Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

many issues, interesting to me, on e possiblity katusha.A?


  • This topic is locked This topic is locked
6 replies to this topic

#1 Spre123

Spre123

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:12:03 AM

Posted 20 August 2011 - 12:53 AM

I have been dealing with this for a week, and I am stumped, for every one thing I remove via malewarebytes or AVG another 3 pop up.

I can not run the following programs when not in safe mode, they run then the virus destroys them.

AVG
Malewarebytes
Hijackthis
Combofix
End-it-all


anything else that deals with virus'

Before AVG was taken out it did display that every startup item was infected with Katusha.A, and about halfway through the full system scan all avg componates just dissapeared.

Lets see.. Last malewarebytes log in safe mode.
Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7512

Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702

8/19/2011 5:14:13 PM
mbam-log-2011-08-19 (17-14-13).txt

Scan type: Full scan (C:\|)
Objects scanned: 261954
Time elapsed: 44 minute(s), 16 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 31

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\documents and settings\Jess\application data\Sun\Java\deployment\cache\6.0\26\744771a-649fb448 (Trojan.Ransom.Gen) -> Quarantined and deleted successfully.
c:\system volume information\_restore{26b98663-b1a4-4f39-ad10-ada9715f1d38}\RP157\A0023217.exe (Adware.FunWeb) -> Quarantined and deleted successfully.
c:\system volume information\_restore{26b98663-b1a4-4f39-ad10-ada9715f1d38}\RP157\A0023218.dll (Trojan.Hiloti) -> Quarantined and deleted successfully.
c:\system volume information\_restore{26b98663-b1a4-4f39-ad10-ada9715f1d38}\RP157\A0023219.exe (Adware.FunWeb) -> Quarantined and deleted successfully.
c:\system volume information\_restore{26b98663-b1a4-4f39-ad10-ada9715f1d38}\RP157\A0023220.dll (Adware.FunWeb) -> Quarantined and deleted successfully.
c:\system volume information\_restore{26b98663-b1a4-4f39-ad10-ada9715f1d38}\RP157\A0023221.dll (Adware.FunWeb) -> Quarantined and deleted successfully.
c:\system volume information\_restore{26b98663-b1a4-4f39-ad10-ada9715f1d38}\RP157\A0023222.dll (Adware.FunWeb) -> Quarantined and deleted successfully.
c:\system volume information\_restore{26b98663-b1a4-4f39-ad10-ada9715f1d38}\RP157\A0023223.dll (Adware.FunWeb) -> Quarantined and deleted successfully.
c:\system volume information\_restore{26b98663-b1a4-4f39-ad10-ada9715f1d38}\RP157\A0023224.dll (Adware.FunWeb) -> Quarantined and deleted successfully.
c:\system volume information\_restore{26b98663-b1a4-4f39-ad10-ada9715f1d38}\RP157\A0023225.dll (Adware.FunWeb) -> Quarantined and deleted successfully.
c:\system volume information\_restore{26b98663-b1a4-4f39-ad10-ada9715f1d38}\RP157\A0023226.dll (Adware.FunWeb) -> Quarantined and deleted successfully.
c:\system volume information\_restore{26b98663-b1a4-4f39-ad10-ada9715f1d38}\RP157\A0023227.dll (Adware.FunWeb) -> Quarantined and deleted successfully.
c:\system volume information\_restore{26b98663-b1a4-4f39-ad10-ada9715f1d38}\RP157\A0023228.dll (Adware.FunWeb) -> Quarantined and deleted successfully.
c:\system volume information\_restore{26b98663-b1a4-4f39-ad10-ada9715f1d38}\RP157\A0023229.dll (Adware.FunWeb) -> Quarantined and deleted successfully.
c:\system volume information\_restore{26b98663-b1a4-4f39-ad10-ada9715f1d38}\RP157\A0023230.exe (Adware.FunWeb) -> Quarantined and deleted successfully.
c:\system volume information\_restore{26b98663-b1a4-4f39-ad10-ada9715f1d38}\RP157\A0023231.dll (Adware.FunWeb) -> Quarantined and deleted successfully.
c:\system volume information\_restore{26b98663-b1a4-4f39-ad10-ada9715f1d38}\RP157\A0023232.dll (Adware.FunWeb) -> Quarantined and deleted successfully.
c:\system volume information\_restore{26b98663-b1a4-4f39-ad10-ada9715f1d38}\RP157\A0023233.dll (Adware.FunWeb) -> Quarantined and deleted successfully.
c:\system volume information\_restore{26b98663-b1a4-4f39-ad10-ada9715f1d38}\RP157\A0023234.dll (Adware.FunWeb) -> Quarantined and deleted successfully.
c:\system volume information\_restore{26b98663-b1a4-4f39-ad10-ada9715f1d38}\RP157\A0023235.exe (Adware.FunWeb) -> Quarantined and deleted successfully.
c:\system volume information\_restore{26b98663-b1a4-4f39-ad10-ada9715f1d38}\RP157\A0023236.exe (Adware.FunWeb) -> Quarantined and deleted successfully.
c:\system volume information\_restore{26b98663-b1a4-4f39-ad10-ada9715f1d38}\RP157\A0023237.dll (Adware.FunWeb) -> Quarantined and deleted successfully.
c:\system volume information\_restore{26b98663-b1a4-4f39-ad10-ada9715f1d38}\RP157\A0023238.dll (Adware.FunWeb) -> Quarantined and deleted successfully.
c:\system volume information\_restore{26b98663-b1a4-4f39-ad10-ada9715f1d38}\RP157\A0023239.dll (Adware.FunWeb) -> Quarantined and deleted successfully.
c:\system volume information\_restore{26b98663-b1a4-4f39-ad10-ada9715f1d38}\RP157\A0023240.dll (Adware.FunWeb) -> Quarantined and deleted successfully.
c:\system volume information\_restore{26b98663-b1a4-4f39-ad10-ada9715f1d38}\RP157\A0023241.dll (Adware.FunWeb) -> Quarantined and deleted successfully.
c:\system volume information\_restore{26b98663-b1a4-4f39-ad10-ada9715f1d38}\RP157\A0023242.dll (Adware.FunWeb) -> Quarantined and deleted successfully.
c:\system volume information\_restore{26b98663-b1a4-4f39-ad10-ada9715f1d38}\RP157\A0023243.exe (Adware.FunWeb) -> Quarantined and deleted successfully.
c:\system volume information\_restore{26b98663-b1a4-4f39-ad10-ada9715f1d38}\RP157\A0023244.dll (Adware.FunWeb) -> Quarantined and deleted successfully.
c:\system volume information\_restore{26b98663-b1a4-4f39-ad10-ada9715f1d38}\RP157\A0023245.dll (Adware.FunWeb) -> Quarantined and deleted successfully.
c:\system volume information\_restore{26b98663-b1a4-4f39-ad10-ada9715f1d38}\RP157\A0023246.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.




DDS log:
.
DDS (Ver_2011-06-23.01) - NTFSx86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_20
Run by Jess at 1:29:51 on 2011-08-20
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.480 [GMT -4:00]
.
AV: AVG Internet Security 2011 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
============== Running Processes ===============
.
C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
C:\PROGRA~1\AVG\AVG10\avgrsx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\3712394246:4183537954.exe
svchost.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\KeyboardSurrogate.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\SYSTEM32\WISPTIS.EXE
C:\WINDOWS\System32\tabbtnu.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\TCServer.exe
C:\Program Files\Common Files\Microsoft Shared\Ink\TabTip.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\system32\00THotkey.exe
C:\Program Files\Toshiba\CrossMenu\CrossMenu.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\system32\TFNF5.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\Program Files\TOSHIBA\TME3\TMERzCtl.EXE
C:\Program Files\TOSHIBA\DualPointUtility\TEDTray.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe
C:\Program Files\TOSHIBA\TAudEffect\TAudEff.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\TOSHIBA\TOSHIBA Rotation Utility\TRot.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\Program Files\TOSHIBA\Acceleration Utilities\TAcelMgr\TAcelMgr.exe
C:\Program Files\TOSHIBA\Acceleration Utilities\Shaker\TSkrMain.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\WINDOWS\system32\TPSODDCtl.exe
C:\TOSHIBA\IVP\ISM\pinger.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\AVG\AVG10\avgtray.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
svchost.exe
C:\Program Files\CarMD\CarMD.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Program Files\AVG\AVG10\avgui.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.toshibadirect.com/dpdstart
uSearch Bar = hxxp://www.toshiba.com/search
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: DivX Plus Web Player HTML5 <video>: {326e768d-4182-46fd-9c16-1449a49795f4} - c:\program files\divx\divx plus web player\npdivx32.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll
BHO: DivX HiQ: {593ddec6-7468-4cdd-90e1-42dadaa222e9} - c:\program files\divx\divx plus web player\npdivx32.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll
BHO: FDMIECookiesBHO Class: {cc59e0f9-7e43-44fa-9faa-8377850bf205} - c:\program files\free download manager\iefdm2.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
TB: {BA52B914-B692-46c4-B683-905236F6F655} - No File
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [TOSCDSPD] c:\program files\toshiba\toscdspd\toscdspd.exe
uRun: [CarMD] c:\program files\carmd\CarMD.exe
uRun: [cdloader] "c:\documents and settings\jess\application data\mjusbsp\cdloader2.exe" MAGICJACK
mRun: [TabletWizard] c:\windows\help\SplshWrp.exe
mRun: [TabletTip] "c:\program files\common files\microsoft shared\ink\tabtip.exe" /resume
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /installquiet /nodetect
mRun: [SoundMAXPnP] c:\program files\analog devices\soundmax\SMax4PNP.exe
mRun: [SoundMAX] c:\program files\analog devices\soundmax\Smax4.exe /tray
mRun: [00THotkey] c:\windows\system32\00THotkey.exe
mRun: [CrossMenu] c:\program files\toshiba\crossmenu\CrossMenu.exe
mRun: [000StTHK] 000StTHK.exe
mRun: [Apoint] c:\program files\apoint2k\Apoint.exe
mRun: [TFNF5] TFNF5.exe
mRun: [SmoothView] c:\program files\toshiba\toshiba zooming utility\SmoothView.exe
mRun: [TMERzCtl.EXE] c:\program files\toshiba\tme3\TMERzCtl.EXE /Service
mRun: [DpUtil] c:\program files\toshiba\dualpointutility\TEDTray.exe
mRun: [NDSTray.exe] NDSTray.exe
mRun: [TosHKCW.exe] "c:\program files\toshiba\wireless hotkey\TosHKCW.exe"
mRun: [TAudEffect] c:\program files\toshiba\taudeffect\TAudEff.exe /run
mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
mRun: [TosRotation] "c:\program files\toshiba\toshiba rotation utility\TRot.exe"
mRun: [TFncKy] TFncKy.exe
mRun: [TAcelMgr] c:\program files\toshiba\acceleration utilities\tacelmgr\TAcelMgr.exe
mRun: [TSkrMain] c:\program files\toshiba\acceleration utilities\shaker\TSkrMain.exe
mRun: [LtMoh] c:\program files\ltmoh\Ltmoh.exe
mRun: [AGRSMMSG] AGRSMMSG.exe
mRun: [TPSMain] TPSMain.exe
mRun: [TPSODDCtl] TPSODDCtl.exe
mRun: [PINGER] c:\toshiba\ivp\ism\pinger.exe /run
mRun: [<NO NAME>]
mRun: [IntelWireless] c:\program files\intel\wireless\bin\ifrmewrk.exe /tf Intel PROSet/Wireless
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume
mRun: [PWRISOVM.EXE] c:\program files\poweriso\PWRISOVM.EXE
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [CFSServ.exe] CFSServ.exe -NoClient
mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW
mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
StartupFolder: c:\docume~1\jess\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\toshiba\bluetooth toshiba stack\TosBtMng.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\2.0.181\SSScheduler.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html
IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html
IE: Download all with Free Download Manager - file://c:\program files\free download manager\dlall.htm
IE: Download selected with Free Download Manager - file://c:\program files\free download manager\dlselected.htm
IE: Download video with Free Download Manager - file://c:\program files\free download manager\dlfvideo.htm
IE: Download with Free Download Manager - file://c:\program files\free download manager\dllink.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\micros~2\office14\ONBttnIE.dll/105
IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
LSP: mswsock.dll
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1283813464312
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 192.168.0.1
TCP: Interfaces\{6678B74C-1FF3-440E-8C8C-CAA7F01A7532} : DhcpNameServer = 192.168.0.1
TCP: Interfaces\{CB194A4E-B26B-4822-9CA5-4AB34991FE44} : DhcpNameServer = 192.168.0.1
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\avg\avg10\toolbar\IEToolbar.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll
Notify: IntelWireless - c:\program files\intel\wireless\bin\LgNotify.dll
Notify: loginkey - c:\program files\common files\microsoft shared\ink\loginkey.dll
Notify: TabBtnWL - TabBtnWL.dll
Notify: tpgwlnotify - tpgwlnot.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\jess\application data\mozilla\firefox\profiles\rwnvxccz.default\
FF - prefs.js: browser.search.selectedEngine - AVG Secure Search
FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=4e4ef1d6&v=7.007.026.001&i=26&tp=ab&iy=&ychte=us&lng=en-US&q=
FF - component: c:\program files\avg\avg10\firefox4\components\avgssff4.dll
FF - component: c:\program files\avg\avg10\firefox4\components\avgssff5.dll
FF - component: c:\program files\avg\avg10\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\avg\avg10\toolbar\firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\avg\avg10\toolbar\firefox\avg@igeared\components\xpavgtbapi.dll
FF - plugin: c:\program files\divx\divx ovs helper\npovshelper.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
FF - Ext: DivX Plus Web Player HTML5 &lt;video&gt;: {23fcfd51-4958-4f00-80a3-ae97e717ed8b} - c:\program files\divx\divx plus web player\firefox\html5video
FF - Ext: DivX HiQ: {6904342A-8307-11DF-A508-4AE2DFD72085} - c:\program files\divx\divx plus web player\firefox\wpa
FF - Ext: XULRunner: {178325B3-2CE0-4328-BB2A-E7D84DC36094} - c:\documents and settings\jess\local settings\application data\{178325B3-2CE0-4328-BB2A-E7D84DC36094}
FF - Ext: AVG Safe Search: {1E73965B-8B48-48be-9C8D-68B920ABC1C4} - c:\program files\avg\avg10\Firefox4
FF - Ext: AVG Security Toolbar em:version=7.007.026.001 em:displayname=AVG Security Toolbar em:iconURL=chrome://tavgp/skin/logo.ico em:creator=AVG Technologies em:description=AVG Security Toolbar em:homepageURL=http://www.avg.com >: avg@igeared - c:\program files\avg\avg10\toolbar\firefox\avg@igeared
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2011-2-22 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-3-16 32592]
R0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\drivers\thpdrv.sys [2004-12-28 16384]
R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\drivers\Thpevm.sys [2005-3-28 6528]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-1-7 248656]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-3-1 34896]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-4-5 297168]
R1 TMEI3E;TMEI3E;c:\windows\system32\drivers\TMEI3E.sys [2005-3-28 5888]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2011-4-14 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2011-2-10 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2011-2-10 27216]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [2005-3-28 32640]
R3 TBtnKey;TOSHIBA Tablet PC Buttons Type N HID Driver;c:\windows\system32\drivers\TBtnKey.sys [2005-3-28 8832]
R3 TEchoCan;Toshiba Audio Effect;c:\windows\system32\drivers\TEchoCan.sys [2005-3-28 410112]
R3 TMicAry;Toshiba Audio Effect with MicArray;c:\windows\system32\drivers\TMicAry.sys [2005-3-28 138240]
R3 WacomPen;Wacom Serial Pen HID Driver;c:\windows\system32\drivers\wacompen.sys [2005-3-28 14208]
S1 MpKsl22fc82fa;MpKsl22fc82fa;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{e47e3f48-5b7d-48a7-a4fd-5bdb1f806b74}\mpksl22fc82fa.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{e47e3f48-5b7d-48a7-a4fd-5bdb1f806b74}\MpKsl22fc82fa.sys [?]
S1 MpKsl5a4bfe84;MpKsl5a4bfe84;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{e47e3f48-5b7d-48a7-a4fd-5bdb1f806b74}\mpksl5a4bfe84.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{e47e3f48-5b7d-48a7-a4fd-5bdb1f806b74}\MpKsl5a4bfe84.sys [?]
S1 MpKsl66528f0b;MpKsl66528f0b;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{e47e3f48-5b7d-48a7-a4fd-5bdb1f806b74}\mpksl66528f0b.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{e47e3f48-5b7d-48a7-a4fd-5bdb1f806b74}\MpKsl66528f0b.sys [?]
S1 MpKslab3f00be;MpKslab3f00be;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{568a35ae-ab9f-4417-b18e-4dd59ff947fb}\mpkslab3f00be.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{568a35ae-ab9f-4417-b18e-4dd59ff947fb}\MpKslab3f00be.sys [?]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [2011-4-18 7398752]
S2 avgwd;AVG WatchDog;c:\program files\avg\avg10\avgwdsvc.exe [2011-2-8 269520]
S2 Tmesbs;Tmesbs32;"c:\program files\toshiba\tme3\tmesbs32.exe" /service --> c:\program files\toshiba\tme3\Tmesbs32.exe [?]
S2 Tmesrv;Tmesrv3;"c:\program files\toshiba\tme3\tmesrv31.exe" /service --> c:\program files\toshiba\tme3\Tmesrv31.exe [?]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg10\toolbar\ToolbarBroker.exe [2011-8-19 1025352]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\2.0.181\McCHSvc.exe [2010-1-15 227232]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2005-3-28 14336]
.
=============== Created Last 30 ================
.
2011-08-19 23:55:29 -------- d-----w- c:\documents and settings\jess\local settings\application data\AVG Security Toolbar
2011-08-19 23:35:39 -------- d--h--w- C:\$AVG
2011-08-19 23:30:39 -------- d--h--w- c:\documents and settings\all users\application data\Common Files
2011-08-19 23:30:39 -------- d-----w- c:\documents and settings\jess\application data\AVG10
2011-08-19 23:29:26 -------- d-----w- c:\documents and settings\all users\application data\AVG Security Toolbar
2011-08-19 23:27:56 -------- d-----w- c:\windows\system32\drivers\AVG
2011-08-19 23:27:56 -------- d-----w- c:\documents and settings\all users\application data\AVG10
2011-08-19 23:26:57 -------- d-----w- c:\program files\AVG
2011-08-19 23:25:48 -------- d-----w- c:\documents and settings\all users\application data\MFAData
2011-08-17 20:10:48 -------- d-----w- c:\program files\EndItAll
2011-08-12 16:30:02 -------- d-----w- c:\windows\pss
2011-08-11 10:56:25 43408 --sha-w- c:\windows\system32\c_54770.nl_
2011-08-10 16:55:57 -------- d-----w- c:\documents and settings\jess\local settings\application data\{178325B3-2CE0-4328-BB2A-E7D84DC36094}
2011-08-10 05:12:41 139656 -c----w- c:\windows\system32\dllcache\rdpwd.sys
2011-08-10 05:12:21 10496 -c----w- c:\windows\system32\dllcache\ndistapi.sys
2011-08-07 04:12:57 -------- d-----w- c:\windows\SxsCaPendDel
2011-08-07 03:56:56 -------- d-----w- c:\program files\SpaceMonger
2011-08-07 03:56:56 -------- d-----w- c:\documents and settings\jess\application data\SpaceMonger
2011-08-07 03:02:32 -------- d-----w- c:\program files\PlayOnline
2011-08-06 15:17:32 -------- d-----w- c:\program files\FFXiBench3
.
==================== Find3M ====================
.
2011-07-15 13:29:31 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-11 14:24:54 61440 ----a-w- c:\windows\wnUninstall.exe
2011-07-08 14:02:00 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-07-06 23:52:42 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 23:52:42 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-07-03 16:24:34 1409 ----a-w- c:\windows\QTFont.for
2011-06-24 14:10:36 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:36:30 916480 ----a-w- c:\windows\system32\wininet.dll
2011-06-23 18:36:30 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-06-23 18:36:30 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-06-23 12:05:13 385024 ----a-w- c:\windows\system32\html.iec
2011-06-20 17:44:52 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-06-02 14:02:05 1858944 ----a-w- c:\windows\system32\win32k.sys
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: TOSHIBA_MK6032GSX rev.AS311G -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0xAACCC660]<<
_asm { MOV EAX, [ESP+0x4]; MOV ECX, [EAX+0x28]; PUSH EBP; MOV EBP, [ECX+0x4]; PUSH ESI; MOV ESI, [ESP+0x10]; PUSH EDI; MOV EDI, [ESI+0x60]; MOV AL, [EDI]; CMP AL, 0x16; JNZ 0x36; PUSH ESI; }
1 nt!IofCallDriver[0x804E37D5] -> \Device\Harddisk0\DR0[0x8A37AAB8]
3 CLASSPNP[0xF7657FD7] -> nt!IofCallDriver[0x804E37D5] -> [0x89F3B030]
\Driver\00001392[0x8A23C220] -> IRP_MJ_CREATE -> 0xAACCC660
error: Read A device attached to the system is not functioning.
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV SI, 0x7be; MOV CL, 0x4; CMP [SI], CH; JL 0x2d; JNZ 0x3b; }
detected disk devices:
detected hooks:
\Driver\atapi DriverStartIo -> 0x8A35E31B
user & kernel MBR OK
Warning: possible TDL3 rootkit infection !
.
============= FINISH: 1:30:52.50 ===============

BC AdBot (Login to Remove)

 


#2 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:01:03 AM

Posted 20 August 2011 - 07:13 AM

Hi


Please do the following:

Press the WinKey + R to open a run box, then copy/paste the following single-line command into the Run box and click OK:

cmd /c del /f/a/q "C:\WINDOWS\3712394246"


next


Please download TDSSKiller.zip
  • Extract it to your desktop
  • Double click TDSSKiller.exe
  • Press Start Scan
    • Only if Malicious objects are found then ensure Cure is selected
    • Then click Continue > Reboot now
  • Copy and paste the log in your next reply
    • A copy of the log will be saved automatically to the root of the drive (typically C:\)


NEXT

delete the copy of ComboFix that you have on your desktop and download a fresh copy, this time save it directly to your C:\ drive and rename it to spre.com before saving it.


ComboFix



Now boot into safe mode > navigate to C:\spre.com and run it > post the resulting logs


To Enter Safemode
  • Go to Start> Shut off your Computer> Restart
  • As the computer starts to boot-up, Tap the F8 KEY repeatedly,
  • this will bring up a menu.
  • Use the Up and Down Arrow Keys to scroll up to Safemode
  • Then press the Enter Key on your Keyboard
  • go into your usual account

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#3 Spre123

Spre123
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:12:03 AM

Posted 20 August 2011 - 11:02 AM

TDSS log
2011/08/20 11:06:32.0390 4780 TDSS rootkit removing tool 2.5.16.0 Aug 19 2011 17:48:17
2011/08/20 11:06:32.0906 4780 ================================================================================
2011/08/20 11:06:32.0906 4780 SystemInfo:
2011/08/20 11:06:32.0906 4780
2011/08/20 11:06:32.0906 4780 OS Version: 5.1.2600 ServicePack: 3.0
2011/08/20 11:06:32.0906 4780 Product type: Workstation
2011/08/20 11:06:32.0906 4780 ComputerName: TOSHIBA-USER
2011/08/20 11:06:32.0906 4780 UserName: Jess
2011/08/20 11:06:32.0906 4780 Windows directory: C:\WINDOWS
2011/08/20 11:06:32.0906 4780 System windows directory: C:\WINDOWS
2011/08/20 11:06:32.0906 4780 Processor architecture: Intel x86
2011/08/20 11:06:32.0906 4780 Number of processors: 1
2011/08/20 11:06:32.0906 4780 Page size: 0x1000
2011/08/20 11:06:32.0906 4780 Boot type: Normal boot
2011/08/20 11:06:32.0906 4780 ================================================================================
2011/08/20 11:06:37.0140 4780 Initialize success
2011/08/20 11:06:40.0234 4060 ================================================================================
2011/08/20 11:06:40.0234 4060 Scan started
2011/08/20 11:06:40.0234 4060 Mode: Manual;
2011/08/20 11:06:40.0234 4060 ================================================================================
2011/08/20 11:06:52.0703 4060 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/08/20 11:06:53.0046 4060 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
2011/08/20 11:06:53.0515 4060 aeaudio (f13d8e7e1faa31019c25eb17b5fb2662) C:\WINDOWS\system32\drivers\aeaudio.sys
2011/08/20 11:06:53.0687 4060 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/08/20 11:06:54.0000 4060 AegisP (f498fd605c08404b20a48954c722ff74) C:\WINDOWS\system32\DRIVERS\AegisP.sys
2011/08/20 11:06:54.0171 4060 AFD (355556d9e580915118cd7ef736653a89) C:\WINDOWS\System32\drivers\afd.sys
2011/08/20 11:06:54.0734 4060 AgereSoftModem (029e01cb2938bec5af31bf47b6af0159) C:\WINDOWS\system32\DRIVERS\AGRSM.sys
2011/08/20 11:06:55.0812 4060 ApfiltrService (3ed81e8b4709d13e5a38db2d8e792b28) C:\WINDOWS\system32\DRIVERS\Apfiltr.sys
2011/08/20 11:06:56.0171 4060 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2011/08/20 11:06:56.0968 4060 ASCTRM (d880831279ed91f9a4190a2db9539ea9) C:\WINDOWS\system32\drivers\ASCTRM.sys
2011/08/20 11:06:57.0328 4060 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/08/20 11:06:57.0562 4060 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/08/20 11:06:58.0000 4060 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/08/20 11:06:58.0312 4060 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/08/20 11:06:58.0546 4060 AVGIDSDriver (c403e7f715bb0a851a9dfae16ec4ae42) C:\WINDOWS\system32\DRIVERS\AVGIDSDriver.Sys
2011/08/20 11:06:58.0781 4060 AVGIDSEH (1af676db3f3d4cc709cfab2571cf5fc3) C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys
2011/08/20 11:06:58.0953 4060 AVGIDSFilter (4c51e233c87f9ec7598551de554bc99d) C:\WINDOWS\system32\DRIVERS\AVGIDSFilter.Sys
2011/08/20 11:06:59.0156 4060 AVGIDSShim (c3fc426e54f55c1cc3219e415b88e10c) C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys
2011/08/20 11:06:59.0421 4060 Avgldx86 (4e796d3d2c3182b13b3e3b5a2ad4ef0a) C:\WINDOWS\system32\DRIVERS\avgldx86.sys
2011/08/20 11:06:59.0765 4060 Avgmfx86 (5639de66b37d02bd22df4cf3155fba60) C:\WINDOWS\system32\DRIVERS\avgmfx86.sys
2011/08/20 11:06:59.0890 4060 Avgrkx86 (d1baf652eda0ae70896276a1fb32c2d4) C:\WINDOWS\system32\DRIVERS\avgrkx86.sys
2011/08/20 11:07:00.0187 4060 Avgtdix (aaf0ebcad95f2164cffb544e00392498) C:\WINDOWS\system32\DRIVERS\avgtdix.sys
2011/08/20 11:07:00.0546 4060 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/08/20 11:07:00.0843 4060 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/08/20 11:07:01.0140 4060 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/08/20 11:07:01.0468 4060 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/08/20 11:07:01.0640 4060 Cdr4_xp (c3e76b0c05ebf7261abfb08d9e75822e) C:\WINDOWS\system32\drivers\Cdr4_xp.sys
2011/08/20 11:07:01.0906 4060 Cdralw2k (17590dfe29e02842a6e3a463e443d1b9) C:\WINDOWS\system32\drivers\Cdralw2k.sys
2011/08/20 11:07:02.0125 4060 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/08/20 11:07:02.0515 4060 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
2011/08/20 11:07:02.0843 4060 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
2011/08/20 11:07:02.0968 4060 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/08/20 11:07:03.0062 4060 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
2011/08/20 11:07:03.0140 4060 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
2011/08/20 11:07:03.0203 4060 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/08/20 11:07:03.0265 4060 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/08/20 11:07:03.0390 4060 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/08/20 11:07:03.0437 4060 drvmcdb (f41619ae216b51d68dda163805eefaa9) C:\WINDOWS\system32\drivers\drvmcdb.sys
2011/08/20 11:07:03.0484 4060 drvnddm (2ff629c1c443e25d0149b9dfb77e43a8) C:\WINDOWS\system32\drivers\drvnddm.sys
2011/08/20 11:07:03.0546 4060 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/08/20 11:07:03.0609 4060 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
2011/08/20 11:07:03.0656 4060 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
2011/08/20 11:07:03.0703 4060 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
2011/08/20 11:07:03.0734 4060 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
2011/08/20 11:07:03.0859 4060 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/08/20 11:07:03.0968 4060 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/08/20 11:07:04.0015 4060 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/08/20 11:07:04.0109 4060 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/08/20 11:07:04.0218 4060 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/08/20 11:07:04.0375 4060 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/08/20 11:07:04.0484 4060 IFXTPM (95ede689b1cb7045327eb671b8807833) C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS
2011/08/20 11:07:04.0515 4060 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/08/20 11:07:04.0593 4060 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys
2011/08/20 11:07:04.0671 4060 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/08/20 11:07:04.0703 4060 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
2011/08/20 11:07:04.0859 4060 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/08/20 11:07:04.0906 4060 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/08/20 11:07:04.0968 4060 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/08/20 11:07:05.0031 4060 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/08/20 11:07:05.0109 4060 irda (aca5e7b54409f9cb5eed97ed0c81120e) C:\WINDOWS\system32\DRIVERS\irda.sys
2011/08/20 11:07:05.0156 4060 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/08/20 11:07:05.0234 4060 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/08/20 11:07:05.0484 4060 IWCA (872d090ca5c306f62d1982bce6302376) C:\WINDOWS\system32\DRIVERS\iwca.sys
2011/08/20 11:07:05.0515 4060 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/08/20 11:07:05.0593 4060 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2011/08/20 11:07:05.0656 4060 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/08/20 11:07:05.0734 4060 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/08/20 11:07:05.0890 4060 MBAMSwissArmy (b18225739ed9caa83ba2df966e9f43e8) C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2011/08/20 11:07:05.0984 4060 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/08/20 11:07:06.0031 4060 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
2011/08/20 11:07:06.0078 4060 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/08/20 11:07:06.0109 4060 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/08/20 11:07:06.0156 4060 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/08/20 11:07:06.0328 4060 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/08/20 11:07:06.0406 4060 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/08/20 11:07:06.0468 4060 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/08/20 11:07:06.0546 4060 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/08/20 11:07:06.0609 4060 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/08/20 11:07:06.0656 4060 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/08/20 11:07:06.0703 4060 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/08/20 11:07:06.0875 4060 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
2011/08/20 11:07:06.0968 4060 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/08/20 11:07:07.0031 4060 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/08/20 11:07:07.0109 4060 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/08/20 11:07:07.0156 4060 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/08/20 11:07:07.0203 4060 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/08/20 11:07:07.0234 4060 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/08/20 11:07:07.0312 4060 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/08/20 11:07:07.0375 4060 Netdevio (1265eb253ed4ebe4acb3bd5f548ff796) C:\WINDOWS\system32\DRIVERS\netdevio.sys
2011/08/20 11:07:07.0437 4060 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2011/08/20 11:07:07.0500 4060 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/08/20 11:07:07.0562 4060 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/08/20 11:07:07.0703 4060 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/08/20 11:07:08.0031 4060 nv (3f4ca37fd6123776a41be5ad36878383) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
2011/08/20 11:07:08.0250 4060 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/08/20 11:07:08.0281 4060 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/08/20 11:07:08.0343 4060 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2011/08/20 11:07:08.0421 4060 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys
2011/08/20 11:07:08.0453 4060 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/08/20 11:07:08.0500 4060 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/08/20 11:07:08.0531 4060 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/08/20 11:07:08.0609 4060 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/08/20 11:07:08.0656 4060 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\DRIVERS\pcmcia.sys
2011/08/20 11:07:08.0937 4060 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/08/20 11:07:09.0031 4060 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/08/20 11:07:09.0093 4060 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/08/20 11:07:09.0140 4060 PxHelp20 (e42e3433dbb4cffe8fdd91eab29aea8e) C:\WINDOWS\system32\Drivers\PxHelp20.sys
2011/08/20 11:07:09.0328 4060 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/08/20 11:07:09.0406 4060 Rasirda (0207d26ddf796a193ccd9f83047bb5fc) C:\WINDOWS\system32\DRIVERS\rasirda.sys
2011/08/20 11:07:09.0437 4060 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/08/20 11:07:09.0484 4060 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/08/20 11:07:09.0515 4060 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/08/20 11:07:09.0578 4060 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/08/20 11:07:09.0625 4060 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/08/20 11:07:09.0703 4060 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2011/08/20 11:07:09.0843 4060 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/08/20 11:07:09.0906 4060 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/08/20 11:07:10.0000 4060 s24trans (85a26a3bb748dfd3170cdbf45b0dd7fd) C:\WINDOWS\system32\DRIVERS\s24trans.sys
2011/08/20 11:07:10.0078 4060 SCDEmu (1748a0d9a1b3a0fa35d9538a23e32020) C:\WINDOWS\system32\drivers\SCDEmu.sys
2011/08/20 11:07:10.0140 4060 Suspicious file (NoAccess): C:\WINDOWS\system32\drivers\SCDEmu.sys. md5: 1748a0d9a1b3a0fa35d9538a23e32020
2011/08/20 11:07:10.0156 4060 SCDEmu - detected Rootkit.Win32.ZAccess.c (0)
2011/08/20 11:07:10.0406 4060 sdbus (8d04819a3ce51b9eb47e5689b44d43c4) C:\WINDOWS\system32\DRIVERS\sdbus.sys
2011/08/20 11:07:10.0453 4060 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/08/20 11:07:10.0531 4060 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
2011/08/20 11:07:10.0593 4060 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/08/20 11:07:10.0687 4060 SMCIRDA (9951b523fe6820f29ef010680cb692d2) C:\WINDOWS\system32\DRIVERS\smcirda.sys
2011/08/20 11:07:10.0750 4060 smwdm (014ab093e6452ea88031bb6e22919bb5) C:\WINDOWS\system32\drivers\smwdm.sys
2011/08/20 11:07:10.0859 4060 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/08/20 11:07:10.0906 4060 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/08/20 11:07:10.0984 4060 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/08/20 11:07:11.0046 4060 sscdbhk5 (1cbd1b58a32de97899f5290b05f856db) C:\WINDOWS\system32\drivers\sscdbhk5.sys
2011/08/20 11:07:11.0078 4060 ssrtln (7fb07ac152d7a87e66204860002bd9a4) C:\WINDOWS\system32\drivers\ssrtln.sys
2011/08/20 11:07:11.0125 4060 StillCam (a9573045baa16eab9b1085205b82f1ed) C:\WINDOWS\system32\DRIVERS\serscan.sys
2011/08/20 11:07:11.0171 4060 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/08/20 11:07:11.0218 4060 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/08/20 11:07:11.0453 4060 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/08/20 11:07:11.0531 4060 TBiosDrv (eeca2b57545e7b7be949b5e70e31444f) C:\WINDOWS\system32\drivers\TBiosDrv.sys
2011/08/20 11:07:11.0578 4060 TBtnKey (1f1b3aa534db6107118bf7942275f100) C:\WINDOWS\system32\DRIVERS\TBtnKey.sys
2011/08/20 11:07:11.0656 4060 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/08/20 11:07:11.0718 4060 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/08/20 11:07:11.0781 4060 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/08/20 11:07:11.0875 4060 TEchoCan (baf4c688572267c398411f374454ed21) C:\WINDOWS\system32\DRIVERS\TEchoCan.sys
2011/08/20 11:07:11.0937 4060 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/08/20 11:07:12.0015 4060 tfsnboio (2da3ca4022abb0802de7eeda574e78d6) C:\WINDOWS\system32\dla\tfsnboio.sys
2011/08/20 11:07:12.0031 4060 tfsncofs (c8d6928759b77701c21dc90ad61197f2) C:\WINDOWS\system32\dla\tfsncofs.sys
2011/08/20 11:07:12.0062 4060 tfsndrct (bacdef5510fa643683cddca418e49446) C:\WINDOWS\system32\dla\tfsndrct.sys
2011/08/20 11:07:12.0093 4060 tfsndres (3fc9f390fac563c3d3910d540adbd408) C:\WINDOWS\system32\dla\tfsndres.sys
2011/08/20 11:07:12.0109 4060 tfsnifs (6aef3ec0b64689536891a9b96e9d7b82) C:\WINDOWS\system32\dla\tfsnifs.sys
2011/08/20 11:07:12.0140 4060 tfsnopio (7239873a72dd456f6e74e6987cdb9687) C:\WINDOWS\system32\dla\tfsnopio.sys
2011/08/20 11:07:12.0171 4060 tfsnpool (b78631e3593ddd76a4a8ba7cb8e32302) C:\WINDOWS\system32\dla\tfsnpool.sys
2011/08/20 11:07:12.0187 4060 tfsnudf (9e8b4abb93e5784fc4e5d3202566cc7a) C:\WINDOWS\system32\dla\tfsnudf.sys
2011/08/20 11:07:12.0218 4060 tfsnudfa (056fa0a11ba4cd688e1e40e48ffee921) C:\WINDOWS\system32\dla\tfsnudfa.sys
2011/08/20 11:07:12.0296 4060 Thpdrv (9a932560e9246b0d370fb97789bc0fd4) C:\WINDOWS\system32\DRIVERS\thpdrv.sys
2011/08/20 11:07:12.0406 4060 Thpevm (beeca51c9ef368a1038e455278e4715e) C:\WINDOWS\system32\DRIVERS\Thpevm.SYS
2011/08/20 11:07:12.0468 4060 TMEI3E (684bfb1e9abb05d3f48c53f3cd16a3e6) C:\WINDOWS\system32\Drivers\TMEI3E.SYS
2011/08/20 11:07:12.0546 4060 TMicAry (6dad418085651a1a9a2cb9fc5abb40d3) C:\WINDOWS\system32\DRIVERS\TMicAry.sys
2011/08/20 11:07:12.0625 4060 tosporte (fe6ce38a53db70770b805262afceccef) C:\WINDOWS\system32\DRIVERS\tosporte.sys
2011/08/20 11:07:12.0671 4060 Tosrfbd (81546df5dea8abf2c8864d6d1f724b35) C:\WINDOWS\system32\Drivers\tosrfbd.sys
2011/08/20 11:07:12.0703 4060 Tosrfbnp (fe200eece7521061cdad658c6ee4f341) C:\WINDOWS\system32\Drivers\tosrfbnp.sys
2011/08/20 11:07:12.0734 4060 Tosrfcom (d185be751021bcf1e5d58566d408314a) C:\WINDOWS\system32\Drivers\tosrfcom.sys
2011/08/20 11:07:12.0765 4060 tosrfec (cc42fdbe9760ca1639e23158ab995f98) C:\WINDOWS\system32\DRIVERS\tosrfec.sys
2011/08/20 11:07:12.0796 4060 Tosrfhid (341612b9758054e5965bcd6ae111b8f9) C:\WINDOWS\system32\DRIVERS\Tosrfhid.sys
2011/08/20 11:07:12.0843 4060 tosrfnds (c52fd27b9adf3a1f22cb90e6bcf9b0cb) C:\WINDOWS\system32\DRIVERS\tosrfnds.sys
2011/08/20 11:07:12.0890 4060 Tosrfusb (ddb8a339e57d514768f45d33b11bdb50) C:\WINDOWS\system32\Drivers\tosrfusb.sys
2011/08/20 11:07:13.0000 4060 TVALZ (ae86154a5cc63530d840fd30c04b870f) C:\WINDOWS\system32\DRIVERS\TVALZ.SYS
2011/08/20 11:07:13.0062 4060 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/08/20 11:07:13.0171 4060 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/08/20 11:07:13.0250 4060 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
2011/08/20 11:07:13.0312 4060 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/08/20 11:07:13.0359 4060 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/08/20 11:07:13.0453 4060 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/08/20 11:07:13.0500 4060 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/08/20 11:07:13.0546 4060 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/08/20 11:07:13.0593 4060 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/08/20 11:07:13.0671 4060 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/08/20 11:07:13.0718 4060 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/08/20 11:07:13.0781 4060 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/08/20 11:07:13.0968 4060 w29n51 (c89da341fcc883a3d79dc11727484fc2) C:\WINDOWS\system32\DRIVERS\w29n51.sys
2011/08/20 11:07:14.0171 4060 WacomPen (aced8c149b30f8496c237bcba3727b48) C:\WINDOWS\system32\DRIVERS\wacompen.sys
2011/08/20 11:07:14.0234 4060 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/08/20 11:07:14.0359 4060 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/08/20 11:07:14.0531 4060 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2011/08/20 11:07:14.0578 4060 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2011/08/20 11:07:14.0703 4060 yukonwxp (bac4e920c920168c302c90c0f37740f6) C:\WINDOWS\system32\DRIVERS\yk51x86.sys
2011/08/20 11:07:14.0781 4060 MBR (0x1B8) (2a38a2f9deea228d8e1783700ed15448) \Device\Harddisk0\DR0
2011/08/20 11:07:14.0781 4060 \Device\Harddisk0\DR0 - detected Rootkit.Win32.TDSS.tdl4 (0)
2011/08/20 11:07:14.0796 4060 Boot (0x1200) (844ac0c17dfb1fca702d24507a921352) \Device\Harddisk0\DR0\Partition0
2011/08/20 11:07:14.0796 4060 ================================================================================
2011/08/20 11:07:14.0796 4060 Scan finished
2011/08/20 11:07:14.0796 4060 ================================================================================
2011/08/20 11:07:14.0812 4676 Detected object count: 2
2011/08/20 11:07:14.0812 4676 Actual detected object count: 2
2011/08/20 11:07:27.0390 4676 SCDEmu (1748a0d9a1b3a0fa35d9538a23e32020) C:\WINDOWS\system32\drivers\SCDEmu.sys
2011/08/20 11:07:27.0406 4676 Suspicious file (NoAccess): C:\WINDOWS\system32\drivers\SCDEmu.sys. md5: 1748a0d9a1b3a0fa35d9538a23e32020
2011/08/20 11:07:29.0125 4676 Backup copy not found, trying to cure infected file..
2011/08/20 11:07:29.0187 4676 C:\WINDOWS\system32\drivers\SCDEmu.sys - Cure failed (FFFFFFFF)
2011/08/20 11:07:29.0187 4676 C:\WINDOWS\system32\drivers\SCDEmu.sys - processing error
2011/08/20 11:07:29.0187 4676 Rootkit.Win32.ZAccess.c(SCDEmu) - User select action: Cure
2011/08/20 11:07:29.0234 4676 \Device\Harddisk0\DR0 (Rootkit.Win32.TDSS.tdl4) - will be cured after reboot
2011/08/20 11:07:29.0234 4676 \Device\Harddisk0\DR0 - ok
2011/08/20 11:07:29.0234 4676 Rootkit.Win32.TDSS.tdl4(\Device\Harddisk0\DR0) - User select action: Cure
2011/08/20 11:07:59.0312 4632 Deinitialize success


Combo Fix ( aparently there are 2?)
1st:
ComboFix 11-08-19.02 - Jess 08/20/2011 11:32:37.1.1 - x86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.1280 [GMT -4:00]
Running from: C:\Spre.com.exe
AV: AVG Internet Security 2011 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator\WINDOWS
c:\documents and settings\Default User\WINDOWS
c:\documents and settings\Jess\Application Data\Adobe\plugs
c:\documents and settings\Jess\Application Data\Adobe\shed
c:\documents and settings\Jess\Local Settings\Application Data\{178325B3-2CE0-4328-BB2A-E7D84DC36094}
c:\documents and settings\Jess\Local Settings\Application Data\{178325B3-2CE0-4328-BB2A-E7D84DC36094}\chrome.manifest
c:\documents and settings\Jess\Local Settings\Application Data\{178325B3-2CE0-4328-BB2A-E7D84DC36094}\chrome\content\_cfg.js
c:\documents and settings\Jess\Local Settings\Application Data\{178325B3-2CE0-4328-BB2A-E7D84DC36094}\chrome\content\overlay.xul
c:\documents and settings\Jess\Local Settings\Application Data\{178325B3-2CE0-4328-BB2A-E7D84DC36094}\install.rdf
c:\program files\CouponAlert_2pEI
c:\windows\$NtUninstallKB49030$
c:\windows\$NtUninstallKB49030$\111429341\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}
c:\windows\$NtUninstallKB49030$\111429341\click.tlb
c:\windows\$NtUninstallKB49030$\111429341\L\pnmwrqfu
c:\windows\$NtUninstallKB49030$\111429341\loader.tlb
c:\windows\$NtUninstallKB49030$\111429341\U\@00000001
c:\windows\$NtUninstallKB49030$\111429341\U\@000000c0
c:\windows\$NtUninstallKB49030$\111429341\U\@000000cb
c:\windows\$NtUninstallKB49030$\111429341\U\@000000cf
c:\windows\$NtUninstallKB49030$\111429341\U\@80000000
c:\windows\$NtUninstallKB49030$\111429341\U\@800000c0
c:\windows\$NtUninstallKB49030$\111429341\U\@800000cb
c:\windows\$NtUninstallKB49030$\111429341\U\@800000cf
c:\windows\$NtUninstallKB49030$\16735416
c:\windows\assembly\GAC_MSIL\desktop.ini
c:\windows\clear.bat
c:\windows\system32\config\systemprofile\WINDOWS
c:\windows\system32\drivers\scdemu.sys
.
c:\windows\system32\drivers\scdemu.sys . . . is infected!! . . . Failed to find a valid replacement.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_COUPONALERT_2PSERVICE
-------\Service_6a446dd
-------\Legacy_SCDEmu
-------\Service_SCDEmu
.
.
((((((((((((((((((((((((( Files Created from 2011-07-20 to 2011-08-20 )))))))))))))))))))))))))))))))
.
.
2011-08-19 23:55 . 2011-08-19 23:55 -------- d-----w- c:\documents and settings\Jess\Local Settings\Application Data\AVG Security Toolbar
2011-08-19 23:35 . 2011-08-19 23:35 -------- d-----w- C:\$AVG
2011-08-19 23:30 . 2011-08-19 23:30 -------- d--h--w- c:\documents and settings\All Users\Application Data\Common Files
2011-08-19 23:30 . 2011-08-19 23:30 -------- d-----w- c:\documents and settings\Jess\Application Data\AVG10
2011-08-19 23:29 . 2011-08-19 23:29 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2011-08-19 23:27 . 2011-08-19 23:41 -------- d-----w- c:\windows\system32\drivers\AVG
2011-08-19 23:27 . 2011-08-19 23:37 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG10
2011-08-19 23:26 . 2011-08-19 23:26 -------- d-----w- c:\program files\AVG
2011-08-19 23:25 . 2011-08-19 23:27 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData
2011-08-17 20:10 . 2011-08-17 20:15 -------- d-----w- c:\program files\EndItAll
2011-08-11 10:56 . 2011-08-20 15:50 43408 --sha-w- c:\windows\system32\c_54770.nl_
2011-08-10 05:12 . 2011-06-24 14:10 139656 -c----w- c:\windows\system32\dllcache\rdpwd.sys
2011-08-10 05:12 . 2011-07-08 14:02 10496 -c----w- c:\windows\system32\dllcache\ndistapi.sys
2011-08-07 04:12 . 2011-08-10 17:57 -------- d-----w- c:\windows\SxsCaPendDel
2011-08-07 03:56 . 2011-08-07 03:56 -------- d-----w- c:\program files\SpaceMonger
2011-08-07 03:56 . 2011-08-07 03:56 -------- d-----w- c:\documents and settings\Jess\Application Data\SpaceMonger
2011-08-07 03:02 . 2011-08-07 03:02 -------- d-----w- c:\program files\PlayOnline
2011-08-06 15:17 . 2011-08-06 15:17 -------- d-----w- c:\program files\FFXiBench3
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-15 13:29 . 2005-03-28 18:59 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-11 14:24 . 2011-07-11 14:24 61440 ----a-w- c:\windows\wnUninstall.exe
2011-07-08 14:02 . 2005-03-28 18:59 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-07-06 23:52 . 2011-01-02 00:36 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 23:52 . 2011-01-02 00:36 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-07-03 16:24 . 2011-07-03 16:24 1409 ----a-w- c:\windows\QTFont.for
2011-06-24 14:10 . 2005-03-28 20:10 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:36 . 2005-03-28 18:59 916480 ----a-w- c:\windows\system32\wininet.dll
2011-06-23 18:36 . 2005-03-28 18:59 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-06-23 18:36 . 2005-03-28 18:59 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-06-23 12:05 . 2005-03-28 18:59 385024 ----a-w- c:\windows\system32\html.iec
2011-06-20 17:44 . 2005-03-28 18:59 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-06-02 14:02 . 2005-03-28 18:59 1858944 ----a-w- c:\windows\system32\win32k.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll" [2011-07-26 2532680]
.
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2011-07-26 14:15 2532680 ----a-w- c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll" [2011-07-26 2532680]
.
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2004-12-30 65536]
"CarMD"="c:\program files\CarMD\CarMD.exe" [2010-04-07 796672]
"cdloader"="c:\documents and settings\Jess\Application Data\mjusbsp\cdloader2.exe" [2011-05-16 50592]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CFSServ.exe"="CFSServ.exe -NoClient" [X]
"TabletWizard"="c:\windows\help\SplshWrp.exe" [2008-04-14 16384]
"TabletTip"="c:\program files\Common Files\microsoft shared\ink\tabtip.exe" [2008-04-14 271872]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-03-15 5525504]
"nwiz"="nwiz.exe" [2005-03-15 1490944]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"00THotkey"="c:\windows\system32\00THotkey.exe" [2005-01-28 245760]
"CrossMenu"="c:\program files\Toshiba\CrossMenu\CrossMenu.exe" [2005-01-07 798720]
"000StTHK"="000StTHK.exe" [2001-06-24 24576]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2004-03-23 196608]
"TFNF5"="TFNF5.exe" [2004-06-28 73728]
"SmoothView"="c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2004-09-15 135168]
"TMERzCtl.EXE"="c:\program files\TOSHIBA\TME3\TMERzCtl.EXE" [2005-03-18 81920]
"DpUtil"="c:\program files\TOSHIBA\DualPointUtility\TEDTray.exe" [2003-11-12 159744]
"NDSTray.exe"="NDSTray.exe" [BU]
"TosHKCW.exe"="c:\program files\TOSHIBA\Wireless Hotkey\TosHKCW.exe" [2002-09-09 49152]
"TAudEffect"="c:\program files\TOSHIBA\TAudEffect\TAudEff.exe" [2005-01-14 340032]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-01-14 122939]
"TosRotation"="c:\program files\TOSHIBA\TOSHIBA Rotation Utility\TRot.exe" [2004-12-14 266240]
"TFncKy"="TFncKy.exe" [BU]
"TAcelMgr"="c:\program files\TOSHIBA\Acceleration Utilities\TAcelMgr\TAcelMgr.exe" [2004-12-16 90112]
"TSkrMain"="c:\program files\TOSHIBA\Acceleration Utilities\Shaker\TSkrMain.exe" [2004-07-01 49152]
"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2003-09-06 184320]
"AGRSMMSG"="AGRSMMSG.exe" [2004-12-22 88358]
"TPSMain"="TPSMain.exe" [2005-03-12 278528]
"TPSODDCtl"="TPSODDCtl.exe" [2005-03-12 110592]
"PINGER"="c:\toshiba\IVP\ISM\pinger.exe" [2005-03-17 151552]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-15 385024]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-11-11 288088]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2009-03-15 180224]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2010-11-10 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]
"AVG_TRAY"="c:\program files\AVG\AVG10\avgtray.exe" [2011-04-18 2334560]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2010-01-10 519584]
.
c:\documents and settings\Jess\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2005-3-10 483328]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-27 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
2004-10-15 18:27 110592 ----a-w- c:\program files\Intel\Wireless\Bin\LgNotify.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\loginkey]
2008-04-14 00:11 47104 ----a-w- c:\program files\Common Files\Microsoft Shared\Ink\loginkey.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TabBtnWL]
2002-08-29 11:41 11776 ----a-w- c:\windows\system32\tabbtnwl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpgwlnotify]
2008-04-14 00:12 32256 ----a-w- c:\windows\system32\tpgwlnot.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\TOSHIBA\\ivp\\NetInt\\Netint.exe"=
"c:\\TOSHIBA\\Ivp\\ISM\\pinger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgmfapx.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgemcx.exe"=
"c:\\Documents and Settings\\Jess\\Application Data\\mjusbsp\\magicJack.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2/22/2011 8:13 AM 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [3/16/2011 4:03 PM 32592]
R0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\drivers\thpdrv.sys [12/28/2004 3:31 AM 16384]
R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\drivers\Thpevm.sys [3/28/2005 4:47 PM 6528]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [1/7/2011 6:41 AM 248656]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [4/5/2011 12:59 AM 297168]
R1 TMEI3E;TMEI3E;c:\windows\system32\drivers\TMEI3E.sys [3/28/2005 4:41 PM 5888]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG10\avgwdsvc.exe [2/8/2011 5:33 AM 269520]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [4/14/2011 9:28 PM 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2/10/2011 7:53 AM 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2/10/2011 7:53 AM 27216]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [3/28/2005 4:19 PM 32640]
R3 TBtnKey;TOSHIBA Tablet PC Buttons Type N HID Driver;c:\windows\system32\drivers\TBtnKey.sys [3/28/2005 5:55 PM 8832]
R3 TEchoCan;Toshiba Audio Effect;c:\windows\system32\drivers\TEchoCan.sys [3/28/2005 4:44 PM 410112]
R3 TMicAry;Toshiba Audio Effect with MicArray;c:\windows\system32\drivers\TMicAry.sys [3/28/2005 4:44 PM 138240]
R3 WacomPen;Wacom Serial Pen HID Driver;c:\windows\system32\drivers\wacompen.sys [3/28/2005 8:08 AM 14208]
S1 MpKsl22fc82fa;MpKsl22fc82fa;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E47E3F48-5B7D-48A7-A4FD-5BDB1F806B74}\MpKsl22fc82fa.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E47E3F48-5B7D-48A7-A4FD-5BDB1F806B74}\MpKsl22fc82fa.sys [?]
S1 MpKsl5a4bfe84;MpKsl5a4bfe84;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E47E3F48-5B7D-48A7-A4FD-5BDB1F806B74}\MpKsl5a4bfe84.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E47E3F48-5B7D-48A7-A4FD-5BDB1F806B74}\MpKsl5a4bfe84.sys [?]
S1 MpKsl66528f0b;MpKsl66528f0b;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E47E3F48-5B7D-48A7-A4FD-5BDB1F806B74}\MpKsl66528f0b.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E47E3F48-5B7D-48A7-A4FD-5BDB1F806B74}\MpKsl66528f0b.sys [?]
S1 MpKslab3f00be;MpKslab3f00be;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{568A35AE-AB9F-4417-B18E-4DD59FF947FB}\MpKslab3f00be.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{568A35AE-AB9F-4417-B18E-4DD59FF947FB}\MpKslab3f00be.sys [?]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [4/18/2011 5:39 PM 7398752]
S2 Tmesbs;Tmesbs32;"c:\program files\TOSHIBA\TME3\Tmesbs32.exe" /Service --> c:\program files\TOSHIBA\TME3\Tmesbs32.exe [?]
S2 Tmesrv;Tmesrv3;"c:\program files\TOSHIBA\TME3\Tmesrv31.exe" /Service --> c:\program files\TOSHIBA\TME3\Tmesrv31.exe [?]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG10\Toolbar\ToolbarBroker.exe [8/19/2011 7:29 PM 1025352]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [1/15/2010 8:49 AM 227232]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [3/28/2005 2:59 PM 14336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
Contents of the 'Scheduled Tasks' folder
.
2011-08-20 c:\windows\Tasks\At1.job
- c:\program files\HP\HP Deskjet 3050 J610 series\Bin\HPCustPartic.exe [2010-06-14 21:07]
.
2011-08-20 c:\windows\Tasks\At2.job
- c:\program files\HP\HP Deskjet 3050 J610 series\Bin\HPCustPartic.exe [2010-06-14 21:07]
.
2011-08-18 c:\windows\Tasks\At3.job
- c:\program files\HP\HP Deskjet 3050 J610 series\Bin\HPCustPartic.exe [2010-06-14 21:07]
.
2011-08-18 c:\windows\Tasks\At4.job
- c:\program files\HP\HP Deskjet 3050 J610 series\Bin\HPCustPartic.exe [2010-06-14 21:07]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.toshibadirect.com/dpdstart
IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: Backward Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
IE: Download all with Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm
IE: Download selected with Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm
IE: Download video with Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: Download with Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: Similar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.0.1
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll
FF - ProfilePath - c:\documents and settings\Jess\Application Data\Mozilla\Firefox\Profiles\rwnvxccz.default\
FF - prefs.js: browser.search.selectedEngine - AVG Secure Search
FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=4e4ef1d6&v=7.007.026.001&i=26&tp=ab&iy=&ychte=us&lng=en-US&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: DivX Plus Web Player HTML5 &lt;video&gt;: {23fcfd51-4958-4f00-80a3-ae97e717ed8b} - c:\program files\DivX\DivX Plus Web Player\firefox\html5video
FF - Ext: DivX HiQ: {6904342A-8307-11DF-A508-4AE2DFD72085} - c:\program files\DivX\DivX Plus Web Player\firefox\wpa
FF - Ext: AVG Safe Search: {1E73965B-8B48-48be-9C8D-68B920ABC1C4} - c:\program files\AVG\AVG10\Firefox4
FF - Ext: AVG Security Toolbar em:version=7.007.026.001 em:displayname=AVG Security Toolbar em:iconURL=chrome://tavgp/skin/logo.ico em:creator=AVG Technologies em:description=AVG Security Toolbar em:homepageURL=http://www.avg.com >: avg@igeared - c:\program files\AVG\AVG10\Toolbar\Firefox\avg@igeared
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-20 11:52
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
.
c:\windows\3712394246:4183537954.exe 816 bytes executable
c:\windows\$NtUninstallKB49030$:SummaryInformation 0 bytes hidden from API
.
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\6a446dd]
"ImagePath"="\systemroot\3712394246:4183537954.exe"
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Microsoft Shared\Ink\KeyboardSurrogate.exe
c:\program files\Intel\Wireless\Bin\ZcfgSvc.exe
c:\windows\SYSTEM32\WISPTIS.EXE
c:\windows\System32\tabbtnu.exe
c:\program files\Common Files\Microsoft Shared\Ink\TCServer.exe
c:\windows\system32\TFNF5.exe
c:\program files\TOSHIBA\ConfigFree\NDSTray.exe
c:\windows\AGRSMMSG.exe
c:\program files\Apoint2K\Apntex.exe
c:\windows\system32\TPSODDCtl.exe
c:\windows\system32\TPSBattM.exe
c:\program files\TOSHIBA\ConfigFree\CFSServ.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\3712394246:4183537954.exe
c:\program files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
c:\program files\AVG\AVG10\avgam.exe
c:\program files\AVG\AVG10\avgnsx.exe
c:\program files\AVG\AVG10\avgemcx.exe
c:\program files\AVG\AVG10\avgchsvx.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\dwwin.exe
c:\program files\AVG\AVG10\avgmfapx.exe
c:\program files\AVG\AVG10\avgdiagex.exe
.
**************************************************************************
.
Completion time: 2011-08-20 11:56:53 - machine was rebooted
ComboFix-quarantined-files.txt 2011-08-20 15:56
.
Pre-Run: 8,069,369,856 bytes free
Post-Run: 6,608,699,392 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /forceresetreg
.
- - End Of File - - E61BC7EF3F0C30C18C9C03F0E1375ADB


2nd:
ComboFix 11-08-19.02 - Jess 08/20/2011 11:32:37.1.1 - x86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.1280 [GMT -4:00]
Running from: C:\Spre.com.exe
AV: AVG Internet Security 2011 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator\WINDOWS
c:\documents and settings\Default User\WINDOWS
c:\documents and settings\Jess\Application Data\Adobe\plugs
c:\documents and settings\Jess\Application Data\Adobe\shed
c:\documents and settings\Jess\Local Settings\Application Data\{178325B3-2CE0-4328-BB2A-E7D84DC36094}
c:\documents and settings\Jess\Local Settings\Application Data\{178325B3-2CE0-4328-BB2A-E7D84DC36094}\chrome.manifest
c:\documents and settings\Jess\Local Settings\Application Data\{178325B3-2CE0-4328-BB2A-E7D84DC36094}\chrome\content\_cfg.js
c:\documents and settings\Jess\Local Settings\Application Data\{178325B3-2CE0-4328-BB2A-E7D84DC36094}\chrome\content\overlay.xul
c:\documents and settings\Jess\Local Settings\Application Data\{178325B3-2CE0-4328-BB2A-E7D84DC36094}\install.rdf
c:\program files\CouponAlert_2pEI
c:\windows\$NtUninstallKB49030$
c:\windows\$NtUninstallKB49030$\111429341\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}
c:\windows\$NtUninstallKB49030$\111429341\click.tlb
c:\windows\$NtUninstallKB49030$\111429341\L\pnmwrqfu
c:\windows\$NtUninstallKB49030$\111429341\loader.tlb
c:\windows\$NtUninstallKB49030$\111429341\U\@00000001
c:\windows\$NtUninstallKB49030$\111429341\U\@000000c0
c:\windows\$NtUninstallKB49030$\111429341\U\@000000cb
c:\windows\$NtUninstallKB49030$\111429341\U\@000000cf
c:\windows\$NtUninstallKB49030$\111429341\U\@80000000
c:\windows\$NtUninstallKB49030$\111429341\U\@800000c0
c:\windows\$NtUninstallKB49030$\111429341\U\@800000cb
c:\windows\$NtUninstallKB49030$\111429341\U\@800000cf
c:\windows\$NtUninstallKB49030$\16735416
c:\windows\assembly\GAC_MSIL\desktop.ini
c:\windows\clear.bat
c:\windows\system32\config\systemprofile\WINDOWS
c:\windows\system32\drivers\scdemu.sys
.
c:\windows\system32\drivers\scdemu.sys . . . is infected!! . . . Failed to find a valid replacement.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_COUPONALERT_2PSERVICE
-------\Service_6a446dd
-------\Legacy_SCDEmu
-------\Service_SCDEmu
.
.
((((((((((((((((((((((((( Files Created from 2011-07-20 to 2011-08-20 )))))))))))))))))))))))))))))))
.
.
2011-08-19 23:55 . 2011-08-19 23:55 -------- d-----w- c:\documents and settings\Jess\Local Settings\Application Data\AVG Security Toolbar
2011-08-19 23:35 . 2011-08-19 23:35 -------- d-----w- C:\$AVG
2011-08-19 23:30 . 2011-08-19 23:30 -------- d--h--w- c:\documents and settings\All Users\Application Data\Common Files
2011-08-19 23:30 . 2011-08-19 23:30 -------- d-----w- c:\documents and settings\Jess\Application Data\AVG10
2011-08-19 23:29 . 2011-08-19 23:29 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2011-08-19 23:27 . 2011-08-19 23:41 -------- d-----w- c:\windows\system32\drivers\AVG
2011-08-19 23:27 . 2011-08-19 23:37 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG10
2011-08-19 23:26 . 2011-08-19 23:26 -------- d-----w- c:\program files\AVG
2011-08-19 23:25 . 2011-08-19 23:27 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData
2011-08-17 20:10 . 2011-08-17 20:15 -------- d-----w- c:\program files\EndItAll
2011-08-11 10:56 . 2011-08-20 15:50 43408 --sha-w- c:\windows\system32\c_54770.nl_
2011-08-10 05:12 . 2011-06-24 14:10 139656 -c----w- c:\windows\system32\dllcache\rdpwd.sys
2011-08-10 05:12 . 2011-07-08 14:02 10496 -c----w- c:\windows\system32\dllcache\ndistapi.sys
2011-08-07 04:12 . 2011-08-10 17:57 -------- d-----w- c:\windows\SxsCaPendDel
2011-08-07 03:56 . 2011-08-07 03:56 -------- d-----w- c:\program files\SpaceMonger
2011-08-07 03:56 . 2011-08-07 03:56 -------- d-----w- c:\documents and settings\Jess\Application Data\SpaceMonger
2011-08-07 03:02 . 2011-08-07 03:02 -------- d-----w- c:\program files\PlayOnline
2011-08-06 15:17 . 2011-08-06 15:17 -------- d-----w- c:\program files\FFXiBench3
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-15 13:29 . 2005-03-28 18:59 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-11 14:24 . 2011-07-11 14:24 61440 ----a-w- c:\windows\wnUninstall.exe
2011-07-08 14:02 . 2005-03-28 18:59 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-07-06 23:52 . 2011-01-02 00:36 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 23:52 . 2011-01-02 00:36 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-07-03 16:24 . 2011-07-03 16:24 1409 ----a-w- c:\windows\QTFont.for
2011-06-24 14:10 . 2005-03-28 20:10 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:36 . 2005-03-28 18:59 916480 ----a-w- c:\windows\system32\wininet.dll
2011-06-23 18:36 . 2005-03-28 18:59 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-06-23 18:36 . 2005-03-28 18:59 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-06-23 12:05 . 2005-03-28 18:59 385024 ----a-w- c:\windows\system32\html.iec
2011-06-20 17:44 . 2005-03-28 18:59 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-06-02 14:02 . 2005-03-28 18:59 1858944 ----a-w- c:\windows\system32\win32k.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll" [2011-07-26 2532680]
.
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2011-07-26 14:15 2532680 ----a-w- c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll" [2011-07-26 2532680]
.
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2004-12-30 65536]
"CarMD"="c:\program files\CarMD\CarMD.exe" [2010-04-07 796672]
"cdloader"="c:\documents and settings\Jess\Application Data\mjusbsp\cdloader2.exe" [2011-05-16 50592]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CFSServ.exe"="CFSServ.exe -NoClient" [X]
"TabletWizard"="c:\windows\help\SplshWrp.exe" [2008-04-14 16384]
"TabletTip"="c:\program files\Common Files\microsoft shared\ink\tabtip.exe" [2008-04-14 271872]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-03-15 5525504]
"nwiz"="nwiz.exe" [2005-03-15 1490944]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"00THotkey"="c:\windows\system32\00THotkey.exe" [2005-01-28 245760]
"CrossMenu"="c:\program files\Toshiba\CrossMenu\CrossMenu.exe" [2005-01-07 798720]
"000StTHK"="000StTHK.exe" [2001-06-24 24576]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2004-03-23 196608]
"TFNF5"="TFNF5.exe" [2004-06-28 73728]
"SmoothView"="c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2004-09-15 135168]
"TMERzCtl.EXE"="c:\program files\TOSHIBA\TME3\TMERzCtl.EXE" [2005-03-18 81920]
"DpUtil"="c:\program files\TOSHIBA\DualPointUtility\TEDTray.exe" [2003-11-12 159744]
"NDSTray.exe"="NDSTray.exe" [BU]
"TosHKCW.exe"="c:\program files\TOSHIBA\Wireless Hotkey\TosHKCW.exe" [2002-09-09 49152]
"TAudEffect"="c:\program files\TOSHIBA\TAudEffect\TAudEff.exe" [2005-01-14 340032]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-01-14 122939]
"TosRotation"="c:\program files\TOSHIBA\TOSHIBA Rotation Utility\TRot.exe" [2004-12-14 266240]
"TFncKy"="TFncKy.exe" [BU]
"TAcelMgr"="c:\program files\TOSHIBA\Acceleration Utilities\TAcelMgr\TAcelMgr.exe" [2004-12-16 90112]
"TSkrMain"="c:\program files\TOSHIBA\Acceleration Utilities\Shaker\TSkrMain.exe" [2004-07-01 49152]
"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2003-09-06 184320]
"AGRSMMSG"="AGRSMMSG.exe" [2004-12-22 88358]
"TPSMain"="TPSMain.exe" [2005-03-12 278528]
"TPSODDCtl"="TPSODDCtl.exe" [2005-03-12 110592]
"PINGER"="c:\toshiba\IVP\ISM\pinger.exe" [2005-03-17 151552]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-15 385024]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-11-11 288088]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2009-03-15 180224]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2010-11-10 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]
"AVG_TRAY"="c:\program files\AVG\AVG10\avgtray.exe" [2011-04-18 2334560]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2010-01-10 519584]
.
c:\documents and settings\Jess\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2005-3-10 483328]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-27 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
2004-10-15 18:27 110592 ----a-w- c:\program files\Intel\Wireless\Bin\LgNotify.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\loginkey]
2008-04-14 00:11 47104 ----a-w- c:\program files\Common Files\Microsoft Shared\Ink\loginkey.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TabBtnWL]
2002-08-29 11:41 11776 ----a-w- c:\windows\system32\tabbtnwl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpgwlnotify]
2008-04-14 00:12 32256 ----a-w- c:\windows\system32\tpgwlnot.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\TOSHIBA\\ivp\\NetInt\\Netint.exe"=
"c:\\TOSHIBA\\Ivp\\ISM\\pinger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgmfapx.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG10\\avgemcx.exe"=
"c:\\Documents and Settings\\Jess\\Application Data\\mjusbsp\\magicJack.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2/22/2011 8:13 AM 22992]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [3/16/2011 4:03 PM 32592]
R0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\drivers\thpdrv.sys [12/28/2004 3:31 AM 16384]
R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\drivers\Thpevm.sys [3/28/2005 4:47 PM 6528]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [1/7/2011 6:41 AM 248656]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [4/5/2011 12:59 AM 297168]
R1 TMEI3E;TMEI3E;c:\windows\system32\drivers\TMEI3E.sys [3/28/2005 4:41 PM 5888]
R2 avgwd;AVG WatchDog;c:\program files\AVG\AVG10\avgwdsvc.exe [2/8/2011 5:33 AM 269520]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [4/14/2011 9:28 PM 134480]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2/10/2011 7:53 AM 24144]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2/10/2011 7:53 AM 27216]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [3/28/2005 4:19 PM 32640]
R3 TBtnKey;TOSHIBA Tablet PC Buttons Type N HID Driver;c:\windows\system32\drivers\TBtnKey.sys [3/28/2005 5:55 PM 8832]
R3 TEchoCan;Toshiba Audio Effect;c:\windows\system32\drivers\TEchoCan.sys [3/28/2005 4:44 PM 410112]
R3 TMicAry;Toshiba Audio Effect with MicArray;c:\windows\system32\drivers\TMicAry.sys [3/28/2005 4:44 PM 138240]
R3 WacomPen;Wacom Serial Pen HID Driver;c:\windows\system32\drivers\wacompen.sys [3/28/2005 8:08 AM 14208]
S1 MpKsl22fc82fa;MpKsl22fc82fa;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E47E3F48-5B7D-48A7-A4FD-5BDB1F806B74}\MpKsl22fc82fa.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E47E3F48-5B7D-48A7-A4FD-5BDB1F806B74}\MpKsl22fc82fa.sys [?]
S1 MpKsl5a4bfe84;MpKsl5a4bfe84;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E47E3F48-5B7D-48A7-A4FD-5BDB1F806B74}\MpKsl5a4bfe84.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E47E3F48-5B7D-48A7-A4FD-5BDB1F806B74}\MpKsl5a4bfe84.sys [?]
S1 MpKsl66528f0b;MpKsl66528f0b;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E47E3F48-5B7D-48A7-A4FD-5BDB1F806B74}\MpKsl66528f0b.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E47E3F48-5B7D-48A7-A4FD-5BDB1F806B74}\MpKsl66528f0b.sys [?]
S1 MpKslab3f00be;MpKslab3f00be;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{568A35AE-AB9F-4417-B18E-4DD59FF947FB}\MpKslab3f00be.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{568A35AE-AB9F-4417-B18E-4DD59FF947FB}\MpKslab3f00be.sys [?]
S2 AVGIDSAgent;AVGIDSAgent;c:\program files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [4/18/2011 5:39 PM 7398752]
S2 Tmesbs;Tmesbs32;"c:\program files\TOSHIBA\TME3\Tmesbs32.exe" /Service --> c:\program files\TOSHIBA\TME3\Tmesbs32.exe [?]
S2 Tmesrv;Tmesrv3;"c:\program files\TOSHIBA\TME3\Tmesrv31.exe" /Service --> c:\program files\TOSHIBA\TME3\Tmesrv31.exe [?]
S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG10\Toolbar\ToolbarBroker.exe [8/19/2011 7:29 PM 1025352]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [1/15/2010 8:49 AM 227232]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [3/28/2005 2:59 PM 14336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
Contents of the 'Scheduled Tasks' folder
.
2011-08-20 c:\windows\Tasks\At1.job
- c:\program files\HP\HP Deskjet 3050 J610 series\Bin\HPCustPartic.exe [2010-06-14 21:07]
.
2011-08-20 c:\windows\Tasks\At2.job
- c:\program files\HP\HP Deskjet 3050 J610 series\Bin\HPCustPartic.exe [2010-06-14 21:07]
.
2011-08-18 c:\windows\Tasks\At3.job
- c:\program files\HP\HP Deskjet 3050 J610 series\Bin\HPCustPartic.exe [2010-06-14 21:07]
.
2011-08-18 c:\windows\Tasks\At4.job
- c:\program files\HP\HP Deskjet 3050 J610 series\Bin\HPCustPartic.exe [2010-06-14 21:07]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.toshibadirect.com/dpdstart
IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: Backward Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
IE: Download all with Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm
IE: Download selected with Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm
IE: Download video with Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: Download with Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: Similar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.0.1
Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\AVG\AVG10\Toolbar\IEToolbar.dll
FF - ProfilePath - c:\documents and settings\Jess\Application Data\Mozilla\Firefox\Profiles\rwnvxccz.default\
FF - prefs.js: browser.search.selectedEngine - AVG Secure Search
FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=4e4ef1d6&v=7.007.026.001&i=26&tp=ab&iy=&ychte=us&lng=en-US&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: DivX Plus Web Player HTML5 &lt;video&gt;: {23fcfd51-4958-4f00-80a3-ae97e717ed8b} - c:\program files\DivX\DivX Plus Web Player\firefox\html5video
FF - Ext: DivX HiQ: {6904342A-8307-11DF-A508-4AE2DFD72085} - c:\program files\DivX\DivX Plus Web Player\firefox\wpa
FF - Ext: AVG Safe Search: {1E73965B-8B48-48be-9C8D-68B920ABC1C4} - c:\program files\AVG\AVG10\Firefox4
FF - Ext: AVG Security Toolbar em:version=7.007.026.001 em:displayname=AVG Security Toolbar em:iconURL=chrome://tavgp/skin/logo.ico em:creator=AVG Technologies em:description=AVG Security Toolbar em:homepageURL=http://www.avg.com >: avg@igeared - c:\program files\AVG\AVG10\Toolbar\Firefox\avg@igeared
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-20 11:52
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
.
c:\windows\3712394246:4183537954.exe 816 bytes executable
c:\windows\$NtUninstallKB49030$:SummaryInformation 0 bytes hidden from API
.
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\6a446dd]
"ImagePath"="\systemroot\3712394246:4183537954.exe"
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Microsoft Shared\Ink\KeyboardSurrogate.exe
c:\program files\Intel\Wireless\Bin\ZcfgSvc.exe
c:\windows\SYSTEM32\WISPTIS.EXE
c:\windows\System32\tabbtnu.exe
c:\program files\Common Files\Microsoft Shared\Ink\TCServer.exe
c:\windows\system32\TFNF5.exe
c:\program files\TOSHIBA\ConfigFree\NDSTray.exe
c:\windows\AGRSMMSG.exe
c:\program files\Apoint2K\Apntex.exe
c:\windows\system32\TPSODDCtl.exe
c:\windows\system32\TPSBattM.exe
c:\program files\TOSHIBA\ConfigFree\CFSServ.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\3712394246:4183537954.exe
c:\program files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
c:\program files\AVG\AVG10\avgam.exe
c:\program files\AVG\AVG10\avgnsx.exe
c:\program files\AVG\AVG10\avgemcx.exe
c:\program files\AVG\AVG10\avgchsvx.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\dwwin.exe
c:\program files\AVG\AVG10\avgmfapx.exe
c:\program files\AVG\AVG10\avgdiagex.exe
.
**************************************************************************
.
Completion time: 2011-08-20 11:56:53 - machine was rebooted
ComboFix-quarantined-files.txt 2011-08-20 15:56
.
Pre-Run: 8,069,369,856 bytes free
Post-Run: 6,608,699,392 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /forceresetreg
.
- - End Of File - - E61BC7EF3F0C30C18C9C03F0E1375ADB

#4 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:01:03 AM

Posted 20 August 2011 - 01:49 PM

OK, so we have identified the patched driver, we just need to find a replacement for it now

please do the following:


Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:

    :filefind
    *scdemu*
    
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt



NEXT


  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

http://www.bleepingcomputer.com/forums/topic415250.html/page__pid__2379382#entry2379382

Collect::
c:\windows\system32\c_54770.nl_
c:\windows\3712394246

AtJob::

DDS::
Trusted Zone: clonewarsadventures.com
Trusted Zone: freerealms.com
Trusted Zone: soe.com
Trusted Zone: sony.com

RootKit::
c:\windows\3712394246
c:\windows\$NtUninstallKB49030$

Driver::
6a446dd



Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"


Here's how to do that:

1.Click File;
2.Click Save As... Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save ...

Posted Image
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you.
  • Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Edited by CatByte, 20 August 2011 - 01:50 PM.

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#5 Spre123

Spre123
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:12:03 AM

Posted 20 August 2011 - 10:55 PM

system look

SystemLook 30.07.11 by jpshortstuff
Log created at 23:21 on 20/08/2011 by Jess
Administrator - Elevation successful

========== filefind ==========

Searching for "*scdemu*"
C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\scdemu.sys.vir --a---- 56268 bytes [10:25 15/03/2009] [10:25 15/03/2009] 1748A0D9A1B3A0FA35D9538A23E32020
C:\Qoobox\Quarantine\Registry_backups\Legacy_SCDEmu.reg.dat --a---- 1196 bytes [15:42 20/08/2011] [15:42 20/08/2011] 0F0B2C3F5BB5A063B330F87080F9F439
C:\Qoobox\Quarantine\Registry_backups\Service_SCDEmu.reg.dat --a---- 738 bytes [15:42 20/08/2011] [15:42 20/08/2011] 1774B44B0F6886C9546074D6A8C57472

-= EOF =-


combofix.

ComboFix 11-08-19.02 - Jess 08/20/2011 23:36:40.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.1191 [GMT -4:00]
Running from: C:\Spre.com.exe
Command switches used :: C:\CFScript.txt
AV: AVG Internet Security 2011 *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
file zipped: c:\windows\3712394246
file zipped: c:\windows\system32\c_54770.nl_
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\$NtUninstallKB49030$
c:\windows\$NtUninstallKB49030$\1807256783
c:\windows\3712394246
c:\windows\system32\c_54770.nl_
c:\windows\system32\c_54770.nls
c:\windows\Tasks\At1.job
c:\windows\Tasks\At2.job
c:\windows\Tasks\At3.job
c:\windows\Tasks\At4.job
.
Infected copy of c:\windows\system32\drivers\cdrom.sys was found and disinfected
Restored copy from - The cat found it :)
.
((((((((((((((((((((((((( Files Created from 2011-07-21 to 2011-08-21 )))))))))))))))))))))))))))))))
.
.
2011-08-21 03:33 . 2008-04-13 18:40 62976 -c--a-w- c:\windows\system32\dllcache\cdrom.sys
2011-08-20 15:15 . 2011-08-20 15:57 -------- d-----w- C:\Spre.com
2011-08-19 23:55 . 2011-08-19 23:55 -------- d-----w- c:\documents and settings\Jess\Local Settings\Application Data\AVG Security Toolbar
2011-08-19 23:35 . 2011-08-19 23:35 -------- d-----w- C:\$AVG
2011-08-19 23:30 . 2011-08-19 23:30 -------- d--h--w- c:\documents and settings\All Users\Application Data\Common Files
2011-08-19 23:30 . 2011-08-19 23:30 -------- d-----w- c:\documents and settings\Jess\Application Data\AVG10
2011-08-19 23:27 . 2011-08-21 03:34 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG10
2011-08-19 23:27 . 2011-08-21 03:26 -------- d-----w- c:\windows\system32\drivers\AVG
2011-08-19 23:26 . 2011-08-19 23:26 -------- d-----w- c:\program files\AVG
2011-08-19 23:25 . 2011-08-21 03:27 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData
2011-08-17 20:10 . 2011-08-17 20:15 -------- d-----w- c:\program files\EndItAll
2011-08-10 05:12 . 2011-06-24 14:10 139656 -c----w- c:\windows\system32\dllcache\rdpwd.sys
2011-08-10 05:12 . 2011-07-08 14:02 10496 -c----w- c:\windows\system32\dllcache\ndistapi.sys
2011-08-07 04:12 . 2011-08-10 17:57 -------- d-----w- c:\windows\SxsCaPendDel
2011-08-07 03:56 . 2011-08-07 03:56 -------- d-----w- c:\program files\SpaceMonger
2011-08-07 03:56 . 2011-08-07 03:56 -------- d-----w- c:\documents and settings\Jess\Application Data\SpaceMonger
2011-08-07 03:02 . 2011-08-07 03:02 -------- d-----w- c:\program files\PlayOnline
2011-08-06 15:17 . 2011-08-06 15:17 -------- d-----w- c:\program files\FFXiBench3
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-15 13:29 . 2005-03-28 18:59 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-11 14:24 . 2011-07-11 14:24 61440 ----a-w- c:\windows\wnUninstall.exe
2011-07-08 14:02 . 2005-03-28 18:59 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-07-06 23:52 . 2011-01-02 00:36 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 23:52 . 2011-01-02 00:36 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-07-03 16:24 . 2011-07-03 16:24 1409 ----a-w- c:\windows\QTFont.for
2011-06-24 14:10 . 2005-03-28 20:10 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:36 . 2005-03-28 18:59 916480 ----a-w- c:\windows\system32\wininet.dll
2011-06-23 18:36 . 2005-03-28 18:59 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-06-23 18:36 . 2005-03-28 18:59 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-06-23 12:05 . 2005-03-28 18:59 385024 ----a-w- c:\windows\system32\html.iec
2011-06-20 17:44 . 2005-03-28 18:59 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-06-02 14:02 . 2005-03-28 18:59 1858944 ----a-w- c:\windows\system32\win32k.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2011-08-20_15.51.08 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-08-21 03:33 . 2008-04-13 18:40 62976 c:\windows\system32\drivers\cdrom.sys
- 2004-08-03 22:59 . 2008-04-13 18:40 62976 c:\windows\system32\drivers\cdrom.sys
+ 2005-03-28 18:59 . 2008-04-14 00:11 640000 c:\windows\system32\dllcache\dbghelp.dll
+ 2011-08-20 15:57 . 2011-08-20 15:57 1611776 c:\windows\Installer\6f3ee.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2004-12-30 65536]
"CarMD"="c:\program files\CarMD\CarMD.exe" [2010-04-07 796672]
"cdloader"="c:\documents and settings\Jess\Application Data\mjusbsp\cdloader2.exe" [2011-05-16 50592]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CFSServ.exe"="CFSServ.exe -NoClient" [X]
"TabletWizard"="c:\windows\help\SplshWrp.exe" [2008-04-14 16384]
"TabletTip"="c:\program files\Common Files\microsoft shared\ink\tabtip.exe" [2008-04-14 271872]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-03-15 5525504]
"nwiz"="nwiz.exe" [2005-03-15 1490944]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"00THotkey"="c:\windows\system32\00THotkey.exe" [2005-01-28 245760]
"CrossMenu"="c:\program files\Toshiba\CrossMenu\CrossMenu.exe" [2005-01-07 798720]
"000StTHK"="000StTHK.exe" [2001-06-24 24576]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2004-03-23 196608]
"TFNF5"="TFNF5.exe" [2004-06-28 73728]
"SmoothView"="c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2004-09-15 135168]
"TMERzCtl.EXE"="c:\program files\TOSHIBA\TME3\TMERzCtl.EXE" [2005-03-18 81920]
"DpUtil"="c:\program files\TOSHIBA\DualPointUtility\TEDTray.exe" [2003-11-12 159744]
"NDSTray.exe"="NDSTray.exe" [BU]
"TosHKCW.exe"="c:\program files\TOSHIBA\Wireless Hotkey\TosHKCW.exe" [2002-09-09 49152]
"TAudEffect"="c:\program files\TOSHIBA\TAudEffect\TAudEff.exe" [2005-01-14 340032]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-01-14 122939]
"TosRotation"="c:\program files\TOSHIBA\TOSHIBA Rotation Utility\TRot.exe" [2004-12-14 266240]
"TFncKy"="TFncKy.exe" [BU]
"TAcelMgr"="c:\program files\TOSHIBA\Acceleration Utilities\TAcelMgr\TAcelMgr.exe" [2004-12-16 90112]
"TSkrMain"="c:\program files\TOSHIBA\Acceleration Utilities\Shaker\TSkrMain.exe" [2004-07-01 49152]
"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2003-09-06 184320]
"AGRSMMSG"="AGRSMMSG.exe" [2004-12-22 88358]
"TPSMain"="TPSMain.exe" [2005-03-12 278528]
"TPSODDCtl"="TPSODDCtl.exe" [2005-03-12 110592]
"PINGER"="c:\toshiba\IVP\ISM\pinger.exe" [2005-03-17 151552]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-15 385024]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208]
"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-11-11 288088]
"PWRISOVM.EXE"="c:\program files\PowerISO\PWRISOVM.EXE" [2009-03-15 180224]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2010-11-10 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2010-01-10 519584]
.
c:\documents and settings\Jess\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2005-3-10 483328]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-27 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
2004-10-15 18:27 110592 ----a-w- c:\program files\Intel\Wireless\Bin\LgNotify.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\loginkey]
2008-04-14 00:11 47104 ----a-w- c:\program files\Common Files\Microsoft Shared\Ink\loginkey.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TabBtnWL]
2002-08-29 11:41 11776 ----a-w- c:\windows\system32\tabbtnwl.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpgwlnotify]
2008-04-14 00:12 32256 ----a-w- c:\windows\system32\tpgwlnot.dll
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\TOSHIBA\\ivp\\NetInt\\Netint.exe"=
"c:\\TOSHIBA\\Ivp\\ISM\\pinger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Documents and Settings\\Jess\\Application Data\\mjusbsp\\magicJack.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
.
R0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\drivers\thpdrv.sys [12/28/2004 3:31 AM 16384]
R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\drivers\Thpevm.sys [3/28/2005 4:47 PM 6528]
R1 TMEI3E;TMEI3E;c:\windows\system32\drivers\TMEI3E.sys [3/28/2005 4:41 PM 5888]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [3/28/2005 4:19 PM 32640]
R3 TBtnKey;TOSHIBA Tablet PC Buttons Type N HID Driver;c:\windows\system32\drivers\TBtnKey.sys [3/28/2005 5:55 PM 8832]
R3 TEchoCan;Toshiba Audio Effect;c:\windows\system32\drivers\TEchoCan.sys [3/28/2005 4:44 PM 410112]
R3 TMicAry;Toshiba Audio Effect with MicArray;c:\windows\system32\drivers\TMicAry.sys [3/28/2005 4:44 PM 138240]
R3 WacomPen;Wacom Serial Pen HID Driver;c:\windows\system32\drivers\wacompen.sys [3/28/2005 8:08 AM 14208]
S1 MpKsl22fc82fa;MpKsl22fc82fa;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E47E3F48-5B7D-48A7-A4FD-5BDB1F806B74}\MpKsl22fc82fa.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E47E3F48-5B7D-48A7-A4FD-5BDB1F806B74}\MpKsl22fc82fa.sys [?]
S1 MpKsl5a4bfe84;MpKsl5a4bfe84;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E47E3F48-5B7D-48A7-A4FD-5BDB1F806B74}\MpKsl5a4bfe84.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E47E3F48-5B7D-48A7-A4FD-5BDB1F806B74}\MpKsl5a4bfe84.sys [?]
S1 MpKsl66528f0b;MpKsl66528f0b;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E47E3F48-5B7D-48A7-A4FD-5BDB1F806B74}\MpKsl66528f0b.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E47E3F48-5B7D-48A7-A4FD-5BDB1F806B74}\MpKsl66528f0b.sys [?]
S1 MpKslab3f00be;MpKslab3f00be;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{568A35AE-AB9F-4417-B18E-4DD59FF947FB}\MpKslab3f00be.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{568A35AE-AB9F-4417-B18E-4DD59FF947FB}\MpKslab3f00be.sys [?]
S2 Tmesbs;Tmesbs32;"c:\program files\TOSHIBA\TME3\Tmesbs32.exe" /Service --> c:\program files\TOSHIBA\TME3\Tmesbs32.exe [?]
S2 Tmesrv;Tmesrv3;"c:\program files\TOSHIBA\TME3\Tmesrv31.exe" /Service --> c:\program files\TOSHIBA\TME3\Tmesrv31.exe [?]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [1/15/2010 8:49 AM 227232]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [3/28/2005 2:59 PM 14336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.toshibadirect.com/dpdstart
IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: Backward Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
IE: Download all with Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm
IE: Download selected with Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm
IE: Download video with Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: Download with Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: Similar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\documents and settings\Jess\Application Data\Mozilla\Firefox\Profiles\rwnvxccz.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: keyword.URL - chrome://browser-region/locale/region.properties
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: DivX Plus Web Player HTML5 &lt;video&gt;: {23fcfd51-4958-4f00-80a3-ae97e717ed8b} - c:\program files\DivX\DivX Plus Web Player\firefox\html5video
FF - Ext: DivX HiQ: {6904342A-8307-11DF-A508-4AE2DFD72085} - c:\program files\DivX\DivX Plus Web Player\firefox\wpa
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-20 23:45
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1080)
c:\program files\Intel\Wireless\Bin\LgNotify.dll
.
- - - - - - - > 'explorer.exe'(2092)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\program files\windows journal\nbmaptip.dll
c:\windows\IME\SPGRMR.DLL
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\TPwrCfg.DLL
c:\windows\system32\TPwrReg.dll
c:\windows\system32\TPSTrace.DLL
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Microsoft Shared\Ink\KeyboardSurrogate.exe
c:\program files\Intel\Wireless\Bin\ZcfgSvc.exe
c:\windows\SYSTEM32\WISPTIS.EXE
c:\windows\System32\tabbtnu.exe
c:\program files\Common Files\Microsoft Shared\Ink\TCServer.exe
c:\windows\system32\SearchIndexer.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\TFNF5.exe
c:\program files\TOSHIBA\ConfigFree\NDSTray.exe
c:\program files\Apoint2K\Apntex.exe
c:\program files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
c:\windows\AGRSMMSG.exe
c:\windows\system32\TPSODDCtl.exe
c:\windows\system32\TPSBattM.exe
c:\program files\TOSHIBA\ConfigFree\CFSServ.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
.
**************************************************************************
.
Completion time: 2011-08-20 23:50:12 - machine was rebooted
ComboFix-quarantined-files.txt 2011-08-21 03:50
ComboFix2.txt 2011-08-20 15:56
.
Pre-Run: 7,188,811,776 bytes free
Post-Run: 7,186,161,664 bytes free
.
- - End Of File - - CD0D3F2994703E81D7DDE9ABFC6462A8

#6 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:01:03 AM

Posted 21 August 2011 - 04:33 AM

Hi,


Please re-run TDSSKiller, post the resulting log

NEXT


  • Please open your MalwareBytes AntiMalware Program
  • Click the Update Tab and search for updates
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <-- very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT


Go here to run an online scanner from ESET.
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activeX control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • When the scan completes, press the LIST OF THREATS FOUND button
  • Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop
  • Include the contents of this report in your next reply.
  • Press the BACK button.
  • Press Finish

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#7 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:01:03 AM

Posted 31 August 2011 - 08:14 PM

Due to the lack of feedback, this topic is now closed.In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days. Please include a link to your topic in the Private Message. Thank you.

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users