspptp.sys
2010/10/14 00:38:47.0344 Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
2010/10/14 00:38:47.0656 Psched (ee992183bd8eaefd9973f352e587a299) C:\Windows\system32\DRIVERS\pacer.sys
2010/10/14 00:38:47.0906 pwdrvio (0dbd637896bf41a7d7b9ac01a8d09c9e) C:\Windows\system32\pwdrvio.sys
2010/10/14 00:38:48.0031 pwdspio (6091e6ed1724ace18b014c86ca27246f) C:\Windows\system32\pwdspio.sys
2010/10/14 00:38:48.0234 PxHlpa64 (901dba98359966a62a6548596988e931) C:\Windows\system32\Drivers\PxHlpa64.sys
2010/10/14 00:38:48.0436 ql2300 (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
2010/10/14 00:38:48.0982 ql40xx (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
2010/10/14 00:38:49.0326 QWAVEdrv (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
2010/10/14 00:38:49.0497 RasAcd (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
2010/10/14 00:38:49.0684 RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
2010/10/14 00:38:49.0794 Rasl2tp (87a6e852a22991580d6d39adc4790463) C:\Windows\system32\DRIVERS\rasl2tp.sys
2010/10/14 00:38:49.0825 RasPppoe (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
2010/10/14 00:38:49.0918 RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
2010/10/14 00:38:50.0152 rdbss (3bac8142102c15d59a87757c1d41dce5) C:\Windows\system32\DRIVERS\rdbss.sys
2010/10/14 00:38:50.0262 rdpbus (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
2010/10/14 00:38:50.0340 RDPCDD (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
2010/10/14 00:38:50.0418 RDPDR (9706b84dbabfc4b4ca46c5a82b14dfa3) C:\Windows\system32\drivers\rdpdr.sys
2010/10/14 00:38:50.0511 RDPENCDD (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
2010/10/14 00:38:50.0605 RDPREFMP (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
2010/10/14 00:38:50.0667 RDPWD (8a3e6bea1c53ea6177fe2b6eba2c80d7) C:\Windows\system32\drivers\RDPWD.sys
2010/10/14 00:38:50.0854 rdyboost (634b9a2181d98f15941236886164ec8b) C:\Windows\system32\drivers\rdyboost.sys
2010/10/14 00:38:50.0964 rspndr (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
2010/10/14 00:38:51.0042 s3cap (88af6e02ab19df7fd07ecdf9c91e9af6) C:\Windows\system32\DRIVERS\vms3cap.sys
2010/10/14 00:38:51.0088 sbp2port (e3bbb89983daf5622c1d50cf49f28227) C:\Windows\system32\DRIVERS\sbp2port.sys
2010/10/14 00:38:51.0198 SCDEmu (240cd9582625bc49cc9fa6fcac883aa0) C:\Windows\system32\drivers\SCDEmu.sys
2010/10/14 00:38:51.0400 scfilter (c94da20c7e3ba1dca269bc8460d98387) C:\Windows\system32\DRIVERS\scfilter.sys
2010/10/14 00:38:51.0478 ScreamBAudioSvc (490b0b68bb938d5c628ec4a67277be75) C:\Windows\system32\drivers\ScreamingBAudio64.sys
2010/10/14 00:38:51.0541 secdrv (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
2010/10/14 00:38:51.0619 Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
2010/10/14 00:38:51.0697 Serial (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
2010/10/14 00:38:51.0744 sermouse (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
2010/10/14 00:38:51.0806 sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\DRIVERS\sffdisk.sys
2010/10/14 00:38:51.0837 sffp_mmc (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\DRIVERS\sffp_mmc.sys
2010/10/14 00:38:51.0884 sffp_sd (5588b8c6193eb1522490c122eb94dffa) C:\Windows\system32\DRIVERS\sffp_sd.sys
2010/10/14 00:38:51.0931 sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
2010/10/14 00:38:51.0993 SiSRaid2 (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
2010/10/14 00:38:52.0024 SiSRaid4 (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
2010/10/14 00:38:52.0087 Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
2010/10/14 00:38:52.0134 spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
2010/10/14 00:38:52.0212 srv (43067a65522eaec33d31a12d6fa8e3f4) C:\Windows\system32\DRIVERS\srv.sys
2010/10/14 00:38:52.0258 srv2 (03715cf9c30b563da35fc5f2b8f7b8e0) C:\Windows\system32\DRIVERS\srv2.sys
2010/10/14 00:38:52.0305 srvnet (fbd09635227a8026c0f7790f604343c6) C:\Windows\system32\DRIVERS\srvnet.sys
2010/10/14 00:38:52.0352 stexstor (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
2010/10/14 00:38:52.0414 storflt (ffd7a6f15b14234b5b0e5d49e7961895) C:\Windows\system32\DRIVERS\vmstorfl.sys
2010/10/14 00:38:52.0492 storvsc (8fccbefc5c440b3c23454656e551b09a) C:\Windows\system32\DRIVERS\storvsc.sys
2010/10/14 00:38:52.0539 swenum (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys
2010/10/14 00:38:52.0992 Tcpip (90a2d722cf64d911879d6c4a4f802a4d) C:\Windows\system32\drivers\tcpip.sys
2010/10/14 00:38:53.0413 TCPIP6 (90a2d722cf64d911879d6c4a4f802a4d) C:\Windows\system32\DRIVERS\tcpip.sys
2010/10/14 00:38:53.0460 tcpipreg (76d078af6f587b162d50210f761eb9ed) C:\Windows\system32\drivers\tcpipreg.sys
2010/10/14 00:38:53.0491 TDPIPE (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
2010/10/14 00:38:53.0553 TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys
2010/10/14 00:38:53.0616 tdx (079125c4b17b01fcaeebce0bcb290c0f) C:\Windows\system32\DRIVERS\tdx.sys
2010/10/14 00:38:53.0662 TermDD (c448651339196c0e869a355171875522) C:\Windows\system32\DRIVERS\termdd.sys
2010/10/14 00:38:53.0740 tssecsrv (61b96c26131e37b24e93327a0bd1fb95) C:\Windows\system32\DRIVERS\tssecsrv.sys
2010/10/14 00:38:53.0834 tunnel (3836171a2cdf3af8ef10856db9835a70) C:\Windows\system32\DRIVERS\tunnel.sys
2010/10/14 00:38:53.0865 uagp35 (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
2010/10/14 00:38:53.0928 udfs (d47baead86c65d4f4069d7ce0a4edceb) C:\Windows\system32\DRIVERS\udfs.sys
2010/10/14 00:38:54.0006 uliagpkx (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\DRIVERS\uliagpkx.sys
2010/10/14 00:38:54.0068 umbus (eab6c35e62b1b0db0d1b48b671d3a117) C:\Windows\system32\DRIVERS\umbus.sys
2010/10/14 00:38:54.0115 UmPass (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
2010/10/14 00:38:54.0255 USBAAPL64 (cd03479f2da26500b203ed075c146a7a) C:\Windows\system32\Drivers\usbaapl64.sys
2010/10/14 00:38:54.0396 usbaudio (77b01bc848298223a95d4ec23e1785a1) C:\Windows\system32\drivers\usbaudio.sys
2010/10/14 00:38:54.0442 usbccgp (b26afb54a534d634523c4fb66765b026) C:\Windows\system32\DRIVERS\usbccgp.sys
2010/10/14 00:38:54.0489 usbcir (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\DRIVERS\usbcir.sys
2010/10/14 00:38:54.0536 usbehci (df9f9afc9aaabd8ed47975d44e38169a) C:\Windows\system32\DRIVERS\usbehci.sys
2010/10/14 00:38:54.0598 usbhub (372a91bc3c6603080a793880b0873785) C:\Windows\system32\DRIVERS\usbhub.sys
2010/10/14 00:38:54.0630 usbohci (58e546bbaf87664fc57e0f6081e4f609) C:\Windows\system32\DRIVERS\usbohci.sys
2010/10/14 00:38:54.0676 usbprint (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
2010/10/14 00:38:54.0786 usbscan (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys
2010/10/14 00:38:54.0817 USBSTOR (080d3820da6c046be82fc8b45a893e83) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2010/10/14 00:38:54.0879 usbuhci (81fb2216d3a60d1284455d511797db3d) C:\Windows\system32\DRIVERS\usbuhci.sys
2010/10/14 00:38:54.0988 usbvideo (7cb8c573c6e4a2714402cc0a36eab4fe) C:\Windows\System32\Drivers\usbvideo.sys
2010/10/14 00:38:55.0098 vdrvroot (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\DRIVERS\vdrvroot.sys
2010/10/14 00:38:55.0176 vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
2010/10/14 00:38:55.0285 VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
2010/10/14 00:38:55.0378 vhdmp (c82e748660f62a242b2dfac1442f22a4) C:\Windows\system32\DRIVERS\vhdmp.sys
2010/10/14 00:38:55.0441 viaide (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\DRIVERS\viaide.sys
2010/10/14 00:38:55.0503 vmbus (1501699d7eda984abc4155a7da5738d1) C:\Windows\system32\DRIVERS\vmbus.sys
2010/10/14 00:38:55.0550 VMBusHID (ae10c35761889e65a6f7176937c5592c) C:\Windows\system32\DRIVERS\VMBusHID.sys
2010/10/14 00:38:55.0706 volmgr (2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\Windows\system32\DRIVERS\volmgr.sys
2010/10/14 00:38:55.0800 volmgrx (99b0cbb569ca79acaed8c91461d765fb) C:\Windows\system32\drivers\volmgrx.sys
2010/10/14 00:38:55.0924 volsnap (58f82eed8ca24b461441f9c3e4f0bf5c) C:\Windows\system32\DRIVERS\volsnap.sys
2010/10/14 00:38:56.0018 vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
2010/10/14 00:38:56.0112 VST64HWBS2 (93132c69394a99d992095d8cfe464801) C:\Windows\system32\DRIVERS\VSTBS26.SYS
2010/10/14 00:38:56.0205 VST64_DPV (02071d207a9858fbe3a48cbfd59c4a04) C:\Windows\system32\DRIVERS\VSTDPV6.SYS
2010/10/14 00:38:56.0268 vwifibus (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys
2010/10/14 00:38:56.0361 wacmoumonitor (7447512202ef348c5e8d68f044847e8b) C:\Windows\system32\DRIVERS\wacmoumonitor.sys
2010/10/14 00:38:56.0439 wacommousefilter (e04d43c7d1641e95d35cae6086c7e350) C:\Windows\system32\DRIVERS\wacommousefilter.sys
2010/10/14 00:38:56.0548 WacomPen (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
2010/10/14 00:38:56.0580 wacomvhid (26b430e7c5f598fe7353e3bc4b261321) C:\Windows\system32\DRIVERS\wacomvhid.sys
2010/10/14 00:38:56.0658 WANARP (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys
2010/10/14 00:38:56.0689 Wanarpv6 (47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys
2010/10/14 00:38:56.0829 Wd (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
2010/10/14 00:38:56.0907 Wdf01000 (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
2010/10/14 00:38:57.0001 WfpLwf (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
2010/10/14 00:38:57.0048 WIMMount (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
2010/10/14 00:38:57.0110 winachsf (a6ea7a3fc4b00f48535b506db1e86efd) C:\Windows\system32\DRIVERS\CAX_CNXT.sys
2010/10/14 00:38:57.0219 WinUsb (817eaff5d38674edd7713b9dfb8e9791) C:\Windows\system32\DRIVERS\WinUsb.sys
2010/10/14 00:38:57.0266 WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys
2010/10/14 00:38:57.0344 ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
2010/10/14 00:38:57.0406 WudfPf (7cadc74271dd6461c452c271b30bd378) C:\Windows\system32\drivers\WudfPf.sys
2010/10/14 00:38:57.0469 WUDFRd (3b197af0fff08aa66b6b2241ca538d64) C:\Windows\system32\DRIVERS\WUDFRd.sys
2010/10/14 00:38:57.0516 XAudio (e8f3fa126a06f8e7088f63757112a186) C:\Windows\system32\DRIVERS\XAudio64.sys
2010/10/14 00:38:57.0547 \HardDisk0\MBR - detected Rootkit.Win32.TDSS.tdl4 (0)
2010/10/14 00:38:57.0547 ================================================================================
2010/10/14 00:38:57.0547 Scan finished
2010/10/14 00:38:57.0547 ================================================================================
2010/10/14 00:38:57.0562 Detected object count: 1
2010/10/14 00:40:41.0299 \HardDisk0\MBR - will be cured after reboot
2010/10/14 00:40:41.0299 Rootkit.Win32.TDSS.tdl4(\HardDisk0\MBR) - User select action: Cure
2010/10/14 00:40:47.0211 Deinitialize success

Edited by Carl Berger, 14 October 2010 - 12:00 AM.


#7 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:09 PM

Posted 14 October 2010 - 05:34 PM

Hello, Carl Berger.

Are the redirects gone? You had the TDL4/TDSS/TidServ backdoor rookit which causes redirects. I do need to warn you abotu the backdoor nature below. I also looked for another virus with explorer.exe and it came back clean.





Backdoor Warning
One or more of the identified infections is a backdoor trojan.

This allows hackers to remotely control your computer, steal critical system information and download and execute files.

I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
When Should I Format, How Should I Reinstall

We can still clean this machine but I can't guarantee that it will be 100% secure afterwards. Let me know what you decide to do. If you do decide to proceed, please continue with the fix below.













etavares


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


#8 Carl Berger

Carl Berger
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:07:09 PM

Posted 14 October 2010 - 08:02 PM

Alright, do you have any more information on the TDL4/TDSS/TidServ rootkit? Maybe some specifics would help me in my decision.

As far as I can tell, internet redirects have STOPPED. Yay! busy.gif

For now, I think I have decided NOT to reformat, though I will keep that in mind and may do this in the future when I am sufficiently prepared. I would like to proceed with cleaning my computer (if it is still dirty). I have changed the passwords for various online accounts from a clean computer. I'm not worried about any sensitive information having been leaked (other than said passwords).

NOTE: At one point, during my use of Firefox, I was informed by Google that my email address had been accessed from South Korea. At that time I changed my password from another computer, and have just done so again in light of discovering and removing the rootkit. I believe my email to be safe.

Additionally, I have been behind a firewall since the time this computer was built. I also keep a close watch on my bank account to make sure that there are no unexplained charges.

So, what is the next step?

#9 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:09 PM

Posted 15 October 2010 - 07:59 PM

Hello, Carl Berger.

Ok, sounds good. Here's information on the rootkit:
http://www.securelist.com/en/analysis/204792131

The bottom shows how it can be used.



Step 1

Please go to the Kaspersky website and perform an online antivirus scan.
  1. Read through the requirements and privacy statement and click on Accept button.
  2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  3. When the downloads have finished, click on Settings.
  4. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    Spyware, Adware, Dialers, and other potentially dangerous programs
    Archives
  5. Click on My Computer under Scan.
  6. Once the scan is complete, it will display the results. Click on View Scan Report.
  7. You will see a list of infected items there. Click on Save Report As....
  8. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  9. Please post this log in your next reply.

Note: Kaspersky online scan may take time to complete, please be patient.



Step 2

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan.
  • If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  • Exit MBAM when done.
Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.



Step 3

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explaination about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

etavares


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


#10 Carl Berger

Carl Berger
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:07:09 PM

Posted 17 October 2010 - 08:29 PM

The Kapersky website does not work on 64-bit operating systems.

Malware Bytes Log
QUOTE
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4818

Windows 6.1.7600
Internet Explorer 9.0.7930.16406

10/17/2010 9:09:40 PM
mbam-log-2010-10-17 (21-09-40).txt

Scan type: Quick scan
Objects scanned: 156078
Time elapsed: 5 minute(s), 24 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


DDS Log
QUOTE
DDS (Ver_10-10-10.03) - NTFS_AMD64
Run by JENOVA at 21:24:57.69 on Sun 10/17/2010
Internet Explorer: 9.0.7930.16406

============== Running Processes ===============


============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: {DBC80044-A445-435b-BC74-9C25C1C588A9} - No File
TB: Contribute Toolbar: {517bdde4-e3a7-4570-b21e-2b52b6139fc7} - D:\Program Files (x86)\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
uRun: [AtiTrayTools] "C:\Program Files (x86)\ATI Tray Tools\atitray.exe"
uRun: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
mRun: [<NO NAME>]
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
StartupFolder: C:\Users\JENOVA\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\AUTORU~1\dropbox.lnk - C:\Users\JENOVA\AppData\Roaming\Dropbox\bin\Dropbox.exe
StartupFolder: C:\Users\JENOVA\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\AUTORU~1\LOGITE~1.LNK - C:\Program Files\Logitech\Logitech WebCam Software\eReg.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: E&xport to Microsoft Excel - D:\WINDOW~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - D:\WINDOW~1\MICROS~1\OFFICE11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
TCP: {8B34DF19-3B01-4E60-B2CE-14CB9E5F7FCC} = 156.154.70.22,156.154.71.22
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
AppInit_DLLs:
STS: Windows DreamScene: {e31004d1-a431-41b8-826f-e902f9d95c81} - %SystemRoot%\SysWow64\DreamScene.dll
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
mRun-x64: [Skytel] Skytel.exe
mRun-x64: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
mRun-x64: [RtHDVCpl] RAVCpl64.exe
AppInit_DLLs-X64:
Hosts: 127.0.0.1 www.spywareinfo.com

============= SERVICES / DRIVERS ===============


=============== Created Last 30 ================

2010-10-15 19:12:16 7935824 ----a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\{EC8AD3E6-8631-4E73-A8C7-568C2478F694}\mpengine.dll
2010-10-07 06:28:20 -------- d-----w- C:\Users\JENOVA\AppData\Local\SCE
2010-10-07 06:28:19 -------- d-----w- C:\PROGRA~3\Sony Online Entertainment
2010-10-07 00:19:11 -------- d-----w- C:\Program Files (x86)\Sony
2010-10-01 21:42:54 468480 ----a-w- C:\Windows\System32\deployJava1.dll
2010-10-01 02:39:20 257024 ----a-w- C:\Windows\System32\mfreadwrite.dll
2010-10-01 02:38:44 1863680 ----a-w- C:\Windows\System32\ExplorerFrame.dll
2010-10-01 02:38:43 1495040 ----a-w- C:\Windows\SysWow64\ExplorerFrame.dll
2010-10-01 02:38:06 -------- d-----w- C:\Program Files (x86)\Feedback Tool
2010-09-30 21:16:37 -------- d-----w- C:\PROGRA~3\SITEguard
2010-09-30 21:16:00 -------- d-----w- C:\Program Files (x86)\Common Files\iS3
2010-09-30 21:16:00 -------- d-----w- C:\PROGRA~3\STOPzilla!
2010-09-30 17:44:31 -------- d-----w- C:\Users\JENOVA\AppData\Local\Deployment
2010-09-30 17:44:31 -------- d-----w- C:\Users\JENOVA\AppData\Local\Apps
2010-09-29 19:29:05 243712 ----a-w- C:\Windows\System32\drivers\ks.sys
2010-09-29 19:29:05 184832 ----a-w- C:\Windows\System32\drivers\usbvideo.sys
2010-09-29 17:50:50 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
2010-09-29 17:50:50 2048 ----a-w- C:\Windows\System32\tzres.dll
2010-09-28 15:26:57 -------- d-----w- C:\PROGRA~3\SUPERAntiSpyware.com
2010-09-28 15:26:52 -------- d-----w- C:\PROGRA~3\!SASCORE
2010-09-28 07:27:16 -------- d-----w- C:\Users\JENOVA\AppData\Local\Adobe
2010-09-27 18:16:11 388096 ----a-r- C:\Users\JENOVA\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-09-27 18:16:11 -------- d-----w- C:\Program Files (x86)\Trend Micro
2010-09-27 17:55:21 -------- d-----w- C:\Program Files (x86)\CCleaner
2010-09-27 07:01:54 -------- d-----w- C:\Program Files (x86)\SquareEnix
2010-09-27 06:09:09 423656 ----a-w- C:\Windows\SysWow64\deployJava1.dll
2010-09-26 17:05:10 -------- d--h--w- C:\VritualRoot
2010-09-26 16:32:59 -------- d-----w- C:\PROGRA~3\Comodo
2010-09-26 05:55:34 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy
2010-09-26 05:55:34 -------- d-----w- C:\PROGRA~3\Spybot - Search & Destroy
2010-09-26 02:38:42 -------- d-----w- C:\Users\JENOVA\AppData\Roaming\Malwarebytes
2010-09-26 02:38:28 38224 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
2010-09-26 02:38:27 24664 ----a-w- C:\Windows\System32\drivers\mbam.sys
2010-09-26 02:38:27 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2010-09-26 02:38:27 -------- d-----w- C:\PROGRA~3\Malwarebytes
2010-09-22 22:10:52 103864 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\nppdf32.dll

==================== Find3M ====================

2010-09-11 03:41:40 362784 ----a-w- C:\Windows\System32\guard64.dll
2010-09-11 03:41:40 285480 ----a-w- C:\Windows\SysWow64\guard32.dll
2010-09-11 03:40:44 33208 ----a-w- C:\Windows\System32\drivers\cmdhlp.sys
2010-09-11 03:40:44 249496 ----a-w- C:\Windows\System32\drivers\cmdGuard.sys
2010-09-11 03:40:42 20864 ----a-w- C:\Windows\System32\drivers\cmderd.sys
2010-09-01 05:12:09 12625920 ----a-w- C:\Windows\System32\wmploc.DLL
2010-09-01 04:46:36 1355264 ----a-w- C:\Windows\SysWow64\jscript9.dll
2010-09-01 04:44:32 367104 ----a-w- C:\Windows\SysWow64\html.iec
2010-09-01 04:44:30 1448448 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2010-09-01 04:44:24 1122304 ----a-w- C:\Windows\SysWow64\wininet.dll
2010-09-01 04:44:06 424960 ----a-w- C:\Windows\SysWow64\vbscript.dll
2010-09-01 04:43:22 23552 ----a-w- C:\Windows\SysWow64\licmgr10.dll
2010-09-01 04:43:12 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe
2010-09-01 04:43:12 114176 ----a-w- C:\Windows\SysWow64\iesysprep.dll
2010-09-01 04:43:10 76800 ----a-w- C:\Windows\SysWow64\SetIEInstalledDate.exe
2010-09-01 04:43:10 74752 ----a-w- C:\Windows\SysWow64\RegisterIEPKEYs.exe
2010-09-01 04:43:02 448512 ----a-w- C:\Windows\System32\html.iec
2010-09-01 04:41:56 601088 ----a-w- C:\Windows\System32\vbscript.dll
2010-09-01 04:40:56 76800 ----a-w- C:\Windows\System32\tdc.ocx
2010-09-01 04:40:40 215552 ----a-w- C:\Windows\System32\msls31.dll
2010-09-01 04:23:49 12625408 ----a-w- C:\Windows\SysWow64\wmploc.DLL
2010-09-01 03:50:12 372736 ----a-w- C:\Windows\SysWow64\IJL15.DLL
2010-09-01 02:58:34 3123712 ----a-w- C:\Windows\System32\win32k.sys
2010-08-31 04:32:30 954752 ----a-w- C:\Windows\SysWow64\mfc40.dll
2010-08-31 04:32:30 954288 ----a-w- C:\Windows\SysWow64\mfc40u.dll
2010-08-27 06:14:02 236032 ----a-w- C:\Windows\System32\srvsvc.dll
2010-08-27 05:46:48 9728 ----a-w- C:\Windows\SysWow64\sscore.dll
2010-08-27 03:38:04 463360 ----a-w- C:\Windows\System32\drivers\srv.sys
2010-08-27 03:37:48 402944 ----a-w- C:\Windows\System32\drivers\srv2.sys
2010-08-27 03:37:26 161792 ----a-w- C:\Windows\System32\drivers\srvnet.sys
2010-08-26 05:27:28 148992 ----a-w- C:\Windows\System32\t2embed.dll
2010-08-26 04:39:58 109056 ----a-w- C:\Windows\SysWow64\t2embed.dll
2010-08-26 03:37:26 7767040 ----a-w- C:\Windows\System32\drivers\atikmdag.sys
2010-08-26 02:14:12 20736000 ----a-w- C:\Windows\System32\atio6axx.dll
2010-08-26 02:01:14 143360 ----a-w- C:\Windows\System32\atiapfxx.exe
2010-08-26 02:01:04 528384 ----a-w- C:\Windows\SysWow64\aticfx32.dll
2010-08-26 02:00:02 616960 ----a-w- C:\Windows\System32\aticfx64.dll
2010-08-26 01:57:58 450560 ----a-w- C:\Windows\System32\ATIDEMGX.dll
2010-08-26 01:57:50 462336 ----a-w- C:\Windows\System32\atieclxx.exe
2010-08-26 01:57:14 203264 ----a-w- C:\Windows\System32\atiesrxx.exe
2010-08-26 01:56:06 120320 ----a-w- C:\Windows\System32\atitmm64.dll
2010-08-26 01:55:50 421376 ----a-w- C:\Windows\System32\atipdl64.dll
2010-08-26 01:55:48 15830016 ----a-w- C:\Windows\SysWow64\atioglxx.dll
2010-08-26 01:55:42 356352 ----a-w- C:\Windows\SysWow64\atipdlxx.dll
2010-08-26 01:55:32 278528 ----a-w- C:\Windows\SysWow64\Oemdspif.dll
2010-08-26 01:55:28 12288 ----a-w- C:\Windows\System32\atimuixx.dll
2010-08-26 01:55:22 59392 ----a-w- C:\Windows\System32\atiedu64.dll
2010-08-26 01:55:18 43520 ----a-w- C:\Windows\SysWow64\ati2edxx.dll
2010-08-26 01:52:22 3914240 ----a-w- C:\Windows\SysWow64\atidxx32.dll
2010-08-26 01:43:28 4602880 ----a-w- C:\Windows\System32\atidxx64.dll
2010-08-26 01:34:38 51200 ----a-w- C:\Windows\System32\aticalrt64.dll
2010-08-26 01:34:36 46080 ----a-w- C:\Windows\SysWow64\aticalrt.dll
2010-08-26 01:34:28 44544 ----a-w- C:\Windows\System32\aticalcl64.dll
2010-08-26 01:34:26 44032 ----a-w- C:\Windows\SysWow64\aticalcl.dll
2010-08-26 01:34:16 5425664 ----a-w- C:\Windows\System32\aticaldd64.dll
2010-08-26 01:33:52 4032512 ----a-w- C:\Windows\SysWow64\atiumdag.dll
2010-08-26 01:33:08 4375552 ----a-w- C:\Windows\SysWow64\aticaldd.dll
2010-08-26 01:33:02 3147264 ----a-w- C:\Windows\System32\atiumd6a.dll
2010-08-26 01:27:58 57344 ----a-w- C:\Windows\System32\coinst.dll
2010-08-26 01:27:54 5202944 ----a-w- C:\Windows\System32\atiumd64.dll
2010-08-26 01:25:58 3392000 ----a-w- C:\Windows\SysWow64\atiumdva.dll
2010-08-26 01:21:24 338432 ----a-w- C:\Windows\System32\atiadlxx.dll
2010-08-26 01:21:18 241664 ----a-w- C:\Windows\SysWow64\atiadlxy.dll
2010-08-26 01:21:08 14848 ----a-w- C:\Windows\System32\atig6pxx.dll
2010-08-26 01:21:06 12800 ----a-w- C:\Windows\SysWow64\atiglpxx.dll
2010-08-26 01:21:06 12800 ----a-w- C:\Windows\System32\atiglpxx.dll
2010-08-26 01:21:02 21504 ----a-w- C:\Windows\System32\atig6txx.dll
2010-08-26 01:21:00 19968 ----a-w- C:\Windows\SysWow64\atigktxx.dll
2010-08-26 01:20:56 279040 ----a-w- C:\Windows\System32\drivers\atikmpag.sys
2010-08-26 01:20:14 39424 ----a-w- C:\Windows\System32\atiuxp64.dll
2010-08-26 01:20:08 30208 ----a-w- C:\Windows\SysWow64\atiuxpag.dll
2010-08-26 01:20:04 37376 ----a-w- C:\Windows\System32\atiu9p64.dll
2010-08-26 01:19:56 28160 ----a-w- C:\Windows\SysWow64\atiu9pag.dll
2010-08-26 01:19:28 53248 ----a-w- C:\Windows\System32\drivers\ati2erec.dll
2010-08-26 01:13:22 53760 ----a-w- C:\Windows\System32\atimpc64.dll
2010-08-26 01:13:22 53760 ----a-w- C:\Windows\System32\amdpcom64.dll
2010-08-26 01:13:16 52736 ----a-w- C:\Windows\SysWow64\atimpc32.dll
2010-08-26 01:13:16 52736 ----a-w- C:\Windows\SysWow64\amdpcom32.dll
2010-08-21 06:38:47 1024512 ----a-w- C:\Windows\System32\wmpmde.dll
2010-08-21 06:36:49 340992 ----a-w- C:\Windows\System32\schannel.dll
2010-08-21 06:31:06 633856 ----a-w- C:\Windows\System32\comctl32.dll
2010-08-21 06:29:47 558592 ----a-w- C:\Windows\System32\spoolsv.exe
2010-08-21 05:36:33 738816 ----a-w- C:\Windows\SysWow64\wmpmde.dll
2010-08-21 05:36:24 224256 ----a-w- C:\Windows\SysWow64\schannel.dll
2010-08-21 05:33:24 530432 ----a-w- C:\Windows\SysWow64\comctl32.dll
2010-08-16 06:50:45 1137664 ----a-w- C:\Windows\System32\FntCache.dll
2010-08-16 06:50:43 1543168 ----a-w- C:\Windows\System32\DWrite.dll
2010-08-16 06:50:42 899072 ----a-w- C:\Windows\System32\d2d1.dll
2010-08-16 06:50:42 320512 ----a-w- C:\Windows\System32\d3d10_1core.dll
2010-08-16 06:50:42 1844224 ----a-w- C:\Windows\System32\d3d10warp.dll
2010-08-16 06:14:36 1076224 ----a-w- C:\Windows\SysWow64\DWrite.dll
2010-08-16 06:14:24 737280 ----a-w- C:\Windows\SysWow64\d2d1.dll
2010-08-16 06:14:24 218624 ----a-w- C:\Windows\SysWow64\d3d10_1core.dll
2010-08-16 06:14:24 1172480 ----a-w- C:\Windows\SysWow64\d3d10warp.dll
2010-07-29 06:30:34 82944 ----a-w- C:\Windows\SysWow64\iccvid.dll

============= FINISH: 21:27:31.42 ===============




#11 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:09 PM

Posted 18 October 2010 - 05:51 PM

Hello, Carl Berger.
Let's try ESET. Did that work?

I'd like us to scan your machine with ESET OnlineScan
  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the Posted Image button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on Posted Image to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the Posted Image icon on your desktop.
  • Check Posted Image
  • Click the Posted Image button.
  • Accept any security warnings from your browser.
  • Check Posted Image
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push Posted Image
  • Push Posted Image, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Push the Posted Image button.
  • Push Posted Image
etavares


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


#12 Carl Berger

Carl Berger
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:07:09 PM

Posted 19 October 2010 - 03:05 AM

ESETScan Results

C:\Users\JENOVA\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\8c6243e-6221aea5 a variant of Java/Exploit.Agent.NAL trojan deleted - quarantined
C:\Users\JENOVA\Downloads\unlocker1.9.0.exe Win32/Adware.ADON application deleted - quarantined
D:\Documents and Settings\Administrator\Desktop\Downloads\Revo.zip probably a variant of Win32/TrojanDownloader.Agent.DDQQCSY trojan deleted - quarantined
D:\Documents and Settings\Administrator\Desktop\Revo\PW.exe probably a variant of Win32/TrojanDownloader.Agent.DDQQCSY trojan cleaned by deleting - quarantined
D:\Documents and Settings\Administrator\My Documents\File Cabinet Backup\Install Programs\unlocker1.8.7.exe Win32/Adware.ADON application deleted - quarantined
D:\Program Files (x86)\Unlocker\eBay_shortcuts_1016.exe Win32/Adware.ADON application deleted - quarantined



#13 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:09 PM

Posted 19 October 2010 - 08:32 PM

Hello, Carl Berger.
How is your computer running now? Symptoms all gone?



Step 1

Your Adobe Reader software is out of date and has known security holes. Please launch it, go to Help --> Check for Updates and let it update the main program if needed. Updates the languages and/or dictionaries is optional.

etavares


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 


#14 Carl Berger

Carl Berger
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:07:09 PM

Posted 20 October 2010 - 12:47 AM

I have not been noticing symptoms since I deleted the rootkit, but I imagine there are still vulnerabilities in my system. For example, I have suspected Java of being at risk for some time. The fact that ESETScan found a Java exploit was not surprising. My adobe reader version is 9.4. It says there are no updates to report.

I was wondering if there was anything I could do, or any practices that would help guard against infection like this in the future. I've been very careful not to get virus and malware infections, but this particular one made it through all of my defenses. I'm certainly a lot more wary now. I'm usually the go-to guy for when my friends have viruses. I'm typically pretty good at fixing these types of issues, but I was totally dumbfounded by this and almost just reformatted.

#15 etavares

etavares

    Bleepin' Remover


  • Malware Response Team
  • 15,514 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:09 PM

Posted 20 October 2010 - 06:14 PM

Hello, Carl Berger.

The current version of Java is 1.6 update 22. Let's upgrade now. My post after this one will have some tips to prevent reinfection. You can never be 100% safe. New viruses come out every second, and no antivirus can stop them all. They take advantage of new exploits, etc. A/V are about 90+% effective at stopping 2 week old viruses, but only about 50% at stopping new viruses. You'll still get bad files in your Java cache even with the most up to date version, too. It's best to run one antivirus, one firewall and one antispyware program to help protect, and occasionally scan with a different program. You still can get infected, but the chances are much lower.



Next, we need to update Java.
Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:
  • Download the latest version of Java Runtime Environment (JRE) Version 22 and save it to your desktop.
  • Scroll down to where it says "JDK 6 Update 22 (JDK or JRE)...allows end-users to run Java applications".
  • Click the "Download JRE" button to the right.
  • Select your Platform: "Windows".
  • Select your Language: "Multi-language".
  • Read the License Agreement, and then check the box that says: "Accept License Agreement".
  • Click Continue and the page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) or Java™ in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u22-windows-i586-p.exe to install the newest version.

let me know when you're done and we can clean up our mess.

etavares


If I don't respond within 2 days, please feel free to PM me.
Please don't ask for help via PM. The forums are there for a reason. Please post in the forums so others may benefit as well.

Posted Image
Unified Network of Instructors and Trusted Eliminators
 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users