Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

After TDSSKiller no internet


  • This topic is locked This topic is locked
9 replies to this topic

#1 dne

dne

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:05:04 AM

Posted 18 December 2012 - 05:30 AM

Hello all,

First post, hope someone can help. Saw a post with the same problem ("TDSSKiller, then no internet"), but I'm not computer savvy enough to know if that exact solution will work for my computer

System: HP Presario F700 running Vista Home Premium SP2 with a Wired connection to a Linksys E900 Wireless-N300 router.
Browser: IE9

History of problem: First, infected by the System Progressive Protection fake anti-malware application.

Used Malwarebytes' Anti-Malware (mbam) via mbam-chameleon (based on info at http://forums.malwarebytes.org/index.php?showtopic=116246 "Removal instructions for System Pregressive Protection") which seemed to get rid of System Progressive Protection fake and connection to internet was working.

Direct links via Favorites worked fine but links via Google search seemed to redirect randomly.

Identified new problem as the Google redirect virus.

Used TDSSKiller to try to get rid of that virus.
(based on info at www.youtube.com/watch?v=TLVifFbLIso "Google Redirect Virus TDSS Virus Removal")

May have been successful but could not verify because after running TDSSKiller could not get an internet connection.
(So I could not do the last step of CCleaner)

It's possible that during the reboot process of TDSSKiller chkdsk kicked in (I know chkdsk ran at some point during this ordeal).

Checked network itself to see if it was working. Two other computers were attached wireless and were able to access the internet.

Tried 4 or 5 times to do a System Restore using different restore points but each attempt failed
(ran all the way through the process but after it completed it reported that it did not restore)

Ran sfc /scannow. Appeared to do a number of things but did not solve connection problem.

Found this website (http://www.bleepingcomputer.com/forums/topic436266.html "TDSSKiller, then no internet") and downloaded Farbar Service Scanner


Current status:
No internet connection.

Network and Sharing Center shows the name of the network as "Identifying...(Public Network)"

Checked services, DHCP Client and DNS Client services not running.
Attempt to start DHCP or DNS service results in "Error 1068: The dependency service or group failed to start."

Other services listed as Automatic Startup that are not running are Computer Browser, IKE and AuthIPsec Keying Modules, IPsecPolicy Agent,
and LiveUpdate Notice Service (a Norton service). Did not attempt to start any of them.

Task Manager under Applications constantly shows 2 tasks as running, both show "Navigation Canceled - Windows Internet Explorer"

Using a borrowed laptop that is only sporadically available for use so I may not be able to respond to answers as soon as I would like.

Results of Farbar scan:
Farbar Service Scanner Version: 10-12-2012
Ran by David (administrator) on 18-12-2012 at 00:15:07
Running from "F:\"
Windows Vista ™ Home Premium Service Pack 2 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============
Dnscache Service is not running. Checking service configuration:
The start type of Dnscache service is OK.
The ImagePath of Dnscache service is OK.
The ServiceDll of Dnscache service is OK.

Dhcp Service is not running. Checking service configuration:
The start type of Dhcp service is OK.
The ImagePath of Dhcp service is OK.
The ServiceDll of Dhcp service is OK.

tdx Service is not running. Checking service configuration:
The start type of tdx service is OK.
The ImagePath of tdx: "system32\drivers\tskC4C6.tmp".


Connection Status:
==============
Localhost is accessible.
There is no connection to network.
Attempt to access Google IP returned error.
Attempt to access Google.com returned error: Other errors
Attempt to access Yahoo IP returned error.
Attempt to access Yahoo.com returned error: Other errors


Windows Firewall:
=============
mpsdrv Service is not running. Checking service configuration:
The start type of mpsdrv service is OK.
The ImagePath of mpsdrv service is OK.

MpsSvc Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open MpsSvc registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open MpsSvc registry key. The service key does not exist.
Checking ServiceDll: ATTENTION!=====> Unable to open MpsSvc registry key. The service key does not exist.
Checking LEGACY_MpsSvc: ATTENTION!=====> Unable to open LEGACY_MpsSvc\0000 registry key. The key does not exist.

bfe Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open bfe registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open bfe registry key. The service key does not exist.
Checking ServiceDll: ATTENTION!=====> Unable to open bfe registry key. The service key does not exist.
Checking LEGACY_bfe: ATTENTION!=====> Unable to open LEGACY_bfe\0000 registry key. The key does not exist.


Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Security Center:
============
wscsvc Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open wscsvc registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open wscsvc registry key. The service key does not exist.
Checking ServiceDll: ATTENTION!=====> Unable to open wscsvc registry key. The service key does not exist.
Checking LEGACY_wscsvc: ATTENTION!=====> Unable to open LEGACY_wscsvc\0000 registry key. The key does not exist.


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open WinDefend registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open WinDefend registry key. The service key does not exist.
Checking ServiceDll: ATTENTION!=====> Unable to open WinDefend registry key. The service key does not exist.


Other Services:
==============
Checking Start type of iphlpsvc: ATTENTION!=====> Unable to open iphlpsvc registry key. The service key does not exist.
Checking ImagePath of iphlpsvc: ATTENTION!=====> Unable to open iphlpsvc registry key. The service key does not exist.
Checking ServiceDll of iphlpsvc: ATTENTION!=====> Unable to open iphlpsvc registry key. The service key does not exist.


File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcsvc.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys => MD5 is legit
C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll => MD5 is legit
C:\Windows\system32\bfe.dll => MD5 is legit
C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll => MD5 is legit
C:\Windows\system32\vssvc.exe => MD5 is legit
C:\Windows\system32\wscsvc.dll => MD5 is legit
C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\system32\wuaueng.dll => MD5 is legit
C:\Windows\system32\qmgr.dll => MD5 is legit
C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll
[2012-10-09 14:58] - [2012-06-01 16:02] - 0133120 ____A (Microsoft Corporation) F1E8C34892336D33EDDCDFE44E474F64

C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\system32\ipnathlp.dll => MD5 is legit
C:\Windows\system32\iphlpsvc.dll
[2010-04-13 16:22] - [2010-02-18 05:30] - 0200704 ____A (Microsoft Corporation) 1998BD97F950680BB55F55A7244679C2

C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit


**** End of log ****

Edited by dne, 18 December 2012 - 07:04 AM.


BC AdBot (Login to Remove)

 


#2 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,771 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:05:04 AM

Posted 18 December 2012 - 09:13 PM

Welcome aboard Posted Image

You have several registry keys missing/corrupted but we need to run some general tools first to make sure you're clean.

Download Security Check from HERE, and save it to your Desktop.

* Double-click SecurityCheck.exe
* Follow the onscreen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt; please post the contents of that document.

=============================================================================

Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
  • Make sure the following options are checked:
    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center/Action Center
    • Windows Update
    • Windows Defender
  • Press "Scan".
  • It will create a log (FSS.txt) in the same directory the tool is run.
  • Please copy and paste the log to your reply.

====================================================================================

Please download MiniToolBox and run it.

Checkmark following boxes:
  • Report IE Proxy Settings
  • Report FF Proxy Settings
  • List content of Hosts
  • List IP configuration
  • List Winsock Entries
  • List last 10 Event Viewer log
  • List Installed Programs
  • List Devices (do NOT change any settings here)
  • List Users, Partitions and Memory size
Click Go and post the result.

=============================================================================

Download Malwarebytes' Anti-Malware (aka MBAM): https://www.bleepingcomputer.com/download/malwarebytes-anti-malware/ to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform quick scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

Be sure to restart the computer.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

=============================================================================

Download aswMBR to your desktop.
Double click the aswMBR.exe to run it.
If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".
Click the "Scan" button to start scan.
On completion of the scan click "Save log", save it to your desktop and post in your next reply.

NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.

My Website

My help doesn't cost a penny, but if you'd like to consider a donation, click DONATE

 


#3 dne

dne
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:05:04 AM

Posted 19 December 2012 - 01:40 AM

Hi Broni,

Thank you for the response and for the welcome. I have completed the first 3 tasks (Security Check, FSS, and MiniToolBox) and the results are below.

For steps 4 (MBAM) and 5 (aswMBR) I have questions. I already have an updated (12/13/12) MBAM on the affected computer (updated just before I lost internet access). Should I replace it with the new one and if so can I just run the mbam-setup.exe (or do I need to uninstall the old one first)? Also, for both MBAM and aswMBR it seems there may be prompts for updates. Since the affected machine does not have internet access will that be a problem?

Thanks!

Checkup.txt:
Results of screen317's Security Check version 0.99.56
Windows Vista Service Pack 2 x86 (UAC is enabled)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Security Center service is not running! This report may not be accurate!
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.65.1.1000
Java™ 6 Update 26
Java version out of Date!
Adobe Reader 8 Adobe Reader out of Date!
````````Process Check: objlist.exe by Laurent````````
Norton ccSvcHst.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 3 % Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````


FSS.txt:
Farbar Service Scanner Version: 10-12-2012
Ran by David (administrator) on 18-12-2012 at 22:04:33
Running from "F:\"
Windows Vista ™ Home Premium Service Pack 2 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============
Dnscache Service is not running. Checking service configuration:
The start type of Dnscache service is OK.
The ImagePath of Dnscache service is OK.
The ServiceDll of Dnscache service is OK.

Dhcp Service is not running. Checking service configuration:
The start type of Dhcp service is OK.
The ImagePath of Dhcp service is OK.
The ServiceDll of Dhcp service is OK.

tdx Service is not running. Checking service configuration:
The start type of tdx service is OK.
The ImagePath of tdx: "system32\drivers\tskC4C6.tmp".


Connection Status:
==============
Localhost is accessible.
There is no connection to network.
Attempt to access Google IP returned error.
Attempt to access Google.com returned error: Other errors
Attempt to access Yahoo IP returned error.
Attempt to access Yahoo.com returned error: Other errors


Windows Firewall:
=============
mpsdrv Service is not running. Checking service configuration:
The start type of mpsdrv service is OK.
The ImagePath of mpsdrv service is OK.

MpsSvc Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open MpsSvc registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open MpsSvc registry key. The service key does not exist.
Checking ServiceDll: ATTENTION!=====> Unable to open MpsSvc registry key. The service key does not exist.
Checking LEGACY_MpsSvc: ATTENTION!=====> Unable to open LEGACY_MpsSvc\0000 registry key. The key does not exist.

bfe Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open bfe registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open bfe registry key. The service key does not exist.
Checking ServiceDll: ATTENTION!=====> Unable to open bfe registry key. The service key does not exist.
Checking LEGACY_bfe: ATTENTION!=====> Unable to open LEGACY_bfe\0000 registry key. The key does not exist.


Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Security Center:
============
wscsvc Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open wscsvc registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open wscsvc registry key. The service key does not exist.
Checking ServiceDll: ATTENTION!=====> Unable to open wscsvc registry key. The service key does not exist.
Checking LEGACY_wscsvc: ATTENTION!=====> Unable to open LEGACY_wscsvc\0000 registry key. The key does not exist.


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
Checking Start type: ATTENTION!=====> Unable to open WinDefend registry key. The service key does not exist.
Checking ImagePath: ATTENTION!=====> Unable to open WinDefend registry key. The service key does not exist.
Checking ServiceDll: ATTENTION!=====> Unable to open WinDefend registry key. The service key does not exist.


Other Services:
==============
Checking Start type of iphlpsvc: ATTENTION!=====> Unable to open iphlpsvc registry key. The service key does not exist.
Checking ImagePath of iphlpsvc: ATTENTION!=====> Unable to open iphlpsvc registry key. The service key does not exist.
Checking ServiceDll of iphlpsvc: ATTENTION!=====> Unable to open iphlpsvc registry key. The service key does not exist.


File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcsvc.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys => MD5 is legit
C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll => MD5 is legit
C:\Windows\system32\bfe.dll => MD5 is legit
C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll => MD5 is legit
C:\Windows\system32\vssvc.exe => MD5 is legit
C:\Windows\system32\wscsvc.dll => MD5 is legit
C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\system32\wuaueng.dll => MD5 is legit
C:\Windows\system32\qmgr.dll => MD5 is legit
C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll
[2012-10-09 14:58] - [2012-06-01 16:02] - 0133120 ____A (Microsoft Corporation) F1E8C34892336D33EDDCDFE44E474F64

C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit


**** End of log ****



Result.txt (From MiniToolBox):
MiniToolBox by Farbar Version: 25-11-2012
Ran by David (administrator) on 18-12-2012 at 22:07:23
Running from "F:\"
Windows Vista ™ Home Premium Service Pack 2 (X86)
Boot Mode: Normal
***************************************************************************

========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.
========================= Hosts content: =================================

::1 localhost

127.0.0.1 localhost

========================= IP Configuration: ================================

NVIDIA nForce Networking Controller = Local Area Connection (Connected)


# ----------------------------------
# IPv4 Configuration
# ----------------------------------
pushd interface ipv4

reset
set global icmpredirects=enabled


popd
# End of IPv4 configuration



Windows IP Configuration

Host Name . . . . . . . . . . . . : David-PC
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : NVIDIA nForce Networking Controller
Physical Address. . . . . . . . . : 00-1B-24-99-E4-69
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : fda0:1e3b:5efc:0:b53b:8e69:52d2:e713(Preferred)
Temporary IPv6 Address. . . . . . : fda0:1e3b:5efc:0:cd69:e47a:7f97:1bed(Preferred)
Link-local IPv6 Address . . . . . : fe80::b53b:8e69:52d2:e713%8(Preferred)
Autoconfiguration IPv4 Address. . : 169.254.231.19(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . :
DNS Servers . . . . . . . . . . . : 68.94.156.1
68.94.157.1
192.168.1.1
NetBIOS over Tcpip. . . . . . . . : Disabled

Tunnel adapter Local Area Connection* 6:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : isatap.{33E3719A-76B1-48B1-9F31-BD3CBF2DBDDA}
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 9:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 02-00-54-55-4E-01
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Server: UnKnown
Address: 68.94.156.1

Ping request could not find host google.com. Please check the name and try again.

Server: UnKnown
Address: 68.94.156.1

Ping request could not find host yahoo.com. Please check the name and try again.



Pinging 127.0.0.1 with 32 bytes of data:

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Reply from 127.0.0.1: bytes=32 time<1ms TTL=128



Ping statistics for 127.0.0.1:

Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 0ms, Average = 0ms

===========================================================================
Interface List
8 ...00 1b 24 99 e4 69 ...... NVIDIA nForce Networking Controller
1 ........................... Software Loopback Interface 1
11 ...00 00 00 00 00 00 00 e0 isatap.{33E3719A-76B1-48B1-9F31-BD3CBF2DBDDA}
10 ...02 00 54 55 4e 01 ...... Teredo Tunneling Pseudo-Interface
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
169.254.0.0 255.255.0.0 On-link 169.254.231.19 276
169.254.231.19 255.255.255.255 On-link 169.254.231.19 276
169.254.255.255 255.255.255.255 On-link 169.254.231.19 276
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 169.254.231.19 276
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 169.254.231.19 276
===========================================================================
Persistent Routes:
None

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 306 ::1/128 On-link
8 28 fda0:1e3b:5efc::/64 On-link
8 276 fda0:1e3b:5efc:0:b53b:8e69:52d2:e713/128
On-link
8 276 fda0:1e3b:5efc:0:cd69:e47a:7f97:1bed/128
On-link
8 276 fe80::/64 On-link
8 276 fe80::b53b:8e69:52d2:e713/128
On-link
1 306 ff00::/8 On-link
8 276 ff00::/8 On-link
===========================================================================
Persistent Routes:
None
========================= Winsock entries =====================================

Catalog5 01 C:\Windows\system32\NLAapi.dll [48128] (Microsoft Corporation)
Catalog5 02 C:\Windows\system32\napinsp.dll [50176] (Microsoft Corporation)
Catalog5 03 C:\Windows\system32\pnrpnsp.dll [62464] (Microsoft Corporation)
Catalog5 04 C:\Windows\system32\pnrpnsp.dll [62464] (Microsoft Corporation)
Catalog5 05 C:\Windows\System32\mswsock.dll [223232] (Microsoft Corporation)
Catalog5 06 C:\Windows\System32\winrnr.dll [19968] (Microsoft Corporation)
Catalog9 01 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 02 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 03 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 04 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 05 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 06 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 07 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 08 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 09 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 10 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 11 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 12 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 13 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 14 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 15 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 16 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 17 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 18 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 19 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 20 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 21 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)
Catalog9 22 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation)

========================= Event log errors: ===============================

Application errors:
==================
Error: (12/16/2012 04:34:34 PM) (Source: EventSystem) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c

Error: (12/15/2012 09:19:51 PM) (Source: RasClient) (User: )
Description: CoId={1482F05D-9506-4E27-928D-3FC4E7649616}: The user David-PC\David dialed a connection named ATT which has failed. The error code returned on failure is 815.

Error: (12/15/2012 09:08:40 PM) (Source: System Restore) (User: )
Description: The restore point selected was damaged or deleted during the restore (Scheduled Checkpoint).

Error: (12/15/2012 08:20:39 PM) (Source: System Restore) (User: )
Description: The restore point selected was damaged or deleted during the restore (Scheduled Checkpoint).

Error: (12/15/2012 07:46:20 PM) (Source: System Restore) (User: )
Description: The restore point selected was damaged or deleted during the restore (Windows Update).

Error: (12/15/2012 07:18:03 PM) (Source: System Restore) (User: )
Description: The restore point selected was damaged or deleted during the restore (Scheduled Checkpoint).

Error: (12/15/2012 06:39:05 PM) (Source: System Restore) (User: )
Description: The restore point selected was damaged or deleted during the restore (Windows Update).

Error: (12/15/2012 06:19:21 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description:
Details:
Could not query the status of the EventSystem service.

System Error:
A system shutdown is in progress.

Error: (12/15/2012 06:16:03 PM) (Source: EventSystem) (User: )
Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043c

Error: (12/15/2012 07:46:02 AM) (Source: Application Error) (User: )
Description: Faulting application rundll32.exe, version 6.0.6000.16386, time stamp 0x4549b0e1, faulting module ole32.dll, version 6.0.6002.18277, time stamp 0x4c28d53e, exception code 0xc0000005, fault offset 0x00039e51,
process id 0xb6c, application start time 0xrundll32.exe0.


System errors:
=============

Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
Date: 2012-12-16 05:01:27.870
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2012-12-16 05:01:27.043
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2012-12-16 05:01:26.217
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2012-12-16 05:01:25.327
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2012-12-16 03:56:32.812
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2012-12-16 03:56:31.938
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2012-12-16 03:56:31.080
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2012-12-16 03:56:30.176
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2012-12-15 08:40:50.868
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2012-12-15 08:40:50.057
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.


=========================== Installed Programs ============================

Update for Microsoft Office 2007 (KB2508958)
32 Bit HP CIO Components Installer (Version: 1.0.0)
A430 (Version: 82.0.233.000)
A430_Help (Version: 82.0.233.000)
Activation Assistant for the 2007 Microsoft Office suites
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0)
ActiveCheck component for HP Active Support Library (Version: 3.0.0.2)
Adobe AIR (Version: 2.0.3.13070)
Adobe Flash Player 11 ActiveX (Version: 11.5.502.135)
Adobe Reader X (10.1.4) (Version: 10.1.4)
AppCore (Version: 1)
Apple Software Update (Version: 2.1.1.116)
AV (Version: 1)
BufferChm (Version: 82.0.173.000)
CameraDrivers (Version: 8.0.1)
ccCommon (Version: 106.2.0.21)
Cisco Connect (Version: 1.4.11350.0)
Conexant HD Audio
CustomerResearchQFolder (Version: 1.00.0000)
Destinations (Version: 82.0.173.000)
DeviceManagementQFolder (Version: 1.00.0000)
ESU for Microsoft Vista (Version: 2.0.2.1)
eSupportQFolder (Version: 1.00.0000)
Google Toolbar for Internet Explorer (Version: 1.0.0)
Google Toolbar for Internet Explorer (Version: 7.4.3230.2052)
Google Update Helper (Version: 1.3.21.123)
HDAUDIO Soft Data Fax Modem with SmartCP
HP Active Support Library (Version: 3.1.6.1)
HP Active Support Library 32 bit components (Version: 1.0.9)
HP Active Support Library 32 bit components (Version: 2.1.0)
HP Customer Experience Enhancements (Version: 5.1.0.2278)
HP Customer Participation Program 8.0 (Version: 8.0)
HP Deskjet & Photosmart Printer Driver Software 8.0.A (Version: 8.0)
HP Driver Diagnostics (Version: 1.02.0010)
HP DVD Play 3.6
HP Easy Setup - Frontend (Version: 5.1.0.2279)
HP Help and Support (Version: 2.0.9.0)
HP Imaging Device Functions 8.0 (Version: 8.0)
HP Photosmart Essential (Version: 1.12.0.46)
HP Photosmart Essential 2.0 (Version: 2.0)
HP Photosmart Essential2.5 (Version: 1.00.0000)
HP Quick Launch Buttons 6.20 D3 (Version: 6.20 D3)
HP Solution Center 8.0 (Version: 8.0)
HP Total Care Advisor (Version: 1.1.19)
HP Update (Version: 4.000.010.008)
HP User Guides 0041 (Version: 1.03.0002)
HP Wireless Assistant (Version: 3.00 H3)
HPAsset component for HP Active Support Library (Version: 3.0.1.0)
HPNetworkAssistant (Version: 1.1.70)
HPProductAssistant (Version: 82.0.173.000)
HPSSupply (Version: 2.1.3.0000)
Japanese Fonts Support For Adobe Reader 8 (Version: 8.0)
Java Auto Updater (Version: 2.0.5.1)
Java™ 6 Update 26 (Version: 6.0.260)
LightScribe 1.4.136.1 (Version: 1.4.136.1)
LiveUpdate 3.2 (Symantec Corporation) (Version: 3.2.0.68)
LiveUpdate Notice (Symantec Corporation) (Version: 1.4.5)
Malwarebytes Anti-Malware version 1.65.1.1000 (Version: 1.65.1.1000)
MarketResearch (Version: 82.0.174.000)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Excel MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000)
Microsoft Office OneNote MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Spanish) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Shared MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Word MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Works (Version: 08.05.0818)
MSCU for Microsoft Vista (Version: 1.0.1.1)
MSN
MSRedist (Version: 1.0.0.0)
MSXML 4.0 SP2 (KB936181) (Version: 4.20.9848.0)
MSXML 4.0 SP2 (KB941833) (Version: 4.20.9849.0)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
muvee autoProducer 6.0 (Version: 6.00.050)
My HP Games (Version: HPLAP0503)
Norton AntiVirus (Version: 14.2.0.29)
Norton Confidential Browser Component (Version: 1.5.0.29)
Norton Confidential Web Protection Component (Version: 1.5.0.29)
Norton Internet Security (Symantec Corporation) (Version: 10.2.0.30)
Norton Internet Security (Version: 10.1.0)
Norton Internet Security (Version: 10.2.0.30)
Norton Protection Center (Version: 2007.2.0.22)
NoteTab Light 7 (Remove only) (Version: 7.1)
NVIDIA Drivers
PSSWCORE (Version: 2.00.5000)
QuickPlay SlingPlayer 0.4.4 (Version: 0.4.4)
QuickTime (Version: 7.55.90.70)
QuickTransfer (Version: 1.00.0000)
Rhapsody
Rhapsody Player Engine (Version: 1.0.604)
Roxio Activation Module (Version: 1.0)
Roxio Creator Audio (Version: 3.4.0)
Roxio Creator Basic v9 (Version: 3.4.0)
Roxio Creator Copy (Version: 3.4.0)
Roxio Creator Data (Version: 3.4.0)
Roxio Creator EasyArchive (Version: 3.4.0)
Roxio Creator Tools (Version: 3.4.0)
Roxio Express Labeler 3 (Version: 3.2.1)
Roxio MyDVD Basic v9 (Version: 9.0.551)
SF_CDA_ProductContext (Version: 82.0.233.000)
SF_CDA_Software (Version: 82.0.233.000)
SolutionCenter (Version: 82.0.188.000)
SPBBC 32bit (Version: 3.2.0.21)
Spelling Dictionaries Support For Adobe Reader 8 (Version: 8.0.0)
Status (Version: 82.0.173.000)
Symantec Real Time Storage Protection Component (Version: 10.2.1.8)
SymNet (Version: 7.2.0.15)
Synaptics Pointing Device Driver (Version: 11.0.7.0)
Toolbox (Version: 82.0.173.000)
TrayApp (Version: 82.0.188.000)
UnloadSupport (Version: 1.00.0000)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Vongo (Version: 1.51.1)
WebReg (Version: 82.0.173.000)
Yahoo! Toolbar for Internet Explorer

========================= Devices: ================================


========================= Memory info: ===================================

Percentage of memory in use: 90%
Total physical RAM: 957.87 MB
Available physical RAM: 92.91 MB
Total Pagefile: 2184.08 MB
Available Pagefile: 1382.67 MB
Total Virtual: 2047.88 MB
Available Virtual: 1946.76 MB

========================= Partitions: =====================================

1 Drive c: () (Fixed) (Total:103.68 GB) (Free:4.22 GB) NTFS
2 Drive d: (PRESARIO_RP) (Fixed) (Total:8.11 GB) (Free:1.75 GB) NTFS
4 Drive f: (Lexar) (Removable) (Total:7.45 GB) (Free:7.44 GB) FAT32

========================= Users: ========================================

User accounts for \\DAVID-PC

Administrator David Guest


**** End of log ****

#4 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,771 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:05:04 AM

Posted 19 December 2012 - 07:03 PM

To manually update MBAM, download this file: http://data.mbamupdates.com/tools/mbam-rules.exe
Double click on downloaded file to update the program.

As for aswMBR run it without updating.

My Website

My help doesn't cost a penny, but if you'd like to consider a donation, click DONATE

 


#5 dne

dne
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:05:04 AM

Posted 20 December 2012 - 12:05 AM

Sorry or the delayed response. MBAM quick scan is not so quick on my system. Steps 4 & 5 completed. Results below. Thanks!

Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org

Database version: v2012.12.17.07

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
David :: DAVID-PC [administrator]

12/19/2012 4:26:34 PM
mbam-log-2012-12-19 (16-26-34).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 257143
Time elapsed: 4 hour(s), 7 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Users\David\AppData\Local\Temp\~!#54BD.tmp (Trojan.Ransom) -> Quarantined and deleted successfully.

(end)


aswMBR.txt:
aswMBR version 0.9.9.1707 Copyright© 2011 AVAST Software
Run date: 2012-12-19 20:49:58
-----------------------------
20:49:58.115 OS Version: Windows 6.0.6002 Service Pack 2
20:49:58.115 Number of processors: 2 586 0x6801
20:49:58.131 ComputerName: DAVID-PC UserName: David
20:51:29.796 Initialize success
20:52:21.697 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000064
20:52:21.697 Disk 0 Vendor: ST912082 3.BH Size: 114473MB BusType: 6
20:52:21.729 Disk 0 MBR read successfully
20:52:21.729 Disk 0 MBR scan
20:52:21.744 Disk 0 unknown MBR code
20:52:21.775 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 106163 MB offset 63
20:52:21.822 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 8307 MB offset 217423710
20:52:21.838 Disk 0 scanning sectors +234436545
20:52:21.916 Disk 0 scanning C:\Windows\system32\drivers
20:52:39.029 Service scanning
20:52:39.840 Service .tdx \? **LOCKED** 123
20:53:10.666 Modules scanning
20:53:38.059 Disk 0 trace - called modules:
20:53:38.137 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll storport.sys nvstor32.sys
20:53:38.137 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85312278]
20:53:38.184 3 CLASSPNP.SYS[8679f8b3] -> nt!IofCallDriver -> [0x848e2360]
20:53:38.215 5 acpi.sys[806106bc] -> nt!IofCallDriver -> \Device\00000064[0x848e2c90]
20:53:38.231 Scan finished successfully
20:54:24.469 Disk 0 MBR has been saved successfully to "F:\MBR.dat"
20:54:24.501 The log file has been saved successfully to "F:\aswMBR.txt"


aswMBR version 0.9.9.1707 Copyright© 2011 AVAST Software
Run date: 2012-12-19 20:56:10
-----------------------------
20:56:10.019 OS Version: Windows 6.0.6002 Service Pack 2
20:56:10.019 Number of processors: 2 586 0x6801
20:56:10.035 ComputerName: DAVID-PC UserName: David
20:56:10.986 Initialize success
20:56:14.465 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000064
20:56:14.481 Disk 0 Vendor: ST912082 3.BH Size: 114473MB BusType: 6
20:56:14.543 Disk 0 MBR read successfully
20:56:14.559 Disk 0 MBR scan
20:56:14.574 Disk 0 unknown MBR code
20:56:14.574 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 106163 MB offset 63
20:56:14.621 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 8307 MB offset 217423710
20:56:14.652 Disk 0 scanning sectors +234436545
20:56:14.746 Disk 0 scanning C:\Windows\system32\drivers
20:56:26.727 Service scanning
20:56:27.772 Service .tdx \? **LOCKED** 123
20:56:48.551 Modules scanning
20:57:14.556 Disk 0 trace - called modules:
20:57:14.587 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll storport.sys nvstor32.sys
20:57:14.619 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85312278]
20:57:14.619 3 CLASSPNP.SYS[8679f8b3] -> nt!IofCallDriver -> [0x848e2360]
20:57:14.634 5 acpi.sys[806106bc] -> nt!IofCallDriver -> \Device\00000064[0x848e2c90]
20:57:14.650 Scan finished successfully
20:57:31.701 Disk 0 MBR has been saved successfully to "F:\MBR.dat"
20:57:31.732 The log file has been saved successfully to "F:\aswMBR.txt"

#6 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,771 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:05:04 AM

Posted 20 December 2012 - 12:10 AM

Download Malwarebytes Anti-Rootkit from HERE
  • Unzip downloaded file.
  • Open the folder where the contents were unzipped and run mbar.exe
  • Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
  • DO NOT click on the Cleanup button. Simply exit the program.
  • When done, please post the two logs produced they will be in the MBAR folder..... mbar-log-xxxxx.txt and system-log.txt

My Website

My help doesn't cost a penny, but if you'd like to consider a donation, click DONATE

 


#7 dne

dne
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:05:04 AM

Posted 20 December 2012 - 01:34 AM

Task completed. Attempt to update mbar failed ("No host found" or "Cannot find host" or some similar message) due to lack of internet connection but went on to next step and scan appeared to run successfully to completion. Did NOT attempt cleanup. mbar-log and system-log below.

Thanks!

Malwarebytes Anti-Rootkit 1.01.0.1011
www.malwarebytes.org

Database version: v2012.12.03.14

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
David :: DAVID-PC [administrator]

12/19/2012 10:13:53 PM
mbar-log-2012-12-19 (22-13-53).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 28444
Time elapsed: 30 minute(s), 29 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 1
HKCU\SOFTWARE\CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} (Hijack.Trojan.Siredef.C) -> Delete on reboot.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 8
C:\Windows\$NtUninstallKB62280$\485945278\L (Backdoor.0Access) -> Delete on reboot.
C:\Windows\$NtUninstallKB62280$\485945278\U (Backdoor.0Access) -> Delete on reboot.
C:\Windows\$NtUninstallKB62280$\485945278 (Backdoor.0Access) -> Delete on reboot.
C:\Users\David\Local Settings\Application Data\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\U (Backdoor.0Access) -> Delete on reboot.
C:\Users\David\Local Settings\Application Data\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\L (Backdoor.0Access) -> Delete on reboot.
C:\$RECYCLE.BIN\S-1-5-21-1055404121-919610189-1741765639-1000\$ff24043d55f85ce9a20a8337d9b4b888\U (Trojan.Siredef.C) -> Delete on reboot.
C:\$RECYCLE.BIN\S-1-5-21-1055404121-919610189-1741765639-1000\$ff24043d55f85ce9a20a8337d9b4b888\L (Trojan.Siredef.C) -> Delete on reboot.
C:\$RECYCLE.BIN\S-1-5-21-1055404121-919610189-1741765639-1000\$ff24043d55f85ce9a20a8337d9b4b888 (Trojan.Siredef.C) -> Delete on reboot.

Files Detected: 4
C:\$RECYCLE.BIN\S-1-5-21-1055404121-919610189-1741765639-1000\$ff24043d55f85ce9a20a8337d9b4b888\@ (Trojan.Siredef.C) -> Delete on reboot.
C:\$RECYCLE.BIN\S-1-5-21-1055404121-919610189-1741765639-1000\$ff24043d55f85ce9a20a8337d9b4b888\U\00000001.@ (Trojan.Siredef.C) -> Delete on reboot.
C:\$RECYCLE.BIN\S-1-5-21-1055404121-919610189-1741765639-1000\$ff24043d55f85ce9a20a8337d9b4b888\U\80000000.@ (Trojan.Siredef.C) -> Delete on reboot.
C:\$RECYCLE.BIN\S-1-5-21-1055404121-919610189-1741765639-1000\$ff24043d55f85ce9a20a8337d9b4b888\U\800000cb.@ (Trojan.Siredef.C) -> Delete on reboot.

(end)




---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.01.0.1011

© Malwarebytes Corporation 2011-2012

OS version: 6.0.6002 Windows Vista Service Pack 2 x86

Account is Administrative

Internet Explorer version: 9.0.8112.16421

Java version: 1.6.0_26

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 1.808000 GHz
Memory total: 1004400640, free: 61829120

Host not found
Initializing...
Done!
Scanning directory: C:\Windows\system32\drivers...
The directory C:\Windows\system32\drivers seems inaccessible or encrypted.
Drivers scan is aborted.
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: CE5973CB

Partition information:

Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 63 Numsec = 217423647
Partition file system is NTFS
Partition is bootable

Partition 1 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 217423710 Numsec = 17012835

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 120034123776 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-62-234421648-234441648)...
Drive 1
Scanning MBR on drive 1...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 0

Partition information:

Partition 0 type is Other (0xb)
Partition is NOT ACTIVE.
Partition starts at LBA: 2192 Numsec = 15660912

Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 8019509248 bytes
Sector size: 512 bytes

Done!
Performing system, memory and registry scan...
Infected: C:\$RECYCLE.BIN\S-1-5-21-1055404121-919610189-1741765639-1000\$ff24043d55f85ce9a20a8337d9b4b888\@ --> [Trojan.Siredef.C]
Infected: HKCU\SOFTWARE\CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} --> [Hijack.Trojan.Siredef.C]
Infected: C:\Windows\$NtUninstallKB62280$\485945278\L --> [Backdoor.0Access]
Infected: C:\Windows\$NtUninstallKB62280$\485945278\U --> [Backdoor.0Access]
Infected: C:\Windows\$NtUninstallKB62280$\485945278 --> [Backdoor.0Access]
Infected: C:\Users\David\Local Settings\Application Data\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\U --> [Backdoor.0Access]
Infected: C:\Users\David\Local Settings\Application Data\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\L --> [Backdoor.0Access]
Infected: C:\$RECYCLE.BIN\S-1-5-21-1055404121-919610189-1741765639-1000\$ff24043d55f85ce9a20a8337d9b4b888\U --> [Trojan.Siredef.C]
Infected: C:\$RECYCLE.BIN\S-1-5-21-1055404121-919610189-1741765639-1000\$ff24043d55f85ce9a20a8337d9b4b888\U\00000001.@ --> [Trojan.Siredef.C]
Infected: C:\$RECYCLE.BIN\S-1-5-21-1055404121-919610189-1741765639-1000\$ff24043d55f85ce9a20a8337d9b4b888\U\80000000.@ --> [Trojan.Siredef.C]
Infected: C:\$RECYCLE.BIN\S-1-5-21-1055404121-919610189-1741765639-1000\$ff24043d55f85ce9a20a8337d9b4b888\U\800000cb.@ --> [Trojan.Siredef.C]
Infected: C:\$RECYCLE.BIN\S-1-5-21-1055404121-919610189-1741765639-1000\$ff24043d55f85ce9a20a8337d9b4b888\L --> [Trojan.Siredef.C]
Infected: C:\$RECYCLE.BIN\S-1-5-21-1055404121-919610189-1741765639-1000\$ff24043d55f85ce9a20a8337d9b4b888 --> [Trojan.Siredef.C]
Done!
Scan finished
=======================================

#8 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,771 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:05:04 AM

Posted 20 December 2012 - 05:03 PM

You're infected with ZeroAccess rootkit.
It'll require elevated help.

Please follow the instructions in ==>This Guide<== starting at Step 6. If you cannot complete a step, skip it and continue.

Once the proper logs are created, then make a NEW TOPIC and post it ==>HERE<== Please include a description of your computer issues, what you have done to resolve them, and a link to this topic.

If you can produce at least some of the logs, then please create the new topic and explain what happens when you try to create the log(s) that you couldn't get. If you cannot produce any of the logs, then still post the topic and explain that you followed the Prep. Guide, were unable to create the logs, and describe what happens when you try to create the logs.

It would be helpful if you post a note here once you have completed the steps in the guide and have started your topic in malware removal. Good luck and be patient.

If HelpBot replies to your topic, PLEASE follow Step One so it will report your topic to the team members.

My Website

My help doesn't cost a penny, but if you'd like to consider a donation, click DONATE

 


#9 dne

dne
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:05:04 AM

Posted 20 December 2012 - 09:20 PM

Hi Broni,

Thanks for all your time. Have completed the steps in the guide (starting at step 6) and started the topic in the malware removal forum here: http://www.bleepingcomputer.com/forums/topic479163.html

Thanks again!

#10 boopme

boopme

    To Insanity and Beyond


  • Global Moderator
  • 73,569 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NJ USA
  • Local time:08:04 AM

Posted 21 December 2012 - 11:27 PM

Now that your log is properly posted, you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a Malware Removal Team member, nor should you continue to ask for help elsewhere. Doing so can result in system changes which may not show it the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the Malware Removal Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the Malware Removal Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the Malware Removal Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another MRL Team member is already assisting you and not open the thread to respond.

The current wait time is 1 - 2 days and ALL logs are answered.

If HelpBot replies to your topic, PLEASE follow Step One so it will report your topic to the team members.

To avoid confusion, I am closing this topic.
How do I get help? Who is helping me?For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear....Become a BleepingComputer fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users