Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Backdoor.Tidserv!kmem Removal


  • Please log in to reply
16 replies to this topic

#1 Angry_Samoan

Angry_Samoan

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:12:41 AM

Posted 31 December 2011 - 07:06 AM

Hello,

I noticed last night that I have recently acquired the Backdoor.Tidserv!kmem trojan. Norton 360 is not able to remove it, and Malwarebytes' Anti-Malware does not detect it. I removed some threats with tdsskiller, but it looks like it is still present.

Any assistance would be great. Thanks.

-A/S

PS - *EDIT*-NEW INFO - Ok, in the interim after initially posting this, I ran a full Norton360 scan again. It seems the tdsskiller removed it, because Norton does not register it in the scan anymore. However, I still seem to have some of the fallout from this trojan. First, I still have the Disk Defragmenter error that first brought my attention that I may have a virus on my system. When trying to run the Disk Defragmenter, I get this message:
"Disk Defragmentation has detected that Chkdsk is scheduled to run on the volume: (C:).
Please run Chkdsk /f."

Second, I no longer seem to have any audi alerts, and the same is for when the system boots up and closes. I think this is from the tdsskiller eliminating the Backdoor.Tidserv!kmem trojan.

Yes, I admit that I am a bit of a computer idiot. Sorry. Thanks again for any assistance. - A/S

Edited by hamluis, 31 December 2011 - 09:25 AM.
Moved from XP to Am I Infected.


BC AdBot (Login to Remove)

 


#2 Angry_Samoan

Angry_Samoan
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:12:41 AM

Posted 31 December 2011 - 12:43 PM

Quick follow up...

I ran Chkdsk /f, which removed a dirty file and restored an orphan file. Unfortunately, I didn't have the chance to write down either file name and it closed upon completion. Apparently, that fixed the disk problem I was having, as the error didn't come up again upon initiating Disk Defragmenter. However, the alert sounds and the opening and closing music is still silent.

I am wondering if there is anything else in my system affected by this trojan.

Thanks.

-A/S

#3 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,166 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:07:41 PM

Posted 05 January 2012 - 08:42 PM

Hello and welcome..

Please run these now.

Please download MiniToolBox, save it to your desktop and run it.

Checkmark the following checkboxes:
  • Flush DNS
  • Report IE Proxy Settings
  • Reset IE Proxy Settings
  • Report FF Proxy Settings
  • Reset FF Proxy Settings
  • List content of Hosts
  • List IP configuration
  • List Winsock Entries
  • List last 10 Event Viewer log
  • List Installed Programs
  • List Devices
  • List Users, Partitions and Memory size.
  • List Minidump Files
Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run.

Note: When using "Reset FF Proxy Settings" option Firefox should be closed.



Please download TDSSKiller.zip and and extract it.
  • Run TDSSKiller.exe.
  • Click Start scan.
  • When it is finished the utility outputs a list of detected objects with description.
    The utility automatically selects an action (Cure or Delete) for malicious objects.
    The utility prompts the user to select an action to apply to suspicious objects (Skip, by default). Let the options as it is and click Continue
  • Let reboot if needed and tell me if the tool needed a reboot.
  • Click on Report and post the contents of the text file that will open.

    Note: By default, the utility outputs the log into system disk (it is usually the disk with installed operating system, C:\) root folder. The Log have a name like: TDSSKiller.Version_Date_Time_log.txt.



Next run MBAM (MalwareBytes):

Please download Malwarebytes Anti-Malware and save it to your desktop.
Download Link 1 <<<== Use this one first.

Download Link 2MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application.
    For instructions with screenshots, please refer to the How to use Malwarebytes' Anti-Malware Guide.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan.
  • If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  • Exit MBAM when done.
Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

Troubleshoot Malwarebytes' Anti-Malware
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#4 Angry_Samoan

Angry_Samoan
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:12:41 AM

Posted 06 January 2012 - 06:13 AM

Thanks. I will be bolding texts just for ease of reading.

Here is the MiniToolBox Log...


MiniToolBox by Farbar
Ran by Terrence (administrator) on 06-01-2012 at 11:49:03
Microsoft Windows XP Home Edition Service Pack 3 (X86)
Boot Mode: Normal
***************************************************************************

========================= Flush DNS: ===================================


Windows IP Configuration



Successfully flushed the DNS Resolver Cache.


========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.

"Reset IE Proxy Settings": IE Proxy Settings were reset.

========================= FF Proxy Settings: ==============================

"network.proxy.http", "127.0.0.1"
"network.proxy.http_port", 18810
"network.proxy.no_proxies_on", "localhost,127.0.0.1"
"network.proxy.type", 1

"Reset FF Proxy Settings": Firefox Proxy settings were reset.

========================= Hosts content: =================================


========================= IP Configuration: ================================

Intel® 82562V-2 10/100 Network Connection = Local Area Connection (Connected)


# ----------------------------------
# Interface IP Configuration
# ----------------------------------
pushd interface ip


# Interface IP Configuration for "Local Area Connection"

set address name="Local Area Connection" source=dhcp
set dns name="Local Area Connection" source=dhcp register=PRIMARY
set wins name="Local Area Connection" source=dhcp


popd
# End of interface IP configuration




Windows IP Configuration



Host Name . . . . . . . . . . . . : DB2L1GG1

Primary Dns Suffix . . . . . . . :

Node Type . . . . . . . . . . . . : Unknown

IP Routing Enabled. . . . . . . . : No

WINS Proxy Enabled. . . . . . . . : No



Ethernet adapter Local Area Connection:



Connection-specific DNS Suffix . :

Description . . . . . . . . . . . : Intel® 82562V-2 10/100 Network Connection

Physical Address. . . . . . . . . : 00-1D-09-9F-6A-08

Dhcp Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

IP Address. . . . . . . . . . . . : 192.168.11.102

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . : 192.168.11.1

DHCP Server . . . . . . . . . . . : 192.168.11.1

DNS Servers . . . . . . . . . . . : 192.168.11.1

Lease Obtained. . . . . . . . . . : Friday, January 06, 2012 8:53:40 AM

Lease Expires . . . . . . . . . . : Sunday, January 08, 2012 8:53:40 AM

Server: buffalo.setup
Address: 192.168.11.1

Name: google.com
Addresses: 173.194.69.103, 173.194.69.104, 173.194.69.105, 173.194.69.106
173.194.69.147, 173.194.69.99



Pinging google.com [173.194.69.105] with 32 bytes of data:



Reply from 173.194.69.105: bytes=32 time=41ms TTL=51

Reply from 173.194.69.105: bytes=32 time=42ms TTL=51



Ping statistics for 173.194.69.105:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 41ms, Maximum = 42ms, Average = 41ms

Server: buffalo.setup
Address: 192.168.11.1

Name: yahoo.com
Addresses: 98.137.149.56, 98.139.180.149, 209.191.122.70, 72.30.2.43



Pinging yahoo.com [98.139.180.149] with 32 bytes of data:



Reply from 98.139.180.149: bytes=32 time=170ms TTL=53

Reply from 98.139.180.149: bytes=32 time=159ms TTL=53



Ping statistics for 98.139.180.149:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 159ms, Maximum = 170ms, Average = 164ms

Server: buffalo.setup
Address: 192.168.11.1

Name: bleepingcomputer.com
Address: 208.43.87.2



Pinging bleepingcomputer.com [208.43.87.2] with 32 bytes of data:



Reply from 208.43.87.2: Destination host unreachable.

Reply from 208.43.87.2: Destination host unreachable.



Ping statistics for 208.43.87.2:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 0ms, Average = 0ms



Pinging 127.0.0.1 with 32 bytes of data:



Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128



Ping statistics for 127.0.0.1:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 0ms, Average = 0ms

===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 1d 09 9f 6a 08 ...... Intel® 82562V-2 10/100 Network Connection - Packet Scheduler Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.11.1 192.168.11.102 20
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.11.0 255.255.255.0 192.168.11.102 192.168.11.102 20
192.168.11.102 255.255.255.255 127.0.0.1 127.0.0.1 20
192.168.11.255 255.255.255.255 192.168.11.102 192.168.11.102 20
224.0.0.0 240.0.0.0 192.168.11.102 192.168.11.102 20
255.255.255.255 255.255.255.255 192.168.11.102 192.168.11.102 1
Default Gateway: 192.168.11.1
===========================================================================
Persistent Routes:
None
========================= Winsock entries =====================================

Catalog5 01 C:\Windows\System32\mswsock.dll [245248] (Microsoft Corporation)
Catalog5 02 C:\Windows\System32\winrnr.dll [16896] (Microsoft Corporation)
Catalog5 03 C:\Windows\System32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 01 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 02 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 03 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 04 C:\Windows\system32\rsvpsp.dll [92672] (Microsoft Corporation)
Catalog9 05 C:\Windows\system32\rsvpsp.dll [92672] (Microsoft Corporation)
Catalog9 06 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 07 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 08 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 09 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 10 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)
Catalog9 11 C:\Windows\system32\mswsock.dll [245248] (Microsoft Corporation)

========================= Event log errors: ===============================

Application errors:
==================
Error: (12/31/2011 00:14:40 PM) (Source: MsiInstaller) (User: Terrence)Terrence
Description: Product: SpyHunter -- Error 1721. There is a problem with this Windows Installer package. A program required for this install to complete could not be run. Contact your support personnel or package vendor. Action: , location: WiseCustomCall, command: g1

Error: (12/29/2011 07:29:15 PM) (Source: Application Error) (User: )
Description: Faulting application iexplore.exe, version 8.0.6001.18702, faulting module mshtml.dll, version 8.0.6001.19046, fault address 0x000679b8.
Processing media-specific event for [iexplore.exe!ws!]

Error: (12/29/2011 07:27:56 PM) (Source: Application Error) (User: )
Description: Faulting application iexplore.exe, version 8.0.6001.18702, faulting module mshtml.dll, version 8.0.6001.19046, fault address 0x000679b8.
Processing media-specific event for [iexplore.exe!ws!]

Error: (12/28/2011 08:41:45 PM) (Source: Application Error) (User: )
Description: Faulting application iexplore.exe, version 8.0.6001.18702, faulting module jvm.dll, version 20.1.0.2, fault address 0x0005e5c4.
Processing media-specific event for [iexplore.exe!ws!]

Error: (12/27/2011 09:50:40 AM) (Source: Application Error) (User: )
Description: Faulting application iexplore.exe, version 8.0.6001.18702, faulting module mshtml.dll, version 8.0.6001.19046, fault address 0x000679b8.
Processing media-specific event for [iexplore.exe!ws!]

Error: (09/21/2011 00:15:38 AM) (Source: Application Error) (User: )
Description: Faulting application , version 0.0.0.0, faulting module unknown, version 0.0.0.0, fault address 0x00000000.
Processing media-specific event for [!ws!]

Error: (09/15/2011 04:06:03 AM) (Source: Application Error) (User: )
Description: Faulting application iexplore.exe, version 8.0.6001.18702, faulting module mshtml.dll, version 8.0.6001.19046, fault address 0x000679b8.
Processing media-specific event for [iexplore.exe!ws!]

Error: (08/26/2011 11:55:24 AM) (Source: Application Error) (User: )
Description: Faulting application iexplore.exe, version 8.0.6001.18702, faulting module mshtml.dll, version 8.0.6001.19046, fault address 0x000679b8.
Processing media-specific event for [iexplore.exe!ws!]

Error: (08/13/2011 00:57:05 PM) (Source: Application Error) (User: )
Description: Faulting application iexplore.exe, version 8.0.6001.18702, faulting module mshtml.dll, version 8.0.6001.19046, fault address 0x000679b8.
Processing media-specific event for [iexplore.exe!ws!]

Error: (08/13/2011 04:44:33 AM) (Source: Application Error) (User: )
Description: Faulting application iexplore.exe, version 8.0.6001.18702, faulting module mshtml.dll, version 8.0.6001.19046, fault address 0x000679b8.
Processing media-specific event for [iexplore.exe!ws!]


System errors:
=============
Error: (12/31/2011 01:04:58 PM) (Source: Service Control Manager) (User: )
Description: The Application Management service terminated with the following error:
%%126

Error: (12/31/2011 01:04:58 PM) (Source: Service Control Manager) (User: )
Description: The Application Management service terminated with the following error:
%%126

Error: (12/31/2011 01:04:58 PM) (Source: Service Control Manager) (User: )
Description: The Application Management service terminated with the following error:
%%126

Error: (12/31/2011 01:04:57 PM) (Source: Service Control Manager) (User: )
Description: The Application Management service terminated with the following error:
%%126

Error: (12/31/2011 01:04:57 PM) (Source: Service Control Manager) (User: )
Description: The Application Management service terminated with the following error:
%%126

Error: (12/31/2011 01:04:57 PM) (Source: Service Control Manager) (User: )
Description: The Application Management service terminated with the following error:
%%126

Error: (12/31/2011 01:04:57 PM) (Source: Service Control Manager) (User: )
Description: The Application Management service terminated with the following error:
%%126

Error: (12/31/2011 01:04:57 PM) (Source: Service Control Manager) (User: )
Description: The Application Management service terminated with the following error:
%%126

Error: (12/31/2011 01:04:57 PM) (Source: Service Control Manager) (User: )
Description: The Application Management service terminated with the following error:
%%126

Error: (12/31/2011 01:04:57 PM) (Source: Service Control Manager) (User: )
Description: The Application Management service terminated with the following error:
%%126


Microsoft Office Sessions:
=========================

=========================== Installed Programs ============================

Adobe Flash Player 11 ActiveX (Version: 11.1.102.55)
Adobe Reader 8.1.3 (Version: 8.1.3)
Adobe Shockwave Player 11.5 (Version: 11.5.7.609)
AT&T Yahoo! Applications
ATI - Software Uninstall Utility (Version: 6.14.10.1022)
ATI AVIVO Codecs (Version: 10.10.0.41001)
ATI Display Driver (Version: 8.662-091001b-091992C)
Babylon-English Toolbar (Version: 5.7.2.2)
Bejeweled 2 Deluxe
BioWare Premium Module: Neverwinter Nights™ Kingmaker
Brother HL-2040 (Version: 1.00)
Brother HL-2140 (Version: 1.00)
Browser Address Error Redirector (Version: 1.00.0000)
Comcast Desktop Software (v1.2.0.9) (Version: 23)
Compatibility Pack for the 2007 Office system (Version: 12.0.6425.1000)
Dell DataSafe Online (Version: 1.0.21)
Dell Driver Reset Tool (Version: 1.02.0000)
Dell Support Center (Support Software) (Version: 2.2.09085)
Dell System Restore (Version: 2.00.0000)
Desktop Doctor (Version: 2.5.5)
Documentation & Support Launcher (Version: 1.00.0000)
Games, Music, & Photos Launcher (Version: 1.00.0000)
GameSpy Arcade
Google Toolbar for Internet Explorer (Version: 1.0.0)
Google Toolbar for Internet Explorer (Version: 7.2.2318.1946)
Google Update Helper (Version: 1.3.21.79)
GoToAssist 8.0.0.514
High Definition Audio Driver Package - KB835221 (Version: 20040219.000000)
Intel® Graphics Media Accelerator Driver
Intel® PRO Network Connections Drivers
Internet Service Offers Launcher (Version: 1.00.0000)
Java Auto Updater (Version: 2.0.5.1)
Java™ 6 Update 26 (Version: 6.0.260)
Malwarebytes Anti-Malware version 1.60.0.1800 (Version: 1.60.0.1800)
Microsoft .NET Framework 1.1 (Version: 1.1.4322)
Microsoft .NET Framework 1.1 Security Update (KB2656353)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2 (Version: 2.2.30729)
Microsoft .NET Framework 3.0 Service Pack 2 (Version: 3.2.30729)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft Compression Client Pack 1.0 for Windows XP (Version: 1)
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Home and Student 2007 (Version: 12.0.6425.1000)
Microsoft Office OneNote MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office PowerPoint Viewer 2007 (English) (Version: 12.0.6425.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6425.1000)
Microsoft Office Proof (Spanish) 2007 (Version: 12.0.6425.1000)
Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Office Word MUI (English) 2007 (Version: 12.0.6425.1000)
Microsoft Plus! Digital Media Edition Installer (Version: 1.1.0.3514)
Microsoft Plus! Photo Story 2 LE (Version: 1.1.0.3463)
Microsoft Silverlight (Version: 4.0.60831.0)
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Works (Version: 9.7.0621)
MSXML 6.0 Parser (KB933579) (Version: 6.10.1200.0)
Musicmatch for Windows Media Player (Version: 0.00.000)
Neverwinter Nights 2 (Version: 1.00.0000)
Norton 360 (Version: 4.4.0.12)
Norton Bootable Recovery Tool Wizard (Version: 4.1.0.15)
Norton Security Scan (Version: 2.7.0.52)
PowerDVD (Version: 7.0)
RealPlayer
Realtek High Definition Audio Driver
Roxio Creator Audio (Version: 3.7.0)
Roxio Creator Copy (Version: 3.7.0)
Roxio Creator Data (Version: 3.7.0)
Roxio Creator DE (Version: 10.1)
Roxio Creator DE (Version: 3.7.0)
Roxio Creator Tools (Version: 3.7.0)
Roxio Express Labeler 3 (Version: 3.2.1)
Roxio Update Manager (Version: 6.0.0)
Search Toolbar (Version: 1.2)
Symantec Technical Support Web Controls (Version: 3.5.3)
Veetle TV 0.9.17 (Version: 0.9.17)
WebFldrs XP (Version: 9.50.7523)
Winamp (Version: 5.61 )
Windows Genuine Advantage Validation Tool (KB892130)
Windows Genuine Advantage Validation Tool (KB892130) (Version: 1.7.0069.2)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7 (Version: 20070813.185237)
Windows Internet Explorer 8 (Version: 20090308.140743)
Windows Media Format 11 runtime
Windows Media Player 10 (Version: 9.00.3636)
Windows Media Player 11
Windows XP Service Pack 3 (Version: 20080414.031525)
WinRAR archiver

========================= Devices: ================================


========================= Memory info: ===================================

Percentage of memory in use: 91%
Total physical RAM: 1022.1 MB
Available physical RAM: 91.68 MB
Total Pagefile: 2447.42 MB
Available Pagefile: 1228.38 MB
Total Virtual: 2047.88 MB
Available Virtual: 1971.47 MB

========================= Partitions: =====================================

2 Drive c: () (Fixed) (Total:462.4 GB) (Free:437.62 GB) NTFS

========================= Users: ========================================

User accounts for \\DB2L1GG1

Administrator Guest HelpAssistant
SUPPORT_388945a0 Terrence

========================= Minidump Files ==================================

No minidump file found

**** End of log ****




Here is the TDSS Log...


11:54:39.0609 4008 TDSS rootkit removing tool 2.6.25.0 Dec 23 2011 14:51:16
11:54:41.0609 4008 ============================================================
11:54:41.0609 4008 Current date / time: 2012/01/06 11:54:41.0609
11:54:41.0609 4008 SystemInfo:
11:54:41.0609 4008
11:54:41.0609 4008 OS Version: 5.1.2600 ServicePack: 3.0
11:54:41.0609 4008 Product type: Workstation
11:54:41.0609 4008 ComputerName: DB2L1GG1
11:54:41.0609 4008 UserName: Terrence
11:54:41.0609 4008 Windows directory: C:\WINDOWS
11:54:41.0609 4008 System windows directory: C:\WINDOWS
11:54:41.0609 4008 Processor architecture: Intel x86
11:54:41.0609 4008 Number of processors: 2
11:54:41.0609 4008 Page size: 0x1000
11:54:41.0609 4008 Boot type: Normal boot
11:54:41.0609 4008 ============================================================
11:54:44.0312 4008 Initialize success
11:54:47.0343 3248 ============================================================
11:54:47.0343 3248 Scan started
11:54:47.0343 3248 Mode: Manual;
11:54:47.0343 3248 ============================================================
11:54:48.0500 3248 Abiosdsk - ok
11:54:48.0531 3248 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
11:54:48.0531 3248 abp480n5 - ok
11:54:48.0562 3248 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
11:54:48.0562 3248 ACPI - ok
11:54:48.0593 3248 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
11:54:48.0593 3248 ACPIEC - ok
11:54:48.0609 3248 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys
11:54:48.0609 3248 adpu160m - ok
11:54:48.0656 3248 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
11:54:48.0656 3248 aec - ok
11:54:48.0703 3248 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
11:54:48.0703 3248 AFD - ok
11:54:48.0718 3248 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
11:54:48.0734 3248 agp440 - ok
11:54:48.0734 3248 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
11:54:48.0734 3248 agpCPQ - ok
11:54:48.0750 3248 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys
11:54:48.0750 3248 Aha154x - ok
11:54:48.0781 3248 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys
11:54:48.0781 3248 aic78u2 - ok
11:54:48.0796 3248 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys
11:54:48.0796 3248 aic78xx - ok
11:54:48.0812 3248 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
11:54:48.0812 3248 AliIde - ok
11:54:48.0843 3248 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\system32\DRIVERS\alim1541.sys
11:54:48.0843 3248 alim1541 - ok
11:54:48.0843 3248 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys
11:54:48.0843 3248 amdagp - ok
11:54:48.0859 3248 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys
11:54:48.0859 3248 amsint - ok
11:54:48.0890 3248 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys
11:54:48.0890 3248 asc - ok
11:54:48.0906 3248 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys
11:54:48.0906 3248 asc3350p - ok
11:54:48.0921 3248 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys
11:54:48.0921 3248 asc3550 - ok
11:54:48.0953 3248 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
11:54:48.0953 3248 AsyncMac - ok
11:54:48.0968 3248 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
11:54:48.0968 3248 atapi - ok
11:54:48.0984 3248 Atdisk - ok
11:54:49.0140 3248 ati2mtag (9cd9658b9575a07aad676639fe3b51d6) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
11:54:49.0203 3248 ati2mtag - ok
11:54:49.0265 3248 AtiHdmiService (fac04a8e09c8d70594382656d99772a3) C:\WINDOWS\system32\drivers\AtiHdmi.sys
11:54:49.0265 3248 AtiHdmiService - ok
11:54:49.0281 3248 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
11:54:49.0281 3248 Atmarpc - ok
11:54:49.0296 3248 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
11:54:49.0296 3248 audstub - ok
11:54:49.0328 3248 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
11:54:49.0328 3248 Beep - ok
11:54:49.0437 3248 BHDrvx86 (9d14d76e4e7b9b2ead17149011db2b11) C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\BASHDefs\20111221.003\BHDrvx86.sys
11:54:49.0453 3248 BHDrvx86 - ok
11:54:49.0484 3248 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
11:54:49.0484 3248 cbidf - ok
11:54:49.0500 3248 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
11:54:49.0500 3248 cbidf2k - ok
11:54:49.0562 3248 ccHP (1fa1c0e73eca849bed29a47c508f7f17) C:\WINDOWS\system32\drivers\N360\0404000.00C\ccHPx86.sys
11:54:49.0562 3248 ccHP - ok
11:54:49.0593 3248 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
11:54:49.0593 3248 cd20xrnt - ok
11:54:49.0593 3248 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
11:54:49.0609 3248 Cdaudio - ok
11:54:49.0609 3248 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
11:54:49.0609 3248 Cdfs - ok
11:54:49.0640 3248 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
11:54:49.0640 3248 Cdrom - ok
11:54:49.0656 3248 Changer - ok
11:54:49.0671 3248 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys
11:54:49.0671 3248 CmdIde - ok
11:54:49.0703 3248 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys
11:54:49.0703 3248 Cpqarray - ok
11:54:49.0734 3248 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
11:54:49.0734 3248 dac2w2k - ok
11:54:49.0750 3248 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys
11:54:49.0750 3248 dac960nt - ok
11:54:49.0765 3248 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
11:54:49.0765 3248 Disk - ok
11:54:49.0812 3248 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
11:54:49.0828 3248 dmboot - ok
11:54:49.0843 3248 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
11:54:49.0859 3248 dmio - ok
11:54:49.0875 3248 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
11:54:49.0875 3248 dmload - ok
11:54:49.0890 3248 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
11:54:49.0890 3248 DMusic - ok
11:54:49.0906 3248 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys
11:54:49.0921 3248 dpti2o - ok
11:54:49.0921 3248 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
11:54:49.0921 3248 drmkaud - ok
11:54:49.0953 3248 E100B (3fca03cbca11269f973b70fa483c88ef) C:\WINDOWS\system32\DRIVERS\e100b325.sys
11:54:49.0953 3248 E100B - ok
11:54:49.0968 3248 e1express (34aaa3b298a852b3663e6e0d94d12945) C:\WINDOWS\system32\DRIVERS\e1e5132.sys
11:54:49.0984 3248 e1express - ok
11:54:50.0093 3248 eeCtrl (75e8b69f28c813675b16db357f20720f) C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
11:54:50.0093 3248 eeCtrl - ok
11:54:50.0125 3248 EraserUtilRebootDrv (720b18d76de9e603b626dfcd6f1fca7c) C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
11:54:50.0125 3248 EraserUtilRebootDrv - ok
11:54:50.0171 3248 esgiguard - ok
11:54:50.0203 3248 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
11:54:50.0203 3248 Fastfat - ok
11:54:50.0218 3248 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
11:54:50.0218 3248 Fdc - ok
11:54:50.0234 3248 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
11:54:50.0234 3248 Fips - ok
11:54:50.0265 3248 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
11:54:50.0265 3248 Flpydisk - ok
11:54:50.0265 3248 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
11:54:50.0281 3248 FltMgr - ok
11:54:50.0281 3248 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
11:54:50.0296 3248 Fs_Rec - ok
11:54:50.0296 3248 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
11:54:50.0296 3248 Ftdisk - ok
11:54:50.0343 3248 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
11:54:50.0343 3248 GEARAspiWDM - ok
11:54:50.0343 3248 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
11:54:50.0359 3248 Gpc - ok
11:54:50.0375 3248 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
11:54:50.0375 3248 HDAudBus - ok
11:54:50.0406 3248 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
11:54:50.0406 3248 HidUsb - ok
11:54:50.0421 3248 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys
11:54:50.0421 3248 hpn - ok
11:54:50.0453 3248 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
11:54:50.0468 3248 HTTP - ok
11:54:50.0500 3248 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys
11:54:50.0500 3248 i2omgmt - ok
11:54:50.0531 3248 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\system32\DRIVERS\i2omp.sys
11:54:50.0531 3248 i2omp - ok
11:54:50.0546 3248 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
11:54:50.0546 3248 i8042prt - ok
11:54:50.0687 3248 ialm (28423512370705aeda6a652fedb25468) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
11:54:50.0781 3248 ialm - ok
11:54:50.0812 3248 iaStor (997e8f5939f2d12cd9f2e6b395724c16) C:\WINDOWS\system32\drivers\iaStor.sys
11:54:50.0812 3248 iaStor - ok
11:54:51.0015 3248 IDSxpx86 (e72d3894d42355e9cd5fd77e1e4fea11) C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\IPSDefs\20120105.001\IDSxpx86.sys
11:54:51.0062 3248 IDSxpx86 - ok
11:54:51.0093 3248 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
11:54:51.0093 3248 Imapi - ok
11:54:51.0125 3248 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys
11:54:51.0140 3248 ini910u - ok
11:54:51.0265 3248 IntcAzAudAddService (17bbbabb21f86b650b2626045a9d016c) C:\WINDOWS\system32\drivers\RtkHDAud.sys
11:54:51.0343 3248 IntcAzAudAddService - ok
11:54:51.0375 3248 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys
11:54:51.0375 3248 IntelIde - ok
11:54:51.0406 3248 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
11:54:51.0406 3248 intelppm - ok
11:54:51.0421 3248 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
11:54:51.0437 3248 Ip6Fw - ok
11:54:51.0453 3248 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
11:54:51.0453 3248 IpFilterDriver - ok
11:54:51.0468 3248 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
11:54:51.0468 3248 IpInIp - ok
11:54:51.0500 3248 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
11:54:51.0500 3248 IpNat - ok
11:54:51.0515 3248 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
11:54:51.0515 3248 IPSec - ok
11:54:51.0546 3248 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
11:54:51.0546 3248 IRENUM - ok
11:54:51.0562 3248 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
11:54:51.0578 3248 isapnp - ok
11:54:51.0593 3248 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
11:54:51.0593 3248 Kbdclass - ok
11:54:51.0609 3248 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
11:54:51.0609 3248 kbdhid - ok
11:54:51.0625 3248 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
11:54:51.0640 3248 kmixer - ok
11:54:51.0656 3248 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
11:54:51.0656 3248 KSecDD - ok
11:54:51.0671 3248 lbrtfdc - ok
11:54:51.0718 3248 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
11:54:51.0718 3248 mnmdd - ok
11:54:51.0750 3248 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
11:54:51.0750 3248 Modem - ok
11:54:51.0750 3248 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
11:54:51.0765 3248 Mouclass - ok
11:54:51.0781 3248 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
11:54:51.0781 3248 mouhid - ok
11:54:51.0781 3248 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
11:54:51.0796 3248 MountMgr - ok
11:54:51.0812 3248 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys
11:54:51.0812 3248 mraid35x - ok
11:54:51.0828 3248 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
11:54:51.0843 3248 MRxDAV - ok
11:54:51.0890 3248 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
11:54:51.0890 3248 MRxSmb - ok
11:54:51.0921 3248 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
11:54:51.0921 3248 Msfs - ok
11:54:51.0953 3248 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
11:54:51.0953 3248 MSKSSRV - ok
11:54:51.0968 3248 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
11:54:51.0968 3248 MSPCLOCK - ok
11:54:51.0984 3248 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
11:54:51.0984 3248 MSPQM - ok
11:54:52.0015 3248 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
11:54:52.0015 3248 mssmbios - ok
11:54:52.0031 3248 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
11:54:52.0046 3248 Mup - ok
11:54:52.0156 3248 NAVENG (862f55824ac81295837b0ab63f91071f) C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20120105.034\NAVENG.SYS
11:54:52.0156 3248 NAVENG - ok
11:54:52.0203 3248 NAVEX15 (529d571b551cb9da44237389b936f1ae) C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_4.0.0.127\Definitions\VirusDefs\20120105.034\NAVEX15.SYS
11:54:52.0234 3248 NAVEX15 - ok
11:54:52.0265 3248 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
11:54:52.0265 3248 NDIS - ok
11:54:52.0296 3248 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
11:54:52.0296 3248 NdisTapi - ok
11:54:52.0312 3248 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
11:54:52.0312 3248 Ndisuio - ok
11:54:52.0328 3248 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
11:54:52.0328 3248 NdisWan - ok
11:54:52.0359 3248 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
11:54:52.0359 3248 NDProxy - ok
11:54:52.0375 3248 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
11:54:52.0375 3248 NetBIOS - ok
11:54:52.0390 3248 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
11:54:52.0390 3248 NetBT - ok
11:54:52.0421 3248 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
11:54:52.0421 3248 Npfs - ok
11:54:52.0468 3248 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
11:54:52.0484 3248 Ntfs - ok
11:54:52.0515 3248 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
11:54:52.0515 3248 Null - ok
11:54:52.0578 3248 nv (2b298519edbfcf451d43e0f1e8f1006d) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
11:54:52.0609 3248 nv - ok
11:54:52.0625 3248 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
11:54:52.0640 3248 NwlnkFlt - ok
11:54:52.0656 3248 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
11:54:52.0656 3248 NwlnkFwd - ok
11:54:52.0687 3248 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
11:54:52.0687 3248 Parport - ok
11:54:52.0687 3248 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
11:54:52.0687 3248 PartMgr - ok
11:54:52.0718 3248 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
11:54:52.0718 3248 ParVdm - ok
11:54:52.0718 3248 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
11:54:52.0718 3248 PCI - ok
11:54:52.0734 3248 PCIDump - ok
11:54:52.0750 3248 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
11:54:52.0750 3248 PCIIde - ok
11:54:52.0765 3248 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
11:54:52.0765 3248 Pcmcia - ok
11:54:52.0781 3248 PDCOMP - ok
11:54:52.0781 3248 PDFRAME - ok
11:54:52.0796 3248 PDRELI - ok
11:54:52.0812 3248 PDRFRAME - ok
11:54:52.0828 3248 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys
11:54:52.0828 3248 perc2 - ok
11:54:52.0843 3248 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys
11:54:52.0843 3248 perc2hib - ok
11:54:52.0875 3248 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
11:54:52.0875 3248 PptpMiniport - ok
11:54:52.0890 3248 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
11:54:52.0890 3248 PSched - ok
11:54:52.0906 3248 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
11:54:52.0906 3248 Ptilink - ok
11:54:52.0921 3248 PxHelp20 (e42e3433dbb4cffe8fdd91eab29aea8e) C:\WINDOWS\system32\Drivers\PxHelp20.sys
11:54:52.0921 3248 PxHelp20 - ok
11:54:52.0953 3248 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys
11:54:52.0953 3248 ql1080 - ok
11:54:52.0953 3248 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
11:54:52.0968 3248 Ql10wnt - ok
11:54:52.0984 3248 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys
11:54:52.0984 3248 ql12160 - ok
11:54:53.0000 3248 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys
11:54:53.0000 3248 ql1240 - ok
11:54:53.0015 3248 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys
11:54:53.0015 3248 ql1280 - ok
11:54:53.0046 3248 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
11:54:53.0046 3248 RasAcd - ok
11:54:53.0062 3248 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
11:54:53.0062 3248 Rasl2tp - ok
11:54:53.0078 3248 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
11:54:53.0078 3248 RasPppoe - ok
11:54:53.0078 3248 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
11:54:53.0078 3248 Raspti - ok
11:54:53.0109 3248 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
11:54:53.0109 3248 Rdbss - ok
11:54:53.0109 3248 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
11:54:53.0125 3248 RDPCDD - ok
11:54:53.0140 3248 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
11:54:53.0156 3248 rdpdr - ok
11:54:53.0171 3248 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
11:54:53.0187 3248 RDPWD - ok
11:54:53.0203 3248 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
11:54:53.0203 3248 redbook - ok
11:54:53.0265 3248 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
11:54:53.0265 3248 Secdrv - ok
11:54:53.0296 3248 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
11:54:53.0296 3248 serenum - ok
11:54:53.0312 3248 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
11:54:53.0312 3248 Serial - ok
11:54:53.0343 3248 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
11:54:53.0343 3248 Sfloppy - ok
11:54:53.0359 3248 Simbad - ok
11:54:53.0375 3248 sisagp (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\system32\DRIVERS\sisagp.sys
11:54:53.0375 3248 sisagp - ok
11:54:53.0406 3248 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys
11:54:53.0406 3248 Sparrow - ok
11:54:53.0421 3248 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
11:54:53.0421 3248 splitter - ok
11:54:53.0453 3248 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
11:54:53.0453 3248 sr - ok
11:54:53.0500 3248 SRTSP (ec5c3c6260f4019b03dfaa03ec8cbf6a) C:\WINDOWS\System32\Drivers\N360\0404000.00C\SRTSP.SYS
11:54:53.0500 3248 SRTSP - ok
11:54:53.0531 3248 SRTSPX (55d5c37ed41231e3ac2063d16df50840) C:\WINDOWS\system32\drivers\N360\0404000.00C\SRTSPX.SYS
11:54:53.0531 3248 SRTSPX - ok
11:54:53.0546 3248 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
11:54:53.0562 3248 Srv - ok
11:54:53.0593 3248 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
11:54:53.0593 3248 swenum - ok
11:54:53.0609 3248 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
11:54:53.0609 3248 swmidi - ok
11:54:53.0640 3248 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys
11:54:53.0640 3248 symc810 - ok
11:54:53.0656 3248 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys
11:54:53.0656 3248 symc8xx - ok
11:54:53.0671 3248 SymDS (56890bf9d9204b93042089d4b45ae671) C:\WINDOWS\system32\drivers\N360\0404000.00C\SYMDS.SYS
11:54:53.0687 3248 SymDS - ok
11:54:53.0718 3248 SymEFA (10ba64273feff4df0a7ccb0ff3b9b26b) C:\WINDOWS\system32\drivers\N360\0404000.00C\SYMEFA.SYS
11:54:53.0718 3248 SymEFA - ok
11:54:53.0750 3248 SymEvent (961b48b86f94d4cc8ceb483f8aa89374) C:\WINDOWS\system32\Drivers\SYMEVENT.SYS
11:54:53.0750 3248 SymEvent - ok
11:54:53.0796 3248 SymIRON (dc80fbf0a348e54853ef82eed4e11e35) C:\WINDOWS\system32\drivers\N360\0404000.00C\Ironx86.SYS
11:54:53.0796 3248 SymIRON - ok
11:54:53.0812 3248 SYMTDI (be6de8fbf2df9f13a90b8b6e943871b7) C:\WINDOWS\System32\Drivers\N360\0404000.00C\SYMTDI.SYS
11:54:53.0812 3248 SYMTDI - ok
11:54:53.0843 3248 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys
11:54:53.0843 3248 sym_hi - ok
11:54:53.0859 3248 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys
11:54:53.0859 3248 sym_u3 - ok
11:54:53.0859 3248 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
11:54:53.0875 3248 sysaudio - ok
11:54:53.0906 3248 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
11:54:53.0906 3248 Tcpip - ok
11:54:53.0921 3248 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
11:54:53.0921 3248 TDPIPE - ok
11:54:53.0937 3248 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
11:54:53.0937 3248 TDTCP - ok
11:54:53.0953 3248 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
11:54:53.0953 3248 TermDD - ok
11:54:53.0968 3248 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys
11:54:53.0968 3248 TosIde - ok
11:54:54.0000 3248 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
11:54:54.0000 3248 Udfs - ok
11:54:54.0015 3248 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys
11:54:54.0015 3248 ultra - ok
11:54:54.0031 3248 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
11:54:54.0031 3248 Update - ok
11:54:54.0062 3248 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
11:54:54.0062 3248 usbehci - ok
11:54:54.0078 3248 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
11:54:54.0078 3248 usbhub - ok
11:54:54.0109 3248 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
11:54:54.0109 3248 usbprint - ok
11:54:54.0140 3248 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
11:54:54.0140 3248 usbscan - ok
11:54:54.0171 3248 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
11:54:54.0171 3248 USBSTOR - ok
11:54:54.0187 3248 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
11:54:54.0187 3248 usbuhci - ok
11:54:54.0203 3248 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
11:54:54.0203 3248 VgaSave - ok
11:54:54.0234 3248 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys
11:54:54.0234 3248 viaagp - ok
11:54:54.0250 3248 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
11:54:54.0250 3248 ViaIde - ok
11:54:54.0281 3248 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
11:54:54.0281 3248 VolSnap - ok
11:54:54.0296 3248 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
11:54:54.0312 3248 Wanarp - ok
11:54:54.0312 3248 WDICA - ok
11:54:54.0343 3248 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
11:54:54.0343 3248 wdmaud - ok
11:54:54.0406 3248 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
11:54:54.0406 3248 WpdUsb - ok
11:54:54.0437 3248 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
11:54:54.0437 3248 WudfPf - ok
11:54:54.0468 3248 WUDFRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\WUDFRd.sys
11:54:54.0468 3248 WUDFRd - ok
11:54:54.0500 3248 MBR (0x1B8) (5cb90281d1a59b251f6603134774eec3) \Device\Harddisk0\DR0
11:54:54.0531 3248 \Device\Harddisk0\DR0 - ok
11:54:54.0562 3248 Boot (0x1200) (a8134493f10a5353c38f91f87c223da5) \Device\Harddisk0\DR0\Partition0
11:54:54.0562 3248 \Device\Harddisk0\DR0\Partition0 - ok
11:54:54.0562 3248 ============================================================
11:54:54.0562 3248 Scan finished
11:54:54.0562 3248 ============================================================
11:54:54.0578 0500 Detected object count: 0
11:54:54.0578 0500 Actual detected object count: 0



Here is the MalWareBytes' Log... I use this quite a bit, and it did not find the bug before. I'm guessing I was able to remove it before the software was updated enough to ferret it out...


Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org

Database version: v2012.01.06.02

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Terrence :: DB2L1GG1 [administrator]

1/6/2012 12:00:29 PM
mbam-log-2012-01-06 (12-00-29).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 163733
Time elapsed: 5 minute(s), 22 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)


Thanks again. I'm still wondering what fallout is left on my computer after getting this bug.

-A/S

#5 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,166 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:07:41 PM

Posted 06 January 2012 - 02:32 PM

Ok, let's reset your hosts file as it appears missing. Then run a scan to see uf there is fallout and then we ca mop up.

Your HOSTS file may be infected.
Reset the HOSTS file
As this infection also changes your Windows HOSTS file, we want to replace this file with the default version for your operating system.
Some types of malware will alter the HOSTS file as part of its infection. Please follow the instructions provided in How do I reset the hosts file back to the default?

To reset the hosts file automatically,go HERE click the Posted Image button. Then just follow the prompts in the Fix it wizard.


OR
Click Run in the File Download dialog box or save MicrosoftFixit50267.msi to your Desktop and double-click on it to run. Then just follow the promots in the Fix it wizard.



I'd like us to scan your machine with ESET OnlineScan
  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the Posted Image button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on Posted Image to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the Posted Image icon on your desktop.
  • Check Posted Image
  • Click the Posted Image button.
  • Accept any security warnings from your browser.
  • Under scan settings, check Posted Image and check Remove found threats
  • Click Advanced settings and select the following:
    • Scan potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth technology
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push Posted Image
  • Push Posted Image, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Push the Posted Image button.
  • Push Posted Image


NOTE: In some instances if no malware is found there will be no log produced.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#6 Angry_Samoan

Angry_Samoan
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:12:41 AM

Posted 07 January 2012 - 08:24 AM

Hello.

I ran the Microsoft Fix It, and restarted the computer as prompted. I still do not have the Recycle Bin emptying sound, not do I have the system opening and shutting down sound.

It seems that I am incapable of running the ESET Online Scan. The window for running the scan does not show any graphics, but will give a pop-up noise. And then the browser (Internet Explorer) will not respond. And when I close out the scan window, all windows get closed. I have attempted this scan multiple scans and each time it has done the same thing.

Thanks.

-A/S

#7 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,166 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:07:41 PM

Posted 07 January 2012 - 11:17 PM

OK, let's run SFC

Please run SFC (System File Checker)
Please run System File Checker sfc /scannow... For more information on this tool see How To Use Sfc.exe To Repair System Files

NOTE for Vista/WIN 7 users..The command needs to be run from an Elevated Command Prompt.Click Start, type cmd into the Start/Search box,
right-click cmd.exe in the list above and select 'Run as Administrator'


You will need your operating system CD handy.

Open Windows Task Manager....by pressing CTRL+SHIFT+ESC

Then click File.. then New Task(Run)

In the box that opens type sfc /scannow ......There is a space between c and /

Click OK
Let it run and insert the CD when asked.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#8 Angry_Samoan

Angry_Samoan
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:12:41 AM

Posted 09 January 2012 - 03:46 AM

Sorry to go back a step, but I ended up downloading Mozilla FireFox and ran the ESET Online Scan through that. I figured this would be easier than using a recovery disk that I don't think I have.

Here is the result of the ESET Online Scan, checking for the items asked for (Scan Archives, Remove Found Threats, Scan for Potentially Unwanted Applications, Scan for Potentially Unsafe Applications, and Enable Anti-Stealth Technology)...

.................................
C:\Program Files\Search Toolbar\SearchToolbar.dll Win32/Toolbar.Zugo application cleaned by deleting - quarantined
C:\WINDOWS\system32\rfpaplik.ini Win32/Adware.Virtumonde.NEO application cleaned by deleting - quarantined
C:\WINDOWS\system32\VGgjlnnn.ini Win32/Adware.Virtumonde.NEO application cleaned by deleting - quarantined
................................


Thanks.

-A/S

Edited by Angry_Samoan, 09 January 2012 - 03:47 AM.


#9 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,166 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:07:41 PM

Posted 09 January 2012 - 10:37 AM

Good, is Norton still moaning?
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#10 Angry_Samoan

Angry_Samoan
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:12:41 AM

Posted 09 January 2012 - 03:11 PM

No. I updated, and, ran a full scan of Norton 360, and then I updated, and ran, a full scan of Malwarebytes' Anti-Malware. Both scans found nothing.

In theory, I restored my sounds and alerts back to their default settings through the Sounds & Alerts section from the Control panel. In practice, neither the "Empty Recycle Bin" sound nor the "Logging in" and "Logging Out" sounds are working. I have sound for other things though, so I just assuemd this was a bit of fallout from the virus.

Thanks.

-A/S

#11 Angry_Samoan

Angry_Samoan
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:12:41 AM

Posted 12 January 2012 - 12:39 PM

Hello,

Is there anything further that I should do? I think my system's clean, but I don't know about if there is any extra further fallout.

Thanks.

-A/S

#12 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,166 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:07:41 PM

Posted 12 January 2012 - 12:47 PM

If there are no more problems or signs of infection, you should Create a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:
  • Go to Start > Programs > Accessories > System Tools and click "System Restore".
  • Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name, then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
  • Then use Disk Cleanup to remove all but the most recently created Restore Point.
  • Go to Start > Run and type: Cleanmgr
  • Click "Ok". Disk Cleanup will scan your files for several minutes, then open.
  • Click the "More Options" tab, then click the "Clean up" button under System Restore.
  • Click Ok. You will be prompted with "Are you sure you want to delete all but the most recent restore point?"
  • Click Yes, then click Ok.
  • Click Yes again when prompted with "Are you sure you want to perform these actions?"
  • Disk Cleanup will remove the files and close automatically.
Vista Users can refer to these links: Create a New Restore Point and Disk Cleanup.

Tips to protect yourself against malware and reduce the potential for re-infection:Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.

Keeping Autorun enabled on USB and other removable drives has become a significant security risk due to the increasing number of malware variants that can infect them and transfer the infection to your computer. To learn more about this risk, please read:
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#13 Angry_Samoan

Angry_Samoan
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:12:41 AM

Posted 13 January 2012 - 06:02 PM

I ran the Create New Restore Point and Disk Cleanup.

Here's where my earlier self-proclaimed "computer idiocy" comes in.

I still do not have any alert sound for when the Recycle Bin empties, or for when the system starts up or shuts down. I changed the alert sounds for these through the "Sounds and Audio Devices" section of my Control Panel, but even with different sounds those are mute. What's more is that I have other alerts still running fine.

I think when I cleaned out this virus earlier, one of the files that might have been deleted was a file that controlled this section (recycle bin emptying and system starting up/shutting down). How can I check for that, and restore that (for lack of a better word)?

Thanks.

-A/S

Edited by Angry_Samoan, 13 January 2012 - 06:03 PM.


#14 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,166 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:07:41 PM

Posted 13 January 2012 - 08:07 PM

OK run SFC

Please run SFC (System File Checker)
Please run System File Checker sfc /scannow... For more information on this tool see How To Use Sfc.exe To Repair System Files

NOTE for Vista/WIN 7 users..The command needs to be run from an Elevated Command Prompt.Click Start, type cmd into the Start/Search box,
right-click cmd.exe in the list above and select 'Run as Administrator'


You will need your operating system CD handy.

Open Windows Task Manager....by pressing CTRL+SHIFT+ESC

Then click File.. then New Task(Run)

In the box that opens type sfc /scannow ......There is a space between c and /

Click OK
Let it run and insert the CD when asked.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook

#15 Angry_Samoan

Angry_Samoan
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:12:41 AM

Posted 14 January 2012 - 05:29 AM

I ran the SFC. It scanned the system and then nothing else happened. I wasn't asked to put in my operating system CD or anything.

Thanks.

-A/S




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users