What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Google Search Redirects, Clickover.cn, etc...

44 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16 last edited
Hi,

Please do the following:


  • Go to Start->Run and type in notepad and hit OK.
  • Then copy and paste the content of the following codebox into Notepad:

    @ECHO OFF
(
PEV -tf %systemroot%\System32\geyekr* DEL /A/F/S/Q %systemroot%\System32\geyekr*
ECHO.
ECHO.—AFTER—-
ECHO.
PEV -tf %systemroot%\System32\geyekr* )>Logit.txt
Start Logit.txt
SC DELETE geyekrflnqlsuo
del %0
  • Save the file to your DESKTOP as "fix.bat". Make sure to save it with the quotes.
  • Once saved, the icon to click should look like this on your desktop:

    [external image: Posted Image]
  • Double click fix.bat. to run it. A small black box should open and close - this is normal.

Please post the results of Logit.txt


NEXT

  • Please run GMER once again, using these instructions.
  • Double click GMER.exe.
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO, then proceed as indicated below to set it up for a more complete scan.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • Sections
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #17
From the .bat file —AFTER—- C:\WINDOWS\System32\geyekrlog.dat C:\WINDOWS\System32\geyekrnqndekri.dat C:\WINDOWS\System32\geyekrsijtewtm.dll C:\WINDOWS\System32\geyekrvhxbqpxu.dll

Attachments:

Post #19
New SysProt log SysProt AntiRootkit v1.0.1.0 by swatkat ******************************************************************************** ********** ******************************************************************************** ********** Process: Name: [System Idle Process] PID: 0 Hidden: No Window Visible: No Name: System PID: 4 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\smss.exe PID: 916 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\csrss.exe PID: 1024 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\winlogon.exe PID: 1060 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\services.exe PID: 1108 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\lsass.exe PID: 1120 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\svchost.exe PID: 1272 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\svchost.exe PID: 1360 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\svchost.exe PID: 1400 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\svchost.exe PID: 1436 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\svchost.exe PID: 1684 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\svchost.exe PID: 1828 Hidden: No Window Visible: No Name: C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe PID: 232 Hidden: No Window Visible: No Name: C:\Program Files\Alwil Software\Avast4\ashServ.exe PID: 288 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\spoolsv.exe PID: 1972 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\svchost.exe PID: 508 Hidden: No Window Visible: No Name: C:\WINDOWS\ehome\ehrecvr.exe PID: 580 Hidden: No Window Visible: No Name: C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe PID: 664 Hidden: No Window Visible: No Name: C:\WINDOWS\ehome\ehSched.exe PID: 668 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\ctfmon.exe PID: 692 Hidden: No Window Visible: No Name: C:\Program Files\Java\jre6\bin\jqs.exe PID: 788 Hidden: No Window Visible: No Name: C:\Program Files\Common Files\LightScribe\LSSrvc.exe PID: 768 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\svchost.exe PID: 964 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\svchost.exe PID: 976 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\MsPMSPSv.exe PID: 1900 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\searchindexer.exe PID: 2088 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\dllhost.exe PID: 3192 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\wbem\wmiapsrv.exe PID: 3296 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\alg.exe PID: 3564 Hidden: No Window Visible: No Name: C:\WINDOWS\system32\wscntfy.exe PID: 3176 Hidden: No Window Visible: No Name: C:\WINDOWS\explorer.exe PID: 2472 Hidden: No Window Visible: No Name: C:\Documents and Settings\FatalPlus\Desktop\SysProt\SysProt.exe PID: 3716 Hidden: No Window Visible: Yes ******************************************************************************** ********** ******************************************************************************** ********** Kernel Modules: Module Name: \systemroot\system32\drivers\geyekrmnukcigp.sys Service Name: geyekrflnqlsuo Module Base: — Module End: — Hidden: Yes Module Name: \??\C:\Documents and Settings\FatalPlus\Desktop\SysProt\SysProtDrv.sys Service Name: SysProtDrv.sys Module Base: F6C78000 Module End: F6C83000 Hidden: No Module Name: \WINDOWS\system32\ntkrnlpa.exe Service Name: — Module Base: 804D7000 Module End: 806CF680 Hidden: No Module Name: \WINDOWS\system32\hal.dll Service Name: — Module Base: 806D0000 Module End: 806F0300 Hidden: No Module Name: \WINDOWS\system32\KDCOM.DLL Service Name: — Module Base: F7A92000 Module End: F7A94000 Hidden: No Module Name: \WINDOWS\system32\BOOTVID.dll Service Name: — Module Base: F79A2000 Module End: F79A5000 Hidden: No Module Name: speb.sys Service Name: — Module Base: F7390000 Module End: F7491000 Hidden: Yes Module Name: \WINDOWS\System32\Drivers\WMILIB.SYS Service Name: — Module Base: F7A94000 Module End: F7A96000 Hidden: No Module Name: \WINDOWS\System32\Drivers\SCSIPORT.SYS Service Name: ScsiPort Module Base: F7378000 Module End: F7390000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\ACPI.sys Service Name: ACPI Module Base: F734A000 Module End: F7378000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\isapnp.sys Service Name: isapnp Module Base: F7592000 Module End: F759C000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\pci.sys Service Name: PCI Module Base: F7339000 Module End: F734A000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\compbatt.sys Service Name: Compbatt Module Base: F79A6000 Module End: F79A9000 Hidden: No Module Name: \WINDOWS\system32\DRIVERS\BATTC.SYS Service Name: BattC Module Base: F79AA000 Module End: F79AE000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\pciide.sys Service Name: PCIIde Module Base: F7B5A000 Module End: F7B5B000 Hidden: No Module Name: \WINDOWS\system32\DRIVERS\PCIIDEX.SYS Service Name: — Module Base: F7812000 Module End: F7819000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\intelide.sys Service Name: IntelIde Module Base: F7A96000 Module End: F7A98000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\viaide.sys Service Name: ViaIde Module Base: F7A98000 Module End: F7A9A000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\aliide.sys Service Name: AliIde Module Base: F7A9A000 Module End: F7A9C000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\pcmcia.sys Service Name: Pcmcia Module Base: F731B000 Module End: F7339000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\MountMgr.sys Service Name: MountMgr Module Base: F75A2000 Module End: F75AD000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\ftdisk.sys Service Name: Disk Module Base: F72FC000 Module End: F731B000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\dmload.sys Service Name: dmload Module Base: F7A9C000 Module End: F7A9E000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\dmio.sys Service Name: dmio Module Base: F72D6000 Module End: F72FC000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\ACPIEC.sys Service Name: ACPIEC Module Base: F79AE000 Module End: F79B1000 Hidden: No Module Name: \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS Service Name: — Module Base: F7B5B000 Module End: F7B5C000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\PartMgr.sys Service Name: PartMgr Module Base: F781A000 Module End: F781F000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\VolSnap.sys Service Name: VolSnap Module Base: F75B2000 Module End: F75BF000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\atapi.sys Service Name: atapi Module Base: F72BE000 Module End: F72D6000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\disk.sys Service Name: — Module Base: F75C2000 Module End: F75CB000 Hidden: No Module Name: \WINDOWS\system32\DRIVERS\CLASSPNP.SYS Service Name: — Module Base: F75D2000 Module End: F75DF000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\fltmgr.sys Service Name: FltMgr Module Base: F729E000 Module End: F72BE000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\sr.sys Service Name: sr Module Base: F728C000 Module End: F729E000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\PxHelp20.sys Service Name: PxHelp20 Module Base: F75E2000 Module End: F75EC000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\KSecDD.sys Service Name: KSecDD Module Base: F7275000 Module End: F728C000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\WudfPf.sys Service Name: WudfPf Module Base: F7262000 Module End: F7275000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\Ntfs.sys Service Name: Ntfs Module Base: F71D5000 Module End: F7262000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\NDIS.sys Service Name: NDIS Module Base: F71A8000 Module End: F71D5000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\Serial.sys Service Name: Serial Module Base: F75F2000 Module End: F7602000 Hidden: No Module Name: Combo-Fix.sys Service Name: — Module Base: F7602000 Module End: F7611000 Hidden: Yes Module Name: C:\WINDOWS\system32\drivers\ohci1394.sys Service Name: ohci1394 Module Base: F7612000 Module End: F7622000 Hidden: No Module Name: \WINDOWS\system32\DRIVERS\1394BUS.SYS Service Name: — Module Base: F7622000 Module End: F7630000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\Mup.sys Service Name: Mup Module Base: F718E000 Module End: F71A8000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\nic1394.sys Service Name: NIC1394 Module Base: F7642000 Module End: F7652000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\AmdK8.sys Service Name: AmdK8 Module Base: F7662000 Module End: F7670000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\wmiacpi.sys Service Name: WmiAcpi Module Base: F7159000 Module End: F715C000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\ati2mtag.sys Service Name: ati2mtag Module Base: F66A7000 Module End: F6992000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS Service Name: — Module Base: F6693000 Module End: F66A7000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\usbohci.sys Service Name: usbohci Module Base: F792A000 Module End: F792F000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\USBPORT.SYS Service Name: — Module Base: F666F000 Module End: F6693000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\usbehci.sys Service Name: usbehci Module Base: F7932000 Module End: F793A000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\imapi.sys Service Name: Imapi Module Base: F7672000 Module End: F767D000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\cdrom.sys Service Name: Cdrom Module Base: F7682000 Module End: F7692000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\redbook.sys Service Name: redbook Module Base: F7692000 Module End: F76A1000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\ks.sys Service Name: — Module Base: F664C000 Module End: F666F000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\i8042prt.sys Service Name: i8042prt Module Base: F76A2000 Module End: F76AF000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\kbdclass.sys Service Name: Kbdclass Module Base: F793A000 Module End: F7940000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\SynTP.sys Service Name: SynTP Module Base: F6617000 Module End: F664C000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\USBD.SYS Service Name: — Module Base: F7AD4000 Module End: F7AD6000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\mouclass.sys Service Name: Mouclass Module Base: F7942000 Module End: F7948000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\CmBatt.sys Service Name: CmBatt Module Base: F7151000 Module End: F7155000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\bcmwl5.sys Service Name: BCM43XX Module Base: F64C3000 Module End: F6617000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\tifm21.sys Service Name: tifm21 Module Base: F649B000 Module End: F64C3000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\sdbus.sys Service Name: sdbus Module Base: F6487000 Module End: F649B000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\camc6hal.sys Service Name: CAMCHALA Module Base: F6431000 Module End: F6487000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\camc6aud.sys Service Name: CAMCAUD Module Base: F76B2000 Module End: F76BC000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\portcls.sys Service Name: — Module Base: F640D000 Module End: F6431000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\drmk.sys Service Name: — Module Base: F76C2000 Module End: F76D1000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys Service Name: HSFHWATI Module Base: F63D4000 Module End: F640D000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys Service Name: HSF_DPV Module Base: F62D7000 Module End: F63D4000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys Service Name: winachsf Module Base: F6227000 Module End: F62D7000 Hidden: No Module Name: C:\WINDOWS\System32\Drivers\Modem.SYS Service Name: Modem Module Base: F794A000 Module End: F7952000 Hidden: No Module Name: \SystemRoot\System32\Drivers\avzp4dcf.SYS Service Name: — Module Base: F61EF000 Module End: F6227000 Hidden: Yes Module Name: C:\WINDOWS\system32\DRIVERS\dne2000.sys Service Name: DNE Module Base: F61D4000 Module End: F61EF000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\audstub.sys Service Name: audstub Module Base: F7C49000 Module End: F7C4A000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\rasl2tp.sys Service Name: Rasl2tp Module Base: F76D2000 Module End: F76DF000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\ndistapi.sys Service Name: NdisTapi Module Base: F7141000 Module End: F7144000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\ndiswan.sys Service Name: NdisWan Module Base: F61BD000 Module End: F61D4000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\raspppoe.sys Service Name: RasPppoe Module Base: F76E2000 Module End: F76ED000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\raspptp.sys Service Name: PptpMiniport Module Base: F76F2000 Module End: F76FE000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\TDI.SYS Service Name: — Module Base: F784A000 Module End: F784F000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\psched.sys Service Name: PSched Module Base: F61AC000 Module End: F61BD000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\msgpc.sys Service Name: Gpc Module Base: F7702000 Module End: F770B000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\ptilink.sys Service Name: Ptilink Module Base: F7852000 Module End: F7857000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\raspti.sys Service Name: Raspti Module Base: F785A000 Module End: F785F000 Hidden: No Module Name: C:\WINDOWS\System32\Drivers\pcouffin.sys Service Name: pcouffin Module Base: F7712000 Module End: F771E000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\rdpdr.sys Service Name: rdpdr Module Base: F617C000 Module End: F61AC000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\termdd.sys Service Name: TermDD Module Base: F7722000 Module End: F772C000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\swenum.sys Service Name: swenum Module Base: F7ADA000 Module End: F7ADC000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\update.sys Service Name: Update Module Base: F611E000 Module End: F617C000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\mssmbios.sys Service Name: mssmbios Module Base: F6DB0000 Module End: F6DB4000 Hidden: No Module Name: C:\WINDOWS\System32\Drivers\NDProxy.SYS Service Name: NDProxy Module Base: F7732000 Module End: F773C000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\usbhub.sys Service Name: usbhub Module Base: F6A12000 Module End: F6A21000 Hidden: No Module Name: C:\WINDOWS\System32\Drivers\Fs_Rec.SYS Service Name: Fs_Rec Module Base: F7AE0000 Module End: F7AE2000 Hidden: No Module Name: C:\WINDOWS\System32\Drivers\Null.SYS Service Name: Null Module Base: F7C7F000 Module End: F7C80000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS Service Name: — Module Base: F7882000 Module End: F7889000 Hidden: No Module Name: C:\WINDOWS\System32\drivers\vga.sys Service Name: VgaSave Module Base: F788A000 Module End: F7890000 Hidden: No Module Name: C:\WINDOWS\System32\Drivers\mnmdd.SYS Service Name: mnmdd Module Base: F7AE2000 Module End: F7AE4000 Hidden: No Module Name: C:\WINDOWS\System32\DRIVERS\RDPCDD.sys Service Name: RDPCDD Module Base: F7AE4000 Module End: F7AE6000 Hidden: No Module Name: C:\WINDOWS\System32\Drivers\Msfs.SYS Service Name: Msfs Module Base: F7892000 Module End: F7897000 Hidden: No Module Name: C:\WINDOWS\System32\Drivers\Npfs.SYS Service Name: Npfs Module Base: F789A000 Module End: F78A2000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\rasacd.sys Service Name: RasAcd Module Base: F7A62000 Module End: F7A65000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\ipsec.sys Service Name: IPSec Module Base: EE079000 Module End: EE08C000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\tcpip.sys Service Name: Tcpip Module Base: EE020000 Module End: EE079000 Hidden: No Module Name: C:\WINDOWS\System32\Drivers\aswTdi.SYS Service Name: aswTdi Module Base: F69F2000 Module End: F69FD000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\netbt.sys Service Name: NetBT Module Base: EDF58000 Module End: EDF80000 Hidden: No Module Name: C:\WINDOWS\System32\drivers\afd.sys Service Name: AFD Module Base: EDF36000 Module End: EDF58000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\netbios.sys Service Name: NetBIOS Module Base: F69E2000 Module End: F69EB000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\rdbss.sys Service Name: Rdbss Module Base: EDF0B000 Module End: EDF36000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\mrxsmb.sys Service Name: MRxSmb Module Base: EDE9B000 Module End: EDF0B000 Hidden: No Module Name: C:\WINDOWS\System32\Drivers\Fips.SYS Service Name: Fips Module Base: F69C2000 Module End: F69CD000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\ipnat.sys Service Name: IpNat Module Base: EDE75000 Module End: EDE9B000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\wanarp.sys Service Name: Wanarp Module Base: F69B2000 Module End: F69BB000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\arp1394.sys Service Name: Arp1394 Module Base: F69A2000 Module End: F69B1000 Hidden: No Module Name: \??\C:\WINDOWS\system32\drivers\EABFiltr.sys Service Name: eabfiltr Module Base: F7AE6000 Module End: F7AE8000 Hidden: No Module Name: \??\C:\Program Files\Radeon Omega Drivers\v4.8.442\ATI Tray Tools\atitray.sys Service Name: atitray Module Base: F7A8E000 Module End: F7A92000 Hidden: No Module Name: C:\WINDOWS\System32\Drivers\aswSP.SYS Service Name: aswSP Module Base: EDE2C000 Module End: EDE4D000 Hidden: No Module Name: C:\WINDOWS\System32\Drivers\Aavmker4.SYS Service Name: Aavmker4 Module Base: F78A2000 Module End: F78A7000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\hidusb.sys Service Name: HidUsb Module Base: F7149000 Module End: F714C000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS Service Name: — Module Base: F7752000 Module End: F775B000 Hidden: No Module Name: C:\WINDOWS\System32\Drivers\Cdfs.SYS Service Name: Cdfs Module Base: F7762000 Module End: F7772000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\mouhid.sys Service Name: mouhid Module Base: F7145000 Module End: F7148000 Hidden: No Module Name: \SystemRoot\System32\Drivers\dump_atapi.sys Service Name: — Module Base: EDE14000 Module End: EDE2C000 Hidden: Yes Module Name: \SystemRoot\System32\Drivers\dump_WMILIB.SYS Service Name: — Module Base: F7AEE000 Module End: F7AF0000 Hidden: Yes Module Name: C:\WINDOWS\System32\drivers\Dxapi.sys Service Name: — Module Base: F60FA000 Module End: F60FD000 Hidden: No Module Name: C:\WINDOWS\System32\watchdog.sys Service Name: — Module Base: F78B2000 Module End: F78B7000 Hidden: No Module Name: C:\WINDOWS\System32\drivers\dxgthk.sys Service Name: — Module Base: F7BAF000 Module End: F7BB0000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys Service Name: aswFsBlk Module Base: F78EA000 Module End: F78F2000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\ndisuio.sys Service Name: Ndisuio Module Base: EB9B8000 Module End: EB9BC000 Hidden: No Module Name: C:\WINDOWS\System32\Drivers\aswMon2.SYS Service Name: aswMon2 Module Base: EB78E000 Module End: EB7A4000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\wdmaud.sys Service Name: wdmaud Module Base: EB521000 Module End: EB536000 Hidden: No Module Name: C:\WINDOWS\system32\drivers\sysaudio.sys Service Name: sysaudio Module Base: F7772000 Module End: F7781000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\mrxdav.sys Service Name: MRxDAV Module Base: EB3AE000 Module End: EB3DB000 Hidden: No Module Name: \??\C:\WINDOWS\system32\Drivers\CVPNDRVA.sys Service Name: CVPNDRVA Module Base: EB301000 Module End: EB386000 Hidden: No Module Name: C:\WINDOWS\System32\drivers\enodpl.sys Service Name: enodpl Module Base: F7B38000 Module End: F7B3A000 Hidden: No Module Name: C:\WINDOWS\System32\Drivers\HTTP.sys Service Name: HTTP Module Base: EB1F8000 Module End: EB239000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\srv.sys Service Name: Srv Module Base: EB0DE000 Module End: EB130000 Hidden: No Module Name: C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys Service Name: mdmxsdk Module Base: EB251000 Module End: EB254000 Hidden: No Module Name: \??\C:\WINDOWS\system32\drivers\symlcbrd.sys Service Name: symlcbrd Module Base: F78BA000 Module End: F78C0000 Hidden: No Module Name: C:\WINDOWS\System32\drivers\tandpl.sys Service Name: tandpl Module Base: F7AA2000 Module End: F7AA4000 Hidden: No Module Name: C:\WINDOWS\System32\Drivers\aswRdr.SYS Service Name: aswRdr Module Base: F6B4C000 Module End: F6B50000 Hidden: No Module Name: \??\C:\DOCUME~1\FATALP~1\LOCALS~1\Temp\catchme.sys Service Name: catchme Module Base: F7862000 Module End: F786A000 Hidden: Yes Module Name: \??\C:\WINDOWS\system32\Drivers\PROCEXP90.SYS Service Name: — Module Base: F7B2C000 Module End: F7B2E000 Hidden: Yes Module Name: C:\WINDOWS\system32\drivers\kmixer.sys Service Name: kmixer Module Base: BA51A000 Module End: BA545000 Hidden: No Module Name: \??\C:\DOCUME~1\FATALP~1\LOCALS~1\Temp\aujasnkj.sys Service Name: aujasnkj Module Base: BA506000 Module End: BA51A000 Hidden: Yes ******************************************************************************** ********** ******************************************************************************** ********** SSDT: Function Name: ZwClose Address: EDE346B8 Driver Base: EDE2C000 Driver End: EDE4D000 Driver Name: \SystemRoot\System32\Drivers\aswSP.SYS Function Name: ZwCreateKey Address: EDE34574 Driver Base: EDE2C000 Driver End: EDE4D000 Driver Name: \SystemRoot\System32\Drivers\aswSP.SYS Function Name: ZwDeleteValueKey Address: EDE34A52 Driver Base: EDE2C000 Driver End: EDE4D000 Driver Name: \SystemRoot\System32\Drivers\aswSP.SYS Function Name: ZwDuplicateObject Address: EDE3414C Driver Base: EDE2C000 Driver End: EDE4D000 Driver Name: \SystemRoot\System32\Drivers\aswSP.SYS Function Name: ZwEnumerateKey Address: F73AFCA4 Driver Base: F7390000 Driver End: F7491000 Driver Name: speb.sys Function Name: ZwEnumerateValueKey Address: F73B0032 Driver Base: F7390000 Driver End: F7491000 Driver Name: speb.sys Function Name: ZwOpenKey Address: EDE3464E Driver Base: EDE2C000 Driver End: EDE4D000 Driver Name: \SystemRoot\System32\Drivers\aswSP.SYS Function Name: ZwOpenProcess Address: EDE3408C Driver Base: EDE2C000 Driver End: EDE4D000 Driver Name: \SystemRoot\System32\Drivers\aswSP.SYS Function Name: ZwOpenThread Address: EDE340F0 Driver Base: EDE2C000 Driver End: EDE4D000 Driver Name: \SystemRoot\System32\Drivers\aswSP.SYS Function Name: ZwQueryKey Address: F73B010A Driver Base: F7390000 Driver End: F7491000 Driver Name: speb.sys Function Name: ZwQueryValueKey Address: EDE3476E Driver Base: EDE2C000 Driver End: EDE4D000 Driver Name: \SystemRoot\System32\Drivers\aswSP.SYS Function Name: ZwRestoreKey Address: EDE3472E Driver Base: EDE2C000 Driver End: EDE4D000 Driver Name: \SystemRoot\System32\Drivers\aswSP.SYS Function Name: ZwSetValueKey Address: EDE348AE Driver Base: EDE2C000 Driver End: EDE4D000 Driver Name: \SystemRoot\System32\Drivers\aswSP.SYS ******************************************************************************** ********** ******************************************************************************** ********** No Kernel Hooks found ******************************************************************************** ********** ******************************************************************************** ********** IRP Hooks: Hooked Module: \SystemRoot\System32\Drivers\avzp4dcf.SYS Hooked IRP: IRP_MJ_CREATE Jump To: 86D2E500 Hooking Module: _unknown_ Hooked Module: \SystemRoot\System32\Drivers\avzp4dcf.SYS Hooked IRP: IRP_MJ_CLOSE Jump To: 86D2E500 Hooking Module: _unknown_ Hooked Module: \SystemRoot\System32\Drivers\avzp4dcf.SYS Hooked IRP: IRP_MJ_DEVICE_CONTROL Jump To: 86D2E500 Hooking Module: _unknown_ Hooked Module: \SystemRoot\System32\Drivers\avzp4dcf.SYS Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL Jump To: 86D2E500 Hooking Module: _unknown_ Hooked Module: \SystemRoot\System32\Drivers\avzp4dcf.SYS Hooked IRP: IRP_MJ_POWER Jump To: 86D2E500 Hooking Module: _unknown_ Hooked Module: \SystemRoot\System32\Drivers\avzp4dcf.SYS Hooked IRP: IRP_MJ_SYSTEM_CONTROL Jump To: 86D2E500 Hooking Module: _unknown_ Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_CREATE Jump To: F7391000 Hooking Module: speb.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_CREATE_NAMED_PIPE Jump To: F7391000 Hooking Module: speb.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_CLOSE Jump To: F7391000 Hooking Module: speb.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_READ Jump To: F7391000 Hooking Module: speb.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_WRITE Jump To: F7391000 Hooking Module: speb.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_QUERY_INFORMATION Jump To: F7391000 Hooking Module: speb.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_SET_INFORMATION Jump To: F7391000 Hooking Module: speb.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_QUERY_EA Jump To: F7391000 Hooking Module: speb.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_SET_EA Jump To: F7391000 Hooking Module: speb.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_FLUSH_BUFFERS Jump To: F7391000 Hooking Module: speb.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_QUERY_VOLUME_INFORMATION Jump To: F7391000 Hooking Module: speb.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_SET_VOLUME_INFORMATION Jump To: F7391000 Hooking Module: speb.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_DIRECTORY_CONTROL Jump To: F7391000 Hooking Module: speb.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_FILE_SYSTEM_CONTROL Jump To: F7391000 Hooking Module: speb.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_DEVICE_CONTROL Jump To: F7391000 Hooking Module: speb.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL Jump To: F7391000 Hooking Module: speb.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_SHUTDOWN Jump To: F7391000 Hooking Module: speb.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_LOCK_CONTROL Jump To: F7391000 Hooking Module: speb.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_CLEANUP Jump To: F7391000 Hooking Module: speb.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_CREATE_MAILSLOT Jump To: F7391000 Hooking Module: speb.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_QUERY_SECURITY Jump To: F7391000 Hooking Module: speb.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_SET_SECURITY Jump To: F7391000 Hooking Module: speb.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_POWER Jump To: F7391000 Hooking Module: speb.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_SYSTEM_CONTROL Jump To: F7391000 Hooking Module: speb.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_DEVICE_CHANGE Jump To: F7391000 Hooking Module: speb.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_QUERY_QUOTA Jump To: F7391000 Hooking Module: speb.sys Hooked Module: \Driver\sptd Hooked IRP: IRP_MJ_SET_QUOTA Jump To: F7391000 Hooking Module: speb.sys Hooked Module: C:\WINDOWS\system32\drivers\dmio.sys Hooked IRP: IRP_MJ_CREATE Jump To: 8716C1F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\drivers\dmio.sys Hooked IRP: IRP_MJ_CLOSE Jump To: 8716C1F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\drivers\dmio.sys Hooked IRP: IRP_MJ_READ Jump To: 8716C1F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\drivers\dmio.sys Hooked IRP: IRP_MJ_WRITE Jump To: 8716C1F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\drivers\dmio.sys Hooked IRP: IRP_MJ_FLUSH_BUFFERS Jump To: 8716C1F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\drivers\dmio.sys Hooked IRP: IRP_MJ_DEVICE_CONTROL Jump To: 8716C1F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\drivers\dmio.sys Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL Jump To: 8716C1F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\drivers\dmio.sys Hooked IRP: IRP_MJ_SHUTDOWN Jump To: 8716C1F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\drivers\dmio.sys Hooked IRP: IRP_MJ_POWER Jump To: 8716C1F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\drivers\dmio.sys Hooked IRP: IRP_MJ_SYSTEM_CONTROL Jump To: 8716C1F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\DRIVERS\usbohci.sys Hooked IRP: IRP_MJ_CREATE Jump To: 86D2C500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\DRIVERS\usbohci.sys Hooked IRP: IRP_MJ_CLOSE Jump To: 86D2C500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\DRIVERS\usbohci.sys Hooked IRP: IRP_MJ_DEVICE_CONTROL Jump To: 86D2C500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\DRIVERS\usbohci.sys Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL Jump To: 86D2C500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\DRIVERS\usbohci.sys Hooked IRP: IRP_MJ_POWER Jump To: 86D2C500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\DRIVERS\usbohci.sys Hooked IRP: IRP_MJ_SYSTEM_CONTROL Jump To: 86D2C500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\drivers\ftdisk.sys Hooked IRP: IRP_MJ_CREATE Jump To: 871D91F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\drivers\ftdisk.sys Hooked IRP: IRP_MJ_READ Jump To: 871D91F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\drivers\ftdisk.sys Hooked IRP: IRP_MJ_WRITE Jump To: 871D91F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\drivers\ftdisk.sys Hooked IRP: IRP_MJ_FLUSH_BUFFERS Jump To: 871D91F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\drivers\ftdisk.sys Hooked IRP: IRP_MJ_DEVICE_CONTROL Jump To: 871D91F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\drivers\ftdisk.sys Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL Jump To: 871D91F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\drivers\ftdisk.sys Hooked IRP: IRP_MJ_SHUTDOWN Jump To: 871D91F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\drivers\ftdisk.sys Hooked IRP: IRP_MJ_CLEANUP Jump To: 871D91F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\drivers\ftdisk.sys Hooked IRP: IRP_MJ_POWER Jump To: 871D91F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\drivers\ftdisk.sys Hooked IRP: IRP_MJ_SYSTEM_CONTROL Jump To: 871D91F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\DRIVERS\netbt.sys Hooked IRP: IRP_MJ_CREATE Jump To: 865291F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\DRIVERS\netbt.sys Hooked IRP: IRP_MJ_CLOSE Jump To: 865291F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\DRIVERS\netbt.sys Hooked IRP: IRP_MJ_DEVICE_CONTROL Jump To: 865291F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\DRIVERS\netbt.sys Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL Jump To: 865291F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\DRIVERS\netbt.sys Hooked IRP: IRP_MJ_CLEANUP Jump To: 865291F8 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\DRIVERS\cdrom.sys Hooked IRP: IRP_MJ_CREATE Jump To: 86E0C500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\DRIVERS\cdrom.sys Hooked IRP: IRP_MJ_CLOSE Jump To: 86E0C500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\DRIVERS\cdrom.sys Hooked IRP: IRP_MJ_READ Jump To: 86E0C500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\DRIVERS\cdrom.sys Hooked IRP: IRP_MJ_WRITE Jump To: 86E0C500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\DRIVERS\cdrom.sys Hooked IRP: IRP_MJ_FLUSH_BUFFERS Jump To: 86E0C500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\DRIVERS\cdrom.sys Hooked IRP: IRP_MJ_DEVICE_CONTROL Jump To: 86E0C500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\DRIVERS\cdrom.sys Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL Jump To: 86E0C500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\DRIVERS\cdrom.sys Hooked IRP: IRP_MJ_SHUTDOWN Jump To: 86E0C500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\DRIVERS\cdrom.sys Hooked IRP: IRP_MJ_POWER Jump To: 86E0C500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\DRIVERS\cdrom.sys Hooked IRP: IRP_MJ_SYSTEM_CONTROL Jump To: 86E0C500 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\DRIVERS\usbehci.sys Hooked IRP: IRP_MJ_CREATE Jump To: 86E25368 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\DRIVERS\usbehci.sys Hooked IRP: IRP_MJ_CLOSE Jump To: 86E25368 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\DRIVERS\usbehci.sys Hooked IRP: IRP_MJ_DEVICE_CONTROL Jump To: 86E25368 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\DRIVERS\usbehci.sys Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL Jump To: 86E25368 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\DRIVERS\usbehci.sys Hooked IRP: IRP_MJ_POWER Jump To: 86E25368 Hooking Module: _unknown_ Hooked Module: C:\WINDOWS\system32\DRIVERS\usbehci.sys Hooked IRP: IRP_MJ_SYSTEM_CONTROL Jump To: 86E25368 Hooking Module: _unknown_ Hooked Module: \Driver\PCI_PNP9552 Hooked IRP: IRP_MJ_CREATE Jump To: F73D4AEA Hooking Module: speb.sys Hooked Module: \Driver\PCI_PNP9552 Hooked IRP: IRP_MJ_CREATE_NAMED_PIPE Jump To: F73D4AEA Hooking Module: speb.sys Hooked Module: \Driver\PCI_PNP9552 Hooked IRP: IRP_MJ_CLOSE Jump To: F73D4AEA Hooking Module: speb.sys Hooked Module: \Driver\PCI_PNP9552 Hooked IRP: IRP_MJ_READ Jump To: F73D4AEA Hooking Module: speb.sys Hooked Module: \Driver\PCI_PNP9552 Hooked IRP: IRP_MJ_WRITE Jump To: F73D4AEA Hooking Module: speb.sys Hooked Module: \Driver\PCI_PNP9552 Hooked IRP: IRP_MJ_QUERY_INFORMATION Jump To: F73D4AEA Hooking Module: speb.sys Hooked Module: \Driver\PCI_PNP9552 Hooked IRP: IRP_MJ_SET_INFORMATION Jump To: F73D4AEA Hooking Module: speb.sys Hooked Module: \Driver\PCI_PNP9552 Hooked IRP: IRP_MJ_QUERY_EA Jump To: F73D4AEA Hooking Module: speb.sys Hooked Module: \Driver\PCI_PNP9552 Hooked IRP: IRP_MJ_SET_EA Jump To: F73D4AEA Hooking Module: speb.sys Hooked Module: \Driver\PCI_PNP9552 Hooked IRP: IRP_MJ_FLUSH_BUFFERS Jump To: F73D4AEA Hooking Module: speb.sys Hooked Module: \Driver\PCI_PNP9552 Hooked IRP: IRP_MJ_QUERY_VOLUME_INFORMATION Jump To: F73D4AEA Hooking Module: speb.sys Hooked Module: \Driver\PCI_PNP9552 Hooked IRP: IRP_MJ_SET_VOLUME_INFORMATION Jump To: F73D4AEA Hooking Module: speb.sys Hooked Module: \Driver\PCI_PNP9552 Hooked IRP: IRP_MJ_DIRECTORY_CONTROL Jump To: F73D4AEA Hooking Module: speb.sys Hooked Module: \Driver\PCI_PNP9552 Hooked IRP: IRP_MJ_FILE_SYSTEM_CONTROL Jump To: F73D4AEA Hooking Module: speb.sys Hooked Module: \Driver\PCI_PNP9552 Hooked IRP: IRP_MJ_DEVICE_CONTROL Jump To: F73D4AEA Hooking Module: speb.sys Hooked Module: \Driver\PCI_PNP9552 Hooked IRP: IRP_MJ_INTERNAL_DEVICE_CONTROL Jump To: F73D4AEA Hooking Module: speb.sys Hooked Module: \Driver\PCI_PNP9552 Hooked IRP: IRP_MJ_SHUTDOWN Jump To: F73D4AEA Hooking Module: speb.sys Hooked Module: \Driver\PCI_PNP9552 Hooked IRP: IRP_MJ_LOCK_CONTROL Jump To: F73D4AEA Hooking Module: speb.sys Hooked Module: \Driver\PCI_PNP9552 Hooked IRP: IRP_MJ_CLEANUP Jump To: F73D4AEA Hooking Module: speb.sys Hooked Module: \Driver\PCI_PNP9552 Hooked IRP: IRP_MJ_CREATE_MAILSLOT Jump To: F73D4AEA Hooking Module: speb.sys Hooked Module: \Driver\PCI_PNP9552 Hooked IRP: IRP_MJ_QUERY_SECURITY Jump To: F73D4AEA Hooking Module: speb.sys Hooked Module: \Driver\PCI_PNP9552 Hooked IRP: IRP_MJ_SET_SECURITY Jump To: F73D4AEA Hooking Module: speb.sys Hooked Module: \Driver\PCI_PNP9552 Hooked IRP: IRP_MJ_POWER Jump To: F7398E30 Hooking Module: speb.sys Hooked Module: \Driver\PCI_PNP9552 Hooked IRP: IRP_MJ_SYSTEM_CONTROL Jump To: F73AD514 Hooking Module: speb.sys Hooked Module: \Driver\PCI_PNP9552 Hooked IRP: IRP_MJ_DEVICE_CHANGE Jump To: F73D4AEA Hooking Module: speb.sys Hooked Module: \Driver\PCI_PNP9552 Hooked IRP: IRP_MJ_QUERY_QUOTA Jump To: F73D4AEA Hooking Module: speb.sys Hooked Module: \Driver\PCI_PNP9552 Hooked IRP: IRP_MJ_SET_QUOTA Jump To: F73D4AEA Hooking Module: speb.sys ******************************************************************************** ********** ******************************************************************************** ********** Ports: Local Address: FATALX:1335 Remote Address: [removed]:HTTP Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: FATALX:1334 Remote Address: [removed]:HTTPS Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: FATALX:1331 Remote Address: [removed]:HTTP Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: FATALX:1326 Remote Address: [removed]:HTTP Type: TCP Process: [System Idle Process] State: TIME_WAIT Local Address: FATALX:NETBIOS-SSN Remote Address: 0.0.0.0:0 Type: TCP Process: System State: LISTENING Local Address: FATALX:5152 Remote Address: LOCALHOST:1037 Type: TCP Process: C:\Program Files\Java\jre6\bin\jqs.exe State: CLOSE_WAIT Local Address: FATALX:5152 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\Program Files\Java\jre6\bin\jqs.exe State: LISTENING Local Address: FATALX:1028 Remote Address: 0.0.0.0:0 Type: TCP Process: C:\WINDOWS\system32\alg.exe State: LISTENING Local Address: FATALX:MICROSOFT-DS Remote Address: 0.0.0.0:0 Type: TCP Process: System State: LISTENING Local Address: FATALX:EPMAP Remote Address: 0.0.0.0:0 Type: TCP Process: C:\WINDOWS\system32\svchost.exe State: LISTENING Local Address: FATALX:1900 Remote Address: NA Type: UDP Process: C:\WINDOWS\system32\svchost.exe State: NA Local Address: FATALX:138 Remote Address: NA Type: UDP Process: System State: NA Local Address: FATALX:NETBIOS-NS Remote Address: NA Type: UDP Process: System State: NA Local Address: FATALX:123 Remote Address: NA Type: UDP Process: C:\WINDOWS\system32\svchost.exe State: NA Local Address: FATALX:1900 Remote Address: NA Type: UDP Process: C:\WINDOWS\system32\svchost.exe State: NA Local Address: FATALX:123 Remote Address: NA Type: UDP Process: C:\WINDOWS\system32\svchost.exe State: NA Local Address: FATALX:4500 Remote Address: NA Type: UDP Process: C:\WINDOWS\system32\lsass.exe State: NA Local Address: FATALX:500 Remote Address: NA Type: UDP Process: C:\WINDOWS\system32\lsass.exe State: NA Local Address: FATALX:MICROSOFT-DS Remote Address: NA Type: UDP Process: System State: NA ******************************************************************************** ********** ******************************************************************************** ********** Hidden files/folders: Object: C:\Documents and Settings\FatalPlus\My Documents\My Music\Classical Music Top 100\008. Antonín Dvorák - New World Symphony (Op. 95) - Largo.mp3 Status: Hidden Object: C:\Documents and Settings\FatalPlus\My Documents\My Music\Classical Music Top 100\024. Bedrich Smetana - Má Vlast - Vltava.mp3 Status: Hidden Object: C:\Documents and Settings\FatalPlus\My Documents\My Music\Classical Music Top 100\051. Frv©dv©ric Franvßois Chopin - Concerto Pour Piano No. 1 (Op. 11) - Romance.mp3 Status: Hidden Object: C:\Documents and Settings\FatalPlus\My Documents\My Music\Classical Music Top 100\052. Gabriel Urbain Faurv© - Requiem (Op. 48) - Pie Jesu.mp3 Status: Hidden Object: C:\Documents and Settings\FatalPlus\My Documents\My Music\Classical Music Top 100\057. Antonv?n Dvo˜ôv°k - Rusalka - Mƒõsv?ƒçku Na Nebi Hlubokv©m.mp3 Status: Hidden Object: C:\Documents and Settings\FatalPlus\My Documents\My Music\Classical Music Top 100\061. Pyotr Ilyich Tchaikovsky - The Nutcracker (Op. 71) - Waltz Of The Flowers - –©–µ–ª–?—É–O—á–?–?.mp3 Status: Hidden Object: C:\Documents and Settings\FatalPlus\My Documents\My Music\Classical Music Top 100\065. Frv©dv©ric Franvßois Chopin - Concerto Pour Piano No. 2 (Op. 21).mp3 Status: Hidden Object: C:\Documents and Settings\FatalPlus\My Documents\My Music\Classical Music Top 100\067. Jules vâmile Frv©dv©ric Massenet - Thav_s - Mv©ditation.mp3 Status: Hidden Object: C:\Documents and Settings\FatalPlus\My Documents\My Music\Classical Music Top 100\071. Giuseppe Fortunino Francesco Verdi - Rigoletto - La Donna và Mobile.mp3 Status: Hidden Object: C:\Documents and Settings\FatalPlus\My Documents\My Music\Classical Music Top 100\072. Pyotr Ilyich Tchaikovsky - The Nutcracker (Op. 71) - Dance Of The Sugar-Plum Fairy - –©–µ–ª–?—É–O—á–?–?.mp3 Status: Hidden Object: C:\Documents and Settings\FatalPlus\My Documents\My Music\Classical Music Top 100\073. Johann Sebastian Bach - Doppelkonzert Fvºr Zwei Violinen (BWV 1043) - Largo Ma Non Tanto.mp3 Status: Hidden Object: C:\Documents and Settings\FatalPlus\My Documents\My Music\Classical Music Top 100\074. Georg Friederich Hv§ndel - Serse (HWV 40) - Ombra Mai Fvp.mp3 Status: Hidden Object: C:\Documents and Settings\FatalPlus\My Documents\My Music\Classical Music Top 100\078. Niccolv= Paganini - Concerto Pour Violon No. 1 (Op. 6).mp3 Status: Hidden Object: C:\Documents and Settings\FatalPlus\My Documents\My Music\Classical Music Top 100\079. Gabriel Urbain Faurv© - Requiem (Op. 48) - In Paradisum.mp3 Status: Hidden Object: C:\Documents and Settings\FatalPlus\My Documents\My Music\Classical Music Top 100\080. Joaquv?n Rodrigo Vidre - Concierto De Aranjuez - Adagio.mp3 Status: Hidden Object: C:\Documents and Settings\FatalPlus\My Documents\My Music\Classical Music Top 100\082. Wolfgang Amadeus Mozart - Die Zauberflv?te (K. 620) - Overture.mp3 Status: Hidden Object: C:\Documents and Settings\FatalPlus\My Documents\My Music\Classical Music Top 100\086. Wolfgang Amadeus Mozart - Konzert Fvºr Flv?te, Harfe Und Orchester (K. 299) - Allegro.mp3 Status: Hidden Object: C:\Documents and Settings\FatalPlus\My Documents\My Music\Classical Music Top 100\089. Georg Friederich Hv§ndel - Solomon (HWV 67) - The Arrival Of The Queen Of Sheba.mp3 Status: Hidden Object: C:\Documents and Settings\FatalPlus\My Documents\My Music\Classical Music Top 100\091. Johann Strauss, Jr. - An Der Schv?nen Blauen Donau (Op. 314).mp3 Status: Hidden Object: C:\Documents and Settings\FatalPlus\My Documents\My Music\Classical Music Top 100\094. Wolfgang Amadeus Mozart - Krv?nungsmesse (K. 317) - Agnus Dei.mp3 Status: Hidden Object: C:\Documents and Settings\FatalPlus\My Documents\My Music\Classical Music Top 100\095. Erik Alfred Leslie Satie - Gymnopv©die No.1.mp3 Status: Hidden Object: C:\Documents and Settings\FatalPlus\My Documents\My Music\Classical Music Top 100\100. Cv©sar-Auguste-Jean-Guillaume-Hubert Franck - Panis Angelicus.mp3 Status: Hidden
Post #20
Hi,

Please do the following:

Please delete the copy of GMER that you have on your desktop.

Please download a fresh copy from >>HERE<<

Please reboot your computer ONCE before running the program as previously instructed.

Please make sure there are no other programs running while GMER runs.

Please post the resulting log.

Thanks

~CB
Post #22 last edited
Hi,

I have attached a batch fix for you to run on your computer, please let me know when you have it so I can remove the attachment.

Please make sure Avast is totally disabled when you run this batch.

Please make sure you only run this batch ONCE.

  • Save the zipped file to your DESKTOP
  • Unzip it to your desktop
  • Once unzipped, the icon to click should look like this on your desktop:
    [external image: Posted Image]
  • Double click fixit.bat to run it. A small black box should open and close - this is normal.


Please post the resulting log
Post #23
—BEFORE—- C:\WINDOWS\System32\geyekrlog.dat C:\WINDOWS\System32\geyekrnqndekri.dat C:\WINDOWS\System32\geyekrsijtewtm.dll C:\WINDOWS\System32\geyekrvhxbqpxu.dll Deleted file - C:\WINDOWS\System32\geyekrlog.dat Deleted file - C:\WINDOWS\System32\geyekrnqndekri.dat Deleted file - C:\WINDOWS\System32\geyekrsijtewtm.dll Deleted file - C:\WINDOWS\System32\geyekrvhxbqpxu.dll SteelWerX Registry Console Tool 2.0 Written by Bobbi Flekman 2006 © HKEY_LOCAL_MACHINE\system\currentcontrolset\services\geyekrflnqlsuo start REG_DWORD 1 (0x1) type REG_DWORD 1 (0x1) group REG_SZ file system imagepath REG_EXPAND_SZ \systemroot\system32\drivers\geyekrmnukcigp.sys HKEY_LOCAL_MACHINE\system\currentcontrolset\services\geyekrflnqlsuo\main HKEY_LOCAL_MACHINE\system\currentcontrolset\services\geyekrflnqlsuo\modules SteelWerX Registry Console Tool 2.0 Written by Bobbi Flekman 2006 © HKEY_LOCAL_MACHINE\system\controlset003\services\geyekrflnqlsuo start REG_DWORD 1 (0x1) type REG_DWORD 1 (0x1) group REG_SZ file system imagepath REG_EXPAND_SZ \systemroot\system32\drivers\geyekrmnukcigp.sys HKEY_LOCAL_MACHINE\system\controlset003\services\geyekrflnqlsuo\main HKEY_LOCAL_MACHINE\system\controlset003\services\geyekrflnqlsuo\modules —AFTER—- SteelWerX Registry Console Tool 2.0 Written by Bobbi Flekman 2006 © Error: Key: system\currentcontrolset\services\geyekrflnqlsuo does not exist! SteelWerX Registry Console Tool 2.0 Written by Bobbi Flekman 2006 © Error: Key: system\controlset003\services\geyekrflnqlsuo does not exist!
Post #25
Seems to be all set now :thumbup: Thanks a bunch for the copious amount of time it took to fix such a small issue. One question though. The only problem I was having was google links not sending me to where they should, was this malware doing anything else to my computer that I didn't notice? Would you recommend changing all my passwords etc?
Post #26 last edited
haha..I'm not done with you yet…sorry…

yes, I would change my passwords, this was a very serious infection. I would also notify your financial institutions to advise them that your personal information may have been compromised.

I would like to do a couple more scans to look for the waifs and strays.

Please do the following:

NEXT

Please download Malwarebytes' Anti-Malware
  • Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT

Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.

    [external image: Posted Image]
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply


In your next reply please include
  • MBAM Log
  • Kaspersky report
Post #27
Hi,

I was going back over the thread and something important was missed, please do this before the other scans I asked you to do.

In post #10 I asked for this file: c:\windows\system32\drivers\wdmaudd.sys to be uploaded

notice the double d's at the end.

the file that was analyzed had one d.

VirSCAN.org Scanned Report :
Scanned time : 2009/07/29 23:09:58 (EDT)
Scanner results: All Scanners reported not find malware!
File Name : wdmaud.sys
File Size : 83072 byte


so we need to do that again with the correct file as I believe that is a bad file but just wish to confirm it.

  • Make sure to use Internet Explorer for this
  • Please go to VirSCAN.org FREE on-line scan service
  • Copy and paste the following file path into the "Suspicious files to scan" box on the top of the page:


    c:\windows\system32\drivers\wdmaudd.sys

  • Click on the Upload button
  • If a pop-up appears saying the file has been scanned already, please select the ReScan button.
  • Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
  • Paste the contents of the Clipboard in your next reply.


Please post the resulting log
Post #28
MBAM and Kapersky scan logs. Malwarebytes' Anti-Malware 1.39 Database version: 2532 Windows 5.1.2600 Service Pack 3 7/30/2009 6:51:47 PM mbam-log-2009-07-30 (18-51-47).txt Scan type: Quick Scan Objects scanned: 101763 Time elapsed: 5 minute(s), 59 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0 REPORT Thursday, July 30, 2009 Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Friday, July 31, 2009 00:40:37 Records in database: 2565014 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ Scan statistics: Files scanned: 81591 Threat name: 2 Infected objects: 4 Suspicious objects: 0 Duration of the scan: 01:30:54 File name / Threat name / Threats count C:\Qoobox\Quarantine\C\WINDOWS\system32\geyekrdqwrtqkh.dll.vir Infected: Trojan.Win32.Agent.crez 1 C:\System Volume Information\_restore{BFAA719B-281F-45B6-9E39-9D4BB578C2A4}\RP840\A0117300.exe Infected: Trojan.Win32.Chifrax.c 1 C:\System Volume Information\_restore{BFAA719B-281F-45B6-9E39-9D4BB578C2A4}\RP876\A0121401.dll Infected: Trojan.Win32.Agent.crez 1 C:\System Volume Information\_restore{BFAA719B-281F-45B6-9E39-9D4BB578C2A4}\RP876\A0121403.dll Infected: Trojan.Win32.Agent.crez 1 The selected area was scanned.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI