Solved Google Search Link opens to random sites

sox7rock · 2010/12/12

[Resolved] Google Search Link opens to random sites

My google search links, keeps opening to some random sites like casinocaesar or moviearchive etc etc sites. Pleaes help me out.

gmer.log

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2010-12-12 18:54:48
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdePort0 WDC_WD600BB-75CAA0 rev.16.06V16
Running: pbpfj6qm.exe; Driver: C:\DOCUME~1\Paul\LOCALS~1\Temp\kxtdapob.sys

---- System - GMER 1.0.15 ----

SSDT 86714630 ZwAssignProcessToJobObject
SSDT 86713A60 ZwOpenProcess
SSDT 86713E80 ZwOpenThread
SSDT 86714460 ZwSuspendProcess
SSDT 86714280 ZwSuspendThread
SSDT 86713C90 ZwTerminateProcess
SSDT 867140B0 ZwTerminateThread

---- Kernel code sections - GMER 1.0.15 ----

.text ntoskrnl.exe!_abnormal_termination + 445 804E2AB1 3 Bytes [42, 71, 86] {INC EDX; JNO 0xffffffffffffff89}
? rccpsft.sys The system cannot find the file specified. !
.rsrc C:\WINDOWS\system32\drivers\ultra.sys entry point in ".rsrc" section [0xF75F5314]
.text C:\WINDOWS\System32\DRIVERS\nv4_mini.sys section is writeable [0xF61B6360, 0x24CB9D, 0xE8000020]
init C:\WINDOWS\system32\DRIVERS\VPCPOWER.SYS entry point in "init" section [0xF7A514A0]

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1064] kernel32.dll!SetUnhandledExceptionFilter 7C8447ED 4 Bytes [C2, 04, 00, 00]
.text C:\WINDOWS\System32\svchost.exe[1676] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 006D000A
.text C:\WINDOWS\System32\svchost.exe[1676] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 006E000A
.text C:\WINDOWS\System32\svchost.exe[1676] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 006C000C
.text C:\WINDOWS\System32\svchost.exe[1676] USER32.dll!GetCursorPos 7E41BD76 5 Bytes JMP 0266000A
.text C:\WINDOWS\System32\svchost.exe[1676] ole32.dll!CoCreateInstance 774FFAC3 5 Bytes JMP 00AF000A
.text C:\WINDOWS\Explorer.EXE[1740] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00D7000A
.text C:\WINDOWS\Explorer.EXE[1740] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00D8000A
.text C:\WINDOWS\Explorer.EXE[1740] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00C1000C
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[2328] USER32.dll!TrackPopupMenu 7E4650EE 5 Bytes JMP 10402342 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 0167000A
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 0169000A
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 0166000C
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] USER32.dll!DrawTextW 7E41D7C2 5 Bytes JMP 00ECCE9E
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] USER32.dll!DrawTextExW 7E41DD7F 5 Bytes JMP 00ECD062
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] USER32.dll!DialogBoxParamW 7E42555F 5 Bytes JMP 00ECC197
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] USER32.dll!SetClipboardData 7E430F5E 5 Bytes JMP 00ECCB15
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] USER32.dll!DrawTextA 7E43C6CA 5 Bytes JMP 00ECCDC2
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] USER32.dll!DrawTextExA 7E43C701 5 Bytes JMP 00ECCF7A
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] GDI32.dll!TextOutW 77F17EAC 5 Bytes JMP 00ECCCF5
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] GDI32.dll!ExtTextOutW 77F18086 5 Bytes JMP 00ECD22F
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] GDI32.dll!TextOutA 77F1BC14 5 Bytes JMP 00ECCC28
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] GDI32.dll!ExtTextOutA 77F1D45A 5 Bytes JMP 00ECD14A
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] GDI32.dll!GetGlyphIndicesA 77F3DB23 5 Bytes JMP 00ECD5E6
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] GDI32.dll!GetGlyphIndicesW 77F51D6E 5 Bytes JMP 00ECD6B0

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Program Files\Skype\Phone\Skype.exe[2940] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00382F20] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Skype\Phone\Skype.exe[2940] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00382C90] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Skype\Phone\Skype.exe[2940] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00382CF0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Skype\Phone\Skype.exe[2940] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00382CC0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)
AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdir.sys (ESET Antivirus Network Redirector/ESET)

Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP1T1L0-17 872D6AEA
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort0 872D6AEA
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort1 872D6AEA
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP1T0L0-f 872D6AEA
Device \FileSystem\Fastfat \Fat B6C65C8A

AttachedDevice \FileSystem\Fastfat \Fat eamon.sys (Amon monitor/ESET)

Device \Device\Ide\IdeDeviceP0T0L0-3 -> \??\IDE#DiskWDC_WD600BB-75CAA0______________________16.06V16#4457572d414d4638343132313633_030_0_0_0_0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found

---- Threads - GMER 1.0.15 ----

Thread System [4:448] 86712790

---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 sectors 117187244 (+254): rootkit-like behavior;

---- Files - GMER 1.0.15 ----

File C:\WINDOWS\system32\drivers\ultra.sys suspicious modification; TDL3 <-- ROOTKIT !!!

---- EOF - GMER 1.0.15 ----

MBRCheck

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2010-12-12 18:54:48
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdePort0 WDC_WD600BB-75CAA0 rev.16.06V16
Running: pbpfj6qm.exe; Driver: C:\DOCUME~1\Paul\LOCALS~1\Temp\kxtdapob.sys

---- System - GMER 1.0.15 ----

SSDT 86714630 ZwAssignProcessToJobObject
SSDT 86713A60 ZwOpenProcess
SSDT 86713E80 ZwOpenThread
SSDT 86714460 ZwSuspendProcess
SSDT 86714280 ZwSuspendThread
SSDT 86713C90 ZwTerminateProcess
SSDT 867140B0 ZwTerminateThread

---- Kernel code sections - GMER 1.0.15 ----

.text ntoskrnl.exe!_abnormal_termination + 445 804E2AB1 3 Bytes [42, 71, 86] {INC EDX; JNO 0xffffffffffffff89}
? rccpsft.sys The system cannot find the file specified. !
.rsrc C:\WINDOWS\system32\drivers\ultra.sys entry point in ".rsrc" section [0xF75F5314]
.text C:\WINDOWS\System32\DRIVERS\nv4_mini.sys section is writeable [0xF61B6360, 0x24CB9D, 0xE8000020]
init C:\WINDOWS\system32\DRIVERS\VPCPOWER.SYS entry point in "init" section [0xF7A514A0]

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1064] kernel32.dll!SetUnhandledExceptionFilter 7C8447ED 4 Bytes [C2, 04, 00, 00]
.text C:\WINDOWS\System32\svchost.exe[1676] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 006D000A
.text C:\WINDOWS\System32\svchost.exe[1676] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 006E000A
.text C:\WINDOWS\System32\svchost.exe[1676] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 006C000C
.text C:\WINDOWS\System32\svchost.exe[1676] USER32.dll!GetCursorPos 7E41BD76 5 Bytes JMP 0266000A
.text C:\WINDOWS\System32\svchost.exe[1676] ole32.dll!CoCreateInstance 774FFAC3 5 Bytes JMP 00AF000A
.text C:\WINDOWS\Explorer.EXE[1740] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00D7000A
.text C:\WINDOWS\Explorer.EXE[1740] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00D8000A
.text C:\WINDOWS\Explorer.EXE[1740] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00C1000C
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[2328] USER32.dll!TrackPopupMenu 7E4650EE 5 Bytes JMP 10402342 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 0167000A
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 0169000A
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 0166000C
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] USER32.dll!DrawTextW 7E41D7C2 5 Bytes JMP 00ECCE9E
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] USER32.dll!DrawTextExW 7E41DD7F 5 Bytes JMP 00ECD062
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] USER32.dll!DialogBoxParamW 7E42555F 5 Bytes JMP 00ECC197
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] USER32.dll!SetClipboardData 7E430F5E 5 Bytes JMP 00ECCB15
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] USER32.dll!DrawTextA 7E43C6CA 5 Bytes JMP 00ECCDC2
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] USER32.dll!DrawTextExA 7E43C701 5 Bytes JMP 00ECCF7A
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] GDI32.dll!TextOutW 77F17EAC 5 Bytes JMP 00ECCCF5
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] GDI32.dll!ExtTextOutW 77F18086 5 Bytes JMP 00ECD22F
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] GDI32.dll!TextOutA 77F1BC14 5 Bytes JMP 00ECCC28
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] GDI32.dll!ExtTextOutA 77F1D45A 5 Bytes JMP 00ECD14A
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] GDI32.dll!GetGlyphIndicesA 77F3DB23 5 Bytes JMP 00ECD5E6
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] GDI32.dll!GetGlyphIndicesW 77F51D6E 5 Bytes JMP 00ECD6B0

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Program Files\Skype\Phone\Skype.exe[2940] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00382F20] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Skype\Phone\Skype.exe[2940] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00382C90] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Skype\Phone\Skype.exe[2940] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00382CF0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Skype\Phone\Skype.exe[2940] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00382CC0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)
AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdir.sys (ESET Antivirus Network Redirector/ESET)

Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP1T1L0-17 872D6AEA
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort0 872D6AEA
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort1 872D6AEA
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP1T0L0-f 872D6AEA
Device \FileSystem\Fastfat \Fat B6C65C8A

AttachedDevice \FileSystem\Fastfat \Fat eamon.sys (Amon monitor/ESET)

Device \Device\Ide\IdeDeviceP0T0L0-3 -> \??\IDE#DiskWDC_WD600BB-75CAA0______________________16.06V16#4457572d414d4638343132313633_030_0_0_0_0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found

---- Threads - GMER 1.0.15 ----

Thread System [4:448] 86712790

---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 sectors 117187244 (+254): rootkit-like behavior;

---- Files - GMER 1.0.15 ----

File C:\WINDOWS\system32\drivers\ultra.sys suspicious modification; TDL3 <-- ROOTKIT !!!

---- EOF - GMER 1.0.15 ----

DDS.txt

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2010-12-12 18:54:48
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdePort0 WDC_WD600BB-75CAA0 rev.16.06V16
Running: pbpfj6qm.exe; Driver: C:\DOCUME~1\Paul\LOCALS~1\Temp\kxtdapob.sys

---- System - GMER 1.0.15 ----

SSDT 86714630 ZwAssignProcessToJobObject
SSDT 86713A60 ZwOpenProcess
SSDT 86713E80 ZwOpenThread
SSDT 86714460 ZwSuspendProcess
SSDT 86714280 ZwSuspendThread
SSDT 86713C90 ZwTerminateProcess
SSDT 867140B0 ZwTerminateThread

---- Kernel code sections - GMER 1.0.15 ----

.text ntoskrnl.exe!_abnormal_termination + 445 804E2AB1 3 Bytes [42, 71, 86] {INC EDX; JNO 0xffffffffffffff89}
? rccpsft.sys The system cannot find the file specified. !
.rsrc C:\WINDOWS\system32\drivers\ultra.sys entry point in ".rsrc" section [0xF75F5314]
.text C:\WINDOWS\System32\DRIVERS\nv4_mini.sys section is writeable [0xF61B6360, 0x24CB9D, 0xE8000020]
init C:\WINDOWS\system32\DRIVERS\VPCPOWER.SYS entry point in "init" section [0xF7A514A0]

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1064] kernel32.dll!SetUnhandledExceptionFilter 7C8447ED 4 Bytes [C2, 04, 00, 00]
.text C:\WINDOWS\System32\svchost.exe[1676] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 006D000A
.text C:\WINDOWS\System32\svchost.exe[1676] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 006E000A
.text C:\WINDOWS\System32\svchost.exe[1676] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 006C000C
.text C:\WINDOWS\System32\svchost.exe[1676] USER32.dll!GetCursorPos 7E41BD76 5 Bytes JMP 0266000A
.text C:\WINDOWS\System32\svchost.exe[1676] ole32.dll!CoCreateInstance 774FFAC3 5 Bytes JMP 00AF000A
.text C:\WINDOWS\Explorer.EXE[1740] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00D7000A
.text C:\WINDOWS\Explorer.EXE[1740] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00D8000A
.text C:\WINDOWS\Explorer.EXE[1740] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00C1000C
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[2328] USER32.dll!TrackPopupMenu 7E4650EE 5 Bytes JMP 10402342 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 0167000A
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 0169000A
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 0166000C
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] USER32.dll!DrawTextW 7E41D7C2 5 Bytes JMP 00ECCE9E
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] USER32.dll!DrawTextExW 7E41DD7F 5 Bytes JMP 00ECD062
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] USER32.dll!DialogBoxParamW 7E42555F 5 Bytes JMP 00ECC197
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] USER32.dll!SetClipboardData 7E430F5E 5 Bytes JMP 00ECCB15
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] USER32.dll!DrawTextA 7E43C6CA 5 Bytes JMP 00ECCDC2
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] USER32.dll!DrawTextExA 7E43C701 5 Bytes JMP 00ECCF7A
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] GDI32.dll!TextOutW 77F17EAC 5 Bytes JMP 00ECCCF5
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] GDI32.dll!ExtTextOutW 77F18086 5 Bytes JMP 00ECD22F
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] GDI32.dll!TextOutA 77F1BC14 5 Bytes JMP 00ECCC28
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] GDI32.dll!ExtTextOutA 77F1D45A 5 Bytes JMP 00ECD14A
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] GDI32.dll!GetGlyphIndicesA 77F3DB23 5 Bytes JMP 00ECD5E6
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] GDI32.dll!GetGlyphIndicesW 77F51D6E 5 Bytes JMP 00ECD6B0

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Program Files\Skype\Phone\Skype.exe[2940] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00382F20] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Skype\Phone\Skype.exe[2940] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00382C90] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Skype\Phone\Skype.exe[2940] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00382CF0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Skype\Phone\Skype.exe[2940] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00382CC0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)
AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdir.sys (ESET Antivirus Network Redirector/ESET)

Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP1T1L0-17 872D6AEA
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort0 872D6AEA
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort1 872D6AEA
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP1T0L0-f 872D6AEA
Device \FileSystem\Fastfat \Fat B6C65C8A

AttachedDevice \FileSystem\Fastfat \Fat eamon.sys (Amon monitor/ESET)

Device \Device\Ide\IdeDeviceP0T0L0-3 -> \??\IDE#DiskWDC_WD600BB-75CAA0______________________16.06V16#4457572d414d4638343132313633_030_0_0_0_0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found

---- Threads - GMER 1.0.15 ----

Thread System [4:448] 86712790

---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 sectors 117187244 (+254): rootkit-like behavior;

---- Files - GMER 1.0.15 ----

File C:\WINDOWS\system32\drivers\ultra.sys suspicious modification; TDL3 <-- ROOTKIT !!!

---- EOF - GMER 1.0.15 ----

cont.

broni · 2010/12/13

Welcome aboard

Please, read this post, then post the requested log(s).

So far, you posted same GMER log three times.

Please, observe following rules:

Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.

If you're stuck, or you're not sure about certain step, always ask before doing anything else.

Please refrain from running tools or applying updates other than those I suggest.

Never run more than one scan at a time.

Keep updating me regarding your computer behavior, good, or bad.

The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.

If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.

I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

sox7rock · 2010/12/13

Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Database version: 5302

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

12/12/2010 6:17:32 PM
mbam-log-2010-12-12 (18-17-31).txt

Scan type: Quick scan
Objects scanned: 156738
Time elapsed: 11 minute(s), 43 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 2
Registry Keys Infected: 6
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 10

Memory Processes Infected:
c:\documents and settings\Paul\.commgr\complmgr.exe (Trojan.Dropper) -> 2972 -> Unloaded process successfully.

Memory Modules Infected:
c:\WINDOWS\SYSTEM32\6to4v32.dll (Trojan.Agent.Gen) -> Delete on reboot.
c:\WINDOWS\SYSTEM32\convshta.dll (Trojan.Agent) -> Delete on reboot.

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\OTGV1DNWQQ (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\wnxmal (Rogue.SecuritySuite) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\XBV6RD5SZF (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MySearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\RkHit (Rogue.SpywareCease) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\COM+ Manager (Trojan.Dropper) -> Value: COM+ Manager -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ljyaaioo (Rogue.SecuritySuite) -> Value: ljyaaioo -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\WINDOWS\SYSTEM32\6to4v32.dll (Trojan.Agent.Gen) -> Delete on reboot.
c:\WINDOWS\SYSTEM32\convshta.dll (Trojan.Agent) -> Delete on reboot.
c:\documents and settings\Paul\.commgr\complmgr.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\documents and settings\networkservice\local settings\application data\jqypccvgv\dnivimglanw.exe (Rogue.SecuritySuite) -> Quarantined and deleted successfully.
c:\WINDOWS\SYSTEM32\DRIVERS\aloejmn.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\SYSTEM32\certstore.dat (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\Paul\local settings\application data\windows server\admin.txt (Malware.Trace) -> Quarantined and deleted successfully.
c:\documents and settings\Paul\templates\memory.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\Tasks\{22116563-108c-42c0-a7ce-60161b75e508}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\WINDOWS\Tasks\{35dc3473-a719-4d14-b7c1-fd326ca84a0c}.job (Trojan.Downloader) -> Quarantined and deleted successfully.

GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2010-12-12 18:54:48
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdePort0 WDC_WD600BB-75CAA0 rev.16.06V16
Running: pbpfj6qm.exe; Driver: C:\DOCUME~1\Paul\LOCALS~1\Temp\kxtdapob.sys

---- System - GMER 1.0.15 ----

SSDT 86714630 ZwAssignProcessToJobObject
SSDT 86713A60 ZwOpenProcess
SSDT 86713E80 ZwOpenThread
SSDT 86714460 ZwSuspendProcess
SSDT 86714280 ZwSuspendThread
SSDT 86713C90 ZwTerminateProcess
SSDT 867140B0 ZwTerminateThread

---- Kernel code sections - GMER 1.0.15 ----

.text ntoskrnl.exe!_abnormal_termination + 445 804E2AB1 3 Bytes [42, 71, 86] {INC EDX; JNO 0xffffffffffffff89}
? rccpsft.sys The system cannot find the file specified. !
.rsrc C:\WINDOWS\system32\drivers\ultra.sys entry point in ".rsrc" section [0xF75F5314]
.text C:\WINDOWS\System32\DRIVERS\nv4_mini.sys section is writeable [0xF61B6360, 0x24CB9D, 0xE8000020]
init C:\WINDOWS\system32\DRIVERS\VPCPOWER.SYS entry point in "init" section [0xF7A514A0]

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1064] kernel32.dll!SetUnhandledExceptionFilter 7C8447ED 4 Bytes [C2, 04, 00, 00]
.text C:\WINDOWS\System32\svchost.exe[1676] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 006D000A
.text C:\WINDOWS\System32\svchost.exe[1676] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 006E000A
.text C:\WINDOWS\System32\svchost.exe[1676] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 006C000C
.text C:\WINDOWS\System32\svchost.exe[1676] USER32.dll!GetCursorPos 7E41BD76 5 Bytes JMP 0266000A
.text C:\WINDOWS\System32\svchost.exe[1676] ole32.dll!CoCreateInstance 774FFAC3 5 Bytes JMP 00AF000A
.text C:\WINDOWS\Explorer.EXE[1740] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00D7000A
.text C:\WINDOWS\Explorer.EXE[1740] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00D8000A
.text C:\WINDOWS\Explorer.EXE[1740] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00C1000C
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[2328] USER32.dll!TrackPopupMenu 7E4650EE 5 Bytes JMP 10402342 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 0167000A
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 0169000A
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 0166000C
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] USER32.dll!DrawTextW 7E41D7C2 5 Bytes JMP 00ECCE9E
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] USER32.dll!DrawTextExW 7E41DD7F 5 Bytes JMP 00ECD062
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] USER32.dll!DialogBoxParamW 7E42555F 5 Bytes JMP 00ECC197
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] USER32.dll!SetClipboardData 7E430F5E 5 Bytes JMP 00ECCB15
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] USER32.dll!DrawTextA 7E43C6CA 5 Bytes JMP 00ECCDC2
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] USER32.dll!DrawTextExA 7E43C701 5 Bytes JMP 00ECCF7A
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] GDI32.dll!TextOutW 77F17EAC 5 Bytes JMP 00ECCCF5
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] GDI32.dll!ExtTextOutW 77F18086 5 Bytes JMP 00ECD22F
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] GDI32.dll!TextOutA 77F1BC14 5 Bytes JMP 00ECCC28
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] GDI32.dll!ExtTextOutA 77F1D45A 5 Bytes JMP 00ECD14A
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] GDI32.dll!GetGlyphIndicesA 77F3DB23 5 Bytes JMP 00ECD5E6
.text C:\Program Files\Mozilla Firefox\firefox.exe[2924] GDI32.dll!GetGlyphIndicesW 77F51D6E 5 Bytes JMP 00ECD6B0

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Program Files\Skype\Phone\Skype.exe[2940] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00382F20] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Skype\Phone\Skype.exe[2940] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00382C90] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Skype\Phone\Skype.exe[2940] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00382CF0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT C:\Program Files\Skype\Phone\Skype.exe[2940] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00382CC0] C:\WINDOWS\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)
AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdir.sys (ESET Antivirus Network Redirector/ESET)

Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP1T1L0-17 872D6AEA
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort0 872D6AEA
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort1 872D6AEA
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP1T0L0-f 872D6AEA
Device \FileSystem\Fastfat \Fat B6C65C8A

AttachedDevice \FileSystem\Fastfat \Fat eamon.sys (Amon monitor/ESET)

Device \Device\Ide\IdeDeviceP0T0L0-3 -> \??\IDE#DiskWDC_WD600BB-75CAA0______________________16.06V16#4457572d414d4638343132313633_030_0_0_0_0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found

---- Threads - GMER 1.0.15 ----

Thread System [4:448] 86712790

---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 sectors 117187244 (+254): rootkit-like behavior;

---- Files - GMER 1.0.15 ----

File C:\WINDOWS\system32\drivers\ultra.sys suspicious modification; TDL3 <-- ROOTKIT !!!

---- EOF - GMER 1.0.15 ----

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 2 (build 2600)
Logical Drives Mask: 0x0000003d

Kernel Drivers (total 151):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806EC000 \WINDOWS\system32\hal.dll
0xF7A6F000 \WINDOWS\system32\KDCOM.DLL
0xF797F000 \WINDOWS\system32\BOOTVID.dll
0xF756F000 rccpsft.sys
0xF7520000 ACPI.sys
0xF7A71000 \WINDOWS\System32\DRIVERS\WMILIB.SYS
0xF750F000 pci.sys
0xF757F000 isapnp.sys
0xF7B37000 pciide.sys
0xF77EF000 \WINDOWS\System32\DRIVERS\PCIIDEX.SYS
0xF758F000 MountMgr.sys
0xF74F0000 ftdisk.sys
0xF77F7000 PartMgr.sys
0xF759F000 VolSnap.sys
0xF74D8000 \WINDOWS\System32\DRIVERS\SCSIPORT.SYS
0xF74C0000 atapi.sys
0xF75EF000 ultra.sys
0xF763F000 disk.sys
0xF764F000 \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
0xF745B000 fltmgr.sys
0xF7449000 sr.sys
0xF765F000 PxHelp20.sys
0xF7432000 KSecDD.sys
0xF741F000 WudfPf.sys
0xF7392000 Ntfs.sys
0xF7365000 NDIS.sys
0xF768F000 ohci1394.sys
0xF769F000 \WINDOWS\System32\DRIVERS\1394BUS.SYS
0xF734A000 Mup.sys
0xF76AF000 agp440.sys
0xF76FF000 \SystemRoot\System32\DRIVERS\nic1394.sys
0xF72DA000 \SystemRoot\System32\DRIVERS\intelppm.sys
0xF61B6000 \SystemRoot\System32\DRIVERS\nv4_mini.sys
0xF61A2000 \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS
0xF7937000 \SystemRoot\System32\DRIVERS\usbuhci.sys
0xF617F000 \SystemRoot\System32\DRIVERS\USBPORT.SYS
0xF793F000 \SystemRoot\System32\DRIVERS\usbehci.sys
0xF6159000 \SystemRoot\System32\DRIVERS\HSFHWBS2.sys
0xF604E000 \SystemRoot\System32\DRIVERS\HSF_DP.sys
0xF5FC4000 \SystemRoot\System32\DRIVERS\HSF_CNXT.sys
0xF7947000 \SystemRoot\System32\Drivers\Modem.SYS
0xF5F06000 \SystemRoot\system32\drivers\emu10k1f.sys
0xF5EE2000 \SystemRoot\system32\drivers\portcls.sys
0xF72CA000 \SystemRoot\system32\drivers\drmk.sys
0xF5EBF000 \SystemRoot\system32\drivers\ks.sys
0xF72BA000 \SystemRoot\system32\drivers\sfman.sys
0xF7AD7000 \SystemRoot\system32\drivers\ctlface.sys
0xF7C39000 \SystemRoot\System32\DRIVERS\ctljystk.sys
0xF799B000 \SystemRoot\System32\DRIVERS\gameenum.sys
0xF5A08000 \SystemRoot\System32\DRIVERS\e100b325.sys
0xF7877000 \SystemRoot\System32\DRIVERS\fdc.sys
0xF67F1000 \SystemRoot\System32\DRIVERS\i8042prt.sys
0xF7A27000 \SystemRoot\system32\DRIVERS\itchfltr.sys
0xF787F000 \SystemRoot\System32\DRIVERS\kbdclass.sys
0xF67E1000 \SystemRoot\system32\DRIVERS\L8042pr2.Sys
0xF67D1000 \SystemRoot\system32\DRIVERS\LMouFlt2.Sys
0xF7887000 \SystemRoot\System32\DRIVERS\mouclass.sys
0xF67C1000 \SystemRoot\System32\DRIVERS\serial.sys
0xF7A17000 \SystemRoot\System32\DRIVERS\serenum.sys
0xF59F4000 \SystemRoot\System32\DRIVERS\parport.sys
0xF7A1B000 \SystemRoot\system32\drivers\pfc.sys
0xF75BF000 \SystemRoot\System32\DRIVERS\cdrom.sys
0xF75CF000 \SystemRoot\System32\DRIVERS\redbook.sys
0xF788F000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys
0xF75DF000 \SystemRoot\System32\DRIVERS\imapi.sys
0xF760F000 \SystemRoot\system32\DRIVERS\VMNetSrv.sys
0xF7C48000 \SystemRoot\System32\DRIVERS\audstub.sys
0xF7AD9000 \SystemRoot\System32\Drivers\RootMdm.sys
0xF761F000 \SystemRoot\System32\DRIVERS\rasl2tp.sys
0xF7A2B000 \SystemRoot\System32\DRIVERS\ndistapi.sys
0xF59DD000 \SystemRoot\System32\DRIVERS\ndiswan.sys
0xF762F000 \SystemRoot\System32\DRIVERS\raspppoe.sys
0xF76DF000 \SystemRoot\System32\DRIVERS\raspptp.sys
0xF7807000 \SystemRoot\System32\DRIVERS\TDI.SYS
0xF545A000 \SystemRoot\System32\DRIVERS\psched.sys
0xF766F000 \SystemRoot\System32\DRIVERS\msgpc.sys
0xF780F000 \SystemRoot\System32\DRIVERS\ptilink.sys
0xF7817000 \SystemRoot\System32\DRIVERS\raspti.sys
0xF781F000 \SystemRoot\System32\DRIVERS\wanatw4.sys
0xF7827000 \SystemRoot\system32\DRIVERS\RimSerial.sys
0xF767F000 \SystemRoot\System32\DRIVERS\termdd.sys
0xF7AE5000 \SystemRoot\System32\DRIVERS\swenum.sys
0xF5401000 \SystemRoot\System32\DRIVERS\update.sys
0xF7A4B000 \SystemRoot\System32\DRIVERS\mssmbios.sys
0xF782F000 \SystemRoot\system32\DRIVERS\VPCAppSv.sys
0xF7A4F000 \SystemRoot\system32\DRIVERS\VPCPOWER.SYS
0xF77AF000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xF77DF000 \SystemRoot\System32\DRIVERS\usbhub.sys
0xF7B07000 \SystemRoot\System32\DRIVERS\USBD.SYS
0xF7276000 \SystemRoot\system32\drivers\MODEMCSA.sys
0xF78F7000 \SystemRoot\System32\DRIVERS\flpydisk.sys
0xF7B23000 \SystemRoot\System32\Drivers\i2omgmt.SYS
0xF31A9000 \SystemRoot\System32\DRIVERS\usbccgp.sys
0xF7BC1000 \SystemRoot\System32\Drivers\Cdr4_xp.SYS
0xF7BC8000 \SystemRoot\System32\Drivers\Cdralw2k.SYS
0xF7B33000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7BC9000 \SystemRoot\System32\Drivers\Null.SYS
0xF7B35000 \SystemRoot\System32\Drivers\Beep.SYS
0xF05BC000 \SystemRoot\system32\DRIVERS\ehdrv.sys
0xEFCE9000 \SystemRoot\system32\DRIVERS\lvuvc.sys
0xF2217000 \SystemRoot\system32\drivers\usbaudio.sys
0xEFC8D000 \SystemRoot\system32\DRIVERS\lvrs.sys
0xF2370000 \SystemRoot\System32\drivers\vga.sys
0xF7A75000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7A77000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xF2368000 \SystemRoot\System32\Drivers\Msfs.SYS
0xF2360000 \SystemRoot\System32\Drivers\Npfs.SYS
0xF2FC2000 \SystemRoot\System32\DRIVERS\rasacd.sys
0xEFB47000 \SystemRoot\System32\DRIVERS\ipsec.sys
0xEFAEF000 \SystemRoot\System32\DRIVERS\tcpip.sys
0xEFAC7000 \SystemRoot\System32\DRIVERS\netbt.sys
0xEFAAE000 \SystemRoot\system32\DRIVERS\epfwtdir.sys
0xEFA8C000 \SystemRoot\System32\drivers\afd.sys
0xF2207000 \SystemRoot\System32\DRIVERS\netbios.sys
0xEFA66000 \??\C:\WINDOWS\system32\Drivers\vmm.sys
0xF2FBE000 \??\C:\WINDOWS\SYSTEM32\DRIVERS\VCdRom.sys
0xF21D7000 \SystemRoot\System32\Drivers\SCDEmu.SYS
0xEF9EB000 \SystemRoot\System32\DRIVERS\rdbss.sys
0xEF954000 \SystemRoot\System32\DRIVERS\mrxsmb.sys
0xF21C7000 \SystemRoot\System32\Drivers\Fips.SYS
0xEF66D000 \SystemRoot\System32\DRIVERS\ipnat.sys
0xF1B39000 \SystemRoot\System32\DRIVERS\wanarp.sys
0xF1B29000 \SystemRoot\System32\DRIVERS\arp1394.sys
0xED350000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xED688000 \SystemRoot\System32\drivers\Dxapi.sys
0xEEE70000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xED57B000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\nv4_disp.dll
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xBA544000 \SystemRoot\system32\DRIVERS\eamon.sys
0xF2FDA000 \SystemRoot\System32\DRIVERS\ndisuio.sys
0xB9CC8000 \SystemRoot\System32\DRIVERS\mrxdav.sys
0xEEEE0000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xED3DE000 \??\C:\WINDOWS\system32\ANIO.SYS
0xF7ABD000 \SystemRoot\system32\DRIVERS\dsunidrv.sys
0xB9C0F000 \SystemRoot\System32\Drivers\HTTP.sys
0xB9B90000 \SystemRoot\System32\DRIVERS\srv.sys
0xB9C5C000 \SystemRoot\System32\DRIVERS\mdmxsdk.sys
0xB9C58000 \SystemRoot\System32\Drivers\mrtRate.SYS
0xB9B03000 \SystemRoot\system32\drivers\wdmaud.sys
0xF6821000 \SystemRoot\system32\drivers\sysaudio.sys
0xF7AE3000 \??\C:\WINDOWS\System32\PfModNT.sys
0xF783F000 \SystemRoot\system32\DRIVERS\LVPr2Mon.sys
0xB7483000 \??\C:\DOCUME~1\Paul\LOCALS~1\Temp\kxtdapob.sys
0xB6C5E000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xB6C33000 \SystemRoot\system32\drivers\kmixer.sys
0xB6BC4000 \SystemRoot\system32\DRIVERS\Dr71WU.sys
0x7C900000 \WINDOWS\SYSTEM32\ntdll.dll

Processes (total 52):
0 System Idle Process
4 System
1212 C:\WINDOWS\SYSTEM32\smss.exe
1264 csrss.exe
1288 C:\WINDOWS\SYSTEM32\winlogon.exe
1340 C:\WINDOWS\SYSTEM32\services.exe
1360 C:\WINDOWS\SYSTEM32\lsass.exe
1548 C:\WINDOWS\SYSTEM32\svchost.exe
1624 svchost.exe
1676 C:\WINDOWS\SYSTEM32\svchost.exe
1776 C:\WINDOWS\SYSTEM32\svchost.exe
1920 svchost.exe
132 svchost.exe
524 C:\WINDOWS\SYSTEM32\spoolsv.exe
532 C:\WINDOWS\SYSTEM32\rundll32.exe
764 svchost.exe
816 C:\WINDOWS\SYSTEM32\svchost.exe
872 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
900 C:\Program Files\Bonjour\mDNSResponder.exe
940 C:\WINDOWS\SYSTEM32\cisvc.exe
988 C:\WINDOWS\SYSTEM32\CTSVCCDA.EXE
1064 C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
1148 C:\Program Files\Java\jre6\bin\jqs.exe
1184 C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
1372 C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
824 C:\WINDOWS\SYSTEM32\nvsvc32.exe
1200 C:\WINDOWS\SYSTEM32\devldr32.exe
1740 C:\WINDOWS\explorer.exe
1168 C:\WINDOWS\SYSTEM32\svchost.exe
292 C:\Program Files\Viewpoint\Common\ViewpointService.exe
472 C:\WINDOWS\wanmpsvc.exe
1700 C:\WINDOWS\SYSTEM32\MsPMSPSv.exe
2700 C:\Program Files\Canon\CAL\CALMAIN.exe
2812 C:\WINDOWS\SYSTEM32\rundll32.exe
2820 C:\Program Files\D-Link\Wireless G WUA-1340\AirGCFG.exe
2856 C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
2912 C:\Program Files\PowerISO\PWRISOVM.EXE
3640 C:\Program Files\iTunes\iTunesHelper.exe
2100 C:\Program Files\DellSupport\DSAgnt.exe
2136 C:\PROGRA~1\Sony\SONICS~1\SSAAD.exe
2940 C:\Program Files\Skype\Phone\Skype.exe
3276 C:\WINDOWS\SYSTEM32\ctfmon.exe
3548 C:\Program Files\RocketDock\RocketDock.exe
3256 alg.exe
3816 C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
2544 C:\Program Files\iPod\bin\iPodService.exe
3624 C:\WINDOWS\SYSTEM32\svchost.exe
3920 C:\Program Files\Skype\Plugin Manager\skypePM.exe
2924 C:\Program Files\Mozilla Firefox\firefox.exe
3192 dllhost.exe
460 C:\WINDOWS\SYSTEM32\wuauclt.exe
1000 C:\Documents and Settings\Paul\My Documents\Downloads\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`01f60800 (NTFS)

PhysicalDrive0 Model Number: WDCWD600BB-75CAA0, Rev: 16.06V16

Size Device Name MBR Status
--------------------------------------------
55 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A

Done!

broni · 2010/12/13

I still need DDS logs.

sox7rock · 2010/12/22

DDS (Ver_10-12-12.02) - NTFSx86
Run by Paul at 19:00:23.91 on Sun 12/12/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_22
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1023.335 [GMT -6:00]

AV: ESET NOD32 Antivirus 4.0 *Enabled/Outdated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
svchost.exe
C:\WINDOWS\System32\svchost.exe -k Akamai
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\D-Link\Wireless G WUA-1340\AirGCFG.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\Paul\My Documents\Downloads\dds.scr

============== Pseudo HJT Report ===============

uDefault_Page_URL = hxxp://www.dellnet.com/
uStart Page = hxxp://www.dellnet.com/
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:6092
mURLSearchHooks: H - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Viewpoint Toolbar BHO: {a7327c09-b521-4edb-8509-7d2660c9ec98} - c:\program files\viewpoint\viewpoint toolbar\3.9.0\ViewBarBHO.dll
BHO: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {ACB1E670-3217-45C4-A021-6B829A8A27CB} - No File
TB: Viewpoint Toolbar: {f8ad5aa5-d966-4667-9daf-2561d68b2012} - c:\program files\common files\viewpoint\toolbar runtime\3.9.0\IEViewBar.dll
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup
uRun: [SsAAD.exe] c:\progra~1\sony\sonics~1\SsAAD.exe
uRun: [Logitech Vid] "c:\program files\logitech\logitech vid\vid.exe" -bootmode
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [ares] "c:\program files\ares\Ares.exe" -h
uRun: [RocketDock] "c:\program files\rocketdock\RocketDock.exe "
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [UpdReg] c:\windows\Updreg.exe
mRun: [AHQInit] c:\program files\creative\sblive\program\AHQInit.exe
mRun: [nwiz] nwiz.exe /install
mRun: [zBrowser Launcher] f:\moreprograms\itouch\iTouch.exe
mRun: [Logitech Utility] Logi_MwX.Exe
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [D-Link Wireless G WUA-1340] c:\program files\d-link\wireless g wua-1340\AirGCFG.exe
mRun: [LogitechQuickCamRibbon] "c:\program files\logitech\logitech webcam software\LWS.exe" /hide
mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice
mRun: [PWRISOVM.EXE] c:\program files\poweriso\PWRISOVM.EXE
mRun: [xwaomnrces.tmp] "c:\docume~1\paul\locals~1\temp\xwaomnrces.tmp "
mRun: [Advanced System Optimizer] "c:\program files\advanced system optimizer 3\ASO3.exe" /autorun
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe "
mRun: [AdobeCS5ServiceManager] "c:\program files\common files\adobe\cs5servicemanager\CS5ServiceManager.exe" -launchedbylogin
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe "
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
mRunOnce: [DELDIR0.EXE] "c:\docume~1\jeffre~1\locals~1\temp\deldir0.exe" "c:\program files\mcafee\mcafee shared components\guardian\ "
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37874.8147106481
DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - hxxp://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {ED28050F-D713-43BA-A376-DCC5C35407D5} - hxxp://65.54.141.62/client/msnmusax4311.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SecurityProviders: msapsspc.dll, schannel.dll, msnsspc.dll, digest.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\paul\applic~1\mozilla\firefox\profiles\q4k6z18u.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/?ref=hp
FF - prefs.js: network.proxy.type - 4
FF - plugin: c:\program files\common files\research in motion\bbwebsllauncher\NPWebSLLauncher.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npmozax.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint_.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

============= SERVICES / DRIVERS ===============

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-2-6 106208]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2009-2-6 93336]
R1 vcdrom;Virtual CD-ROM Device Driver;c:\windows\system32\drivers\VCdRom.sys [2007-12-8 8576]
R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2002-6-25 14336]
R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2009-2-6 727720]
R2 mrtRate;mrtRate;c:\windows\system32\drivers\MrtRate.sys [2003-1-11 34916]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2007-1-10 24652]
R2 VPCAppSv;Virtual PC Application Services;c:\windows\system32\drivers\vpcappsv.sys [2004-5-17 10374]
S3 A5AGU;D-Link USB Wireless Network Adapter Service;c:\windows\system32\drivers\A5AGU.sys [2005-7-25 348352]
S3 ADASPROT;SYSTWEAKASO;\??\c:\program files\advanced system optimizer 3\adasprot32.sys --> c:\program files\advanced system optimizer 3\adasprot32.sys [?]
S3 ATHFMWDL;D-Link predator Bootloader driver;c:\windows\system32\drivers\Athfmwdl.sys [2005-7-25 43392]
S3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [2010-7-12 30432]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [2010-7-12 30432]
S3 cpuz132;cpuz132;\??\c:\docume~1\paul\locals~1\temp\cpuz132\cpuz132_x32.sys --> c:\docume~1\paul\locals~1\temp\cpuz132\cpuz132_x32.sys [?]
S3 MsDtsServer;SQL Server Integration Services;c:\program files\microsoft sql server\90\dts\binn\MsDtsSrvr.exe [2007-3-3 202096]
S3 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys --> c:\windows\system32\vsdatant.sys [?]
S4 msvsmon80;Visual Studio 2005 Remote Debugger; "f:\moreprograms\msvs2005\common7\ide\remote debugger\x86\msvsmon.exe" /service msvsmon80 --> f:\moreprograms\msvs2005\common7\ide\remote debugger\x86\msvsmon.exe [?]

=============== Created Last 30 ================

2067-02-24 21:21:18 79947 ----a-w- c:\windows\fw20.vxd
2010-12-13 00:02:02 -------- d-----w- c:\docume~1\paul\applic~1\Malwarebytes
2010-12-13 00:01:47 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-13 00:01:46 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-12-13 00:01:38 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-13 00:01:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-12-05 08:03:33 -------- d-----w- c:\docume~1\alluse~1\applic~1\AVG10
2010-12-05 07:20:54 -------- d-----w- c:\docume~1\alluse~1\applic~1\MFAData
2010-12-05 06:24:51 -------- d-----w- c:\docume~1\paul\locals~1\applic~1\WMTools Downloaded Files
2010-12-05 05:52:25 -------- d-----w- c:\windows\system32\wbem\repository\FS
2010-12-05 05:52:24 -------- d-----w- c:\windows\system32\wbem\Repository
2010-12-05 05:50:49 -------- d-----w- c:\docume~1\paul\locals~1\applic~1\AOL OCP
2010-12-05 05:50:35 -------- d-----w- c:\program files\AIM6
2010-12-05 05:44:21 -------- d-----w- C:\I386
2010-12-05 05:29:55 -------- d-----w- c:\windows\ie8updates
2010-12-05 05:29:48 -------- d--h--w- c:\windows\ie8
2010-12-05 05:26:59 -------- d-----w- c:\windows\SQLTools9_KB932557_ENU
2010-12-05 05:25:54 -------- d-----w- c:\docume~1\paul\locals~1\applic~1\MigWiz
2010-12-05 05:25:54 -------- d-----w- c:\docume~1\paul\locals~1\applic~1\ApplicationHistory
2010-12-05 05:25:53 -------- d-----w- c:\docume~1\paul\applic~1\TweakNow RegCleaner
2010-12-05 05:25:53 -------- d-----w- c:\docume~1\paul\applic~1\Systweak
2010-12-02 03:58:32 -------- d-----w- c:\windows\Offline Web Pages
2010-11-30 01:30:32 -------- d-----w- c:\docume~1\paul\applic~1\uTorrent
2010-11-29 22:45:24 -------- d-----w- c:\windows\Registration(2)
2010-11-28 21:57:13 -------- d-----w- c:\program files\RocketDock
2010-11-15 21:31:56 -------- d-----w- c:\program files\iTunes

==================== Find3M ====================

2010-09-28 21:44:52 4184352 ----a-w- c:\windows\system32\usbaaplrc.dll
2010-09-15 09:50:37 472808 ----a-w- c:\windows\system32\deployJava1.dll
2010-09-15 07:29:49 73728 ----a-w- c:\windows\system32\javacpl.cpl

=================== ROOTKIT ====================

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: WDC_WD600BB-75CAA0 rev.16.06V16 -> Harddisk0\DR0 -> \Device\Ide\IdePort0 P0T0L0-3

device: opened successfully
user: MBR read successfully

Disk trace:
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x872D6EC5]<<
_asm { PUSH EBP; MOV EBP, ESP; SUB ESP, 0x1c; PUSH EBX; PUSH ESI; MOV DWORD [EBP-0x4], 0x85b80872; SUB DWORD [EBP-0x4], 0x85b8012e; PUSH EDI; CALL 0xffffffffffffdf33; }
1 nt!IofCallDriver[0x804E37D5] -> \Device\Harddisk0\DR0[0x8735F030]
3 CLASSPNP[0xF765005B] -> nt!IofCallDriver[0x804E37D5] -> [0x8734F248]
[0x8735DD48] -> IRP_MJ_CREATE -> 0x872D6EC5
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
detected disk devices:
\Device\Ide\IdeDeviceP0T0L0-3 -> \??\IDE#DiskWDC_WD600BB-75CAA0______________________16.06V16#4457572d414d4638343132313633_030_0_0_0_0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
detected hooks:
\Driver\atapi DriverStartIo -> 0x872D6AEA
user & kernel MBR OK
sectors 117187498 (+255): user != kernel
Warning: possible TDL3 rootkit infection !

============= FINISH: 19:02:43.99 ===============

sox7rock · 2010/12/22

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-12-12.02)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 2/21/2004 7:41:27 PM
System Uptime: 12/12/2010 6:19:22 PM (1 hours ago)

Motherboard: Dell Computer Corp. | |
Processor: Intel(R) Pentium(R) 4 CPU 2.40GHz | Microprocessor | 2399/533mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 56 GiB total, 23.883 GiB free.
D: is CDROM (CDFS)
E: is CDROM ()
F: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP96: 11/28/2010 6:31:56 PM - System Checkpoint
RP97: 11/28/2010 8:43:41 PM - Software Distribution Service 3.0
RP98: 11/29/2010 3:02:03 AM - Software Distribution Service 3.0
RP99: 11/30/2010 3:00:30 AM - Software Distribution Service 3.0
RP100: 12/1/2010 3:00:22 AM - Software Distribution Service 3.0
RP101: 12/1/2010 9:58:26 PM - Installed Windows Internet Explorer 8.
RP102: 12/1/2010 10:49:03 PM - Cleaned registry with Windows Live OneCare safety scanner
RP103: 12/2/2010 3:00:24 AM - Software Distribution Service 3.0
RP104: 12/3/2010 3:00:24 AM - Software Distribution Service 3.0
RP105: 12/4/2010 5:17:06 AM - Software Distribution Service 3.0
RP106: 12/4/2010 11:23:11 PM - Restore Operation
RP107: 12/4/2010 11:57:43 PM - Software Distribution Service 3.0
RP108: 12/5/2010 2:00:33 AM - Installed Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
RP109: 12/5/2010 2:01:05 AM - Installed AVG 2011
RP110: 12/5/2010 2:15:34 AM - Installed AVG 2011
RP111: 12/5/2010 2:38:54 AM - Removed AVG 2011
RP112: 12/6/2010 3:00:22 AM - Software Distribution Service 3.0
RP113: 12/6/2010 4:41:01 PM - Software Distribution Service 3.0
RP114: 12/7/2010 3:00:22 AM - Software Distribution Service 3.0
RP115: 12/8/2010 3:00:26 AM - Software Distribution Service 3.0
RP116: 12/8/2010 5:04:32 PM - Software Distribution Service 3.0
RP117: 12/9/2010 3:00:27 AM - Software Distribution Service 3.0
RP118: 12/10/2010 3:00:23 AM - Software Distribution Service 3.0
RP119: 12/11/2010 3:00:28 AM - Software Distribution Service 3.0
RP120: 12/12/2010 3:00:22 AM - Software Distribution Service 3.0

==== Installed Programs ======================

Adobe AIR
Adobe Community Help
Adobe Dreamweaver CS5
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Media Player
Adobe Reader 9.4.1
AIM 6
Akamai NetSession Interface
ANIO Service
ANIWZCS2 Service
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Ask Toolbar
BlackBerry Desktop Software 6.0
Bonjour
Canon Camera Access Library
Canon RemoteCapture Task for ZoomBrowser EX
Creative Mass Storage Drivers
Creative System Information
Critical Update for Windows Media Player 11 (KB959772)
DAO 3.5
DellSupport
eMbedded Visual C++ 4.0 SP4
ESET NOD32 Antivirus
GDR 1406 for SQL Server Integration Services 2005 ENU (KB932557)
Help and Support Customization
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB909394)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB981793)
Intel(R) Integrated Performance Primitives RTI 4.0
Intel(R) PRO Ethernet Adapter and Software
Intel(R) PROSet II
InterActual Player
iPod Updater 2004-08-06
iTunes
Java 2 Runtime Environment Standard Edition v1.3.1_02
Java 2 Runtime Environment, SE v1.4.0_03
Java 2 Runtime Environment, SE v1.4.1_02
Java Auto Updater
Java Web Start
Java(TM) 6 Update 22
LG USB Modem driver
Logitech Desktop Messenger
Logitech iTouch Software
Logitech MouseWare 9.79
Logitech Resource Center
Logitech Vid
Logitech Webcam Software
Logitech Webcam Software Driver Package
Macromedia Shockwave Player
Malwarebytes' Anti-Malware
Microsoft .NET Compact Framework 1.0 SP3 Developer
Microsoft .NET Compact Framework 2.0
Microsoft .NET Framework (English)
Microsoft .NET Framework (English) v1.0.3705
Microsoft .NET Framework 1.0 Hotfix (KB928367)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Device Emulator version 1.0 - ENU
Microsoft Document Explorer 2005
Microsoft FrontPage Client - English
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office FrontPage 2003
Microsoft Office Professional Edition 2003
Microsoft Office XP Media Content
Microsoft Office XP Small Business
Microsoft Silverlight
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Backward compatibility
Microsoft SQL Server 2005 Books Online (English)
Microsoft SQL Server 2005 Integration Services
Microsoft SQL Server 2005 Mobile [ENU] Developer Tools
Microsoft SQL Server Native Client
Microsoft SQL Server Setup Support Files (English)
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual Studio 2005 Professional Edition - ENU
Microsoft Web Publishing Wizard 1.52
Microsoft Windows CE Platform Manager 4.0
Microsoft_VC80_CRT_x86
Microsoft_VC80_MFC_x86
Microsoft_VC80_MFCLOC_x86
Microsoft_VC90_ATL_x86
Microsoft_VC90_CRT_x86
Microsoft_VC90_MFC_x86
MovieShop
Mozilla Firefox (3.6.13)
MSXML 4.0 SP2 (KB925672)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6 Service Pack 2 (KB973686)
Netscape (7.1)
NVIDIA Display Driver
NVIDIA Drivers
OmniPage SE 2.0
OpenMG Secure Module 4.6.01
OTrader Software Option Pricing
Paint Shop Pro 7
Pinnacle Hollywood FX 4.6
PowerDVD
PowerISO
Presto! PageManager 7.15.11
Quicken Deluxe 2000
QuickTime
Radio@Netscape Plus
RangeBooster G WUA-2340
RocketDock 1.3.5
Security Update for CAPICOM (KB931906)
Security Update for Microsoft Visual Studio 2005 Professional Edition - ENU (KB925674)
Security Update for Microsoft Visual Studio 2005 Professional Edition - ENU (KB937060)
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Internet Explorer 7 (KB974455)
Security Update for Windows Internet Explorer 7 (KB976325)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911280)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925454)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB948881)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953155)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958470)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Skype™ 4.2
SonicStage 4.2
Sound Blaster Live! Value
Studio 8
The Rosetta Stone
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 7 (KB976749)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB982632)
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB910437)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB925720)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB932823-v3)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
URGE
V CAST Music Manager
Viewpoint Manager (Remove Only)
Viewpoint Media Player
Viewpoint Toolbar
Visual Studio.NET Baseline - English
WebFldrs XP
Windows Backup Utility
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage v1.3.0254.0
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 10 Hotfix - KB894476
Windows Media Player 11
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
Windows XP Service Pack 2
WinRAR archiver
WinZip

==== Event Viewer Messages From Past Week ========

12/8/2010 5:11:18 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments " " in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
12/8/2010 5:11:10 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
12/8/2010 3:03:47 AM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Microsoft .NET Framework 1.1 SP1 Security Update for Windows 2000 and Windows XP (KB979906).
12/6/2010 6:19:41 PM, error: Ftdisk [49] - Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory.
12/6/2010 6:19:41 PM, error: Ftdisk [45] - The system could not sucessfully load the crash dump driver.
12/5/2010 2:15:13 AM, error: Dhcp [1001] - Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 001E58B40836. The following error occurred: The operation was canceled by the user. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.
12/5/2010 2:12:44 AM, error: Service Control Manager [7000] - The AVG AVI Loader Driver service failed to start due to the following error: The system cannot find message text for message number 0x%1 in the message file for %2.
12/5/2010 2:12:38 AM, error: Service Control Manager [7000] - The AVG Anti-Rootkit Driver service failed to start due to the following error: A device attached to the system is not functioning.
12/12/2010 6:30:16 PM, error: atapi [9] - The device, \Device\Ide\IdePort0, did not respond within the timeout period.
12/12/2010 6:21:44 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: abp480n5 adpu160m agpCPQ Aha154x aic78u2 aic78xx AliIde alim1541 amdagp amsint asc asc3350p asc3550 cbidf cd20xrnt CmdIde Cpqarray dac2w2k dac960nt dpti2o hpn hpt3xx i2omp ini910u IntelIde mraid35x perc2 perc2hib ql1080 Ql10wnt ql12160 ql1240 ql1280 sisagp Sparrow symc8xx sym_hi sym_u3 TosIde ultra viaagp ViaIde
12/12/2010 6:21:44 PM, error: Service Control Manager [7023] - The Network Security service terminated with the following error: The specified module could not be found.
12/12/2010 5:44:07 PM, error: Service Control Manager [7034] - The iPod Service service terminated unexpectedly. It has done this 1 time(s).
12/12/2010 5:44:05 PM, error: Service Control Manager [7034] - The Canon Camera Access Library 8 service terminated unexpectedly. It has done this 1 time(s).
12/12/2010 5:44:04 PM, error: Service Control Manager [7034] - The WAN Miniport (ATW) Service service terminated unexpectedly. It has done this 1 time(s).
12/12/2010 5:44:04 PM, error: Service Control Manager [7034] - The Viewpoint Manager Service service terminated unexpectedly. It has done this 1 time(s).
12/12/2010 5:44:03 PM, error: Service Control Manager [7034] - The Process Monitor service terminated unexpectedly. It has done this 1 time(s).
12/12/2010 5:44:03 PM, error: Service Control Manager [7034] - The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s).
12/12/2010 5:44:03 PM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
12/12/2010 5:44:02 PM, error: Service Control Manager [7034] - The Creative Service for CDROM Access service terminated unexpectedly. It has done this 1 time(s).
12/12/2010 5:44:02 PM, error: Service Control Manager [7034] - The Bonjour Service service terminated unexpectedly. It has done this 1 time(s).
12/12/2010 5:44:01 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
12/12/2010 12:48:22 PM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 30 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)
12/12/2010 12:33:22 PM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)
12/12/2010 1:18:22 PM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 60 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)

==== End Of File ===========================

broni · 2010/12/22

You're infected with a rootkit....

Download TDSSKiller and save it to your desktop.

Extract (unzip) its contents to your desktop.

Open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.

If an infected file is detected, the default action will be Cure, click on Continue.

If a suspicious file is detected, the default action will be Skip, click on Continue.

It may ask you to reboot the computer to complete the process. Click on Reboot Now.

If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.

If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.

sox7rock · 2010/12/22

2010/12/22 14:38:27.0859 TDSS rootkit removing tool 2.4.12.0 Dec 16 2010 09:46:46
2010/12/22 14:38:27.0859 ================================================================================
2010/12/22 14:38:27.0859 SystemInfo:
2010/12/22 14:38:27.0859
2010/12/22 14:38:27.0859 OS Version: 5.1.2600 ServicePack: 2.0
2010/12/22 14:38:27.0859 Product type: Workstation
2010/12/22 14:38:27.0859 ComputerName: PAULS
2010/12/22 14:38:27.0875 UserName: Paul
2010/12/22 14:38:27.0875 Windows directory: C:\WINDOWS
2010/12/22 14:38:27.0875 System windows directory: C:\WINDOWS
2010/12/22 14:38:27.0875 Processor architecture: Intel x86
2010/12/22 14:38:27.0875 Number of processors: 1
2010/12/22 14:38:27.0875 Page size: 0x1000
2010/12/22 14:38:27.0875 Boot type: Normal boot
2010/12/22 14:38:27.0875 ================================================================================
2010/12/22 14:38:29.0656 Initialize success
2010/12/22 14:38:44.0515 ================================================================================
2010/12/22 14:38:44.0515 Scan started
2010/12/22 14:38:44.0515 Mode: Manual;
2010/12/22 14:38:44.0515 ================================================================================
2010/12/22 14:38:46.0031 61883 (86d7b1e70661d754685b9ac6d749aae5) C:\WINDOWS\system32\DRIVERS\61883.sys
2010/12/22 14:38:46.0218 A5AGU (b170143a9fbb293307ebea6b81359c89) C:\WINDOWS\system32\DRIVERS\A5AGU.sys
2010/12/22 14:38:46.0656 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
2010/12/22 14:38:46.0890 ac97intc (0f2d66d5f08ebe2f77bb904288dcf6f0) C:\WINDOWS\system32\drivers\ac97intc.sys
2010/12/22 14:38:47.0140 ACPI (a10c7534f7223f4a73a948967d00e69b) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2010/12/22 14:38:47.0328 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
2010/12/22 14:38:47.0656 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys
2010/12/22 14:38:48.0062 aec (1ee7b434ba961ef845de136224c30fec) C:\WINDOWS\system32\drivers\aec.sys
2010/12/22 14:38:48.0375 AFD (55e6e1c51b6d30e54335750955453702) C:\WINDOWS\System32\drivers\afd.sys
2010/12/22 14:38:48.0562 agp440 (2c428fa0c3e3a01ed93c9b2a27d8d4bb) C:\WINDOWS\system32\DRIVERS\agp440.sys
2010/12/22 14:38:48.0750 agpCPQ (67288b07d6aba6c1267b626e67bc56fd) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
2010/12/22 14:38:48.0953 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys
2010/12/22 14:38:49.0203 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys
2010/12/22 14:38:49.0421 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys
2010/12/22 14:38:49.0625 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
2010/12/22 14:38:49.0812 alim1541 (f312b7cef21eff52fa23056b9d815fad) C:\WINDOWS\system32\DRIVERS\alim1541.sys
2010/12/22 14:38:49.0984 amdagp (675c16a3c1f8482f85ee4a97fc0dde3d) C:\WINDOWS\system32\DRIVERS\amdagp.sys
2010/12/22 14:38:50.0218 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys
2010/12/22 14:38:50.0343 ANIO (920298c7aef97d8168d219d35975d295) C:\WINDOWS\system32\ANIO.SYS
2010/12/22 14:38:50.0625 Arp1394 (f0d692b0bffb46e30eb3cea168bbc49f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2010/12/22 14:38:50.0843 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys
2010/12/22 14:38:51.0046 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys
2010/12/22 14:38:51.0359 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys
2010/12/22 14:38:51.0562 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2010/12/22 14:38:51.0765 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys
2010/12/22 14:38:52.0171 ATHFMWDL (8b56bac1af3a59d665d7a5d1bb5624f0) C:\WINDOWS\system32\Drivers\ATHFMWDL.sys
2010/12/22 14:38:52.0375 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2010/12/22 14:38:52.0593 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2010/12/22 14:38:52.0781 Avc (87c223adb8f7596b31caae3c67b16ddd) C:\WINDOWS\system32\DRIVERS\avc.sys
2010/12/22 14:38:53.0046 Avgfwdx (0c5941af0b6bf2fdf378937392865217) C:\WINDOWS\system32\DRIVERS\avgfwdx.sys
2010/12/22 14:38:53.0078 Avgfwfd (0c5941af0b6bf2fdf378937392865217) C:\WINDOWS\system32\DRIVERS\avgfwdx.sys
2010/12/22 14:38:53.0265 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2010/12/22 14:38:53.0546 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
2010/12/22 14:38:53.0750 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2010/12/22 14:38:53.0937 CCDECODE (6163ed60b684bab19d3352ab22fc48b2) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2010/12/22 14:38:54.0171 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
2010/12/22 14:38:54.0328 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2010/12/22 14:38:54.0546 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys
2010/12/22 14:38:54.0750 Cdr4_xp (bf79e659c506674c0497cc9c61f1a165) C:\WINDOWS\system32\drivers\Cdr4_xp.sys
2010/12/22 14:38:54.0937 Cdralw2k (2c41cd49d82d5fd85c72d57b6ca25471) C:\WINDOWS\system32\drivers\Cdralw2k.sys
2010/12/22 14:38:55.0156 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2010/12/22 14:38:55.0703 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys
2010/12/22 14:38:55.0953 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys
2010/12/22 14:38:56.0390 ctljystk (71007bd2e1e26927fe3e4eb00c0beedf) C:\WINDOWS\system32\DRIVERS\ctljystk.sys
2010/12/22 14:38:56.0625 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
2010/12/22 14:38:56.0875 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys
2010/12/22 14:38:57.0078 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys
2010/12/22 14:38:57.0250 dmboot (c0fbb516e06e243f0cf31f597e7ebf7d) C:\WINDOWS\system32\drivers\dmboot.sys
2010/12/22 14:38:57.0531 dmio (f5e7b358a732d09f4bcf2824b88b9e28) C:\WINDOWS\system32\drivers\dmio.sys
2010/12/22 14:38:57.0734 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2010/12/22 14:38:58.0078 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys
2010/12/22 14:38:58.0437 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys
2010/12/22 14:38:58.0671 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys
2010/12/22 14:38:58.0890 DSproct (413f2d5f9d802688242c23b38f767ecb) C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys
2010/12/22 14:38:59.0093 dsunidrv (dfeabb7cfffadea4a912ab95bdc3177a) C:\WINDOWS\system32\DRIVERS\dsunidrv.sys
2010/12/22 14:38:59.0343 E100B (56ab585a307909c4447d5900a10c6bc7) C:\WINDOWS\system32\DRIVERS\e100b325.sys
2010/12/22 14:38:59.0546 eamon (ad4ab42d4c1e407a300f5bc5b1806c08) C:\WINDOWS\system32\DRIVERS\eamon.sys
2010/12/22 14:38:59.0765 ehdrv (4b211cf255ba71a4fc1777f1fc705e7b) C:\WINDOWS\system32\DRIVERS\ehdrv.sys
2010/12/22 14:39:00.0281 emu10k (ae4e46d96e9d33790c8617e36791b576) C:\WINDOWS\system32\drivers\emu10k1f.sys
2010/12/22 14:39:00.0703 emu10k1 (aadc81e967c25dd7c90e150fec6eab74) C:\WINDOWS\system32\drivers\ctlface.sys
2010/12/22 14:39:01.0046 epfwtdir (23c84a1bd45a338c221a35b19e5d66c2) C:\WINDOWS\system32\DRIVERS\epfwtdir.sys
2010/12/22 14:39:01.0328 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys
2010/12/22 14:39:01.0640 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\DRIVERS\fdc.sys
2010/12/22 14:39:01.0984 FilterService (b73ec688c29f81f9da0fcf63682b3ecb) C:\WINDOWS\system32\DRIVERS\lvuvcflt.sys
2010/12/22 14:39:02.0296 Fips (e153ab8a11de5452bcf5ac7652dbf3ed) C:\WINDOWS\system32\drivers\Fips.sys
2010/12/22 14:39:02.0625 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
2010/12/22 14:39:02.0906 FltMgr (3d234fb6d6ee875eb009864a299bea29) C:\WINDOWS\system32\drivers\fltmgr.sys
2010/12/22 14:39:03.0140 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2010/12/22 14:39:03.0375 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2010/12/22 14:39:03.0609 gameenum (5f92fd09e5610a5995da7d775eadcd12) C:\WINDOWS\system32\DRIVERS\gameenum.sys
2010/12/22 14:39:03.0781 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys
2010/12/22 14:39:03.0968 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2010/12/22 14:39:04.0281 HidUsb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2010/12/22 14:39:04.0562 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys
2010/12/22 14:39:04.0796 hpt3xx (b077b7f8e79779ea967e84a4fc040227) C:\WINDOWS\system32\DRIVERS\hpt3xx.sys
2010/12/22 14:39:05.0015 HSFHWBS2 (95b894b508db03507b61fe213ef6fe19) C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys
2010/12/22 14:39:05.0390 HSF_DP (f66402179ca2b2ae68493103db5fa48c) C:\WINDOWS\system32\DRIVERS\HSF_DP.sys
2010/12/22 14:39:05.0734 HTTP (9f8b0f4276f618964fd118be4289b7cd) C:\WINDOWS\system32\Drivers\HTTP.sys
2010/12/22 14:39:05.0984 i2omgmt (8f09f91b5c91363b77bcd15599570f2c) C:\WINDOWS\system32\drivers\i2omgmt.sys
2010/12/22 14:39:06.0203 i2omp (ed6bf9e441fdea13292a6d30a64a24c3) C:\WINDOWS\system32\DRIVERS\i2omp.sys
2010/12/22 14:39:06.0390 i8042prt (5502b58eef7486ee6f93f3f164dcb808) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2010/12/22 14:39:06.0609 i81x (06b7ef73ba5f302eecc294cdf7e19702) C:\WINDOWS\system32\DRIVERS\i81xnt5.sys
2010/12/22 14:39:06.0812 iAimFP0 (7b5b44efe5eb9dadfb8ee29700885d23) C:\WINDOWS\system32\DRIVERS\wADV01nt.sys
2010/12/22 14:39:07.0046 iAimFP1 (eb1f6bab6c22ede0ba551b527475f7e9) C:\WINDOWS\system32\DRIVERS\wADV02NT.sys
2010/12/22 14:39:07.0265 iAimFP2 (03ce989d846c1aa81145cb22fcb86d06) C:\WINDOWS\system32\DRIVERS\wADV05NT.sys
2010/12/22 14:39:07.0468 iAimFP3 (525849b4469de021d5d61b4db9be3a9d) C:\WINDOWS\system32\DRIVERS\wSiINTxx.sys
2010/12/22 14:39:07.0671 iAimFP4 (589c2bcdb5bd602bf7b63d210407ef8c) C:\WINDOWS\system32\DRIVERS\wVchNTxx.sys
2010/12/22 14:39:07.0859 iAimTV0 (d83bdd5c059667a2f647a6be5703a4d2) C:\WINDOWS\system32\DRIVERS\wATV01nt.sys
2010/12/22 14:39:08.0140 iAimTV1 (ed968d23354daa0d7c621580c012a1f6) C:\WINDOWS\system32\DRIVERS\wATV02NT.sys
2010/12/22 14:39:08.0562 iAimTV3 (d738273f218a224c1ddac04203f27a84) C:\WINDOWS\system32\DRIVERS\wATV04nt.sys
2010/12/22 14:39:08.0781 iAimTV4 (0052d118995cbab152daabe6106d1442) C:\WINDOWS\system32\DRIVERS\wCh7xxNT.sys
2010/12/22 14:39:09.0046 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys
2010/12/22 14:39:09.0328 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys
2010/12/22 14:39:09.0515 IntelIde (2d722b2b54ab55b2fa475eb58d7b2aad) C:\WINDOWS\system32\DRIVERS\intelide.sys
2010/12/22 14:39:09.0687 intelppm (279fb78702454dff2bb445f238c048d2) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2010/12/22 14:39:09.0875 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\drivers\ip6fw.sys
2010/12/22 14:39:10.0093 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2010/12/22 14:39:10.0312 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2010/12/22 14:39:10.0531 IpNat (e2168cbc7098ffe963c6f23f472a3593) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2010/12/22 14:39:10.0796 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2010/12/22 14:39:10.0984 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys
2010/12/22 14:39:11.0218 isapnp (e504f706ccb699c2596e9a3da1596e87) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2010/12/22 14:39:11.0406 itchfltr (f905a2e4a3a8db0f8c41d90cf830b4ca) C:\WINDOWS\system32\DRIVERS\itchfltr.sys
2010/12/22 14:39:11.0609 Kbdclass (ebdee8a2ee5393890a1acee971c4c246) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2010/12/22 14:39:11.0828 kmixer (ba5deda4d934e6288c2f66caf58d2562) C:\WINDOWS\system32\drivers\kmixer.sys
2010/12/22 14:39:12.0015 KSecDD (674d3e5a593475915dc6643317192403) C:\WINDOWS\system32\drivers\KSecDD.sys
2010/12/22 14:39:12.0218 L8042pr2 (4103dbb6caa85e40d271c1ad12bbf776) C:\WINDOWS\system32\DRIVERS\L8042pr2.Sys
2010/12/22 14:39:12.0593 LMouFlt2 (b666f835c18974f392a387c6e863072f) C:\WINDOWS\system32\DRIVERS\LMouFlt2.Sys
2010/12/22 14:39:12.0875 LVPr2Mon (1a7db7a00a4b0d8da24cd691a4547291) C:\WINDOWS\system32\DRIVERS\LVPr2Mon.sys
2010/12/22 14:39:13.0203 LVRS (37072ec9299e825f4335cc554b6fac6a) C:\WINDOWS\system32\DRIVERS\lvrs.sys
2010/12/22 14:39:13.0843 LVUVC (a240e42a7402e927a71b6e8aa4629b13) C:\WINDOWS\system32\DRIVERS\lvuvc.sys
2010/12/22 14:39:14.0437 mdmxsdk (a1e9d936eac07ee9386e87bac1377fad) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys
2010/12/22 14:39:14.0640 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2010/12/22 14:39:14.0828 Modem (6fc6f9d7acc36dca9b914565a3aeda05) C:\WINDOWS\system32\drivers\Modem.sys
2010/12/22 14:39:15.0031 MODEMCSA (1992e0d143b09653ab0f9c5e04b0fd65) C:\WINDOWS\system32\drivers\MODEMCSA.sys
2010/12/22 14:39:15.0265 Mouclass (34e1f0031153e491910e12551400192c) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2010/12/22 14:39:15.0453 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2010/12/22 14:39:15.0640 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys
2010/12/22 14:39:15.0859 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys
2010/12/22 14:39:16.0062 mrtRate (6075de2ad531f6e30c9995dfda22001f) C:\WINDOWS\system32\drivers\mrtRate.sys
2010/12/22 14:39:16.0296 MRxDAV (29414447eb5bde2f8397dc965dbb3156) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2010/12/22 14:39:16.0593 MRxSmb (fb6c89bb3ce282b08bdb1e3c179e1c39) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2010/12/22 14:39:16.0906 MSDV (6dd721dfd2648f3f6d5808b5ba6cb095) C:\WINDOWS\system32\DRIVERS\msdv.sys
2010/12/22 14:39:17.0187 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys
2010/12/22 14:39:17.0515 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2010/12/22 14:39:17.0734 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2010/12/22 14:39:18.0031 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys
2010/12/22 14:39:18.0359 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2010/12/22 14:39:18.0593 MSTEE (bf13612142995096ab084f2db7f40f77) C:\WINDOWS\system32\drivers\MSTEE.sys
2010/12/22 14:39:18.0875 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys
2010/12/22 14:39:19.0406 MXOPSWD (216ac775320f64de28cfeb7c179c4ff9) C:\WINDOWS\system32\DRIVERS\mxopswd.sys
2010/12/22 14:39:19.0843 NABTSFEC (5c8dc6429c43dc6177c1fa5b76290d1a) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2010/12/22 14:39:20.0125 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys
2010/12/22 14:39:20.0375 NdisIP (520ce427a8b298f54112857bcf6bde15) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
2010/12/22 14:39:20.0546 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2010/12/22 14:39:20.0671 Ndisuio (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2010/12/22 14:39:20.0906 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2010/12/22 14:39:21.0140 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys
2010/12/22 14:39:21.0453 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys
2010/12/22 14:39:21.0640 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys
2010/12/22 14:39:21.0937 NIC1394 (5c5c53db4fef16cf87b9911c7e8c6fbc) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2010/12/22 14:39:22.0140 NMSCFG (847d6d775524fa5e58d851ddec566a12) C:\WINDOWS\System32\drivers\NMSCFG.SYS
2010/12/22 14:39:22.0359 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys
2010/12/22 14:39:22.0562 Ntfs (19a811ef5f1ed5c926a028ce107ff1af) C:\WINDOWS\system32\drivers\Ntfs.sys
2010/12/22 14:39:22.0828 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2010/12/22 14:39:23.0296 nv (34c114da0a5e03219444e46f122ff5a3) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
2010/12/22 14:39:23.0796 nv4 (4d31783965b0b7ced7db3f4ee14cf260) C:\WINDOWS\system32\DRIVERS\nv4.sys
2010/12/22 14:39:24.0046 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2010/12/22 14:39:24.0265 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2010/12/22 14:39:24.0500 ohci1394 (0951db8e5823ea366b0e408d71e1ba2a) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2010/12/22 14:39:24.0703 P3 (3e16eff2a6fed2d8d7f5a66dfe65d183) C:\WINDOWS\system32\DRIVERS\p3.sys
2010/12/22 14:39:24.0890 Parport (29744eb4ce659dfe3b4122deb45bc478) C:\WINDOWS\system32\DRIVERS\parport.sys
2010/12/22 14:39:25.0031 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys
2010/12/22 14:39:25.0265 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2010/12/22 14:39:25.0468 PCI (8086d9979234b603ad5bc2f5d890b234) C:\WINDOWS\system32\DRIVERS\pci.sys
2010/12/22 14:39:25.0796 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
2010/12/22 14:39:26.0265 Pcmcia (82a087207decec8456fbe8537947d579) C:\WINDOWS\system32\drivers\Pcmcia.sys
2010/12/22 14:39:28.0656 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys
2010/12/22 14:39:28.0968 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys
2010/12/22 14:39:29.0546 pfc (f2b3785d7282bac66d4b644fc88749f0) C:\WINDOWS\system32\drivers\pfc.sys
2010/12/22 14:39:29.0937 PfModNT (2f5532f9b0f903b26847da674b4f55b2) C:\WINDOWS\System32\PfModNT.sys
2010/12/22 14:39:30.0468 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2010/12/22 14:39:30.0984 Processor (0d97d88720a4087ec93af7dbb303b30a) C:\WINDOWS\system32\DRIVERS\processr.sys
2010/12/22 14:39:31.0671 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys
2010/12/22 14:39:32.0171 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2010/12/22 14:39:32.0593 PxHelp20 (49452bfcec22f36a7a9b9c2181bc3042) C:\WINDOWS\system32\Drivers\PxHelp20.sys
2010/12/22 14:39:33.0218 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys
2010/12/22 14:39:33.0796 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
2010/12/22 14:39:34.0531 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys
2010/12/22 14:39:34.0921 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys
2010/12/22 14:39:35.0406 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys
2010/12/22 14:39:36.0125 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2010/12/22 14:39:36.0953 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2010/12/22 14:39:37.0609 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2010/12/22 14:39:38.0015 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2010/12/22 14:39:38.0578 Rdbss (03b965b1ca47f6ef60eb5e51cb50e0af) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2010/12/22 14:39:38.0859 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2010/12/22 14:39:39.0140 rdpdr (a2cae2c60bc37e0751ef9dda7ceaf4ad) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2010/12/22 14:39:39.0546 RDPWD (b54cd38a9ebfbf2b3561426e3fe26f62) C:\WINDOWS\system32\drivers\RDPWD.sys
2010/12/22 14:39:40.0125 redbook (b31b4588e4086d8d84adbf9845c2402b) C:\WINDOWS\system32\DRIVERS\redbook.sys
2010/12/22 14:39:40.0718 RimUsb (f17713d108aca124a139fde877eef68a) C:\WINDOWS\system32\Drivers\RimUsb.sys
2010/12/22 14:39:41.0046 RimVSerPort (2c4fb2e9f039287767c384e46ee91030) C:\WINDOWS\system32\DRIVERS\RimSerial.sys
2010/12/22 14:39:41.0546 ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS\system32\Drivers\RootMdm.sys
2010/12/22 14:39:41.0875 RT73 (b01b2c25bd80770878285fb569090d7b) C:\WINDOWS\system32\DRIVERS\Dr71WU.sys
2010/12/22 14:39:42.0390 SCDEmu (20b2751cd4c8f3fd989739ca661b9f30) C:\WINDOWS\system32\drivers\SCDEmu.sys
2010/12/22 14:39:42.0828 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2010/12/22 14:39:43.0156 serenum (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS\system32\DRIVERS\serenum.sys
2010/12/22 14:39:43.0750 Serial (cd9404d115a00d249f70a371b46d5a26) C:\WINDOWS\system32\DRIVERS\serial.sys
2010/12/22 14:39:44.0109 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys
2010/12/22 14:39:44.0578 sfman (28b740a66cb88be3d0cd93d5664d7d88) C:\WINDOWS\system32\drivers\sfman.sys
2010/12/22 14:39:45.0609 sisagp (732d859b286da692119f286b21a2a114) C:\WINDOWS\system32\DRIVERS\sisagp.sys
2010/12/22 14:39:45.0906 SLIP (5caeed86821fa2c6139e32e9e05ccdc9) C:\WINDOWS\system32\DRIVERS\SLIP.sys
2010/12/22 14:39:46.0234 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys
2010/12/22 14:39:46.0656 splitter (0ce218578fff5f4f7e4201539c45c78f) C:\WINDOWS\system32\drivers\splitter.sys
2010/12/22 14:39:47.0046 sr (e41b6d037d6cd08461470af04500dc24) C:\WINDOWS\system32\DRIVERS\sr.sys
2010/12/22 14:39:47.0687 Srv (7a4f147cc6b133f905f6e65e2f8669fb) C:\WINDOWS\system32\DRIVERS\srv.sys
2010/12/22 14:39:48.0140 streamip (284c57df5dc7abca656bc2b96a667afb) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
2010/12/22 14:39:48.0640 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys
2010/12/22 14:39:48.0968 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
2010/12/22 14:39:49.0312 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys
2010/12/22 14:39:49.0609 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys
2010/12/22 14:39:50.0312 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys
2010/12/22 14:39:50.0640 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys
2010/12/22 14:39:51.0000 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
2010/12/22 14:39:51.0546 Tcpip (2a5554fc5b1e04e131230e3ce035c3f9) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2010/12/22 14:39:51.0937 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys
2010/12/22 14:39:52.0734 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys
2010/12/22 14:39:53.0609 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys
2010/12/22 14:39:53.0937 TIEHDUSB (a1124ebc672aa3ae1b327096c1dcc346) C:\WINDOWS\system32\drivers\tiehdusb.sys
2010/12/22 14:39:54.0171 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys
2010/12/22 14:39:54.0562 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys
2010/12/22 14:39:54.0859 ultra (8ba589b7788f6b976f1fdf3b097dbd5c) C:\WINDOWS\system32\DRIVERS\ultra.sys
2010/12/22 14:39:54.0859 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\ultra.sys. Real md5: 8ba589b7788f6b976f1fdf3b097dbd5c, Fake md5: 1b698a51cd528d8da4ffaed66dfc51b9
2010/12/22 14:39:54.0875 ultra - detected Rootkit.Win32.TDSS.tdl3 (0)
2010/12/22 14:39:55.0171 Update (ced744117e91bdc0beb810f7d8608183) C:\WINDOWS\system32\DRIVERS\update.sys
2010/12/22 14:39:55.0546 USBAAPL (5c2bdc152bbab34f36473deaf7713f22) C:\WINDOWS\system32\Drivers\usbaapl.sys
2010/12/22 14:39:55.0781 usbaudio (45a0d14b26c35497ad93bce7e15c9941) C:\WINDOWS\system32\drivers\usbaudio.sys
2010/12/22 14:39:56.0109 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2010/12/22 14:39:56.0437 usbehci (15e993ba2f6946b2bfbbfcd30398621e) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2010/12/22 14:39:56.0718 usbhub (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2010/12/22 14:39:57.0031 usbprint (a42369b7cd8886cd7c70f33da6fcbcf5) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2010/12/22 14:39:57.0296 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2010/12/22 14:39:57.0515 USBSTOR (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2010/12/22 14:39:57.0812 usbuhci (f8fd1400092e23c8f2f31406ef06167b) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2010/12/22 14:39:58.0156 usbvideo (8968ff3973a883c49e8b564200f565b9) C:\WINDOWS\system32\Drivers\usbvideo.sys
2010/12/22 14:39:58.0437 vcdrom (bfa4ae30b3ac10e9223830bf103f5a3f) C:\WINDOWS\SYSTEM32\DRIVERS\VCdRom.sys
2010/12/22 14:39:58.0859 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys
2010/12/22 14:39:59.0187 viaagp (d92e7c8a30cfd14d8e15b5f7f032151b) C:\WINDOWS\system32\DRIVERS\viaagp.sys
2010/12/22 14:39:59.0515 ViaIde (59cb1338ad3654417bea49636457f65d) C:\WINDOWS\system32\DRIVERS\viaide.sys
2010/12/22 14:39:59.0734 vmm (189cfded8f2b77cd4dc4972be0a21b78) C:\WINDOWS\system32\Drivers\vmm.sys
2010/12/22 14:40:00.0062 VolSnap (ee4660083deba849ff6c485d944b379b) C:\WINDOWS\system32\drivers\VolSnap.sys
2010/12/22 14:40:00.0343 VPCAppSv (d8048841126717cdc1c2e4a8571111d8) C:\WINDOWS\system32\DRIVERS\VPCAppSv.sys
2010/12/22 14:40:00.0625 VPCNetS2 (11f77458f5d3abd76747a628e0da2f6b) C:\WINDOWS\system32\DRIVERS\VMNetSrv.sys
2010/12/22 14:40:00.0875 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2010/12/22 14:40:01.0046 wanatw (ba1d9278448cb26152a18b6a06b61ea3) C:\WINDOWS\system32\DRIVERS\wanatw4.sys
2010/12/22 14:40:01.0531 wdmaud (efd235ca22b57c81118c1aeb4798f1c1) C:\WINDOWS\system32\drivers\wdmaud.sys
2010/12/22 14:40:01.0812 winachsf (fe71b3857bed54600e02288b212e7b7c) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys
2010/12/22 14:40:02.0218 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
2010/12/22 14:40:02.0453 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
2010/12/22 14:40:02.0656 WSTCODEC (d5842484f05e12121c511aa93f6439ec) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2010/12/22 14:40:02.0921 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2010/12/22 14:40:03.0203 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2010/12/22 14:40:03.0484 ================================================================================
2010/12/22 14:40:03.0484 Scan finished
2010/12/22 14:40:03.0484 ================================================================================
2010/12/22 14:40:03.0515 Detected object count: 1
2010/12/22 14:40:26.0515 ultra (8ba589b7788f6b976f1fdf3b097dbd5c) C:\WINDOWS\system32\DRIVERS\ultra.sys
2010/12/22 14:40:26.0515 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\ultra.sys. Real md5: 8ba589b7788f6b976f1fdf3b097dbd5c, Fake md5: 1b698a51cd528d8da4ffaed66dfc51b9
2010/12/22 14:40:29.0062 Backup copy not found, trying to cure infected file..
2010/12/22 14:40:29.0062 Cure success, using it..
2010/12/22 14:40:29.0140 C:\WINDOWS\system32\DRIVERS\ultra.sys - will be cured after reboot
2010/12/22 14:40:29.0140 Rootkit.Win32.TDSS.tdl3(ultra) - User select action: Cure

broni · 2010/12/22

Good job

Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

[color= "Blue"]**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**[/color]

Please, never rename Combofix unless instructed.

Close any open browsers.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".

Click on [color= "Red"]this link[/color] to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.

Close any open browsers.

[color= "Red"]WARNING:[/color] Combofix will disconnect your machine from the Internet as soon as it starts

Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results ". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
Use AppRemover to uninstall it: http://www.appremover.com/
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion ", restart computer to fix the issue.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode.

2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.com
Rkill.scr
Rkill.pif
Rkill.exe

Double-click on the Rkill desktop icon to run the tool.

If using Vista or Windows 7 right-click on it and choose Run As Administrator.

A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.

If not, delete the file, then download and use the one provided in Link 2.

If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.

Do not reboot until instructed.

If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

sox7rock · 2010/12/22

ComboFix 10-12-22.01 - Paul 12/22/2010 16:10:04.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1023.716 [GMT -6:00]
Running from: c:\documents and settings\Paul\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *Disabled/Outdated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\desktop.ini
c:\documents and settings\All Users\Application Data\.wtav
c:\documents and settings\Paul\.COMMgr
c:\program files\Internet Explorer\SET22.tmp
c:\program files\Internet Explorer\SET23.tmp
c:\program files\Internet Explorer\SET24.tmp
c:\program files\Internet Explorer\SET78D.tmp
c:\program files\Internet Explorer\SET78E.tmp
c:\program files\Internet Explorer\SET78F.tmp
C:\Thumbs.db
c:\windows\Dsixia.exe
c:\windows\system32\Oeminfo.ini

c:\windows\system32\winlogon.exe . . . is infected!!

Infected copy of c:\windows\explorer.exe was found and disinfected
Restored copy from - c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_6TO4
-------\Legacy_RKHIT
-------\Service_6to4

((((((((((((((((((((((((( Files Created from 2010-11-22 to 2010-12-22 )))))))))))))))))))))))))))))))
.

2067-02-24 21:21 . 2003-02-05 10:02 79947 ----a-w- c:\windows\fw20.vxd
2010-12-21 05:03 . 2010-12-21 05:05 -------- d-----w- c:\program files\iTunes
2010-12-13 05:44 . 2009-01-26 05:36 679936 ----a-w- c:\windows\system32\D3DX81ab.dll
2010-12-13 05:44 . 2009-01-26 05:36 1970176 ----a-w- c:\windows\system32\d3dx9.dll
2010-12-13 05:44 . 2010-12-13 07:15 -------- d-----w- c:\program files\Cheat Engine
2010-12-13 00:02 . 2010-12-13 00:02 -------- d-----w- c:\documents and settings\Paul\Application Data\Malwarebytes
2010-12-13 00:01 . 2010-11-29 23:42 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-13 00:01 . 2010-12-13 00:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-12-13 00:01 . 2010-11-29 23:42 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-13 00:01 . 2010-12-13 00:01 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-12-05 18:36 . 2010-12-05 18:36 -------- d-----w- c:\documents and settings\Paul\Application Data\Logitech
2010-12-05 08:03 . 2010-12-05 08:15 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG10
2010-12-05 07:20 . 2010-12-05 08:01 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData
2010-12-05 06:24 . 2010-12-05 07:03 -------- d-----w- c:\documents and settings\Paul\Local Settings\Application Data\WMTools Downloaded Files
2010-12-05 05:52 . 2010-12-05 05:52 -------- d-----w- c:\windows\system32\wbem\Repository
2010-12-05 05:50 . 2010-12-05 05:50 -------- d-----w- c:\documents and settings\Paul\Local Settings\Application Data\AOL OCP
2010-12-05 05:50 . 2010-12-05 05:50 -------- d-----w- c:\program files\AIM6
2010-12-05 05:29 . 2010-12-05 05:29 -------- d--h--w- c:\windows\ie8
2010-12-05 05:26 . 2010-12-05 05:26 -------- d-----w- c:\windows\SQL9_KB960089_ENU
2010-12-05 05:25 . 2010-12-05 05:25 -------- d-----w- c:\documents and settings\Paul\Local Settings\Application Data\MigWiz
2010-12-05 05:25 . 2010-12-05 05:25 -------- d-----w- c:\documents and settings\Paul\Local Settings\Application Data\ApplicationHistory
2010-12-05 05:25 . 2010-12-05 05:25 -------- d-----w- c:\documents and settings\Paul\Application Data\Leadertech
2010-12-05 05:25 . 2010-12-05 05:25 -------- d-----w- c:\documents and settings\Paul\Application Data\TweakNow RegCleaner
2010-12-05 05:25 . 2010-12-05 05:25 -------- d-----w- c:\documents and settings\Paul\Application Data\Systweak
2010-12-05 05:25 . 2010-12-05 05:25 -------- d-----w- c:\documents and settings\Paul\Application Data\NCH Swift Sound
2010-12-02 04:10 . 2010-12-05 05:25 -------- d-----w- c:\program files\Windows Live Safety Center
2010-11-30 01:30 . 2010-12-05 05:25 -------- d-----w- c:\documents and settings\Paul\Application Data\uTorrent
2010-11-29 23:38 . 2010-11-29 23:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-11-29 23:38 . 2010-11-29 23:38 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-11-28 21:57 . 2010-12-05 06:15 -------- d-----w- c:\program files\RocketDock

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-22 20:42 . 2002-06-25 21:48 36736 ----a-w- c:\windows\system32\drivers\ultra.sys
2010-09-28 21:44 . 2009-05-17 00:10 41984 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2010-09-28 21:44 . 2009-05-17 00:10 4184352 ----a-w- c:\windows\system32\usbaaplrc.dll
.

------- Sigcheck -------

[-] 2008-04-14 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\winlogon.exe
[-] 2004-08-04 07:56 . 47FE4E46795B261E1353447D0064B661 . 502272 . . [------] . . c:\windows\ServicePackFiles\i386\winlogon.exe
[-] 2004-08-04 . 401B6E1B63710610DC43EEB5E1C05DF6 . 502272 . . [5.1.2600.2180] . . c:\windows\SYSTEM32\winlogon.exe

[-] 2008-04-14 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\explorer.exe
[-] 2007-06-13 . C59C3671DE1D07F89429D7B2848C94FF . 1033216 . . [6.00.2900.3156] . . c:\windows\explorer.exe
[7] 2007-06-13 . 7712DF0CDDE3A5AC89843E61CD5B3658 . 1033216 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[7] 2004-08-04 . A0732187050030AE399B241436565E64 . 1032192 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB938828$\explorer.exe
[7] 2004-08-04 . A0732187050030AE399B241436565E64 . 1032192 . . [6.00.2900.2180] . . c:\windows\ServicePackFiles\i386\explorer.exe
[7] 2002-08-29 . A82B28BFC2E4455FE43022A498C0EF0A . 1004032 . . [6.00.2800.1106] . . c:\windows\$NtUninstallKB820291$\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport "= "c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"SsAAD.exe "= "c:\progra~1\Sony\SONICS~1\SsAAD.exe" [2006-11-02 472632]
"Logitech Vid "= "c:\program files\Logitech\Logitech Vid\vid.exe" [2009-07-16 5458704]
"Skype "= "c:\program files\Skype\Phone\Skype.exe" [2010-05-13 26192168]
"RocketDock "= "c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2007-04-19 7700480]
"UpdReg "= "c:\windows\Updreg.exe" [2000-05-11 90112]
"AHQInit "= "c:\program files\Creative\SBLive\Program\AHQInit.exe" [2001-03-28 102400]
"nwiz "= "nwiz.exe" [2007-04-19 1626112]
"Logitech Utility "= "Logi_MwX.Exe" [2003-11-07 19968]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2007-04-19 86016]
"D-Link Wireless G WUA-1340 "= "c:\program files\D-Link\Wireless G WUA-1340\AirGCFG.exe" [2007-08-27 1662976]
"LogitechQuickCamRibbon "= "c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-10-14 2793304]
"egui "= "c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-02-06 2021400]
"PWRISOVM.EXE "= "c:\program files\PowerISO\PWRISOVM.EXE" [2010-04-12 180224]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"AdobeAAMUpdater-1.0 "= "c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"AdobeCS5ServiceManager "= "c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2010-12-13 421160]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting "= "c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-23 39264]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0sasnative32\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, msnsspc.dll, digest.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RkHit.sys]
@=" "

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Netscape\\Netscape 6\\Netscp.exe "=
"c:\\WINDOWS\\SYSTEM32\\telnet.exe "=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe "=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\Research In Motion\\BlackBerry Desktop\\Rim.Desktop.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=
"c:\\Program Files\\Skype\\Phone\\Skype.exe "=
"c:\\Program Files\\Logitech\\Logitech Vid\\Vid.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"23:TCP "= 23:TCP:Telnet
"67:UDP "= 67:UDPHCP Discovery Service
"1041:TCP "= 1041:TCP:Akamai NetSession Interface
"5000:UDP "= 5000:UDP:Akamai NetSession Interface

R1 ehdrv;ehdrv;c:\windows\SYSTEM32\DRIVERS\ehdrv.sys [2/6/2009 10:56 AM 106208]
R1 epfwtdir;epfwtdir;c:\windows\SYSTEM32\DRIVERS\epfwtdir.sys [2/6/2009 10:58 AM 93336]
R1 vcdrom;Virtual CD-ROM Device Driver;c:\windows\SYSTEM32\DRIVERS\VCdRom.sys [12/8/2007 4:42 PM 8576]
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [6/25/2002 3:47 PM 14336]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2/6/2009 10:57 AM 727720]
R2 mrtRate;mrtRate;c:\windows\SYSTEM32\DRIVERS\MrtRate.sys [1/11/2003 7:52 PM 34916]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [1/10/2007 11:26 AM 24652]
R2 VPCAppSv;Virtual PC Application Services;c:\windows\SYSTEM32\DRIVERS\vpcappsv.sys [5/17/2004 6:15 PM 10374]
S3 A5AGU;D-Link USB Wireless Network Adapter Service;c:\windows\SYSTEM32\DRIVERS\A5AGU.sys [7/25/2005 9:32 PM 348352]
S3 ADASPROT;SYSTWEAKASO;\??\c:\program files\Advanced System Optimizer 3\adasprot32.sys --> c:\program files\Advanced System Optimizer 3\adasprot32.sys [?]
S3 ATHFMWDL;D-Link predator Bootloader driver;c:\windows\SYSTEM32\DRIVERS\Athfmwdl.sys [7/25/2005 9:35 PM 43392]
S3 Avgfwdx;Avgfwdx;c:\windows\SYSTEM32\DRIVERS\avgfwdx.sys [7/12/2010 4:33 AM 30432]
S3 Avgfwfd;AVG network filter service;c:\windows\SYSTEM32\DRIVERS\avgfwdx.sys [7/12/2010 4:33 AM 30432]
S3 MsDtsServer;SQL Server Integration Services;c:\program files\Microsoft SQL Server\90\DTS\Binn\MsDtsSrvr.exe [3/3/2007 10:12 PM 202096]
S4 msvsmon80;Visual Studio 2005 Remote Debugger; "f:\moreprograms\msvs2005\Common7\IDE\Remote Debugger\x86\msvsmon.exe" /service msvsmon80 --> f:\moreprograms\msvs2005\Common7\IDE\Remote Debugger\x86\msvsmon.exe [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
Contents of the 'Scheduled Tasks' folder

2010-12-19 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 16:50]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.dellnet.com/
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:6092
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Paul\Application Data\Mozilla\Firefox\Profiles\q4k6z18u.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/?ref=hp
FF - prefs.js: network.proxy.type - 4
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
.
- - - - ORPHANS REMOVED - - - -

BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKCU-Run-ares - c:\program files\Ares\Ares.exe
HKLM-Run-zBrowser Launcher - f:\moreprograms\iTouch\iTouch.exe
HKLM-Run-Advanced System Optimizer - c:\program files\Advanced System Optimizer 3\ASO3.exe
HKLM-RunOnce-DELDIR0.EXE - c:\docume~1\JEFFRE~1\LOCALS~1\Temp\DELDIR0.EXE
SafeBoot-klmdb.sys
AddRemove-CAL - c:\program files\Common Files\Canon\UIW\1.2.0.0\Uninst.exe
AddRemove-Creative News - c:\program files\Creative\News\CTNews.isu
AddRemove-Logitech Resource Center - f:\morepr~1\\RESOUR~1\rem\UNWISE.EXE
AddRemove-Quicken Deluxe 2000 - c:\quickenw\Uninst.isu
AddRemove-Radio@Netscape Plus - c:\program files\Radio@Netscape Plus\uninst.isu
AddRemove-RemoteCaptureTask - c:\program files\Common Files\Canon\UIW\1.2.0.0\Uninst.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-22 16:23
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
DELDIR0.EXE = "c:\docume~1\JEFFRE~1\LOCALS~1\Temp\DELDIR0.EXE" "c:\program files\McAfee\McAfee Shared Components\Guardian\ "????????????????????????????? ?????H??w?????9?w?9?w????H??w????L???T??w????<????????D?wx? ????w????7??w?? ?????t???????v???C?:?\?P?r?o?g?r?a?m? ?F?i?l?e?s?\?M?c?A?f?e?e?\?M?c?A?f?e?e? ?S?h?a?r?e?d? ?C?o?m?p?o?n?e?n?t?s?\?G?u?a?r?d?i?a?n?\?????????????????t????????????????? ????????w???w????7??w?%?w?????$?wd???????????T} ?????,2??

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2060)
c:\windows\system32\WININET.dll
c:\windows\TEMP\logishrd\LVPrcInj01.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\rundll32.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\System32\CTsvcCDA.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\system32\nvsvc32.exe
c:\windows\wanmpsvc.exe
c:\windows\System32\MsPMSPSv.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\system32\devldr32.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2010-12-22 16:31:19 - machine was rebooted
ComboFix-quarantined-files.txt 2010-12-22 22:31

Pre-Run: 27,142,348,800 bytes free
Post-Run: 27,158,323,200 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug= "do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS= "Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

- - End Of File - - 76C8EDA3D4523A4C41257ECDA1FA5A8D

broni · 2010/12/22

Yeah, we have more issues here....

Do you have Windows XP CD, if we need to use it?

Unless you installed Viewpoint Manager knowledgeably...
Go Start>Control Panel>Add\Remove (Programs and Features in Vista), and...
Uninstall any of the following programs associated with Viewpoint:
* Viewpoint Manager
* Viewpoint Media Player
* Viewpoint Toolbar
This program does not do anything bad such as deliver ads or spy on you, but it is considered foistware ( "drive-by-install ") as it is installed without your consent through programs like AOL, AIM, Compuserve, etc.

===============================================================

1. Please open Notepad

Click Start , then Run

Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:
Code:
FCopy::
c:\windows\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\winlogon.exe | c:\windows\system32\winlogon.exe

File::
c:\windows\SYSTEM32\DRIVERS\avgfwdx.sys


Folder::
c:\documents and settings\All Users\Application Data\AVG10
c:\documents and settings\Paul\Application Data\TweakNow RegCleaner

DDS::
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:6092

Driver::
Avgfwdx
Avgfwfd

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
 "AntiVirusOverride "=-
3. Save the above as CFScript.txt

4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt

sox7rock · 2010/12/22

i received this computer from a family member and dont have the windows XP Cd but i will do these other things right away

broni · 2010/12/22

Ok

sox7rock · 2010/12/22

its said i couldnt remove the viewpoint media play but here is the other thing

ComboFix 10-12-22.01 - Paul 12/22/2010 19:22:21.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1023.555 [GMT -6:00]
Running from: c:\documents and settings\Paul\Desktop\Windowsbbs\ComboFix.exe
Command switches used :: c:\documents and settings\Paul\Desktop\Windowsbbs\cfscript.txt
AV: ESET NOD32 Antivirus 4.0 *Disabled/Outdated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

FILE ::
"c:\windows\SYSTEM32\DRIVERS\avgfwdx.sys "
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\AVG10
c:\documents and settings\All Users\Application Data\AVG10\Cfg\krnl.cfg
c:\documents and settings\All Users\Application Data\AVG10\Chjw\e698f93498f903b9.dat
c:\documents and settings\All Users\Application Data\AVG10\Chjw\e698f93498f903b9\avgcchff.dat
c:\documents and settings\All Users\Application Data\AVG10\Chjw\e698f93498f903b9\avgcchmf.dat
c:\documents and settings\All Users\Application Data\AVG10\log\avgcfg.log
c:\documents and settings\All Users\Application Data\AVG10\log\avgcfg.log.lock
c:\documents and settings\All Users\Application Data\AVG10\log\avgchjw.log
c:\documents and settings\All Users\Application Data\AVG10\log\avgchjw.log.lock
c:\documents and settings\All Users\Application Data\AVG10\log\avgchjwsrv.log
c:\documents and settings\All Users\Application Data\AVG10\log\avgchjwsrv.log.lock
c:\documents and settings\All Users\Application Data\AVG10\log\avgldr.log
c:\documents and settings\All Users\Application Data\AVG10\log\avgldr.log.lock
c:\documents and settings\All Users\Application Data\AVG10\log\avgrs.log
c:\documents and settings\All Users\Application Data\AVG10\log\avgrs.log.lock
c:\documents and settings\All Users\Application Data\AVG10\log\avgtdi.log
c:\documents and settings\All Users\Application Data\AVG10\log\avgtdi.log.lock
c:\documents and settings\Paul\Application Data\TweakNow RegCleaner
c:\windows\SYSTEM32\DRIVERS\avgfwdx.sys

c:\windows\system32\winlogon.exe . . . is infected!!

Infected copy of c:\windows\explorer.exe was found and disinfected
Restored copy from - c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe

.
--------------- FCopy ---------------

c:\windows\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\winlogon.exe --> c:\windows\system32\winlogon.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_Avgfwdx
-------\Service_Avgfwfd

((((((((((((((((((((((((( Files Created from 2010-11-23 to 2010-12-23 )))))))))))))))))))))))))))))))
.

2067-02-24 21:21 . 2003-02-05 10:02 79947 ----a-w- c:\windows\fw20.vxd
2010-12-21 05:03 . 2010-12-21 05:05 -------- d-----w- c:\program files\iTunes
2010-12-13 05:44 . 2009-01-26 05:36 679936 ----a-w- c:\windows\system32\D3DX81ab.dll
2010-12-13 05:44 . 2009-01-26 05:36 1970176 ----a-w- c:\windows\system32\d3dx9.dll
2010-12-13 05:44 . 2010-12-13 07:15 -------- d-----w- c:\program files\Cheat Engine
2010-12-13 00:02 . 2010-12-13 00:02 -------- d-----w- c:\documents and settings\Paul\Application Data\Malwarebytes
2010-12-13 00:01 . 2010-11-29 23:42 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-13 00:01 . 2010-12-13 00:01 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-12-13 00:01 . 2010-11-29 23:42 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-13 00:01 . 2010-12-13 00:01 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-12-05 18:36 . 2010-12-05 18:36 -------- d-----w- c:\documents and settings\Paul\Application Data\Logitech
2010-12-05 07:20 . 2010-12-05 08:01 -------- d-----w- c:\documents and settings\All Users\Application Data\MFAData
2010-12-05 06:24 . 2010-12-05 07:03 -------- d-----w- c:\documents and settings\Paul\Local Settings\Application Data\WMTools Downloaded Files
2010-12-05 05:52 . 2010-12-05 05:52 -------- d-----w- c:\windows\system32\wbem\Repository
2010-12-05 05:50 . 2010-12-05 05:50 -------- d-----w- c:\documents and settings\Paul\Local Settings\Application Data\AOL OCP
2010-12-05 05:50 . 2010-12-05 05:50 -------- d-----w- c:\program files\AIM6
2010-12-05 05:29 . 2010-12-05 05:29 -------- d--h--w- c:\windows\ie8
2010-12-05 05:26 . 2010-12-05 05:26 -------- d-----w- c:\windows\SQL9_KB960089_ENU
2010-12-05 05:25 . 2010-12-05 05:25 -------- d-----w- c:\documents and settings\Paul\Local Settings\Application Data\MigWiz
2010-12-05 05:25 . 2010-12-05 05:25 -------- d-----w- c:\documents and settings\Paul\Local Settings\Application Data\ApplicationHistory
2010-12-05 05:25 . 2010-12-05 05:25 -------- d-----w- c:\documents and settings\Paul\Application Data\Leadertech
2010-12-05 05:25 . 2010-12-05 05:25 -------- d-----w- c:\documents and settings\Paul\Application Data\Systweak
2010-12-05 05:25 . 2010-12-05 05:25 -------- d-----w- c:\documents and settings\Paul\Application Data\NCH Swift Sound
2010-12-02 04:10 . 2010-12-05 05:25 -------- d-----w- c:\program files\Windows Live Safety Center
2010-11-30 01:30 . 2010-12-05 05:25 -------- d-----w- c:\documents and settings\Paul\Application Data\uTorrent
2010-11-29 23:38 . 2010-11-29 23:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-11-29 23:38 . 2010-11-29 23:38 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-11-28 21:57 . 2010-12-05 06:15 -------- d-----w- c:\program files\RocketDock

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-22 20:42 . 2002-06-25 21:48 36736 ----a-w- c:\windows\system32\drivers\ultra.sys
2010-09-28 21:44 . 2009-05-17 00:10 41984 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2010-09-28 21:44 . 2009-05-17 00:10 4184352 ----a-w- c:\windows\system32\usbaaplrc.dll
.

------- Sigcheck -------

[-] 2008-04-14 . ED0EF0A136DEC83DF69F04118870003E . 507904 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\winlogon.exe
[-] 2008-04-14 . DA00E793A1C4A8D8DCB2E817965B9641 . 507904 . . [5.1.2600.5512] . . c:\windows\SYSTEM32\winlogon.exe
[-] 2004-08-04 07:56 . 47FE4E46795B261E1353447D0064B661 . 502272 . . [------] . . c:\windows\ServicePackFiles\i386\winlogon.exe

[-] 2008-04-14 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\explorer.exe
[-] 2007-06-13 . C59C3671DE1D07F89429D7B2848C94FF . 1033216 . . [6.00.2900.3156] . . c:\windows\explorer.exe
[7] 2007-06-13 . 7712DF0CDDE3A5AC89843E61CD5B3658 . 1033216 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
[7] 2004-08-04 . A0732187050030AE399B241436565E64 . 1032192 . . [6.00.2900.2180] . . c:\windows\$NtUninstallKB938828$\explorer.exe
[7] 2004-08-04 . A0732187050030AE399B241436565E64 . 1032192 . . [6.00.2900.2180] . . c:\windows\ServicePackFiles\i386\explorer.exe
[7] 2002-08-29 . A82B28BFC2E4455FE43022A498C0EF0A . 1004032 . . [6.00.2800.1106] . . c:\windows\$NtUninstallKB820291$\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport "= "c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"SsAAD.exe "= "c:\progra~1\Sony\SONICS~1\SsAAD.exe" [2006-11-02 472632]
"Logitech Vid "= "c:\program files\Logitech\Logitech Vid\vid.exe" [2009-07-16 5458704]
"Skype "= "c:\program files\Skype\Phone\Skype.exe" [2010-05-13 26192168]
"RocketDock "= "c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2007-04-19 7700480]
"UpdReg "= "c:\windows\Updreg.exe" [2000-05-11 90112]
"AHQInit "= "c:\program files\Creative\SBLive\Program\AHQInit.exe" [2001-03-28 102400]
"nwiz "= "nwiz.exe" [2007-04-19 1626112]
"Logitech Utility "= "Logi_MwX.Exe" [2003-11-07 19968]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2007-04-19 86016]
"D-Link Wireless G WUA-1340 "= "c:\program files\D-Link\Wireless G WUA-1340\AirGCFG.exe" [2007-08-27 1662976]
"LogitechQuickCamRibbon "= "c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-10-14 2793304]
"egui "= "c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-02-06 2021400]
"PWRISOVM.EXE "= "c:\program files\PowerISO\PWRISOVM.EXE" [2010-04-12 180224]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"AdobeAAMUpdater-1.0 "= "c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"AdobeCS5ServiceManager "= "c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2010-12-13 421160]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting "= "c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-23 39264]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0sasnative32\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, msnsspc.dll, digest.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RkHit.sys]
@=" "

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Netscape\\Netscape 6\\Netscp.exe "=
"c:\\WINDOWS\\SYSTEM32\\telnet.exe "=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe "=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\Research In Motion\\BlackBerry Desktop\\Rim.Desktop.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=
"c:\\Program Files\\Skype\\Phone\\Skype.exe "=
"c:\\Program Files\\Logitech\\Logitech Vid\\Vid.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"23:TCP "= 23:TCP:Telnet
"67:UDP "= 67:UDPHCP Discovery Service
"1038:TCP "= 1038:TCP:Akamai NetSession Interface
"5000:UDP "= 5000:UDP:Akamai NetSession Interface

R1 ehdrv;ehdrv;c:\windows\SYSTEM32\DRIVERS\ehdrv.sys [2/6/2009 10:56 AM 106208]
R1 epfwtdir;epfwtdir;c:\windows\SYSTEM32\DRIVERS\epfwtdir.sys [2/6/2009 10:58 AM 93336]
R1 vcdrom;Virtual CD-ROM Device Driver;c:\windows\SYSTEM32\DRIVERS\VCdRom.sys [12/8/2007 4:42 PM 8576]
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [6/25/2002 3:47 PM 14336]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2/6/2009 10:57 AM 727720]
R2 mrtRate;mrtRate;c:\windows\SYSTEM32\DRIVERS\MrtRate.sys [1/11/2003 7:52 PM 34916]
R2 VPCAppSv;Virtual PC Application Services;c:\windows\SYSTEM32\DRIVERS\vpcappsv.sys [5/17/2004 6:15 PM 10374]
S3 A5AGU;D-Link USB Wireless Network Adapter Service;c:\windows\SYSTEM32\DRIVERS\A5AGU.sys [7/25/2005 9:32 PM 348352]
S3 ADASPROT;SYSTWEAKASO;\??\c:\program files\Advanced System Optimizer 3\adasprot32.sys --> c:\program files\Advanced System Optimizer 3\adasprot32.sys [?]
S3 ATHFMWDL;D-Link predator Bootloader driver;c:\windows\SYSTEM32\DRIVERS\Athfmwdl.sys [7/25/2005 9:35 PM 43392]
S3 MsDtsServer;SQL Server Integration Services;c:\program files\Microsoft SQL Server\90\DTS\Binn\MsDtsSrvr.exe [3/3/2007 10:12 PM 202096]
S4 msvsmon80;Visual Studio 2005 Remote Debugger; "f:\moreprograms\msvs2005\Common7\IDE\Remote Debugger\x86\msvsmon.exe" /service msvsmon80 --> f:\moreprograms\msvs2005\Common7\IDE\Remote Debugger\x86\msvsmon.exe [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
Contents of the 'Scheduled Tasks' folder

2010-12-19 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 16:50]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.dellnet.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Paul\Application Data\Mozilla\Firefox\Profiles\q4k6z18u.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/?ref=hp
FF - prefs.js: network.proxy.type - 4
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-12-22 19:37
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(5748)
c:\windows\system32\WININET.dll
c:\windows\TEMP\logishrd\LVPrcInj01.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\progra~1\MICROS~2\OFFICE11\MCPS.DLL
c:\program files\Microsoft Silverlight\xapauthenticodesip.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\System32\CTsvcCDA.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\devldr32.exe
c:\windows\wanmpsvc.exe
c:\windows\System32\MsPMSPSv.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2010-12-22 19:44:12 - machine was rebooted
ComboFix-quarantined-files.txt 2010-12-23 01:44
ComboFix2.txt 2010-12-22 22:31

Pre-Run: 27,125,895,168 bytes free
Post-Run: 27,108,532,224 bytes free

- - End Of File - - 20CBAD2BD9707B20CB8C46378968B5D8

broni · 2010/12/22

We still have very issue:

c:\windows\system32\winlogon.exe . . . is infected!!
Click to expand...

and unfortunately, you don't have any healthy replacement on your computer.

We'll try to cheat a little...
Download winlogon.zip from here: http://www.smartestcomputing.us.com/files/file/1-windows-xp-explorerexe-and-winlogonexe/ (safe file from my XP).
Unzip it and paste winlogon.exe into root C:\ directory.

I want to see, if you placed the file in a right location, so....

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
64-bit users go HERE
Double-click SystemLook.exe to run it.

Vista users:: Right click on SystemLook.exe, click Run As Administrator
Copy the content of the following box into the main textfield:
Code:
:filefind
winlogon.exe
Click the Look button to start the scan.

When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

sox7rock · 2010/12/22

SystemLook 04.09.10 by jpshortstuff
Log created at 23:03 on 22/12/2010 by Paul
Administrator - Elevation successful

========== filefind ==========

Searching for "winlogon.exe "
C:\winlogon.exe --a---- 507904 bytes [07:36 21/03/2008] [07:36 21/03/2008] B8135E9ED99A0858DF535CE0A0271558
C:\I386\winlogon.exe --a---- 429056 bytes [03:47 01/11/2002] [15:54 21/02/2002] C605FFF733AAD029D6B533E609C8A6E6
C:\WINDOWS\ServicePackFiles\i386\winlogon.exe -----c- 502272 bytes [03:06 22/02/2004] [07:56 04/08/2004] 47FE4E46795B261E1353447D0064B661
C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\winlogon.exe -----c- 507904 bytes [05:39 19/08/2008] [00:12 14/04/2008] ED0EF0A136DEC83DF69F04118870003E
C:\WINDOWS\SYSTEM32\winlogon.exe --a---- 507904 bytes [21:50 25/06/2002] [00:12 14/04/2008] DA00E793A1C4A8D8DCB2E817965B9641

-= EOF =-

broni · 2010/12/22

Good

Download BlitzBlank and save it to your desktop.
Double click on Blitzblank.exe

Click OK at the warning (and take note of it, this is a VERY powerful tool!).

Click the Script tab and copy/paste the following text there:
Code:
CopyFile:
C:\winlogon.exe C:\WINDOWS\system32\winlogon.exe
Click Execute Now. Your computer will need to reboot in order to replace the files.

When done, post the report created by Blitzblank.
You can find it in the root of the drive, normally C:\

When done, post new SystemLook log (same script as in my reply #15)

sox7rock · 2010/12/22

SystemLook 04.09.10 by jpshortstuff
Log created at 23:40 on 22/12/2010 by Paul
Administrator - Elevation successful

========== filefind ==========

Searching for "winlogon.exe "
C:\winlogon.exe --a---- 507904 bytes [07:36 21/03/2008] [07:36 21/03/2008] B8135E9ED99A0858DF535CE0A0271558
C:\I386\winlogon.exe --a---- 429056 bytes [03:47 01/11/2002] [15:54 21/02/2002] C605FFF733AAD029D6B533E609C8A6E6
C:\WINDOWS\ServicePackFiles\i386\winlogon.exe -----c- 502272 bytes [03:06 22/02/2004] [07:56 04/08/2004] 47FE4E46795B261E1353447D0064B661
C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\winlogon.exe -----c- 507904 bytes [05:39 19/08/2008] [00:12 14/04/2008] ED0EF0A136DEC83DF69F04118870003E
C:\WINDOWS\SYSTEM32\winlogon.exe --a---- 507904 bytes [21:50 25/06/2002] [05:29 23/12/2010] 14EE0F586D4B26605BEA5FCC085E1BCF

-= EOF =-

broni · 2010/12/22

It didn't work.
Give me a moment to give you new instructions.

broni · 2010/12/22

Now, you'll have to be EXTREMELY careful with this procedure.
We'll be replacing two crucial Windows files, so make sure you read everything.
You'll be typing couple of commands by hand, so make sure, there is no single misspell and watch for "spaces" in those commands.

Restart computer
When you reboot you will see an option to boot into the Recovery Console or the normal Windows installation.
You have to use the up/down arrows to choose the Recovery Console. Then press Enter but you only have 2 seconds by default.

(If you find this hard to do then you can go into Control Panel, System, Advanced, Startup and Recovery, Settings. Where it says Time to Display List of Operating Systems, change it to 10 or more seconds. OK Then reboot.)

You must enter which Windows installation to log onto. Type 1 and press enter.

It will then prompt you for the Administrator's password. If there is no password, simply press Enter.

You should get a black screen with a C:\>Windows prompt.

Type the bolded text below, pressing Enter after each line:

copy C:\winlogon.exe C:\WINDOWS\system32\winlogon.exe (<---- watch for "spaces ")

(If it asks you if you are sure then say "Y ".)

copy c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe C:\WINDOWS\explorer.exe (<---- watch for "spaces ")

Reboot computer.

Post new SystemLook log.

Log in or Sign up

Solved Google Search Link opens to random sites

sox7rock Inactive Thread Starter

broni Moderator Malware Analyst

sox7rock Inactive Thread Starter

broni Moderator Malware Analyst

sox7rock Inactive Thread Starter

sox7rock Inactive Thread Starter

broni Moderator Malware Analyst

sox7rock Inactive Thread Starter

broni Moderator Malware Analyst

sox7rock Inactive Thread Starter

broni Moderator Malware Analyst

sox7rock Inactive Thread Starter

broni Moderator Malware Analyst

sox7rock Inactive Thread Starter

broni Moderator Malware Analyst

sox7rock Inactive Thread Starter

broni Moderator Malware Analyst

sox7rock Inactive Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

Share This Page

Log in or Sign up

Solved Google Search Link opens to random sites

sox7rock Inactive Thread Starter

broni Moderator Malware Analyst

sox7rock Inactive Thread Starter

broni Moderator Malware Analyst

sox7rock Inactive Thread Starter

sox7rock Inactive Thread Starter

broni Moderator Malware Analyst

sox7rock Inactive Thread Starter

broni Moderator Malware Analyst

sox7rock Inactive Thread Starter

broni Moderator Malware Analyst

sox7rock Inactive Thread Starter

broni Moderator Malware Analyst

sox7rock Inactive Thread Starter

broni Moderator Malware Analyst

sox7rock Inactive Thread Starter

broni Moderator Malware Analyst

sox7rock Inactive Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

Share This Page

Useful Searches