[Resolved] #2 Google redirect , kills spybot, Malwarebytes, HJT

Hello, I was reading the "Google redirect malware, kills spybot, Malwarebytes, HJT, and super An" thread and i have the exact same problem. i was on mininova just browsing when macfee stoped a fake alert trojan, then SBSD gave a spoolsv.exe termintaed box and i selected "imform me again" then it started spamming the box so i selected "always kill" the box still kept spaming up , i ran a MBAM quick scan wich finish with finding problems, i couldnt read them because of the spamming boxs but i selected fix, and then it gave the needs to reboot to finish cleaning, so i did. after reboot MSN messenger crashed right off the bat, so i ran MBAM again, 5 seconds into the scan it crashed with no error and the program stoped working and gave the message "Windows canont access the specified device, path, or file. You may not have the appropriate permissions to access the item" same with SBSD and HJT. so i treid a system restore, it failed… i treid searching the web, and atfirst i couldnt get to any anti virus/malware pages or forums but now i dont seem to have the problem, i downloaded combo fix and ran that, it finished and rebooted, but the log file it created was called "Catchme.txt" and only had this line in it " File "C:\ComboFix\MT_netlogon.dll.tmp" added successfully", then i download avz and ran it, crashed like the other and now gives the same error….if anyone could help me out it would be greatly appreciated. To save time for you guys, i can just keep following the other post since my issue seems to mirror that one exactly, i can just post here if somthing pops up diffrent. your call Just some more info: been messing with HJT a lil while im waiting. i deleted HJT and reinstalled it, the exe was still broken, so i uninstalled it again and installed it to a diffret directory, changed the install path to C:\Program Files\TM\HJT, that fixed the exe and HJT launched, ran scan and again is ruined the exe, reinstalled again to the same altered directory and it worked again,tried changing the name of the exe to hjt.exe but still ruined the exe when scaned, still cant get a log file out of it, thought that lil bit of info might help.. Also: I can not delete the broken exe directly, says its write protected, however i can delte the folder it is in and the exe along with it. I just installed MBAM in a seprate folder and updated it just fine, im going to try a safemode scan now, will post results: No dice, even in safemode the scan for both HJT and MBAM break their respective exe's… back to waiting untill i get another stupid idea. ;P PLEASE DO NOT DO WHAT IM DOING, IM AN IDIOT AND VERY IMPAITIONT, WAIT FOR THE PRO'S TO HELP YOU, Im likly going to break somthing, it happens all the time,

[external image: Posted Image]

Hi Mike, welcome to the WTT Forums. My username is Raktor, and I would be glad to take a look at your log.
Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.
This may cause a delay, but I will do my best to keep it as short as possible.

I will be back to you shortly with instructions.

Hi rakor, and thanks happy to be a training dummy for you, its nice to have somewhere to turn when annoying things like this pop up. take your time, theres no hurry and the good news is i havnt broken anything yet other them some dead reg vaules.

[external image: Posted Image]

Hi, welcome to the WTT Forums. My username is Raktor, and I would be glad to take a look at your log. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

• I will be working on your malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for the issues on this machine.
• If you don't know or understand something, please don't hesitate to say or ask! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.
• Please do not use any tools such as Combofix, Vundofix, or HijackThis fixes without instruction to do so!
• Finally, stay with this topic until I give you the final 'All clear' post!

1) DDS
[external image: Posted Image]
Please download DDS and save it to your desktop from here or here or here.
Disable any script blocker, and then double click dds.scr to run the tool.

• When done, DDS will open two (2) logs:
  
  • DDS.txt
  • Attach.txt
• Save both reports to your desktop.

2) GMER
Please download GMER Rootkit Scanner from here or here.

• Extract the contents of the zipped file to desktop.
• Important: Rename GMER.exe to REMG.exe
• Double click REMG.exe. If asked to allow gmer.sys driver to load, please consent .
• If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
• In the right panel, you will see several boxes that have been checked. Uncheck the following …
  • Sections
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
• Save it where you can easily find it, such as your desktop, and put it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

3) What You Will Need To Post:

• DDS logs
• GMER log

Ok, one more scan.

Please download Sysprot Antirootkit from here

http://sites.google.com/site/sysprotantirootkit/

Unzip it into a folder on your desktop.

• Double click Sysprot.exe to start the program.
  
• Click on the Log tab.
• In the Write to log box select all items.
• Click on the Create Log button on the bottom right.
• After a few seconds a new window should appear.
• Select Scan Root Drive. Click on the Start button.
• When it is complete a new window will appear to indicate that the scan is finished.
• The log will be saved automatically in the same folder Sysprot.exe was extracted to.
  
• Open the text file and copy/paste the log here.

Also, please post the contents of C:\Combofix.txt in a separate post, if the file exists.

in the middle of the creatlog scan is gives me a warning message about drive a: is not ready door maybe open….i dont have a drive a:, at least dont know what it is, i have a cd/dvd combo D: and HD C:, E: is used for usb type drives , should i cancle, try again, or continue? also, as i said in OP, i ran combofix but the only file it created was "catchmE.txt", at that point i unistalled combofix with the /u cmd and started this post..combofix.txt was never made as far as i know

Continue.

SysProt AntiRootkit v1.0.1.0 by swatkat ******************************************************************************** ********** ******************************************************************************** ********** Process: Name: [System Idle Process] PID: 0 Hidden: No Window Visible: No Name: System PID: 4 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\smss.exe PID: 792 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\csrss.exe PID: 856 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\winlogon.exe PID: 892 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\services.exe PID: 936 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\lsass.exe PID: 948 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\ati2evxx.exe PID: 1120 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\svchost.exe PID: 1140 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\svchost.exe PID: 1208 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\svchost.exe PID: 1360 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\svchost.exe PID: 1480 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\svchost.exe PID: 1592 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\ati2evxx.exe PID: 1692 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\spoolsv.exe PID: 1804 Hidden: No Window Visible: No Name: C:\WINDOWS\explorer.exe PID: 232 Hidden: No Window Visible: No Name: C:\Program Files\Analog Devices\SoundMAX\SMax4.exe PID: 516 Hidden: No Window Visible: No Name: C:\Program Files\Analog Devices\Core\smax4pnp.exe PID: 524 Hidden: No Window Visible: No Name: C:\Program Files\Razer\DeathAdder\razerhid.exe PID: 536 Hidden: No Window Visible: No Name: C:\Program Files\McAfee.com\Agent\mcagent.exe PID: 544 Hidden: No Window Visible: No Name: C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe PID: 572 Hidden: No Window Visible: No Name: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe PID: 596 Hidden: No Window Visible: No Name: C:\Program Files\Windows Live\Messenger\msnmsgr.exe PID: 608 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\ctfmon.exe PID: 620 Hidden: No Window Visible: No Name: C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe PID: 628 Hidden: No Window Visible: No Name: C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe PID: 860 Hidden: No Window Visible: Yes Name: C:\WINDOWS\system32\svchost.exe PID: 1340 Hidden: No Window Visible: No Name: C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe PID: 1468 Hidden: No Window Visible: No Name: C:\PROGRA~1\COMMON~1\McAfee\MNA\McNASvc.exe PID: 1524 Hidden: No Window Visible: No Name: C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe PID: 1764 Hidden: No Window Visible: No Name: C:\Program Files\McAfee\VirusScan\Mcshield.exe PID: 1880 Hidden: No Window Visible: No Name: C:\Program Files\McAfee\MPF\MpfSrv.exe PID: 1992 Hidden: No Window Visible: No Name: C:\Program Files\Razer\DeathAdder\razerofa.exe PID: 2428 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\PnkBstrA.exe PID: 2976 Hidden: No Window Visible: No Name: C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe PID: 3016 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\alg.exe PID: 3908 Hidden: No Window Visible: No Name: C:\Program Files\Internet Explorer\iexplore.exe PID: 3788 Hidden: No Window Visible: No Name: C:\Program Files\Internet Explorer\iexplore.exe PID: 772 Hidden: No Window Visible: No Name: C:\Program Files\Razer\DeathAdder\razertra.exe PID: 2916 Hidden: No Window Visible: No Name: C:\Program Files\Internet Explorer\iexplore.exe PID: 3140 Hidden: No Window Visible: No Name: C:\Documents and Settings\Owner\Desktop\SysProt\SysProt.exe PID: 6824 Hidden: No Window Visible: Yes ******************************************************************************** ********** ******************************************************************************** ********** Kernel Modules: Module Name: \??\C:\Documents and Settings\Owner\Desktop\SysProt\SysProtDrv.sys Service Name: SysProtDrv.sys Module Base: A7E90000 Module End: A7E9B000 Hidden: No Module Name: \WINDOWS\system32\ntkrnlpa.exe Service Name: — Module Base: 804D7000 Module End: 806E4000 Hidden: No Module Name: \WINDOWS\system32\hal.dll Service Name: — Module Base: 806E4000 Module End: 80704D00 Hidden: No Module Name: \WINDOWS\system32\KDCOM.DLL Service Name: — Module Base: BA5A8000 Module End: BA5AA000 Hidden: No Module Name: \WINDOWS\system32\BOOTVID.dll Service Name: — Module Base: BA4B8000 Module End: BA4BB000 Hidden: No Module Name: spjo.sys Service Name: — Module Base: B9EA7000 Module End: B9FA7000 Hidden: Yes Module Name: \WINDOWS\System32\Drivers\WMILIB.SYS Service Name: — Module Base: BA5AA000 Module End: BA5AC000 Hidden: No Module Name: \WINDOWS\System32\Drivers\SCSIPORT.SYS Service Name: ScsiPort Module Base: B9E8F000 Module End: B9EA7000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\ACPI.sys Service Name: ACPI Module Base: B9E61000 Module End: B9E8F000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\pci.sys Service Name: PCI Module Base: B9E50000 Module End: B9E61000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\ohci1394.sys Service Name: ohci1394 Module Base: BA0A8000 Module End: BA0B8000 Hidden: No Module Name: \WINDOWS\System32\DRIVERS\1394BUS.SYS Service Name: — Module Base: BA0B8000 Module End: BA0C6000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\isapnp.sys Service Name: isapnp Module Base: BA0C8000 Module End: BA0D2000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\pciide.sys Service Name: PCIIde Module Base: BA670000 Module End: BA671000 Hidden: No Module Name: \WINDOWS\System32\DRIVERS\PCIIDEX.SYS Service Name: — Module Base: BA328000 Module End: BA32F000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\MountMgr.sys Service Name: MountMgr Module Base: BA0D8000 Module End: BA0E3000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\ftdisk.sys Service Name: Disk Module Base: B9E31000 Module End: B9E50000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\PartMgr.sys Service Name: PartMgr Module Base: BA330000 Module End: BA335000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\VolSnap.sys Service Name: VolSnap Module Base: BA0E8000 Module End: BA0F5000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\atapi.sys Service Name: atapi Module Base: B9E19000 Module End: B9E31000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\disk.sys Service Name: — Module Base: BA0F8000 Module End: BA101000 Hidden: No Module Name: \WINDOWS\System32\DRIVERS\CLASSPNP.SYS Service Name: — Module Base: BA108000 Module End: BA115000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\fltmgr.sys Service Name: FltMgr Module Base: B9DF9000 Module End: B9E19000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\sr.sys Service Name: sr Module Base: B9DE7000 Module End: B9DF9000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\Lbd.sys Service Name: Lbd Module Base: BA118000 Module End: BA127000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\KSecDD.sys Service Name: KSecDD Module Base: B9DD0000 Module End: B9DE7000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\Ntfs.sys Service Name: Ntfs Module Base: B9D43000 Module End: B9DD0000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\NDIS.sys Service Name: NDIS Module Base: B9D16000 Module End: B9D43000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\Mup.sys Service Name: Mup Module Base: B9CFC000 Module End: B9D16000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\intelppm.sys Service Name: intelppm Module Base: BA2A8000 Module End: BA2B1000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\ati2mtag.sys Service Name: ati2mtag Module Base: B88D2000 Module End: B8D04000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS Service Name: — Module Base: B88BE000 Module End: B88D2000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\HDAudBus.sys Service Name: HDAudBus Module Base: B8899000 Module End: B88BE000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\usbuhci.sys Service Name: usbuhci Module Base: BA3A0000 Module End: BA3A6000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\USBPORT.SYS Service Name: — Module Base: B8875000 Module End: B8899000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\usbehci.sys Service Name: usbehci Module Base: BA3A8000 Module End: BA3B0000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\yk51x86.sys Service Name: yukonwxp Module Base: B8838000 Module End: B8875000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\nic1394.sys Service Name: NIC1394 Module Base: B8D64000 Module End: B8D74000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\serial.sys Service Name: Serial Module Base: B8D54000 Module End: B8D64000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\serenum.sys Service Name: serenum Module Base: B9B90000 Module End: B9B94000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\fdc.sys Service Name: Fdc Module Base: BA3B0000 Module End: BA3B7000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\ASACPI.sys Service Name: MTsensor Module Base: BA604000 Module End: BA606000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\i8042prt.sys Service Name: i8042prt Module Base: B8D44000 Module End: B8D51000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\kbdclass.sys Service Name: Kbdclass Module Base: BA3B8000 Module End: BA3BE000 Hidden: No Module Name: C:\WINDOWS\System32\Drivers\kbdcap.SYS Service Name: kbdcap Module Base: B881D000 Module End: B8838000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\imapi.sys Service Name: Imapi Module Base: B8D34000 Module End: B8D3F000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\cdrom.sys Service Name: Cdrom Module Base: B8D24000 Module End: B8D34000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\redbook.sys Service Name: redbook Module Base: B8D14000 Module End: B8D23000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\ks.sys Service Name: — Module Base: B87FA000 Module End: B881D000 Hidden: No Module Name: \SystemRoot\System32\Drivers\ao6twrft.SYS Service Name: — Module Base: B87C3000 Module End: B87FA000 Hidden: Yes Module Name: C:\WINDOWS\System32\DRIVERS\audstub.sys Service Name: audstub Module Base: BA7CE000 Module End: BA7CF000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\rasl2tp.sys Service Name: Rasl2tp Module Base: B8D04000 Module End: B8D11000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\ndistapi.sys Service Name: NdisTapi Module Base: B92C6000 Module End: B92C9000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\ndiswan.sys Service Name: NdisWan Module Base: B87AC000 Module End: B87C3000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\raspppoe.sys Service Name: RasPppoe Module Base: BA2B8000 Module End: BA2C3000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\raspptp.sys Service Name: PptpMiniport Module Base: BA2C8000 Module End: BA2D4000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\TDI.SYS Service Name: — Module Base: BA420000 Module End: BA425000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\psched.sys Service Name: PSched Module Base: B879B000 Module End: B87AC000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\msgpc.sys Service Name: Gpc Module Base: BA2D8000 Module End: BA2E1000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\ptilink.sys Service Name: Ptilink Module Base: BA428000 Module End: BA42D000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\raspti.sys Service Name: Raspti Module Base: BA430000 Module End: BA435000 Hidden: No Module Name: C:\WINDOWS\System32\Drivers\pcouffin.sys Service Name: pcouffin Module Base: BA2E8000 Module End: BA2F4000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\termdd.sys Service Name: TermDD Module Base: BA2F8000 Module End: BA302000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\mouclass.sys Service Name: Mouclass Module Base: BA438000 Module End: BA43E000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\swenum.sys Service Name: swenum Module Base: BA60C000 Module End: BA60E000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\update.sys Service Name: Update Module Base: B873D000 Module End: B879B000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\mssmbios.sys Service Name: mssmbios Module Base: B92BA000 Module End: B92BE000 Hidden: No Module Name: C:\WINDOWS\System32\Drivers\NDProxy.SYS Service Name: NDProxy Module Base: BA1A8000 Module End: BA1B2000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\AtiHdmi.sys Service Name: AtiHdmiService Module Base: AC701000 Module End: AC71B000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\portcls.sys Service Name: — Module Base: AC6DD000 Module End: AC701000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\drmk.sys Service Name: — Module Base: B9926000 Module End: B9935000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\usbhub.sys Service Name: usbhub Module Base: B9916000 Module End: B9925000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\USBD.SYS Service Name: — Module Base: BA624000 Module End: BA626000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\ADIHdAud.sys Service Name: ADIHdAudAddService Module Base: AC691000 Module End: AC6DD000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\AEAudio.sys Service Name: AEAudio Module Base: AC67A000 Module End: AC691000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\adidts.sys Service Name: ADIDTSFiltService Module Base: AC657000 Module End: AC67A000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\flpydisk.sys Service Name: Flpydisk Module Base: BA498000 Module End: BA49D000 Hidden: No Module Name: C:\WINDOWS\System32\Drivers\Fs_Rec.SYS Service Name: Fs_Rec Module Base: BA5AC000 Module End: BA5AE000 Hidden: No Module Name: C:\WINDOWS\System32\Drivers\Null.SYS Service Name: Null Module Base: BA7F7000 Module End: BA7F8000 Hidden: No Module Name: C:\WINDOWS\System32\Drivers\Beep.SYS Service Name: Beep Module Base: BA5AE000 Module End: BA5B0000 Hidden: No Module Name: C:\WINDOWS\System32\drivers\vga.sys Service Name: VgaSave Module Base: BA4A8000 Module End: BA4AE000 Hidden: No Module Name: C:\WINDOWS\System32\Drivers\mnmdd.SYS Service Name: mnmdd Module Base: BA5B0000 Module End: BA5B2000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\RDPCDD.sys Service Name: RDPCDD Module Base: BA5B2000 Module End: BA5B4000 Hidden: No Module Name: C:\WINDOWS\System32\Drivers\Msfs.SYS Service Name: Msfs Module Base: BA4B0000 Module End: BA4B5000 Hidden: No Module Name: C:\WINDOWS\System32\Drivers\Npfs.SYS Service Name: Npfs Module Base: BA340000 Module End: BA348000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\rasacd.sys Service Name: RasAcd Module Base: B9B84000 Module End: B9B87000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\ipsec.sys Service Name: IPSec Module Base: AC5FC000 Module End: AC60F000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\tcpip.sys Service Name: Tcpip Module Base: AC5A3000 Module End: AC5FC000 Hidden: No Module Name: C:\WINDOWS\System32\Drivers\Mpfp.sys Service Name: MPFP Module Base: AC57C000 Module End: AC5A3000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\ipnat.sys Service Name: IpNat Module Base: AC556000 Module End: AC57C000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\wanarp.sys Service Name: Wanarp Module Base: BA1E8000 Module End: BA1F1000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\ipfltdrv.sys Service Name: IpFilterDriver Module Base: BA1F8000 Module End: BA201000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\netbt.sys Service Name: NetBT Module Base: AC52E000 Module End: AC556000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\arp1394.sys Service Name: Arp1394 Module Base: BA208000 Module End: BA217000 Hidden: No Module Name: C:\WINDOWS\System32\drivers\afd.sys Service Name: AFD Module Base: AC50C000 Module End: AC52E000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\netbios.sys Service Name: NetBIOS Module Base: BA218000 Module End: BA221000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\rdbss.sys Service Name: Rdbss Module Base: AC4E1000 Module End: AC50C000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\mrxsmb.sys Service Name: MRxSmb Module Base: AC471000 Module End: AC4E1000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Service Name: mfehidk Module Base: AC43E000 Module End: AC471000 Hidden: No Module Name: C:\WINDOWS\System32\Drivers\Fips.SYS Service Name: Fips Module Base: BA248000 Module End: BA253000 Hidden: No Module Name: \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys Service Name: eeCtrl Module Base: AC3DB000 Module End: AC43E000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\AsIO.sys Service Name: AsIO Module Base: BA5BE000 Module End: BA5C0000 Hidden: No Module Name: C:\WINDOWS\System32\Drivers\Cdfs.SYS Service Name: Cdfs Module Base: BA268000 Module End: BA278000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\dadder.sys Service Name: DAdderFltr Module Base: BA584000 Module End: BA587000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS Service Name: — Module Base: BA348000 Module End: BA34F000 Hidden: No Module Name: \SystemRoot\System32\Drivers\dump_atapi.sys Service Name: — Module Base: AC2FB000 Module End: AC313000 Hidden: Yes Module Name: \SystemRoot\System32\Drivers\dump_WMILIB.SYS Service Name: — Module Base: BA5C2000 Module End: BA5C4000 Hidden: Yes Module Name: C:\WINDOWS\System32\drivers\Dxapi.sys Service Name: — Module Base: B9CC8000 Module End: B9CCB000 Hidden: No Module Name: C:\WINDOWS\System32\watchdog.sys Service Name: — Module Base: BA390000 Module End: BA395000 Hidden: No Module Name: C:\WINDOWS\System32\drivers\dxgthk.sys Service Name: — Module Base: BA6A9000 Module End: BA6AA000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\atinavt2.sys Service Name: ATIAVAIW Module Base: AC298000 Module End: AC2C2000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\BdaSup.SYS Service Name: — Module Base: BA568000 Module End: BA56B000 Hidden: No Module Name: \systemroot\win32k.sys:1 Service Name: — Module Base: BA468000 Module End: BA46D000 Hidden: Yes Module Name: \systemroot\win32k.sys:2 Service Name: — Module Base: AC3BB000 Module End: AC3CA000 Hidden: Yes Module Name: C:\WINDOWS\System32\DRIVERS\ndisuio.sys Service Name: Ndisuio Module Base: A97A4000 Module End: A97A8000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\wdmaud.sys Service Name: wdmaud Module Base: A9513000 Module End: A9528000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\sysaudio.sys Service Name: sysaudio Module Base: A97F0000 Module End: A97FF000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\mrxdav.sys Service Name: MRxDAV Module Base: A8FF6000 Module End: A9023000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\srv.sys Service Name: Srv Module Base: A8EDC000 Module End: A8F2E000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\mfebopk.sys Service Name: mfebopk Module Base: BA380000 Module End: BA387000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\mfeavfk.sys Service Name: mfeavfk Module Base: A8AF8000 Module End: A8B0A000 Hidden: No Module Name: C:\WINDOWS\System32\Drivers\HTTP.sys Service Name: HTTP Module Base: A8837000 Module End: A8878000 Hidden: No Module Name: \??\C:\DOCUME~1\Owner\LOCALS~1\Temp\avyaaomn.sys Service Name: avyaaomn Module Base: A7957000 Module End: A796B000 Hidden: Yes Module Name: C:\WINDOWS\system32\DRIVERS\hidusb.sys Service Name: HidUsb Module Base: A810F000 Module End: A8112000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS Service Name: — Module Base: A7A36000 Module End: A7A3F000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\mouhid.sys Service Name: mouhid Module Base: A9157000 Module End: A915A000 Hidden: No ******************************************************************************** ********** ******************************************************************************** ********** SSDT: Function Name: ZwCreateKey Address: BA11887E Driver Base: BA118000 Driver End: BA127000 Driver Name: Lbd.sys Function Name: ZwEnumerateKey Address: B9EC6CA2 Driver Base: B9EA7000 Driver End: B9FA7000 Driver Name: spjo.sys Function Name: ZwEnumerateValueKey Address: B9EC7030 Driver Base: B9EA7000 Driver End: B9FA7000 Driver Name: spjo.sys Function Name: ZwOpenKey Address: B9EA80C0 Driver Base: B9EA7000 Driver End: B9FA7000 Driver Name: spjo.sys Function Name: ZwQueryKey Address: B9EC7108 Driver Base: B9EA7000 Driver End: B9FA7000 Driver Name: spjo.sys Function Name: ZwQueryValueKey Address: B9EC6F88 Driver Base: B9EA7000 Driver End: B9FA7000 Driver Name: spjo.sys Function Name: ZwSetValueKey Address: BA118BFE Driver Base: BA118000 Driver End: BA127000 Driver Name: Lbd.sys ******************************************************************************** ********** ******************************************************************************** ********** Kernel Hooks: Hooked Function: ZwYieldExecution At Address: 80504AE8 Jump To: AC457518 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwUnmapViewOfSection At Address: 805B2E14 Jump To: AC457544 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwTerminateProcess At Address: 805D29AA Jump To: AC45755D Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwSetInformationProcess At Address: 805CDE52 Jump To: AC4574C6 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwSetContextThread At Address: 805D1702 Jump To: AC4574DA Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwProtectVirtualMemory At Address: 805B83E6 Jump To: AC457502 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwOpenThread At Address: 805CB694 Jump To: AC457488 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwOpenProcess At Address: 805CB408 Jump To: AC457474 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwMapViewOfSection At Address: 805B2006 Jump To: AC45752E Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwCreateProcessEx At Address: 805D1142 Jump To: AC4574B0 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwCreateProcess At Address: 805D11F8 Jump To: AC45749C Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: ZwCreateFile At Address: 80579084 Jump To: AC4574EE Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: PsCreateSystemThread At Address: 805D1142 Jump To: AC4574B0 Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys Hooked Function: PsCreateSystemProcess At Address: 805D11F8 Jump To: AC45749C Module Name: C:\WINDOWS\system32\drivers\mfehidk.sys ******************************************************************************** ********** ******************************************************************************** ********** IRP Hooks: Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_CREATE Jump To: B9EA8000 Hooking Module: spjo.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_CREATE_NAMED_PIPE Jump To: B9EA8000 Hooking Module: spjo.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_CLOSE Jump To: B9EA8000 Hooking Module: spjo.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_READ Jump To: B9EA8000 Hooking Module: spjo.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_WRITE Jump To: B9EA8000 Hooking Module: spjo.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_QUERY_INFORMATION Jump To: B9EA8000 Hooking Module: spjo.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_SET_INFORMATION Jump To: B9EA8000 Hooking Module: spjo.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_QUERY_EA Jump To: B9EA8000 Hooking Module: spjo.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_SET_EA Jump To: B9EA8000 Hooking Module: spjo.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_FLUSH_BUFFERS Jump To: B9EA8000 Hooking Module: spjo.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_QUERY_VOLUME_INFORMATION Jump To: B9EA8000 Hooking Module: spjo.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_SET_VOLUME_INFORMATION Jump To: B9EA8000 Hooking Module: spjo.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_DIRECTORY_CONTROL Jump To: B9EA8000 Hooking Module: spjo.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_FILE_SYSTEM_CONTROL Jump To: B9EA8000 Hooking Module: spjo.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_DEVICE_CONTROL Jump To: B9EA8000 Hooking Module: spjo.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL Jump To: B9EA8000 Hooking Module: spjo.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_SHUTDOWN Jump To: B9EA8000 Hooking Module: spjo.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_LOCK_CONTROL Jump To: B9EA8000 Hooking Module: spjo.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_CLEANUP Jump To: B9EA8000 Hooking Module: spjo.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_CREATE_MAILSLOT Jump To: B9EA8000 Hooking Module: spjo.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_QUERY_SECURITY Jump To: B9EA8000 Hooking Module: spjo.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_SET_SECURITY Jump To: B9EA8000 Hooking Module: spjo.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_POWER Jump To: B9EA8000 Hooking Module: spjo.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_SYSTEM_CONTROL Jump To: B9EA8000 Hooking Module: spjo.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_DEVICE_CHANGE Jump To: B9EA8000 Hooking Module: spjo.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_QUERY_QUOTA Jump To: B9EA8000 Hooking Module: spjo.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_SET_QUOTA Jump To: B9EA8000 Hooking Module: spjo.sys Hooked Module: C:\WINDOWS\System32\DRIVERS\usbuhci.sys Hooked IRP: IRP_MJ_CREATE Jump To: 8A1D7500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\System32\DRIVERS\usbuhci.sys Hooked IRP: IRP_MJ_CLOSE Jump To: 8A1D7500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\System32\DRIVERS\usbuhci.sys Hooked IRP: IRP_MJ_DEVICE_CONTROL Jump To: 8A1D7500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\System32\DRIVERS\usbuhci.sys Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL Jump To: 8A1D7500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\System32\DRIVERS\usbuhci.sys Hooked IRP: IRP_MJ_POWER Jump To: 8A1D7500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\System32\DRIVERS\usbuhci.sys Hooked IRP: IRP_MJ_SYSTEM_CONTROL Jump To: 8A1D7500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\drivers\ftdisk.sys Hooked IRP: IRP_MJ_CREATE Jump To: 8A6E41F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\drivers\ftdisk.sys Hooked IRP: IRP_MJ_READ Jump To: 8A6E41F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\drivers\ftdisk.sys Hooked IRP: IRP_MJ_WRITE Jump To: 8A6E41F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\drivers\ftdisk.sys Hooked IRP: IRP_MJ_FLUSH_BUFFERS Jump To: 8A6E41F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\drivers\ftdisk.sys Hooked IRP: IRP_MJ_DEVICE_CONTROL Jump To: 8A6E41F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\drivers\ftdisk.sys Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL Jump To: 8A6E41F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\drivers\ftdisk.sys Hooked IRP: IRP_MJ_SHUTDOWN Jump To: 8A6E41F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\drivers\ftdisk.sys Hooked IRP: IRP_MJ_CLEANUP Jump To: 8A6E41F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\drivers\ftdisk.sys Hooked IRP: IRP_MJ_POWER Jump To: 8A6E41F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\drivers\ftdisk.sys Hooked IRP: IRP_MJ_SYSTEM_CONTROL Jump To: 8A6E41F8 Hooking Module: _unknown_ Hooked Module: \SystemRoot\System32\Drivers\ao6twrft.SYS Hooked IRP: IRP_MJ_CREATE Jump To: 8A25D500 Hooking Module: _unknown_ Hooked Module: \SystemRoot\System32\Drivers\ao6twrft.SYS Hooked IRP: IRP_MJ_CLOSE Jump To: 8A25D500 Hooking Module: _unknown_ Hooked Module: \SystemRoot\System32\Drivers\ao6twrft.SYS Hooked IRP: IRP_MJ_DEVICE_CONTROL Jump To: 8A25D500 Hooking Module: _unknown_ Hooked Module: \SystemRoot\System32\Drivers\ao6twrft.SYS Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL Jump To: 8A25D500 Hooking Module: _unknown_ Hooked Module: \SystemRoot\System32\Drivers\ao6twrft.SYS Hooked IRP: IRP_MJ_POWER Jump To: 8A25D500 Hooking Module: _unknown_ Hooked Module: \SystemRoot\System32\Drivers\ao6twrft.SYS Hooked IRP: IRP_MJ_SYSTEM_CONTROL Jump To: 8A25D500 Hooking Module: _unknown_ Hooked Module: \Driver\PCI_PNP6028 Hooked IRP: IRP_MJ_CREATE Jump To: B9EEBB1C Hooking Module: spjo.sys Hooked Module: \Driver\PCI_PNP6028 Hooked IRP: IRP_MJ_CREATE_NAMED_PIPE Jump To: B9EEBB1C Hooking Module: spjo.sys Hooked Module: \Driver\PCI_PNP6028 Hooked IRP: IRP_MJ_CLOSE Jump To: B9EEBB1C Hooking Module: spjo.sys Hooked Module: \Driver\PCI_PNP6028 Hooked IRP: IRP_MJ_READ Jump To: B9EEBB1C Hooking Module: spjo.sys Hooked Module: \Driver\PCI_PNP6028 Hooked IRP: IRP_MJ_WRITE Jump To: B9EEBB1C Hooking Module: spjo.sys Hooked Module: \Driver\PCI_PNP6028 Hooked IRP: IRP_MJ_QUERY_INFORMATION Jump To: B9EEBB1C Hooking Module: spjo.sys Hooked Module: \Driver\PCI_PNP6028 Hooked IRP: IRP_MJ_SET_INFORMATION Jump To: B9EEBB1C Hooking Module: spjo.sys Hooked Module: \Driver\PCI_PNP6028 Hooked IRP: IRP_MJ_QUERY_EA Jump To: B9EEBB1C Hooking Module: spjo.sys Hooked Module: \Driver\PCI_PNP6028 Hooked IRP: IRP_MJ_SET_EA Jump To: B9EEBB1C Hooking Module: spjo.sys Hooked Module: \Driver\PCI_PNP6028 Hooked IRP: IRP_MJ_FLUSH_BUFFERS Jump To: B9EEBB1C Hooking Module: spjo.sys Hooked Module: \Driver\PCI_PNP6028 Hooked IRP: IRP_MJ_QUERY_VOLUME_INFORMATION Jump To: B9EEBB1C Hooking Module: spjo.sys Hooked Module: \Driver\PCI_PNP6028 Hooked IRP: IRP_MJ_SET_VOLUME_INFORMATION Jump To: B9EEBB1C Hooking Module: spjo.sys Hooked Module: \Driver\PCI_PNP6028 Hooked IRP: IRP_MJ_DIRECTORY_CONTROL Jump To: B9EEBB1C Hooking Module: spjo.sys Hooked Module: \Driver\PCI_PNP6028 Hooked IRP: IRP_MJ_FILE_SYSTEM_CONTROL Jump To: B9EEBB1C Hooking Module: spjo.sys Hooked Module: \Driver\PCI_PNP6028 Hooked IRP: IRP_MJ_DEVICE_CONTROL Jump To: B9EEBB1C Hooking Module: spjo.sys Hooked Module: \Driver\PCI_PNP6028 Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL Jump To: B9EEBB1C Hooking Module: spjo.sys Hooked Module: \Driver\PCI_PNP6028 Hooked IRP: IRP_MJ_SHUTDOWN Jump To: B9EEBB1C Hooking Module: spjo.sys Hooked Module: \Driver\PCI_PNP6028 Hooked IRP: IRP_MJ_LOCK_CONTROL Jump To: B9EEBB1C Hooking Module: spjo.sys Hooked Module: \Driver\PCI_PNP6028 Hooked IRP: IRP_MJ_CLEANUP Jump To: B9EEBB1C Hooking Module: spjo.sys Hooked Module: \Driver\PCI_PNP6028 Hooked IRP: IRP_MJ_CREATE_MAILSLOT Jump To: B9EEBB1C Hooking Module: spjo.sys Hooked Module: \Driver\PCI_PNP6028 Hooked IRP: IRP_MJ_QUERY_SECURITY Jump To: B9EEBB1C Hooking Module: spjo.sys Hooked Module: \Driver\PCI_PNP6028 Hooked IRP: IRP_MJ_SET_SECURITY Jump To: B9EEBB1C Hooking Module: spjo.sys Hooked Module: \Driver\PCI_PNP6028 Hooked IRP: IRP_MJ_POWER Jump To: B9EAFE1C Hooking Module: spjo.sys Hooked Module: \Driver\PCI_PNP6028 Hooked IRP: IRP_MJ_SYSTEM_CONTROL Jump To: B9EC4514 Hooking Module: spjo.sys Hooked Module: \Driver\PCI_PNP6028 Hooked IRP: IRP_MJ_DEVICE_CHANGE Jump To: B9EEBB1C Hooking Module: spjo.sys Hooked Module: \Driver\PCI_PNP6028 Hooked IRP: IRP_MJ_QUERY_QUOTA Jump To: B9EEBB1C Hooking Module: spjo.sys Hooked Module: \Driver\PCI_PNP6028 Hooked IRP: IRP_MJ_SET_QUOTA Jump To: B9EEBB1C Hooking Module: spjo.sys Hooked Module: C:\WINDOWS\System32\DRIVERS\netbt.sys Hooked IRP: IRP_MJ_CREATE Jump To: 8A373500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\System32\DRIVERS\netbt.sys Hooked IRP: IRP_MJ_CLOSE Jump To: 8A373500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\System32\DRIVERS\netbt.sys Hooked IRP: IRP_MJ_DEVICE_CONTROL Jump To: 8A373500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\System32\DRIVERS\netbt.sys Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL Jump To: 8A373500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\System32\DRIVERS\netbt.sys Hooked IRP: IRP_MJ_CLEANUP Jump To: 8A373500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\System32\DRIVERS\cdrom.sys Hooked IRP: IRP_MJ_CREATE Jump To: 8A265500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\System32\DRIVERS\cdrom.sys Hooked IRP: IRP_MJ_CLOSE Jump To: 8A265500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\System32\DRIVERS\cdrom.sys Hooked IRP: IRP_MJ_READ Jump To: 8A265500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\System32\DRIVERS\cdrom.sys Hooked IRP: IRP_MJ_WRITE Jump To: 8A265500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\System32\DRIVERS\cdrom.sys Hooked IRP: IRP_MJ_FLUSH_BUFFERS Jump To: 8A265500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\System32\DRIVERS\cdrom.sys Hooked IRP: IRP_MJ_DEVICE_CONTROL Jump To: 8A265500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\System32\DRIVERS\cdrom.sys Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL Jump To: 8A265500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\System32\DRIVERS\cdrom.sys Hooked IRP: IRP_MJ_SHUTDOWN Jump To: 8A265500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\System32\DRIVERS\cdrom.sys Hooked IRP: IRP_MJ_POWER Jump To: 8A265500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\System32\DRIVERS\cdrom.sys Hooked IRP: IRP_MJ_SYSTEM_CONTROL Jump To: 8A265500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\System32\DRIVERS\usbehci.sys Hooked IRP: IRP_MJ_CREATE Jump To: 8A1B1500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\System32\DRIVERS\usbehci.sys Hooked IRP: IRP_MJ_CLOSE Jump To: 8A1B1500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\System32\DRIVERS\usbehci.sys Hooked IRP: IRP_MJ_DEVICE_CONTROL Jump To: 8A1B1500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\System32\DRIVERS\usbehci.sys Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL Jump To: 8A1B1500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\System32\DRIVERS\usbehci.sys Hooked IRP: IRP_MJ_POWER Jump To: 8A1B1500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\System32\DRIVERS\usbehci.sys Hooked IRP: IRP_MJ_SYSTEM_CONTROL Jump To: 8A1B1500 Hooking Module: _unknown_ ******************************************************************************** ********** ******************************************************************************** ********** Ports: Local Address: BRYAN-2L2U6K2N1:1027 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\WINDOWS\system32\alg.exe State: LISTENING Local Address: BRYAN-2L2U6K2N1.SD.COX.NET:3144 Remote Address: IY-IN-F113.GOOGLE.COM:HTTP Type: TCP Process: C:\Program Files\Internet Explorer\iexplore.exe State: ESTABLISHED Local Address: BRYAN-2L2U6K2N1.SD.COX.NET:3143 Remote Address: IP70-167-151-181.AT.AT.COX.NET:HTTP Type: TCP Process: C:\Program Files\Internet Explorer\iexplore.exe State: ESTABLISHED Local Address: BRYAN-2L2U6K2N1.SD.COX.NET:3142 Remote Address: WINDOWSLIVETRANSLATOR.COM:HTTP Type: TCP Process: C:\Program Files\Internet Explorer\iexplore.exe State: ESTABLISHED Local Address: BRYAN-2L2U6K2N1.SD.COX.NET:3130 Remote Address: CF-IN-F154.GOOGLE.COM:HTTP Type: TCP Process: C:\Program Files\Internet Explorer\iexplore.exe State: ESTABLISHED Local Address: BRYAN-2L2U6K2N1.SD.COX.NET:3127 Remote Address: 67.228.244.251:HTTP Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: BRYAN-2L2U6K2N1.SD.COX.NET:3126 Remote Address: [removed]:HTTP Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: BRYAN-2L2U6K2N1.SD.COX.NET:3125 Remote Address: CF-IN-F167.GOOGLE.COM:HTTP Type: TCP Process: C:\Program Files\Internet Explorer\iexplore.exe State: ESTABLISHED Local Address: BRYAN-2L2U6K2N1.SD.COX.NET:NETBIOS-SSN Remote Address: 0.0.0.0:0 Type: TCP Process: System State: LISTENING Local Address: BRYAN-2L2U6K2N1:6646 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\PROGRA~1\COMMON~1\McAfee\MNA\McNASvc.exe State: LISTENING Local Address: BRYAN-2L2U6K2N1:MICROSOFT-DS Remote Address: 0.0.0.0:0 Type: TCP Process: System State: LISTENING Local Address: BRYAN-2L2U6K2N1:EPMAP Remote Address: 0.0.0.0:0 Type: TCP Process: C:\WINDOWS\system32\svchost.exe State: LISTENING Local Address: BRYAN-2L2U6K2N1:44301 Remote Address: NA Type: UDP Process: C:\WINDOWS\system32\PnkBstrA.exe State: NA Local Address: BRYAN-2L2U6K2N1:2623 Remote Address: NA Type: UDP Process: C:\Program Files\Internet Explorer\iexplore.exe State: NA Local Address: BRYAN-2L2U6K2N1:2098 Remote Address: NA Type: UDP Process: C:\Program Files\Internet Explorer\iexplore.exe State: NA Local Address: BRYAN-2L2U6K2N1:1900 Remote Address: NA Type: UDP Process: C:\WINDOWS\system32\svchost.exe State: NA Local Address: BRYAN-2L2U6K2N1:1113 Remote Address: NA Type: UDP Process: C:\Program Files\Internet Explorer\iexplore.exe State: NA Local Address: BRYAN-2L2U6K2N1:1032 Remote Address: NA Type: UDP Process: C:\Program Files\Windows Live\Messenger\msnmsgr.exe State: NA Local Address: BRYAN-2L2U6K2N1:123 Remote Address: NA Type: UDP Process: C:\WINDOWS\system32\svchost.exe State: NA Local Address: BRYAN-2L2U6K2N1.SD.COX.NET:6646 Remote Address: NA Type: UDP Process: C:\PROGRA~1\COMMON~1\McAfee\MNA\McNASvc.exe State: NA Local Address: BRYAN-2L2U6K2N1.SD.COX.NET:1900 Remote Address: NA Type: UDP Process: C:\WINDOWS\system32\svchost.exe State: NA Local Address: BRYAN-2L2U6K2N1.SD.COX.NET:138 Remote Address: NA Type: UDP Process: System State: NA Local Address: BRYAN-2L2U6K2N1.SD.COX.NET:NETBIOS-NS Remote Address: NA Type: UDP Process: System State: NA Local Address: BRYAN-2L2U6K2N1.SD.COX.NET:123 Remote Address: NA Type: UDP Process: C:\WINDOWS\system32\svchost.exe State: NA Local Address: BRYAN-2L2U6K2N1:4500 Remote Address: NA Type: UDP Process: C:\WINDOWS\system32\lsass.exe State: NA Local Address: BRYAN-2L2U6K2N1:500 Remote Address: NA Type: UDP Process: C:\WINDOWS\system32\lsass.exe State: NA Local Address: BRYAN-2L2U6K2N1:MICROSOFT-DS Remote Address: NA Type: UDP Process: System State: NA ******************************************************************************** ********** ******************************************************************************** ********** Hidden files/folders: Object: C:\Documents and Settings\Owner\Application Data\SecuROM\UserData\???????????p????????? Status: Hidden Object: C:\Documents and Settings\Owner\Application Data\SecuROM\UserData\???????????p????????? Status: Hidden Object: C:\Documents and Settings\Owner\Desktop\sort later\sort later\music\Alice_In_Chains-Discography-(21CD)-h8me\Alice_In_Chains-Dirt-(Special_Limited_Edition)-(2CD)-1992-h8me\Alice_In_Chains-Dirt-(Special_Limited_Edition)-(Disc_1)-1992-h8me\01-alice_in_chains Status: Hidden Object: C:\Documents and Settings\Owner\Desktop\sort later\sort later\music\Alice_In_Chains-Discography-(21CD)-h8me\Alice_In_Chains-Dirt-(Special_Limited_Edition)-(2CD)-1992-h8me\Alice_In_Chains-Dirt-(Special_Limited_Edition)-(Disc_1)-1992-h8me\02-alice_in_chains Status: Hidden Object: C:\Documents and Settings\Owner\Desktop\sort later\sort later\music\Alice_In_Chains-Discography-(21CD)-h8me\Alice_In_Chains-Dirt-(Special_Limited_Edition)-(2CD)-1992-h8me\Alice_In_Chains-Dirt-(Special_Limited_Edition)-(Disc_1)-1992-h8me\03-alice_in_chains Status: Hidden Object: C:\Documents and Settings\Owner\Desktop\sort later\sort later\music\Alice_In_Chains-Discography-(21CD)-h8me\Alice_In_Chains-Dirt-(Special_Limited_Edition)-(2CD)-1992-h8me\Alice_In_Chains-Dirt-(Special_Limited_Edition)-(Disc_1)-1992-h8me\04-alice_in_chains Status: Hidden Object: C:\Documents and Settings\Owner\Desktop\sort later\sort later\music\Alice_In_Chains-Discography-(21CD)-h8me\Alice_In_Chains-Dirt-(Special_Limited_Edition)-(2CD)-1992-h8me\Alice_In_Chains-Dirt-(Special_Limited_Edition)-(Disc_1)-1992-h8me\05-alice_in_chains Status: Hidden Object: C:\Documents and Settings\Owner\Desktop\sort later\sort later\music\Alice_In_Chains-Discography-(21CD)-h8me\Alice_In_Chains-Dirt-(Special_Limited_Edition)-(2CD)-1992-h8me\Alice_In_Chains-Dirt-(Special_Limited_Edition)-(Disc_1)-1992-h8me\06-alice_in_chains Status: Hidden Object: C:\Documents and Settings\Owner\Desktop\sort later\sort later\music\Alice_In_Chains-Discography-(21CD)-h8me\Alice_In_Chains-Dirt-(Special_Limited_Edition)-(2CD)-1992-h8me\Alice_In_Chains-Dirt-(Special_Limited_Edition)-(Disc_1)-1992-h8me\07-alice_in_chains Status: Hidden Object: C:\Documents and Settings\Owner\Desktop\sort later\sort later\music\Alice_In_Chains-Discography-(21CD)-h8me\Alice_In_Chains-Dirt-(Special_Limited_Edition)-(2CD)-1992-h8me\Alice_In_Chains-Dirt-(Special_Limited_Edition)-(Disc_1)-1992-h8me\08-alice_in_chains Status: Hidden Object: C:\Documents and Settings\Owner\Desktop\sort later\sort later\music\Alice_In_Chains-Discography-(21CD)-h8me\Alice_In_Chains-Dirt-(Special_Limited_Edition)-(2CD)-1992-h8me\Alice_In_Chains-Dirt-(Special_Limited_Edition)-(Disc_1)-1992-h8me\09-alice_in_chains Status: Hidden Object: C:\Documents and Settings\Owner\Desktop\sort later\sort later\music\Alice_In_Chains-Discography-(21CD)-h8me\Alice_In_Chains-Dirt-(Special_Limited_Edition)-(2CD)-1992-h8me\Alice_In_Chains-Dirt-(Special_Limited_Edition)-(Disc_1)-1992-h8me\10-alice_in_chains Status: Hidden Object: C:\Documents and Settings\Owner\Desktop\sort later\sort later\music\Alice_In_Chains-Discography-(21CD)-h8me\Alice_In_Chains-Dirt-(Special_Limited_Edition)-(2CD)-1992-h8me\Alice_In_Chains-Dirt-(Special_Limited_Edition)-(Disc_1)-1992-h8me\11-alice_in_chains Status: Hidden Object: C:\Documents and Settings\Owner\Desktop\sort later\sort later\music\Alice_In_Chains-Discography-(21CD)-h8me\Alice_In_Chains-Dirt-(Special_Limited_Edition)-(2CD)-1992-h8me\Alice_In_Chains-Dirt-(Special_Limited_Edition)-(Disc_1)-1992-h8me\12-alice_in_chains Status: Hidden Object: C:\Documents and Settings\Owner\Desktop\sort later\sort later\music\Alice_In_Chains-Discography-(21CD)-h8me\Alice_In_Chains-Dirt-(Special_Limited_Edition)-(2CD)-1992-h8me\Alice_In_Chains-Dirt-(Special_Limited_Edition)-(Disc_1)-1992-h8me\13-alice_in_chains Status: Hidden Object: C:\Documents and Settings\Owner\Desktop\sort later\sort later\music\Alice_In_Chains-Discography-(21CD)-h8me\Alice_In_Chains-Dirt-(Special_Limited_Edition)-(2CD)-1992-h8me\Alice_In_Chains-Dirt-(Special_Limited_Edition)-(Disc_2)-1992-h8me\01-down_in_a_hole_ Status: Hidden Object: C:\Documents and Settings\Owner\Desktop\sort later\sort later\music\Alice_In_Chains-Discography-(21CD)-h8me\Alice_In_Chains-Dirt-(Special_Limited_Edition)-(2CD)-1992-h8me\Alice_In_Chains-Dirt-(Special_Limited_Edition)-(Disc_2)-1992-h8me\02-down_in_a_hole_ Status: Hidden Object: C:\Documents and Settings\Owner\Desktop\sort later\sort later\music\Alice_In_Chains-Discography-(21CD)-h8me\Alice_In_Chains-Dirt-(Special_Limited_Edition)-(2CD)-1992-h8me\Alice_In_Chains-Dirt-(Special_Limited_Edition)-(Disc_2)-1992-h8me\03-what_the_hell_h Status: Hidden Object: C:\Documents and Settings\Owner\Desktop\sort later\sort later\music\Alice_In_Chains-Discography-(21CD)-h8me\Alice_In_Chains-Music_Bank_Boxset-(3CD)-1999-h8me\Alice_In_Chains-Music_Bank_Boxset-(Disc_1)-1999-h8me\02-alice_in_chains-i_can't_have_you_blues_(u Status: Hidden Object: C:\Documents and Settings\Owner\Desktop\sort later\sort later\music\Alice_In_Chains-Discography-(21CD)-h8me\Alice_In_Chains-Music_Bank_Boxset-(3CD)-1999-h8me\Alice_In_Chains-Music_Bank_Boxset-(Disc_1)-1999-h8me\03-alice_in_chains-whatcha_gonna_do_(unrelea Status: Hidden Object: C:\Documents and Settings\Owner\Desktop\sort later\sort later\music\Alice_In_Chains-Discography-(21CD)-h8me\Alice_In_Chains-Music_Bank_Boxset-(3CD)-1999-h8me\Alice_In_Chains-Music_Bank_Boxset-(Disc_1)-1999-h8me\04-alice_in_chains-social_parasite_(unreleas Status: Hidden Object: C:\Documents and Settings\Owner\Desktop\sort later\sort later\music\Alice_In_Chains-Discography-(21CD)-h8me\Alice_In_Chains-Music_Bank_Boxset-(3CD)-1999-h8me\Alice_In_Chains-Music_Bank_Boxset-(Disc_1)-1999-h8me\05-alice_in_chains-queen_of_the_rodeo_(unrel Status: Hidden Object: C:\Documents and Settings\Owner\Desktop\sort later\sort later\music\Alice_In_Chains-Discography-(21CD)-h8me\Alice_In_Chains-Music_Bank_Boxset-(3CD)-1999-h8me\Alice_In_Chains-Music_Bank_Boxset-(Disc_1)-1999-h8me\06-alice_in_chains-bleed_the_freak_(unreleas Status: Hidden Object: C:\Documents and Settings\Owner\Desktop\sort later\sort later\music\Alice_In_Chains-Discography-(21CD)-h8me\Alice_In_Chains-Music_Bank_Boxset-(3CD)-1999-h8me\Alice_In_Chains-Music_Bank_Boxset-(Disc_1)-1999-h8me\07-alice_in_chains-killing_yourself_(unrelea Status: Hidden Object: C:\Documents and Settings\Owner\Desktop\sort later\sort later\music\Alice_In_Chains-Discography-(21CD)-h8me\Alice_In_Chains-Music_Bank_Boxset-(3CD)-1999-h8me\Alice_In_Chains-Music_Bank_Boxset-(Disc_1)-1999-h8me\10-alice_in_chains-sea_of_sorrow_(unreleased Status: Hidden Object: C:\Documents and Settings\Owner\Desktop\sort later\sort later\music\Alice_In_Chains-Discography-(21CD)-h8me\Alice_In_Chains-Music_Bank_Boxset-(3CD)-1999-h8me\Alice_In_Chains-Music_Bank_Boxset-(Disc_1)-1999-h8me\15-alice_in_chains-rooster_(unreleased_demo) Status: Hidden Object: C:\Documents and Settings\Owner\Desktop\sort later\sort later\music\Alice_In_Chains-Discography-(21CD)-h8me\Alice_In_Chains-Music_Bank_Boxset-(3CD)-1999-h8me\Alice_In_Chains-Music_Bank_Boxset-(Disc_2)-1999-h8me\02-alice_in_chains-fear_the_voices_(unreleas Status: Hidden Object: C:\Documents and Settings\Owner\Desktop\sort later\sort later\music\Alice_In_Chains-Discography-(21CD)-h8me\Alice_In_Chains-Music_Bank_Boxset-(3CD)-1999-h8me\Alice_In_Chains-Music_Bank_Boxset-(Disc_2)-1999-h8me\07-alice_in_chains-junkhead_(unreleased_demo Status: Hidden Object: C:\Documents and Settings\Owner\Desktop\sort later\sort later\music\Alice_In_Chains-Discography-(21CD)-h8me\Alice_In_Chains-Music_Bank_Boxset-(3CD)-1999-h8me\Alice_In_Chains-Music_Bank_Boxset-(Disc_2)-1999-h8me\12-alice_in_chains-lying_season_(unreleased) Status: Hidden Object: C:\Documents and Settings\Owner\Desktop\sort later\sort later\music\Alice_In_Chains-Discography-(21CD)-h8me\Alice_In_Chains-Music_Bank_Boxset-(3CD)-1999-h8me\Alice_In_Chains-Music_Bank_Boxset-(Disc_3)-1999-h8me\03-alice_in_chains-what_the_hell_have_i_(rem Status: Hidden Object: C:\Documents and Settings\Owner\Desktop\sort later\sort later\music\Alice_In_Chains-Discography-(21CD)-h8me\Alice_In_Chains-Music_Bank_Boxset-(3CD)-1999-h8me\Alice_In_Chains-Music_Bank_Boxset-(Disc_3)-1999-h8me\04-alice_in_chains-a_little_bitter_(remix_un Status: Hidden Object: C:\Documents and Settings\Owner\Desktop\sort later\sort later\music\Alice_In_Chains-Discography-(21CD)-h8me\Alice_In_Chains-Music_Bank_Boxset-(3CD)-1999-h8me\Alice_In_Chains-Music_Bank_Boxset-(Disc_3)-1999-h8me\06-alice_in_chains-again_(tattoo_of_pain_mix Status: Hidden Object: C:\Documents and Settings\Owner\Desktop\sort later\sort later\music\Alice_In_Chains-Discography-(21CD)-h8me\Alice_In_Chains-Music_Bank_Boxset-(3CD)-1999-h8me\Alice_In_Chains-Music_Bank_Boxset-(Disc_3)-1999-h8me\12-alice_in_chains-the_killer_is_me_(unplugg Status: Hidden Object: C:\System Volume Information\MountPointManagerRemoteDatabase Status: Access denied Object: C:\System Volume Information\tracking.log Status: Access denied Object: C:\System Volume Information\_restore{1AE56DBC-CDC0-4FF4-8DBE-EC77ABEDB578} Status: Access denied

Also, please post the contents of C:\Combofix.txt in a separate post, if the file exists.

How are you going with this? Did you find the file?

Ya i posted right above the last log , file dosnt exist, combofix made a file called catchme.txt, after that i accepted that this problem wasnt gona be fixed by me alone so i uninstalled CB with the /u cmd and not doing anything else with out you telling me too in all fairness i kind of tricked you with the CB log comment, i think i used the edit button after you read it already, just as im doing here …i like edit buttons…..its a problem i know….

Yes, I missed the edit. I don't get notifications when you edit, only when you reply, so try not to do that so I don't miss anything. Make sure you disable McAfee and Spybot's TeaTimer before running CF - see How to Disable your Security Programs.

Please read through the instructions to familiarize yourself with what to expect when the tool runs.

Please delete your existing copy of ComboFix, then download Combofix from either of the links below, and save it to your desktop.
You must rename it before saving it. Save it as Combo-Fix.exe.

[external image: Posted Image]

Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link:How to Disable your Security Programs
  
• Double click on Combo-Fix.exe & follow the prompts. Close all browsers/windows first.
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

It finished but did not create a log, it only made this log again "catchme.txt" and one single line in it, it did creat a folder "C:\Combofix\" wich is empty….ill do a full system search for combofx.txt incase it went somewhere else for a strange reason… File "C:\Combo-Fix\MT_netlogon.dll.tmp" added successfully