14:59:52:687 4008 TDSS rootkit removing tool 2.2.8 Mar 10 2010 15:53:20 14:59:52:687 4008 ================================================================================ 14:59:52:687 4008 SystemInfo: 14:59:52:687 4008 OS Version: 5.1.2600 ServicePack: 3.0 14:59:52:687 4008 Product type: Workstation 14:59:52:687 4008 ComputerName: NOPE 14:59:52:687 4008 UserName: Tom Ryan 14:59:52:687 4008 Windows directory: C:\WINDOWS 14:59:52:687 4008 Processor architecture: Intel x86 14:59:52:687 4008 Number of processors: 1 14:59:52:687 4008 Page size: 0x1000 14:59:52:687 4008 Boot type: Normal boot 14:59:52:687 4008 ================================================================================ 14:59:52:697 4008 UnloadDriverW: NtUnloadDriver error 1 14:59:52:697 4008 ForceUnloadDriverW: UnloadDriverW(klmd21) error 1 14:59:52:707 4008 LoadDriverW: Driver already loaded 14:59:52:707 4008 KLMD_DropNLoadW: LoadDriverW(klmd21) error 1056 14:59:52:707 4008 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\system 14:59:52:707 4008 wfopen_ex: MyNtCreateFileW error 32 (C0000043) 14:59:52:707 4008 wfopen_ex: Trying to KLMD file open 14:59:52:707 4008 wfopen_ex: File opened ok (Flags 2) 14:59:52:707 4008 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\software 14:59:52:707 4008 wfopen_ex: MyNtCreateFileW error 32 (C0000043) 14:59:52:707 4008 wfopen_ex: Trying to KLMD file open 14:59:52:707 4008 wfopen_ex: File opened ok (Flags 2) 14:59:52:707 4008 Initialize success 14:59:52:707 4008 14:59:52:707 4008 Scanning Services ... 14:59:53:047 4008 GetAdvancedServicesInfo: Raw services enum returned 311 services 14:59:53:057 4008 14:59:53:057 4008 Scanning Kernel memory ... 14:59:53:057 4008 Devices to scan: 4 14:59:53:057 4008 14:59:53:057 4008 Driver Name: Disk 14:59:53:057 4008 IRP_MJ_CREATE : F76B5BB0 14:59:53:057 4008 IRP_MJ_CREATE_NAMED_PIPE : 804FA87E 14:59:53:057 4008 IRP_MJ_CLOSE : F76B5BB0 14:59:53:057 4008 IRP_MJ_READ : F76AFD1F 14:59:53:057 4008 IRP_MJ_WRITE : F76AFD1F 14:59:53:057 4008 IRP_MJ_QUERY_INFORMATION : 804FA87E 14:59:53:057 4008 IRP_MJ_SET_INFORMATION : 804FA87E 14:59:53:057 4008 IRP_MJ_QUERY_EA : 804FA87E 14:59:53:057 4008 IRP_MJ_SET_EA : 804FA87E 14:59:53:057 4008 IRP_MJ_FLUSH_BUFFERS : F76B02E2 14:59:53:057 4008 IRP_MJ_QUERY_VOLUME_INFORMATION : 804FA87E 14:59:53:057 4008 IRP_MJ_SET_VOLUME_INFORMATION : 804FA87E 14:59:53:057 4008 IRP_MJ_DIRECTORY_CONTROL : 804FA87E 14:59:53:057 4008 IRP_MJ_FILE_SYSTEM_CONTROL : 804FA87E 14:59:53:057 4008 IRP_MJ_DEVICE_CONTROL : F76B03BB 14:59:53:057 4008 IRP_MJ_INTERNAL_DEVICE_CONTROL : F76B3F28 14:59:53:057 4008 IRP_MJ_SHUTDOWN : F76B02E2 14:59:53:057 4008 IRP_MJ_LOCK_CONTROL : 804FA87E 14:59:53:057 4008 IRP_MJ_CLEANUP : 804FA87E 14:59:53:057 4008 IRP_MJ_CREATE_MAILSLOT : 804FA87E 14:59:53:057 4008 IRP_MJ_QUERY_SECURITY : 804FA87E 14:59:53:057 4008 IRP_MJ_SET_SECURITY : 804FA87E 14:59:53:057 4008 IRP_MJ_POWER : F76B1C82 14:59:53:057 4008 IRP_MJ_SYSTEM_CONTROL : F76B699E 14:59:53:057 4008 IRP_MJ_DEVICE_CHANGE : 804FA87E 14:59:53:057 4008 IRP_MJ_QUERY_QUOTA : 804FA87E 14:59:53:057 4008 IRP_MJ_SET_QUOTA : 804FA87E 14:59:53:077 4008 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1 14:59:53:077 4008 14:59:53:087 4008 Driver Name: Disk 14:59:53:087 4008 IRP_MJ_CREATE : F76B5BB0 14:59:53:087 4008 IRP_MJ_CREATE_NAMED_PIPE : 804FA87E 14:59:53:087 4008 IRP_MJ_CLOSE : F76B5BB0 14:59:53:087 4008 IRP_MJ_READ : F76AFD1F 14:59:53:087 4008 IRP_MJ_WRITE : F76AFD1F 14:59:53:087 4008 IRP_MJ_QUERY_INFORMATION : 804FA87E 14:59:53:087 4008 IRP_MJ_SET_INFORMATION : 804FA87E 14:59:53:087 4008 IRP_MJ_QUERY_EA : 804FA87E 14:59:53:087 4008 IRP_MJ_SET_EA : 804FA87E 14:59:53:087 4008 IRP_MJ_FLUSH_BUFFERS : F76B02E2 14:59:53:087 4008 IRP_MJ_QUERY_VOLUME_INFORMATION : 804FA87E 14:59:53:087 4008 IRP_MJ_SET_VOLUME_INFORMATION : 804FA87E 14:59:53:087 4008 IRP_MJ_DIRECTORY_CONTROL : 804FA87E 14:59:53:087 4008 IRP_MJ_FILE_SYSTEM_CONTROL : 804FA87E 14:59:53:087 4008 IRP_MJ_DEVICE_CONTROL : F76B03BB 14:59:53:087 4008 IRP_MJ_INTERNAL_DEVICE_CONTROL : F76B3F28 14:59:53:087 4008 IRP_MJ_SHUTDOWN : F76B02E2 14:59:53:087 4008 IRP_MJ_LOCK_CONTROL : 804FA87E 14:59:53:087 4008 IRP_MJ_CLEANUP : 804FA87E 14:59:53:087 4008 IRP_MJ_CREATE_MAILSLOT : 804FA87E 14:59:53:087 4008 IRP_MJ_QUERY_SECURITY : 804FA87E 14:59:53:087 4008 IRP_MJ_SET_SECURITY : 804FA87E 14:59:53:087 4008 IRP_MJ_POWER : F76B1C82 14:59:53:087 4008 IRP_MJ_SYSTEM_CONTROL : F76B699E 14:59:53:087 4008 IRP_MJ_DEVICE_CHANGE : 804FA87E 14:59:53:087 4008 IRP_MJ_QUERY_QUOTA : 804FA87E 14:59:53:087 4008 IRP_MJ_SET_QUOTA : 804FA87E 14:59:53:087 4008 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1 14:59:53:087 4008 14:59:53:087 4008 Driver Name: atapi 14:59:53:087 4008 IRP_MJ_CREATE : F75E26F2 14:59:53:087 4008 IRP_MJ_CREATE_NAMED_PIPE : 804FA87E 14:59:53:087 4008 IRP_MJ_CLOSE : F75E26F2 14:59:53:087 4008 IRP_MJ_READ : 804FA87E 14:59:53:087 4008 IRP_MJ_WRITE : 804FA87E 14:59:53:087 4008 IRP_MJ_QUERY_INFORMATION : 804FA87E 14:59:53:087 4008 IRP_MJ_SET_INFORMATION : 804FA87E 14:59:53:087 4008 IRP_MJ_QUERY_EA : 804FA87E 14:59:53:087 4008 IRP_MJ_SET_EA : 804FA87E 14:59:53:087 4008 IRP_MJ_FLUSH_BUFFERS : 804FA87E 14:59:53:087 4008 IRP_MJ_QUERY_VOLUME_INFORMATION : 804FA87E 14:59:53:087 4008 IRP_MJ_SET_VOLUME_INFORMATION : 804FA87E 14:59:53:087 4008 IRP_MJ_DIRECTORY_CONTROL : 804FA87E 14:59:53:087 4008 IRP_MJ_FILE_SYSTEM_CONTROL : 804FA87E 14:59:53:087 4008 IRP_MJ_DEVICE_CONTROL : F75E2712 14:59:53:087 4008 IRP_MJ_INTERNAL_DEVICE_CONTROL : F75DE852 14:59:53:087 4008 IRP_MJ_SHUTDOWN : 804FA87E 14:59:53:087 4008 IRP_MJ_LOCK_CONTROL : 804FA87E 14:59:53:087 4008 IRP_MJ_CLEANUP : 804FA87E 14:59:53:087 4008 IRP_MJ_CREATE_MAILSLOT : 804FA87E 14:59:53:087 4008 IRP_MJ_QUERY_SECURITY : 804FA87E 14:59:53:087 4008 IRP_MJ_SET_SECURITY : 804FA87E 14:59:53:087 4008 IRP_MJ_POWER : F75E273C 14:59:53:087 4008 IRP_MJ_SYSTEM_CONTROL : F75E9336 14:59:53:087 4008 IRP_MJ_DEVICE_CHANGE : 804FA87E 14:59:53:087 4008 IRP_MJ_QUERY_QUOTA : 804FA87E 14:59:53:087 4008 IRP_MJ_SET_QUOTA : 804FA87E 14:59:53:087 4008 C:\WINDOWS\system32\drivers\tskA.tmp - Verdict: 3 14:59:53:087 4008 14:59:53:087 4008 Driver Name: atapi 14:59:53:087 4008 IRP_MJ_CREATE : 83AE8CA1 14:59:53:087 4008 IRP_MJ_CREATE_NAMED_PIPE : 83AE8CA1 14:59:53:087 4008 IRP_MJ_CLOSE : 83AE8CA1 14:59:53:087 4008 IRP_MJ_READ : 83AE8CA1 14:59:53:087 4008 IRP_MJ_WRITE : 83AE8CA1 14:59:53:087 4008 IRP_MJ_QUERY_INFORMATION : 83AE8CA1 14:59:53:087 4008 IRP_MJ_SET_INFORMATION : 83AE8CA1 14:59:53:087 4008 IRP_MJ_QUERY_EA : 83AE8CA1 14:59:53:087 4008 IRP_MJ_SET_EA : 83AE8CA1 14:59:53:087 4008 IRP_MJ_FLUSH_BUFFERS : 83AE8CA1 14:59:53:087 4008 IRP_MJ_QUERY_VOLUME_INFORMATION : 83AE8CA1 14:59:53:087 4008 IRP_MJ_SET_VOLUME_INFORMATION : 83AE8CA1 14:59:53:087 4008 IRP_MJ_DIRECTORY_CONTROL : 83AE8CA1 14:59:53:087 4008 IRP_MJ_FILE_SYSTEM_CONTROL : 83AE8CA1 14:59:53:087 4008 IRP_MJ_DEVICE_CONTROL : 83AE8CA1 14:59:53:087 4008 IRP_MJ_INTERNAL_DEVICE_CONTROL : 83AE8CA1 14:59:53:087 4008 IRP_MJ_SHUTDOWN : 83AE8CA1 14:59:53:087 4008 IRP_MJ_LOCK_CONTROL : 83AE8CA1 14:59:53:087 4008 IRP_MJ_CLEANUP : 83AE8CA1 14:59:53:087 4008 IRP_MJ_CREATE_MAILSLOT : 83AE8CA1 14:59:53:087 4008 IRP_MJ_QUERY_SECURITY : 83AE8CA1 14:59:53:087 4008 IRP_MJ_SET_SECURITY : 83AE8CA1 14:59:53:087 4008 IRP_MJ_POWER : 83AE8CA1 14:59:53:087 4008 IRP_MJ_SYSTEM_CONTROL : 83AE8CA1 14:59:53:087 4008 IRP_MJ_DEVICE_CHANGE : 83AE8CA1 14:59:53:087 4008 IRP_MJ_QUERY_QUOTA : 83AE8CA1 14:59:53:087 4008 IRP_MJ_SET_QUOTA : 83AE8CA1 14:59:53:087 4008 Driver "atapi" infected by TDSS rootkit! 14:59:53:087 4008 C:\WINDOWS\system32\drivers\tskA.tmp - Verdict: 3 14:59:53:087 4008 14:59:53:087 4008 Completed 14:59:53:087 4008 14:59:53:087 4008 Results: 14:59:53:087 4008 Memory objects infected / cured / cured on reboot: 1 / 0 / 0 14:59:53:087 4008 Registry objects infected / cured / cured on reboot: 0 / 0 / 0 14:59:53:087 4008 File objects infected / cured / cured on reboot: 0 / 0 / 0 14:59:53:097 4008 14:59:53:097 4008 fclose_ex: Trying to close file C:\WINDOWS\system32\config\system 14:59:53:097 4008 fclose_ex: Trying to close file C:\WINDOWS\system32\config\software 14:59:53:097 4008 UnloadDriverW: NtUnloadDriver error 1 14:59:53:097 4008 KLMD_Unload: UnloadDriverW(klmd21) error 1 14:59:53:097 4008 KLMD(ARK) unloaded successfully