1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved Experiencing problems after virus

Discussion in 'Malware and Virus Removal Archive' started by Supermaine, 2011/04/27.

Page 2 of 4
  1. 2011/04/28
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Attempt to restart in normal mode after running following fix...

    Run OTL
    • Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following

      Code:
      :OTL
IE - HKU\S-1-5-21-705464508-3563758628-1241951192-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings:  "ProxyOverride" = <local>
FF - prefs.js..browser.search.defaultthis.engineName:  "Freecorder Customized Web Search "
[2009/06/17 07:04:40 | 000,000,000 | ---D | M] ( "Ask Toolbar for Firefox ") -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\9t9ikza3.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No CLSID value found.
O3 - HKU\S-1-5-21-705464508-3563758628-1241951192-1003\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKU\S-1-5-21-705464508-3563758628-1241951192-1003\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-705464508-3563758628-1241951192-1003\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O4 - HKLM..\Run: [Ask and Record FLV Service] C:\Program Files\Ask & Record Toolbar\FLVSrvc.exe (Applian Technologies, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\run_startmenu.cmd ()
O9 - Extra Button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - Reg Error: Value error. File not found
[2010/06/11 16:43:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0CE7F3C9
@Alternate Data Stream - 1254 bytes -> C:\Documents and Settings\All Users\Application Data\Microsoft:R80dOB6ULNeyzF951yS08o2yy
@Alternate Data Stream - 1232 bytes -> C:\Documents and Settings\All Users\Application Data\Microsoft:dp1cvafmbES0OAERxYZ2jRyli
@Alternate Data Stream - 1212 bytes -> C:\Documents and Settings\All Users\Application Data\Microsoft:y5vcwSdDS25iIXgMMyyjxt0iYjx
@Alternate Data Stream - 1192 bytes -> C:\Documents and Settings\All Users\Application Data\Microsoft:4Axt7MURGmssMxetqPSS8
@Alternate Data Stream - 1122 bytes -> C:\Program Files\Outlook Express:6j8y7mE8rRRVtn9aOGVslMdfLcp
@Alternate Data Stream - 1114 bytes -> C:\Documents and Settings\All Users\Application Data\Microsoft:I7kHu15vzdLl807p3PaGRkQqT
@Alternate Data Stream - 1105 bytes -> C:\Documents and Settings\Owner\Cookies:LFoiLpYjHDwguFvcpL0zEXk


:Services

:Reg

:Files
C:\Program Files\AskBarDis


:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]
    • Then click the [color= "#FF0000"]Run Fix[/color] button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.
     
    broni,
    #21
  2. 2011/04/28
    Supermaine

    Supermaine Inactive Thread Starter

    Joined:
    2010/06/08
    Messages:
    144
    Likes Received:
    0
    I ran the fix, it said it had to reboot. I tried to reboot it and let it reboot in normal mode and the same thing happened so I had to restart. I'm back in Safe Mode with Networking so I'm not sure where the log is located.
     
    Supermaine,
    #22


  3. to hide this advert.

  4. 2011/04/28
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    While in safe mode....

    Go Start>Run (Start Search in Vista), type in:
    msconfig
    Click OK (hit Enter in Vista).

    Click on Startup tab.
    Click Disable all
    IMPORTANT! In case of laptop, make sure, you do NOT disable any keyboard, or touchpad entries.

    Click Services tab.
    Put checkmark in Hide all Microsoft services
    Click Disable all.

    Click OK.
    Attempt to restart computer in Normal Mode.

    NOTE. If you use different firewall, than Windows firewall, turn Windows firewall on, just for this test, since your regular firewall won't be running.
    If you use Windows firewall, you're fine.

    Same problem?
     
    broni,
    #23
  5. 2011/04/28
    Supermaine

    Supermaine Inactive Thread Starter

    Joined:
    2010/06/08
    Messages:
    144
    Likes Received:
    0
    Nope. It opened now in normal mode and here's the log:

    All processes killed
    ========== OTL ==========
    HKU\S-1-5-21-705464508-3563758628-1241951192-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
    Prefs.js: "Freecorder Customized Web Search" removed from browser.search.defaultthis.engineName
    C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\9t9ikza3.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\META-INF folder moved successfully.
    C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\9t9ikza3.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults\preferences folder moved successfully.
    C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\9t9ikza3.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults folder moved successfully.
    C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\9t9ikza3.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\chrome folder moved successfully.
    C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\9t9ikza3.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D} folder moved successfully.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{201f27d4-3704-41d6-89c1-aa35e39143ed}\ deleted successfully.
    C:\Program Files\AskBarDis\bar\bin\askBar.dll moved successfully.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{3041d03e-fd4b-44e0-b742-2d9b88305f98} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3041d03e-fd4b-44e0-b742-2d9b88305f98}\ deleted successfully.
    File C:\Program Files\AskBarDis\bar\bin\askBar.dll not found.
    Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}\ not found.
    Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
    Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found.
    Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{4982D40A-C53B-4615-B15B-B5B5E98D167C} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4982D40A-C53B-4615-B15B-B5B5E98D167C}\ not found.
    Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}\ not found.
    Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
    Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found.
    Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{4982D40A-C53B-4615-B15B-B5B5E98D167C} not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4982D40A-C53B-4615-B15B-B5B5E98D167C}\ not found.
    Registry value HKEY_USERS\S-1-5-21-705464508-3563758628-1241951192-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}\ not found.
    Registry value HKEY_USERS\S-1-5-21-705464508-3563758628-1241951192-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
    Registry value HKEY_USERS\S-1-5-21-705464508-3563758628-1241951192-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{3041D03E-FD4B-44E0-B742-2D9B88305F98} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3041D03E-FD4B-44E0-B742-2D9B88305F98}\ not found.
    File C:\Program Files\AskBarDis\bar\bin\askBar.dll not found.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Ask and Record FLV Service deleted successfully.
    C:\Program Files\Ask & Record Toolbar\FLVSrvc.exe moved successfully.
    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\run_startmenu.cmd moved successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{4982D40A-C53B-4615-B15B-B5B5E98D167C}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4982D40A-C53B-4615-B15B-B5B5E98D167C}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{4982D40A-C53B-4615-B15B-B5B5E98D167C}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4982D40A-C53B-4615-B15B-B5B5E98D167C}\ not found.
    C:\Documents and Settings\All Users\Application Data\Viewpoint folder moved successfully.
    ADS C:\Documents and Settings\All Users\Application Data\TEMP:0CE7F3C9 deleted successfully.
    ADS C:\Documents and Settings\All Users\Application Data\Microsoft:R80dOB6ULNeyzF951yS08o2yy deleted successfully.
    ADS C:\Documents and Settings\All Users\Application Data\Microsoft:dp1cvafmbES0OAERxYZ2jRyli deleted successfully.
    ADS C:\Documents and Settings\All Users\Application Data\Microsoft:y5vcwSdDS25iIXgMMyyjxt0iYjx deleted successfully.
    ADS C:\Documents and Settings\All Users\Application Data\Microsoft:4Axt7MURGmssMxetqPSS8 deleted successfully.
    ADS C:\Program Files\Outlook Express:6j8y7mE8rRRVtn9aOGVslMdfLcp deleted successfully.
    ADS C:\Documents and Settings\All Users\Application Data\Microsoft:I7kHu15vzdLl807p3PaGRkQqT deleted successfully.
    ADS C:\Documents and Settings\Owner\Cookies:LFoiLpYjHDwguFvcpL0zEXk deleted successfully.
    ========== SERVICES/DRIVERS ==========
    ========== REGISTRY ==========
    ========== FILES ==========
    C:\Program Files\AskBarDis\bar\Settings folder moved successfully.
    C:\Program Files\AskBarDis\bar\History folder moved successfully.
    C:\Program Files\AskBarDis\bar\Cache folder moved successfully.
    C:\Program Files\AskBarDis\bar\bin folder moved successfully.
    C:\Program Files\AskBarDis\bar folder moved successfully.
    C:\Program Files\AskBarDis folder moved successfully.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Administrator
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->FireFox cache emptied: 0 bytes

    User: All Users

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: LocalService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 67 bytes
    ->Flash cache emptied: 0 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Java cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Owner
    ->Temp folder emptied: 71381 bytes
    ->Temporary Internet Files folder emptied: 380808 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 58655167 bytes
    ->Flash cache emptied: 456 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
    RecycleBin emptied: 1263721 bytes

    Total Files Cleaned = 58.00 mb


    [EMPTYFLASH]

    User: Administrator

    User: All Users

    User: Default User

    User: LocalService
    ->Flash cache emptied: 0 bytes

    User: NetworkService
    ->Flash cache emptied: 0 bytes

    User: Owner
    ->Flash cache emptied: 0 bytes

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.22.3 log created on 04282011_165211

    Files\Folders moved on Reboot...

    Registry entries deleted on Reboot...
     
    Supermaine,
    #24
  6. 2011/04/28
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Go back to "msconfig ", re-enable all items, you just disabled and see, if it'll restart in NORMAL mode.
     
    broni,
    #25
  7. 2011/04/28
    Supermaine

    Supermaine Inactive Thread Starter

    Joined:
    2010/06/08
    Messages:
    144
    Likes Received:
    0
    Before I do that I should tell you that this message came up regarding the System Configuration Utility. This has been coming up every time I had previously been able to get on Normal Mode. Except it was accompanied by the error I posted in the original post. This time, there was no error. So should I still continue to do what you said?
     
    Supermaine,
    #26
  8. 2011/04/28
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    That message is normal, when you use selective startup.
    Go on....
     
    broni,
    #27
  9. 2011/04/28
    Supermaine

    Supermaine Inactive Thread Starter

    Joined:
    2010/06/08
    Messages:
    144
    Likes Received:
    0
    It says,

    "An access denied error was returned while attempting to change a service. You may need to log in using an Administrator account to make the specified changes. "

    I am already logged on to the only Administrator account on this computer.
     
    Supermaine,
    #28
  10. 2011/04/28
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    OK, we need to clarify couple of things, because I'm not sure where exactly we're at.
    Please, confirm/deny, if this is what happened.
    You...
    1. Ran OTL fix.
    2. Tried to restart in normal mode. No go.
    3. Disabled some items in "msconfig ", while in Safe Mode, following my advice in post #23
    4. Restarted fine in NORMAL mode and OTL log popped up.
    5. Tried to make some changes in "msconfig" while in normal mode - access denied.

    Let me know.
     
    broni,
    #29
  11. 2011/04/28
    Supermaine

    Supermaine Inactive Thread Starter

    Joined:
    2010/06/08
    Messages:
    144
    Likes Received:
    0
    Yes, correct. while trying to enable the items that I had previously disabled, that's the message that came up. But, in my original post I made mention of this error message coming up:

    Error loading C:\Windows\Naxmsr.dll" The specified module could not be found.

    And also the system configuration utility message popped along with that same error.
     
    Supermaine,
    #30
  12. 2011/04/28
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    OK. Thanks :)

    Let's leave "msconfig" alone for now.

    For now, we should be happy, we can operate in normal mode.

    Your Malwarebytes version is very outdated.
    See, if you can update it in normal mode.
    If so, do it, run "Quick scan" and post new log.
     
    broni,
    #31
  13. 2011/04/28
    Supermaine

    Supermaine Inactive Thread Starter

    Joined:
    2010/06/08
    Messages:
    144
    Likes Received:
    0
    I just reread that post, it sounded confusing. Allow me to clarify. ORIGINALLY (before posting here), the error message popped up along with the system utility message.

    After running your fixes, and booting back into normal mode, this time ONLY the system utility came up. You said it was normal so I closed it. Now, while trying to enable the previously disabled services from the startup, the access denied message appeared.
     
    Supermaine,
    #32
  14. 2011/04/28
    Supermaine

    Supermaine Inactive Thread Starter

    Joined:
    2010/06/08
    Messages:
    144
    Likes Received:
    0
    And okay, I'm running the scan now.
     
    Supermaine,
    #33
  15. 2011/04/28
    Supermaine

    Supermaine Inactive Thread Starter

    Joined:
    2010/06/08
    Messages:
    144
    Likes Received:
    0
    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 6467

    Windows 5.1.2600 Service Pack 3
    Internet Explorer 6.0.2900.5512

    4/28/2011 6:13:33 PM
    mbam-log-2011-04-28 (18-13-33).txt

    Scan type: Quick scan
    Objects scanned: 145326
    Time elapsed: 2 minute(s), 21 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)
     
    Supermaine,
    #34
  16. 2011/04/28
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    You're good :)
    Go on...
     
    broni,
    #35
  17. 2011/04/28
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please download Rootkit Unhooker from one of the following links and save it to your desktop.
    In order to use this tool if you downloaded from either of the second two links, you will need to extract the RKUnhookerLE.exe file using a program capable of extracing ZIP and RAR compressed files. If you don't have an extraction program, you can downlaod, install and use the free 7-zip utility.

    • Double-click on RKUnhookerLE.exe to start the program.
      Vista/Windows 7 users right-click and select Run As Administrator.
    • Click the Report tab, then click Scan.
    • Check Drivers, Stealth, and uncheck the rest.
    • Click OK.
    • Wait until it's finished and then go to File > Save Report.
    • Save the report to your Desktop.
    • Copy and paste the contents of the report into your next reply.
    -- Note: You may get this warning...just ignore it, click OK and continue: "Rootkit Unhooker has detected a parasite inside itself! It is recommended to remove parasite, okay? ".
     
    broni,
    #36
  18. 2011/04/28
    Supermaine

    Supermaine Inactive Thread Starter

    Joined:
    2010/06/08
    Messages:
    144
    Likes Received:
    0
    RkU Version: 3.8.388.590, Type LE (SR2)
    ==============================================
    OS Name: Windows XP
    Version 5.1.2600 (Service Pack 3)
    Number of processors #1
    ==============================================
    >Drivers
    ==============================================
    0xF6855000 C:\WINDOWS\system32\DRIVERS\nv4_mini.sys 6135808 bytes (NVIDIA Corporation, NVIDIA Compatible Windows 2000 Miniport Driver, Version 178.13 )
    0xBF012000 C:\WINDOWS\System32\nv4_disp.dll 6057984 bytes (NVIDIA Corporation, NVIDIA Compatible Windows 2000 Display driver, Version 178.13 )
    0xF6E76000 C:\WINDOWS\system32\drivers\ALCXWDM.SYS 2285568 bytes (Realtek Semiconductor Corp., Realtek AC'97 Audio Driver (WDM))
    0x804D7000 C:\WINDOWS\system32\ntoskrnl.exe 2192768 bytes (Microsoft Corporation, NT Kernel & System)
    0x804D7000 PnpManager 2192768 bytes
    0x804D7000 RAW 2192768 bytes
    0x804D7000 WMIxWDM 2192768 bytes
    0xBF800000 Win32k 1859584 bytes
    0xBF800000 C:\WINDOWS\System32\win32k.sys 1859584 bytes (Microsoft Corporation, Multi-User Win32 Driver)
    0xF73DB000 PCI_PNP7938 995328 bytes
    0xF73DB000 spfv.sys 995328 bytes
    0xF73DB000 sptd 995328 bytes
    0xF721F000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)
    0xF4347000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
    0xF66CE000 C:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)
    0xF451A000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)
    0xBA2B4000 C:\WINDOWS\system32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver)
    0xF4300000 C:\WINDOWS\System32\Drivers\aswSP.SYS 290816 bytes (AVAST Software, avast! self protection module)
    0xBF5D9000 C:\WINDOWS\System32\ATMFD.DLL 290816 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)
    0xB9E26000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)
    0xF4228000 C:\WINDOWS\system32\DRIVERS\rt73.sys 245760 bytes (Ralink Technology, Corp., Ralink 802.11 USB Wireless Adapter Driver)
    0xF6808000 C:\WINDOWS\System32\Drivers\atgo9jtf.SYS 233472 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)
    0xF7395000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)
    0xBA48B000 C:\WINDOWS\system32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
    0xF71F2000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)
    0xF7308000 dac2w2k.sys 180224 bytes (Mylex Corporation, Mylex Disk Array Controller Driver)
    0xF43B7000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
    0xF44A4000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)
    0xF44CC000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator)
    0xF4264000 C:\WINDOWS\System32\Drivers\Fastfat.SYS 147456 bytes (Microsoft Corporation, Fast FAT File System Driver)
    0xF6E52000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
    0xF70A4000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
    0xF6E2F000 C:\WINDOWS\system32\drivers\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)
    0xF4482000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
    0x806EF000 ACPI_HAL 131840 bytes
    0x806EF000 C:\WINDOWS\system32\hal.dll 131840 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
    0xF72E8000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
    0xF7365000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)
    0xF71D8000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)
    0xF7334000 adpu160m.sys 102400 bytes (Microsoft Corporation, Adaptec Ultra160 SCSI miniport)
    0xF734D000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)
    0xF4210000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes
    0xF73C3000 C:\WINDOWS\System32\Drivers\SCSIPORT.SYS 98304 bytes (Microsoft Corporation, SCSI Port Driver)
    0xBA44C000 C:\WINDOWS\System32\Drivers\aswMon2.SYS 94208 bytes (AVAST Software, avast! File System Filter Driver for Windows XP)
    0xF72BF000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
    0xF67DD000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
    0xBA1AF000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)
    0xF67F4000 C:\WINDOWS\system32\DRIVERS\parport.sys 81920 bytes (Microsoft Corporation, Parallel Port Driver)
    0xF6841000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)
    0xF4573000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)
    0xF72AC000 WudfPf.sys 77824 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Platform Driver)
    0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)
    0xF72D6000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)
    0xF7384000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
    0xF672C000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)
    0xBA151000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)
    0xF775F000 C:\WINDOWS\system32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
    0xF7170000 C:\WINDOWS\system32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver)
    0xF773F000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
    0xF7180000 C:\WINDOWS\system32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver)
    0xBA538000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)
    0xF763F000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)
    0xF754F000 aic78u2.sys 57344 bytes (Microsoft Corporation, Adaptec Ultra2 SCSI miniport)
    0xF751F000 aic78xx.sys 57344 bytes (Microsoft Corporation, Adaptec Ultra SCSI miniport)
    0xF7100000 C:\WINDOWS\system32\DRIVERS\cledx.sys 57344 bytes (Team H2O, Team H2O CLEDX DevWhore)
    0xF75AF000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)
    0xF7160000 C:\WINDOWS\system32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver)
    0xF7150000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
    0xF750F000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
    0xF772F000 C:\WINDOWS\system32\drivers\nvax.sys 49152 bytes (NVIDIA Corporation, NVIDIA® nForce(TM) MCP Audio Enumerator)
    0xF758F000 ql12160.sys 49152 bytes (QLogic Corporation, Miniport Driver for QLogic ISP PCI Adapters)
    0xF757F000 ql1280.sys 49152 bytes (QLogic Corporation, Miniport Driver for QLogic ISP PCI Adapters)
    0xF7130000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
    0xF75DF000 agp440.sys 45056 bytes (Microsoft Corporation, 440 NT AGP Filter)
    0xF760F000 agpCPQ.sys 45056 bytes (Microsoft Corporation, CompatNT AGP Filter)
    0xF75EF000 alim1541.sys 45056 bytes (Microsoft Corporation, ALi M1541 NT AGP Filter)
    0xF75FF000 amdagp.sys 45056 bytes (Advanced Micro Devices, Inc., AMD Win2000 AGP Filter)
    0xF768F000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)
    0xF774F000 C:\WINDOWS\system32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)
    0xF74FF000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)
    0xF7140000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
    0xF75CF000 viaagp.sys 45056 bytes (Microsoft Corporation, VIA NT AGP Filter)
    0xF771F000 C:\WINDOWS\system32\DRIVERS\amdk7.sys 40960 bytes (Microsoft Corporation, Processor Device Driver)
    0xF764F000 C:\WINDOWS\System32\Drivers\aswTdi.SYS 40960 bytes (AVAST Software, avast! TDI Filter Driver)
    0xF74EF000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver)
    0xF70F0000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)
    0xF756F000 ql1080.sys 40960 bytes (QLogic Corporation, Miniport Driver for QLogic ISP PCI Adapters)
    0xF753F000 ql1240.sys 40960 bytes (Microsoft Corporation, QLogic ISP PCI Adapters)
    0xF75BF000 sisagp.sys 40960 bytes (Silicon Integrated Systems Corporation, SiS NT AGP Filter)
    0xF7110000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)
    0xF759F000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)
    0xF76AF000 C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library)
    0xF7120000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)
    0xF766F000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)
    0xB9C7E000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver)
    0xF752F000 ql10wnt.sys 36864 bytes (Microsoft Corporation, Miniport Driver for QLogic ISP PCI Adapters)
    0xF755F000 ultra.sys 36864 bytes (Promise Technology, Inc., Promise Ultra66 Miniport Driver)
    0xF765F000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
    0xF7877000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)
    0xF779F000 symc8xx.sys 32768 bytes (LSI Logic, Symbios 8XX SCSI Miniport Driver)
    0xF77AF000 sym_u3.sys 32768 bytes (LSI Logic, Symbios Ultra3 SCSI Miniport Driver)
    0xF7847000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
    0xF7787000 asc.sys 28672 bytes (Advanced System Products, Inc., AdvanSys SCSI Controller Driver)
    0xF784F000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
    0xF77D7000 hpn.sys 28672 bytes (Microsoft Corporation, NetRAID-4M Miniport Driver)
    0xF776F000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
    0xF77CF000 perc2.sys 28672 bytes (Microsoft Corporation, PERC 2 Miniport Driver)
    0xF77A7000 sym_hi.sys 28672 bytes (LSI Logic, Symbios Hi-Perf SCSI Miniport Driver)
    0xF78C7000 C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 28672 bytes (Microsoft Corporation, USB Mass Storage Class Driver)
    0xF78B7000 C:\WINDOWS\System32\Drivers\Aavmker4.SYS 24576 bytes (AVAST Software, avast! Base Kernel-Mode Device Driver for Windows NT/2000/XP)
    0xF77B7000 ABP480N5.SYS 24576 bytes (Microsoft Corporation, AdvanSys SCSI Controller Driver)
    0xF77BF000 asc3350p.sys 24576 bytes (Microsoft Corporation, AdvanSys SCSI Card Driver)
    0xF78CF000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)
    0xF7807000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)
    0xF7857000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
    0xF788F000 C:\WINDOWS\System32\Drivers\aswRdr.SYS 20480 bytes (AVAST Software, avast! TDI RDR Driver)
    0xF77C7000 dpti2o.sys 20480 bytes (Microsoft Corporation, DPT SmartRAID miniport)
    0xF7797000 i2omp.sys 20480 bytes (Microsoft Corporation, I2O Miniport Driver)
    0xF778F000 mraid35x.sys 20480 bytes (American Megatrends Inc., MegaRAID RAID Controller Driver for Windows Whistler 32)
    0xF7867000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)
    0xF7777000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)
    0xF77EF000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)
    0xF77FF000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel(R) mini-port/call-manager driver)
    0xF777F000 sparrow.sys 20480 bytes (Adaptec, Inc., Adaptec AIC-6x60 series SCSI miniport)
    0xF78EF000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)
    0xF783F000 C:\WINDOWS\system32\DRIVERS\usbohci.sys 20480 bytes (Microsoft Corporation, OHCI USB Miniport Driver)
    0xF7817000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)
    0xF7907000 aha154x.sys 16384 bytes (Microsoft Corporation, Adaptec AHA-154x series SCSI miniport)
    0xF7917000 asc3550.sys 16384 bytes (Advanced System Products, Inc., AdvanSys Ultra-Wide PCI SCSI Driver)
    0xF791F000 cbidf2k.sys 16384 bytes (Microsoft Corporation, CardBus/PCMCIA IDE Miniport Driver)
    0xF7903000 cpqarray.sys 16384 bytes (Microsoft Corporation, Compaq Drive Array Controllers SCSI Miniport Driver)
    0xF790F000 dac960nt.sys 16384 bytes (Microsoft Corporation, Mylex Disk Array Controller Driver)
    0xF791B000 ini910u.sys 16384 bytes (Microsoft Corporation, INITIO ini910u SCSI miniport)
    0xF79E7000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)
    0xBA6D4000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)
    0xF79C7000 C:\WINDOWS\system32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator)
    0xF790B000 symc810.sys 16384 bytes (Symbios Logic Inc., Symbios Logic Inc. SCSI Miniport Driver)
    0xF7913000 amsint.sys 12288 bytes (Microsoft Corporation, AMD SCSI/NET Controller)
    0xF4512000 C:\WINDOWS\System32\Drivers\aswFsBlk.SYS 12288 bytes (AVAST Software, avast! File System Access Blocking Driver)
    0xF78FF000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)
    0xF450E000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)
    0xF66C6000 C:\WINDOWS\system32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)
    0xF70E0000 C:\WINDOWS\System32\Drivers\i2omgmt.SYS 12288 bytes (Microsoft Corporation, I2O Utility Filter)
    0xF70EC000 C:\WINDOWS\system32\DRIVERS\mouhid.sys 12288 bytes (Microsoft Corporation, HID Mouse Filter Driver)
    0xF79D3000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
    0xF70D0000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
    0xF79F3000 aliide.sys 8192 bytes (Acer Laboratories Inc., ALi mini IDE Driver)
    0xF7A19000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)
    0xF79FD000 cd20xrnt.sys 8192 bytes (Microsoft Corporation, IBM Portable CD-ROM Drive Miniport)
    0xF79F5000 cmdide.sys 8192 bytes (CMD Technology, Inc., CMD PCI IDE Bus Driver)
    0xF7A37000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes
    0xF7A15000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)
    0xF79FB000 intelide.sys 8192 bytes (Microsoft Corporation, Intel PCI IDE Driver)
    0xF79EF000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
    0xF7A1D000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)
    0xF79FF000 perc2hib.sys 8192 bytes (Microsoft Corporation, PERC 2 Hibernate Driver)
    0xF7A21000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)
    0xF7A0D000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
    0xF79F7000 toside.sys 8192 bytes (Microsoft Corporation, Toshiba PCI IDE Controller)
    0xF7A11000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
    0xF79F9000 viaide.sys 8192 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
    0xF79F1000 C:\WINDOWS\System32\Drivers\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
    0xF7C35000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)
    0xF7C45000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)
    0xF7B1B000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)
    0xF7AB7000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
    0x86F571F8 unknown_irp_handler 3592 bytes
    0x86A0E1F8 unknown_irp_handler 3592 bytes
    0x86F5D1F8 unknown_irp_handler 3592 bytes
    0x86F661F8 unknown_irp_handler 3592 bytes
    0x86F5A1F8 unknown_irp_handler 3592 bytes
    0x86F631F8 unknown_irp_handler 3592 bytes
    0x86FC71F8 unknown_irp_handler 3592 bytes
    0x86F651F8 unknown_irp_handler 3592 bytes
    0x86FCB1F8 unknown_irp_handler 3592 bytes
    0x86F5F1F8 unknown_irp_handler 3592 bytes
    0x86F641F8 unknown_irp_handler 3592 bytes
    0x86FCD1F8 unknown_irp_handler 3592 bytes
    0x86FCA1F8 unknown_irp_handler 3592 bytes
    0x86F621F8 unknown_irp_handler 3592 bytes
    0x86FD21F8 unknown_irp_handler 3592 bytes
    0x86F5E1F8 unknown_irp_handler 3592 bytes
    0x86F6A1F8 unknown_irp_handler 3592 bytes
    0x86FCC1F8 unknown_irp_handler 3592 bytes
    0x86F601F8 unknown_irp_handler 3592 bytes
    0x86FC81F8 unknown_irp_handler 3592 bytes
    0x86F5B1F8 unknown_irp_handler 3592 bytes
    0x86FD31F8 unknown_irp_handler 3592 bytes
    0x869C41F8 unknown_irp_handler 3592 bytes
    0x86FC61F8 unknown_irp_handler 3592 bytes
    0x86F671F8 unknown_irp_handler 3592 bytes
    0x86F591F8 unknown_irp_handler 3592 bytes
    0x86FD11F8 unknown_irp_handler 3592 bytes
    0x86EA71F8 unknown_irp_handler 3592 bytes
    0x86FCE1F8 unknown_irp_handler 3592 bytes
    0x86F681F8 unknown_irp_handler 3592 bytes
    0x86F611F8 unknown_irp_handler 3592 bytes
    0x86F5C1F8 unknown_irp_handler 3592 bytes
    0x86FD41F8 unknown_irp_handler 3592 bytes
    0x86FCF1F8 unknown_irp_handler 3592 bytes
    0x86FC91F8 unknown_irp_handler 3592 bytes
    0x86FD01F8 unknown_irp_handler 3592 bytes
    0x86FD51F8 unknown_irp_handler 3592 bytes
    0x86A171F8 unknown_irp_handler 3592 bytes
    0x8677D1F8 unknown_irp_handler 3592 bytes
    0x86EAB500 unknown_irp_handler 2816 bytes
    0x86E17500 unknown_irp_handler 2816 bytes
    0x86A10500 unknown_irp_handler 2816 bytes
    0x86EDE500 unknown_irp_handler 2816 bytes
    ==============================================
    >Stealth
    ==============================================
    WARNING: Virus alike driver modification [bthpan.sys]
    WARNING: Virus alike driver modification [sffp_mmc.sys]
    WARNING: Virus alike driver modification [hsfdpsp2.sys]
    WARNING: Virus alike driver modification [atinrvxx.sys]
    WARNING: Virus alike driver modification [mup.sys]
    WARNING: Virus alike driver modification [NdisIP.sys]
    WARNING: Virus alike driver modification [sffp_sd.sys]
    WARNING: Virus alike driver modification [SLIP.sys]
    WARNING: Virus alike driver modification [irenum.sys]
    WARNING: Virus alike driver modification [wadv08nt.sys]
    WARNING: Virus alike driver modification [ati1mdxx.sys]
    WARNING: Virus alike driver modification [acpiec.sys]
    WARNING: Virus alike driver modification [cpqdap01.sys]
    WARNING: Virus alike driver modification [wadv07nt.sys]
    WARNING: Virus alike driver modification [mdmxsdk.sys]
    WARNING: Virus alike driver modification [wadv09nt.sys]
    WARNING: Virus alike driver modification [sffdisk.sys]
    WARNING: Virus alike driver modification [wadv11nt.sys]
    WARNING: Virus alike driver modification [pcmcia.sys]
    WARNING: Virus alike driver modification [nikedrv.sys]
    WARNING: Virus alike driver modification [rio8drv.sys]
    WARNING: Virus alike driver modification [riodrv.sys]
    WARNING: Virus alike driver modification [ws2ifsl.sys]
    WARNING: Virus alike driver modification [tdpipe.sys]
    WARNING: Virus alike driver modification [ati1pdxx.sys]
    WARNING: Virus alike driver modification [fsvga.sys]
    WARNING: Virus alike driver modification [usbvideo.sys]
    WARNING: Virus alike driver modification [tunmp.sys]
    WARNING: Virus alike driver modification [nwlnkflt.sys]
    WARNING: Virus alike driver modification [mtlmnt5.sys]
    WARNING: Virus alike driver modification [mutohpen.sys]
    WARNING: Virus alike driver modification [usb8023.sys]
    WARNING: Virus alike driver modification [usb8023x.sys]
    WARNING: Virus alike driver modification [slnt7554.sys]
    WARNING: Virus alike driver modification [mtlstrm.sys]
    WARNING: Virus alike driver modification [slwdmsup.sys]
    WARNING: Virus alike driver modification [recagent.sys]
    WARNING: Virus alike driver modification [atinmdxx.sys]
    WARNING: Virus alike driver modification [atinttxx.sys]
    WARNING: Virus alike driver modification [rdpwd.sys]
    WARNING: Virus alike driver modification [diskdump.sys]
    WARNING: Virus alike driver modification [wacompen.sys]
    WARNING: Virus alike driver modification [asyncmac.sys]
    WARNING: Virus alike driver modification [atinpdxx.sys]
    WARNING: Virus alike driver modification [hdaudbus.sys]
    WARNING: Virus alike driver modification [smclib.sys]
    WARNING: Virus alike driver modification [tape.sys]
    WARNING: Virus alike driver modification [StreamIP.sys]
    WARNING: Virus alike driver modification [dmio.sys]
    WARNING: Virus alike driver modification [usbintel.sys]
    WARNING: Virus alike driver modification [s3gnbm.sys]
    WARNING: Virus alike driver modification [bthenum.sys]
    WARNING: Virus alike driver modification [CCDECODE.sys]
    WARNING: Virus alike driver modification [ntmtlfax.sys]
    WARNING: Virus alike driver modification [ndis.sys]
    WARNING: Virus alike driver modification [bthusb.sys]
    WARNING: Virus alike driver modification [hidir.sys]
    WARNING: Virus alike driver modification [WSTCODEC.SYS]
    WARNING: Virus alike driver modification [rdpdr.sys]
    WARNING: Virus alike driver modification [partmgr.sys]
    WARNING: Virus alike driver modification [mxnic.sys]
    WARNING: Virus alike driver modification [rmcast.sys]
    WARNING: Virus alike driver modification [flpydisk.sys]
    WARNING: Virus alike driver modification [secdrv.sys]
    WARNING: Virus alike driver modification [usbuhci.sys]
    WARNING: Virus alike driver modification [ipinip.sys]
    WARNING: Virus alike driver modification [ati1ttxx.sys]
    WARNING: Virus alike driver modification [tsbvcap.sys]
    WARNING: Virus alike driver modification [tdtcp.sys]
    WARNING: Virus alike driver modification [hsfbs2s2.sys]
    WARNING: Virus alike driver modification [watv06nt.sys]
    WARNING: Virus alike driver modification [pciidex.sys]
    WARNING: Virus alike driver modification [cinemst2.sys]
    WARNING: Virus alike driver modification [bthport.sys]
    WARNING: Virus alike driver modification [ati2mtaa.sys]
    WARNING: Virus alike driver modification [atmuni.sys]
    WARNING: Virus alike driver modification [nvapu.sys]
    WARNING: Virus alike driver modification [slntamr.sys]
    WARNING: Virus alike driver modification [mtxparhm.sys]
    WARNING: Virus alike driver modification [MSTEE.sys]
    WARNING: Virus alike driver modification [ntfs.sys]
    WARNING: Virus alike driver modification [dmload.sys]
    WARNING: Virus alike driver modification [rootmdm.sys]
    WARNING: Virus alike driver modification [smbali.sys]
    WARNING: Virus alike driver modification [arp1394.sys]
    WARNING: Virus alike driver modification [nic1394.sys]
    WARNING: File locked for read access [C:\WINDOWS\system32\drivers\sptd.sys]
    WARNING: Virus alike driver modification [nwlnknb.sys]
    WARNING: Virus alike driver modification [ati1rvxx.sys]
    WARNING: Virus alike driver modification [mf.sys]
    WARNING: Virus alike driver modification [udfs.sys]
    WARNING: Virus alike driver modification [nvarm.sys]
    WARNING: Virus alike driver modification [parvdm.sys]
    WARNING: Virus alike driver modification [hsfcxts2.sys]
    WARNING: Virus alike driver modification [ati2mtag.sys]
    WARNING: Virus alike driver modification [bridge.sys]
    WARNING: Virus alike driver modification [mskssrv.sys]
    WARNING: Virus alike driver modification [mcd.sys]
    WARNING: Virus alike driver modification [sdbus.sys]
    WARNING: Virus alike driver modification [dmboot.sys]
    WARNING: Virus alike driver modification [WudfRd.sys]
    WARNING: Virus alike driver modification [NABTSFEC.sys]
    WARNING: Virus alike driver modification [nwlnkipx.sys]
    WARNING: Virus alike driver modification [ksecdd.sys]
    WARNING: Virus alike driver modification [slnthal.sys]
    WARNING: Virus alike driver modification [nvmcp.sys]
    WARNING: Virus alike driver modification [scsiport.sys]
     
    Supermaine,
    #37
  19. 2011/04/28
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Download SUPERAntiSpyware Free for Home Users:
    http://www.superantispyware.com/


    • Double-click SUPERAntiSpyware.exe and use the default settings for installation.
    • An icon will be created on your desktop. Double-click that icon to launch the program.
    • If asked to update the program definitions, click "Yes ". If not, update the definitions before scanning by selecting "Check for Updates ". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
    • Close SUPERAntiSpyware.
    Restart computer in Safe Mode.
    To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; pick Safe Mode; you'll see "Safe Mode" in all four corners of your screen

    • Open SUPERAntiSpyware.
    • Under "Configuration and Preferences ", click the Preferences button.
    • Click the Scanning Control tab.
    • Under Scanner Options make sure the following are checked (leave all others unchecked):
      • Close browsers before scanning.
      • Terminate memory threats before quarantining.
    • Click the "Close" button to leave the control center screen.
    • Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
    • On the left, make sure you check C:\Fixed Drive.
    • On the right, under "Complete Scan ", choose Perform Complete Scan.
    • Click "Next" to start the scan. Please be patient while it scans your computer.
    • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK ".
    • Make sure everything has a checkmark next to it and click "Next ".
    • A notification will appear that "Quarantine and Removal is Complete ". Click "OK" and then click the "Finish" button to return to the main menu.
    • If asked if you want to reboot, click "Yes ".
    • To retrieve the removal information after reboot, launch SUPERAntispyware again.
      • Click Preferences, then click the Statistics/Logs tab.
      • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
      • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
      • Copy and paste the Scan Log results in your next reply.
    • Click Close to exit the program.

    Post SUPERAntiSpyware log.
     
    broni,
    #38
  20. 2011/04/28
    Supermaine

    Supermaine Inactive Thread Starter

    Joined:
    2010/06/08
    Messages:
    144
    Likes Received:
    0
    There were no harmful infections found. To post the log, I had to reboot out of Safe mode, and I booted back into normal mode. The system utility message didn't come up this time, and the computer isn't lagging like it was before. here's the log:

    SUPERAntiSpyware Scan Log
    http://www.superantispyware.com

    Generated 04/28/2011 at 09:10 PM

    Application Version : 4.51.1000

    Core Rules Database Version : 6950
    Trace Rules Database Version: 4762

    Scan type : Complete Scan
    Total Scan Time : 02:35:02

    Memory items scanned : 221
    Memory threats detected : 0
    Registry items scanned : 5496
    Registry threats detected : 0
    File items scanned : 64992
    File threats detected : 0
     
    Supermaine,
    #39
  21. 2011/04/28
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Very well :)

    Delete your Combofix file , download fresh one and post new log.
     
    broni,
    #40
Page 2 of 4

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...