[Resolved] Can't remove Packed.Monder

Yes indeed. I'll run it again now.

Hi,

you have a new rootkit variant on board which is proving a little difficult to remove, so I'd like to try a couple of things if you don't mind.

Download Rootkit Unhooker and save it to your desktop

Double click the icon to extract the files to it's own folder which by default will be C:\RkUnhooker

Locate the C:\RkUnhooker folder, open the folder and double click the purple spider icon to run the tool

Click the "report" tab
click "scan"
Check all the boxes
Select drive to scan - C:\
Press OK - the scan will take quite some time to complete so please be patient - don't have it fix anything…I just need the report for now
When complete go to File > save report > save it to your desktop
Copy/paste the report in your next reply


NEXT

find and delete C:\windows\ntbtlog.txt
Restart your computer.
Just before the windows loading screen starts hit F8 as if going into safe mode.
From the advanced boot menu choose enable boot logging then hit enter.
Your computer will start up as usual, except it will create a log of its bootup processes for one time only.

Please post the contents of the new file:

C:\windows\ntbtlog.txt

Ok, here are reports. RkUnhooker report generator v0.7 ============================================== Rootkit Unhooker kernel version: 3.7.300.505 ============================================== Windows Major Version: 5 Windows Minor Version: 1 Windows Build Number: 2600 ============================================== >SSDT State ============================================== >Shadow ============================================== >Processes Process: System Process Id: 4 EPROCESS Address: 0x8AA7F7F8 Process: C:\WINDOWS\system32\svchost.exe Process Id: 496 EPROCESS Address: 0x8A777308 Process: C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe Process Id: 684 EPROCESS Address: 0x8A71E478 Process: C:\WINDOWS\system32\ctfmon.exe Process Id: 700 EPROCESS Address: 0x8A74FBC8 Process: C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe Process Id: 744 EPROCESS Address: 0x8A513800 Process: C:\WINDOWS\system32\smss.exe Process Id: 792 EPROCESS Address: 0x8A7C49A8 Process: C:\Program Files\Bonjour\mDNSResponder.exe Process Id: 808 EPROCESS Address: 0x8A4A7DA0 Process: C:\WINDOWS\system32\csrss.exe Process Id: 856 EPROCESS Address: 0x8A534C08 Process: C:\WINDOWS\system32\winlogon.exe Process Id: 888 EPROCESS Address: 0x8A91E810 Process: C:\WINDOWS\system32\services.exe Process Id: 936 EPROCESS Address: 0x8A5F1318 Process: C:\WINDOWS\system32\lsass.exe Process Id: 948 EPROCESS Address: 0x8A90A900 Process: C:\Program Files\iTunes\iTunesHelper.exe Process Id: 1000 EPROCESS Address: 0x8A626620 Process: C:\WINDOWS\system32\ati2evxx.exe Process Id: 1116 EPROCESS Address: 0x8A497430 Process: C:\WINDOWS\system32\svchost.exe Process Id: 1136 EPROCESS Address: 0x8A4D35F8 Process: C:\WINDOWS\system32\svchost.exe Process Id: 1256 EPROCESS Address: 0x8A48D818 Process: C:\WINDOWS\system32\svchost.exe Process Id: 1324 EPROCESS Address: 0x8A4947B8 Process: C:\WINDOWS\system32\svchost.exe Process Id: 1356 EPROCESS Address: 0x8A492958 Process: C:\WINDOWS\system32\svchost.exe Process Id: 1432 EPROCESS Address: 0x8A484720 Process: C:\WINDOWS\system32\svchost.exe Process Id: 1576 EPROCESS Address: 0x8A48AB90 Process: C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe Process Id: 1604 EPROCESS Address: 0x8A4EB7A0 Process: C:\WINDOWS\system32\alg.exe Process Id: 1632 EPROCESS Address: 0x89B2C738 Process: C:\WINDOWS\system32\WLTRAY.EXE Process Id: 1680 EPROCESS Address: 0x8A54F588 Process: C:\Program Files\Synaptics\SynTP\SynTPEnh.exe Process Id: 1692 EPROCESS Address: 0x8A4AC838 Process: C:\Program Files\X3watch\x3watch.exe Process Id: 1752 EPROCESS Address: 0x8A4AC5B8 Process: C:\WINDOWS\system32\BCMWLTRY.EXE Process Id: 1772 EPROCESS Address: 0x8A54C4D8 Process: C:\WINDOWS\system32\spoolsv.exe Process Id: 1816 EPROCESS Address: 0x8A87B9C8 Process: C:\WINDOWS\system32\ati2evxx.exe Process Id: 1928 EPROCESS Address: 0x8A4CC3C0 Process: C:\Program Files\QuickTime\QTTask.exe Process Id: 1976 EPROCESS Address: 0x8A5DE620 Process: C:\Program Files\iPod\bin\iPodService.exe Process Id: 2024 EPROCESS Address: 0x89BFB7A0 Process: C:\Program Files\AVG\AVG8\avgtray.exe Process Id: 2084 EPROCESS Address: 0x8A902BF8 Process: C:\Program Files\Novatel Wireless\Sprint\Sprint PCS Connection Manager\OSCMUtilityService.exe Process Id: 2108 EPROCESS Address: 0x8A495620 Process: C:\WINDOWS\system32\searchindexer.exe Process Id: 2776 EPROCESS Address: 0x8A61CDA0 Process: C:\PROGRA~1\AVG\AVG8\avgnsx.exe Process Id: 2920 EPROCESS Address: 0x8A4D9488 Process: C:\Program Files\AVG\AVG8\avgrsx.exe Process Id: 4316 EPROCESS Address: 0x8A758020 Process: C:\Program Files\Windows Media Player\wmpnetwk.exe Process Id: 8400 EPROCESS Address: 0x892C7148 Process: C:\WINDOWS\system32\searchfilterhost.exe Process Id: 14548 EPROCESS Address: 0x8913C868 Process: C:\WINDOWS\explorer.exe Process Id: 15540 EPROCESS Address: 0x890E9020 Process: C:\Program Files\Internet Explorer\iexplore.exe Process Id: 15640 EPROCESS Address: 0x890CD328 Process: C:\Program Files\Internet Explorer\iexplore.exe Process Id: 15820 EPROCESS Address: 0x891A95C8 Process: C:\WINDOWS\system32\searchprotocolhost.exe Process Id: 17124 EPROCESS Address: 0x894BD708 Process: C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe Process Id: 17624 EPROCESS Address: 0x88B40938 Process: C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe Process Id: 17684 EPROCESS Address: 0x88AA77D0 Process: C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe Process Id: 17692 EPROCESS Address: 0x88A965A8 Process: C:\Program Files\Internet Explorer\iexplore.exe Process Id: 18388 EPROCESS Address: 0x88AA5330 Process: C:\RkUnhooker\3jtGfWt2q6.exe Process Id: 17092 EPROCESS Address: 0x89055C90 ============================================== >Drivers Driver: C:\WINDOWS\System32\ati3duag.dll Address: 0xBFA9F000 Size: 2756608 bytes Driver: C:\WINDOWS\system32\ntkrnlpa.exe Address: 0x804D7000 Size: 2150400 bytes Driver: PnpManager Address: 0x804D7000 Size: 2150400 bytes Driver: RAW Address: 0x804D7000 Size: 2150400 bytes Driver: WMIxWDM Address: 0x804D7000 Size: 2150400 bytes Driver: Win32k Address: 0xBF800000 Size: 1847296 bytes Driver: C:\WINDOWS\System32\win32k.sys Address: 0xBF800000 Size: 1847296 bytes Driver: C:\WINDOWS\System32\ativvaxx.dll Address: 0xBFD40000 Size: 1753088 bytes Driver: C:\WINDOWS\system32\DRIVERS\ati2mtag.sys Address: 0xBA0A1000 Size: 1638400 bytes Driver: C:\WINDOWS\system32\drivers\sthda.sys Address: 0xB1AFC000 Size: 1171456 bytes Driver: C:\WINDOWS\system32\DRIVERS\bcmwl5.sys Address: 0xB9F52000 Size: 1126400 bytes Driver: C:\WINDOWS\system32\DRIVERS\HSX_DPV.sys Address: 0xB19A7000 Size: 1011712 bytes Driver: C:\WINDOWS\system32\DRIVERS\HSX_CNXT.sys Address: 0xB18F1000 Size: 745472 bytes Driver: Ntfs.sys Address: 0xBA635000 Size: 577536 bytes Driver: C:\WINDOWS\system32\DRIVERS\mrxsmb.sys Address: 0xB16F1000 Size: 458752 bytes Driver: C:\WINDOWS\system32\DRIVERS\update.sys Address: 0xB9CB0000 Size: 385024 bytes Driver: C:\WINDOWS\system32\DRIVERS\tcpip.sys Address: 0xB1815000 Size: 364544 bytes Driver: C:\WINDOWS\system32\DRIVERS\srv.sys Address: 0xAEB35000 Size: 335872 bytes Driver: C:\WINDOWS\System32\Drivers\avgldx86.sys Address: 0xB1600000 Size: 331776 bytes Driver: C:\WINDOWS\system32\DRIVERS\rixdptsk.sys Address: 0xB9EB5000 Size: 331776 bytes Driver: C:\WINDOWS\System32\ATMFD.DLL Address: 0xBFFA0000 Size: 286720 bytes Driver: C:\WINDOWS\System32\ati2cqag.dll Address: 0xBFA18000 Size: 282624 bytes Driver: C:\WINDOWS\System32\ati2dvag.dll Address: 0xBF9D5000 Size: 274432 bytes Driver: C:\WINDOWS\System32\atikvmag.dll Address: 0xBFA5D000 Size: 270336 bytes Driver: C:\WINDOWS\System32\Drivers\HTTP.sys Address: 0xAED3F000 Size: 266240 bytes Driver: C:\WINDOWS\system32\DRIVERS\HSXHWAZL.sys Address: 0xB1A9E000 Size: 237568 bytes Driver: C:\WINDOWS\system32\DRIVERS\NWADIenum.sys Address: 0xB9C7C000 Size: 212992 bytes Driver: C:\WINDOWS\system32\DRIVERS\rdpdr.sys Address: 0xB9D6B000 Size: 196608 bytes Driver: C:\WINDOWS\system32\DRIVERS\SynTP.sys Address: 0xB9E86000 Size: 192512 bytes Driver: ACPI.sys Address: 0xBA779000 Size: 188416 bytes Driver: C:\WINDOWS\system32\DRIVERS\mrxdav.sys Address: 0xAF093000 Size: 184320 bytes Driver: NDIS.sys Address: 0xBA608000 Size: 184320 bytes Driver: C:\WINDOWS\system32\drivers\kmixer.sys Address: 0xABD11000 Size: 176128 bytes Driver: C:\WINDOWS\system32\DRIVERS\rdbss.sys Address: 0xB1761000 Size: 176128 bytes Driver: C:\WINDOWS\system32\DRIVERS\HDAudBus.sys Address: 0xBA065000 Size: 163840 bytes Driver: C:\WINDOWS\system32\DRIVERS\netbt.sys Address: 0xB17AE000 Size: 163840 bytes Driver: dmio.sys Address: 0xBA723000 Size: 155648 bytes Driver: C:\WINDOWS\system32\DRIVERS\ipnat.sys Address: 0xB17D6000 Size: 155648 bytes Driver: C:\WINDOWS\system32\drivers\portcls.sys Address: 0xB1AD8000 Size: 147456 bytes Driver: C:\WINDOWS\system32\DRIVERS\USBPORT.SYS Address: 0xB9F2E000 Size: 147456 bytes Driver: C:\WINDOWS\system32\DRIVERS\ks.sys Address: 0xB9E63000 Size: 143360 bytes Driver: C:\WINDOWS\System32\drivers\afd.sys Address: 0xB178C000 Size: 139264 bytes Driver: ACPI_HAL Address: 0x806E4000 Size: 134400 bytes Driver: C:\WINDOWS\system32\hal.dll Address: 0x806E4000 Size: 134400 bytes Driver: fltmgr.sys Address: 0xBA6EB000 Size: 131072 bytes Driver: ftdisk.sys Address: 0xBA749000 Size: 126976 bytes Driver: C:\WINDOWS\system32\DRIVERS\mcdbus.sys Address: 0xB9D4E000 Size: 118784 bytes Driver: Mup.sys Address: 0xBA5EE000 Size: 106496 bytes Driver: C:\WINDOWS\System32\Drivers\avgtdix.sys Address: 0xB17FC000 Size: 102400 bytes Driver: atapi.sys Address: 0xBA70B000 Size: 98304 bytes Driver: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xB15C0000 Size: 98304 bytes Driver: C:\WINDOWS\system32\DRIVERS\SCSIPORT.SYS Address: 0xB9D36000 Size: 98304 bytes Driver: KSecDD.sys Address: 0xBA6C2000 Size: 94208 bytes Driver: C:\WINDOWS\system32\DRIVERS\ndiswan.sys Address: 0xB9E4C000 Size: 94208 bytes Driver: C:\WINDOWS\system32\drivers\wdmaud.sys Address: 0xAEFB6000 Size: 86016 bytes Driver: C:\WINDOWS\system32\DRIVERS\rimsptsk.sys Address: 0xB9F06000 Size: 81920 bytes Driver: C:\WINDOWS\system32\DRIVERS\sdbus.sys Address: 0xB9F1A000 Size: 81920 bytes Driver: C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS Address: 0xBA08D000 Size: 81920 bytes Driver: C:\WINDOWS\system32\DRIVERS\ipsec.sys Address: 0xB186E000 Size: 77824 bytes Driver: C:\WINDOWS\System32\drivers\dxg.sys Address: 0xBF9C3000 Size: 73728 bytes Driver: sr.sys Address: 0xBA6D9000 Size: 73728 bytes Driver: pci.sys Address: 0xBA768000 Size: 69632 bytes Driver: C:\WINDOWS\system32\DRIVERS\psched.sys Address: 0xB9E3B000 Size: 69632 bytes Driver: C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys Address: 0xBA998000 Size: 65536 bytes Driver: C:\WINDOWS\System32\Drivers\Cdfs.SYS Address: 0xB9E2B000 Size: 65536 bytes Driver: C:\WINDOWS\system32\DRIVERS\cdrom.sys Address: 0xBA9E8000 Size: 65536 bytes Driver: C:\WINDOWS\system32\DRIVERS\nic1394.sys Address: 0xBA9A8000 Size: 65536 bytes Driver: ohci1394.sys Address: 0xBA8B8000 Size: 65536 bytes Driver: C:\WINDOWS\system32\DRIVERS\arp1394.sys Address: 0xBAAF8000 Size: 61440 bytes Driver: C:\WINDOWS\system32\drivers\drmk.sys Address: 0xBAA88000 Size: 61440 bytes Driver: C:\WINDOWS\system32\DRIVERS\redbook.sys Address: 0xBA9F8000 Size: 61440 bytes Driver: C:\WINDOWS\system32\drivers\sysaudio.sys Address: 0xB16A1000 Size: 61440 bytes Driver: C:\WINDOWS\system32\DRIVERS\usbhub.sys Address: 0xBAAA8000 Size: 61440 bytes Driver: C:\WINDOWS\system32\DRIVERS\1394BUS.SYS Address: 0xBA8C8000 Size: 57344 bytes Driver: C:\WINDOWS\system32\DRIVERS\rimmptsk.sys Address: 0xBA9B8000 Size: 57344 bytes Driver: C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS Address: 0xBA908000 Size: 53248 bytes Driver: C:\WINDOWS\system32\DRIVERS\i8042prt.sys Address: 0xBA9C8000 Size: 53248 bytes Driver: C:\WINDOWS\system32\DRIVERS\rasl2tp.sys Address: 0xBAA08000 Size: 53248 bytes Driver: VolSnap.sys Address: 0xBA8E8000 Size: 53248 bytes Driver: C:\WINDOWS\System32\Drivers\pcouffin.sys Address: 0xBAA48000 Size: 49152 bytes Driver: C:\WINDOWS\system32\DRIVERS\raspptp.sys Address: 0xBAA28000 Size: 49152 bytes Driver: C:\WINDOWS\System32\Drivers\Fips.SYS Address: 0xBAB18000 Size: 45056 bytes Driver: C:\WINDOWS\system32\DRIVERS\imapi.sys Address: 0xBA9D8000 Size: 45056 bytes Driver: MountMgr.sys Address: 0xBA8D8000 Size: 45056 bytes Driver: C:\WINDOWS\system32\DRIVERS\raspppoe.sys Address: 0xBAA18000 Size: 45056 bytes Driver: isapnp.sys Address: 0xBA8A8000 Size: 40960 bytes Driver: C:\WINDOWS\System32\Drivers\NDProxy.SYS Address: 0xBAA98000 Size: 40960 bytes Driver: C:\WINDOWS\system32\DRIVERS\termdd.sys Address: 0xBAA58000 Size: 40960 bytes Driver: disk.sys Address: 0xBA8F8000 Size: 36864 bytes Driver: C:\WINDOWS\system32\DRIVERS\intelppm.sys Address: 0xBA988000 Size: 36864 bytes Driver: C:\WINDOWS\system32\DRIVERS\msgpc.sys Address: 0xBAA38000 Size: 36864 bytes Driver: C:\WINDOWS\system32\DRIVERS\netbios.sys Address: 0xBAB08000 Size: 36864 bytes Driver: C:\WINDOWS\system32\DRIVERS\wanarp.sys Address: 0xBAAE8000 Size: 36864 bytes Driver: C:\DOCUME~1\Robert\LOCALS~1\Temp\catchme.sys Address: 0xBABD8000 Size: 32768 bytes Driver: C:\WINDOWS\System32\Drivers\Modem.SYS Address: 0xBAC58000 Size: 32768 bytes Driver: C:\WINDOWS\System32\Drivers\Npfs.SYS Address: 0xBAB78000 Size: 32768 bytes Driver: C:\WINDOWS\system32\DRIVERS\usbehci.sys Address: 0xBAC20000 Size: 32768 bytes Driver: C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS Address: 0xBAB60000 Size: 28672 bytes Driver: C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS Address: 0xBAB28000 Size: 28672 bytes Driver: C:\WINDOWS\System32\Drivers\avgmfx86.sys Address: 0xBAB80000 Size: 24576 bytes Driver: C:\WINDOWS\system32\DRIVERS\kbdclass.sys Address: 0xBAC30000 Size: 24576 bytes Driver: C:\WINDOWS\system32\DRIVERS\mouclass.sys Address: 0xBAC28000 Size: 24576 bytes Driver: C:\WINDOWS\System32\Drivers\rkhdrv40.SYS Address: 0xBABC0000 Size: 24576 bytes Driver: C:\WINDOWS\system32\DRIVERS\usbuhci.sys Address: 0xBAC18000 Size: 24576 bytes Driver: C:\WINDOWS\System32\drivers\vga.sys Address: 0xBAB68000 Size: 24576 bytes Driver: C:\WINDOWS\System32\Drivers\Msfs.SYS Address: 0xBAB70000 Size: 20480 bytes Driver: PartMgr.sys Address: 0xBAB30000 Size: 20480 bytes Driver: C:\WINDOWS\system32\DRIVERS\ptilink.sys Address: 0xBAC40000 Size: 20480 bytes Driver: C:\WINDOWS\system32\DRIVERS\raspti.sys Address: 0xBAC48000 Size: 20480 bytes Driver: C:\WINDOWS\system32\DRIVERS\TDI.SYS Address: 0xBAC38000 Size: 20480 bytes Driver: C:\WINDOWS\System32\watchdog.sys Address: 0xBAC50000 Size: 20480 bytes Driver: C:\WINDOWS\system32\DRIVERS\BATTC.SYS Address: 0xBACC0000 Size: 16384 bytes Driver: C:\WINDOWS\system32\DRIVERS\CmBatt.sys Address: 0xBADA0000 Size: 16384 bytes Driver: C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys Address: 0xAED2B000 Size: 16384 bytes Driver: C:\WINDOWS\system32\DRIVERS\mssmbios.sys Address: 0xBA241000 Size: 16384 bytes Driver: C:\WINDOWS\system32\DRIVERS\ndisuio.sys Address: 0xAF47C000 Size: 16384 bytes Driver: C:\WINDOWS\system32\BOOTVID.dll Address: 0xBACB8000 Size: 12288 bytes Driver: compbatt.sys Address: 0xBACBC000 Size: 12288 bytes Driver: C:\WINDOWS\System32\drivers\Dxapi.sys Address: 0xB9D2E000 Size: 12288 bytes Driver: C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys Address: 0xBA5B6000 Size: 12288 bytes Driver: C:\WINDOWS\system32\DRIVERS\ndistapi.sys Address: 0xBA5AE000 Size: 12288 bytes Driver: C:\WINDOWS\system32\DRIVERS\rasacd.sys Address: 0xB18ED000 Size: 12288 bytes Driver: C:\WINDOWS\system32\DRIVERS\wmiacpi.sys Address: 0xBAD9C000 Size: 12288 bytes Driver: C:\WINDOWS\System32\Drivers\Beep.SYS Address: 0xBAE3C000 Size: 8192 bytes Driver: dmload.sys Address: 0xBADAC000 Size: 8192 bytes Driver: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xBAE6E000 Size: 8192 bytes Driver: C:\WINDOWS\System32\Drivers\Fs_Rec.SYS Address: 0xBADEA000 Size: 8192 bytes Driver: C:\WINDOWS\system32\KDCOM.DLL Address: 0xBADA8000 Size: 8192 bytes Driver: C:\WINDOWS\System32\Drivers\mnmdd.SYS Address: 0xBAE42000 Size: 8192 bytes Driver: C:\WINDOWS\system32\Drivers\PROCEXP90.SYS Address: 0xBADD2000 Size: 8192 bytes Driver: C:\WINDOWS\System32\DRIVERS\RDPCDD.sys Address: 0xBAE44000 Size: 8192 bytes Driver: C:\WINDOWS\system32\DRIVERS\swenum.sys Address: 0xBADD6000 Size: 8192 bytes Driver: C:\WINDOWS\system32\DRIVERS\USBD.SYS Address: 0xBADD4000 Size: 8192 bytes Driver: C:\WINDOWS\system32\DRIVERS\WMILIB.SYS Address: 0xBADAA000 Size: 8192 bytes Driver: C:\WINDOWS\system32\DRIVERS\audstub.sys Address: 0xBAF71000 Size: 4096 bytes Driver: C:\WINDOWS\System32\drivers\dxgthk.sys Address: 0xBAEC7000 Size: 4096 bytes Driver: C:\WINDOWS\System32\Drivers\Null.SYS Address: 0xBAFDA000 Size: 4096 bytes Driver: pciide.sys Address: 0xBAE70000 Size: 4096 bytes ============================================== >Stealth ============================================== >Files Suspect File: C:\Documents and Settings\Robert\Local Settings\Temporary Internet Files\Content.IE5\NR8SE243\GetOneMessage[1].txt Status: Hidden Suspect File: C:\Documents and Settings\Robert\Local Settings\Temporary Internet Files\Content.IE5\SEFWK55V\77079[1].xml Status: Hidden Suspect File: C:\Documents and Settings\Robert\Local Settings\Temporary Internet Files\Content.IE5\W28BSN0M\GetJobList[2].txt Status: Hidden ============================================== >Hooks ntkrnlpa.exe–>IofCallDriver, Type: Address change at address 0x80555780 hook handler located in [catchme.sys] [15540]explorer.exe–>kernel32.dll–>GetProcAddress, Type: IAT modification at address 0x01001268 hook handler located in [shimeng.dll] [15640]iexplore.exe–>user32.dll–>CallNextHookEx, Type: Inline - RelativeJump at address 0x7E42B3C6 hook handler located in [ieframe.dll] [15640]iexplore.exe–>user32.dll–>CreateWindowExW, Type: Inline - RelativeJump at address 0x7E42D0A3 hook handler located in [ieframe.dll] [15640]iexplore.exe–>user32.dll–>DialogBoxIndirectParamA, Type: Inline - RelativeJump at address 0x7E456D7D hook handler located in [ieframe.dll] [15640]iexplore.exe–>user32.dll–>DialogBoxIndirectParamW, Type: Inline - RelativeJump at address 0x7E432072 hook handler located in [ieframe.dll] [15640]iexplore.exe–>user32.dll–>DialogBoxParamA, Type: Inline - RelativeJump at address 0x7E43B144 hook handler located in [ieframe.dll] [15640]iexplore.exe–>user32.dll–>DialogBoxParamW, Type: Inline - RelativeJump at address 0x7E4247AB hook handler located in [ieframe.dll] [15640]iexplore.exe–>user32.dll–>MessageBoxExA, Type: Inline - RelativeJump at address 0x7E45085C hook handler located in [ieframe.dll] [15640]iexplore.exe–>user32.dll–>MessageBoxExW, Type: Inline - RelativeJump at address 0x7E450838 hook handler located in [ieframe.dll] [15640]iexplore.exe–>user32.dll–>MessageBoxIndirectA, Type: Inline - RelativeJump at address 0x7E43A082 hook handler located in [ieframe.dll] [15640]iexplore.exe–>user32.dll–>MessageBoxIndirectW, Type: Inline - RelativeJump at address 0x7E4664D5 hook handler located in [ieframe.dll] [15640]iexplore.exe–>user32.dll–>SetWindowsHookExW, Type: Inline - RelativeJump at address 0x7E42820F hook handler located in [ieframe.dll] [15640]iexplore.exe–>user32.dll–>UnhookWindowsHookEx, Type: Inline - RelativeJump at address 0x7E42D5F3 hook handler located in [ieframe.dll] [15820]iexplore.exe–>user32.dll–>CreateWindowExW, Type: Inline - RelativeJump at address 0x7E42D0A3 hook handler located in [ieframe.dll] [15820]iexplore.exe–>user32.dll–>DialogBoxIndirectParamA, Type: Inline - RelativeJump at address 0x7E456D7D hook handler located in [ieframe.dll] [15820]iexplore.exe–>user32.dll–>DialogBoxIndirectParamW, Type: Inline - RelativeJump at address 0x7E432072 hook handler located in [ieframe.dll] [15820]iexplore.exe–>user32.dll–>DialogBoxParamA, Type: Inline - RelativeJump at address 0x7E43B144 hook handler located in [ieframe.dll] [15820]iexplore.exe–>user32.dll–>DialogBoxParamW, Type: Inline - RelativeJump at address 0x7E4247AB hook handler located in [ieframe.dll] [15820]iexplore.exe–>user32.dll–>MessageBoxExA, Type: Inline - RelativeJump at address 0x7E45085C hook handler located in [ieframe.dll] [15820]iexplore.exe–>user32.dll–>MessageBoxExW, Type: Inline - RelativeJump at address 0x7E450838 hook handler located in [ieframe.dll] [15820]iexplore.exe–>user32.dll–>MessageBoxIndirectA, Type: Inline - RelativeJump at address 0x7E43A082 hook handler located in [ieframe.dll] [15820]iexplore.exe–>user32.dll–>MessageBoxIndirectW, Type: Inline - RelativeJump at address 0x7E4664D5 hook handler located in [ieframe.dll] [18388]iexplore.exe–>user32.dll–>CallNextHookEx, Type: Inline - RelativeJump at address 0x7E42B3C6 hook handler located in [ieframe.dll] [18388]iexplore.exe–>user32.dll–>CreateWindowExW, Type: Inline - RelativeJump at address 0x7E42D0A3 hook handler located in [ieframe.dll] [18388]iexplore.exe–>user32.dll–>DialogBoxIndirectParamA, Type: Inline - RelativeJump at address 0x7E456D7D hook handler located in [ieframe.dll] [18388]iexplore.exe–>user32.dll–>DialogBoxIndirectParamW, Type: Inline - RelativeJump at address 0x7E432072 hook handler located in [ieframe.dll] [18388]iexplore.exe–>user32.dll–>DialogBoxParamA, Type: Inline - RelativeJump at address 0x7E43B144 hook handler located in [ieframe.dll] [18388]iexplore.exe–>user32.dll–>DialogBoxParamW, Type: Inline - RelativeJump at address 0x7E4247AB hook handler located in [ieframe.dll] [18388]iexplore.exe–>user32.dll–>MessageBoxExA, Type: Inline - RelativeJump at address 0x7E45085C hook handler located in [ieframe.dll] [18388]iexplore.exe–>user32.dll–>MessageBoxExW, Type: Inline - RelativeJump at address 0x7E450838 hook handler located in [ieframe.dll] [18388]iexplore.exe–>user32.dll–>MessageBoxIndirectA, Type: Inline - RelativeJump at address 0x7E43A082 hook handler located in [ieframe.dll] [18388]iexplore.exe–>user32.dll–>MessageBoxIndirectW, Type: Inline - RelativeJump at address 0x7E4664D5 hook handler located in [ieframe.dll] [18388]iexplore.exe–>user32.dll–>SetWindowsHookExW, Type: Inline - RelativeJump at address 0x7E42820F hook handler located in [ieframe.dll] [18388]iexplore.exe–>user32.dll–>UnhookWindowsHookEx, Type: Inline - RelativeJump at address 0x7E42D5F3 hook handler located in [ieframe.dll] [2776]searchindexer.exe–>kernel32.dll–>WriteFile, Type: Inline - RelativeJump at address 0x7C810E27 hook handler located in [mssrch.dll] [2776]searchindexer.exe–>kernel32.dll–>WriteFile, Type: Inline - SEH at address 0x7C810E2C hook handler located in [unknown_code_page] [2776]searchindexer.exe–>kernel32.dll–>WriteFile, Type: Inline - SEH at address 0x7C810E2D hook handler located in [unknown_code_page] Service Pack 3 9 23 2009 16:22:07.375 Loaded driver \WINDOWS\system32\ntkrnlpa.exe Loaded driver \WINDOWS\system32\hal.dll Loaded driver \WINDOWS\system32\KDCOM.DLL Loaded driver \WINDOWS\system32\BOOTVID.dll Loaded driver ACPI.sys Loaded driver \WINDOWS\system32\DRIVERS\WMILIB.SYS Loaded driver pci.sys Loaded driver isapnp.sys Loaded driver ohci1394.sys Loaded driver \WINDOWS\system32\DRIVERS\1394BUS.SYS Loaded driver compbatt.sys Loaded driver \WINDOWS\system32\DRIVERS\BATTC.SYS Loaded driver pciide.sys Loaded driver \WINDOWS\system32\DRIVERS\PCIIDEX.SYS Loaded driver MountMgr.sys Loaded driver ftdisk.sys Loaded driver dmload.sys Loaded driver dmio.sys Loaded driver PartMgr.sys Loaded driver VolSnap.sys Loaded driver atapi.sys Loaded driver disk.sys Loaded driver \WINDOWS\system32\DRIVERS\CLASSPNP.SYS Loaded driver fltmgr.sys Loaded driver sr.sys Loaded driver KSecDD.sys Loaded driver Ntfs.sys Loaded driver NDIS.sys Loaded driver Mup.sys Loaded driver \SystemRoot\system32\DRIVERS\intelppm.sys Loaded driver \SystemRoot\system32\DRIVERS\wmiacpi.sys Loaded driver \SystemRoot\system32\DRIVERS\CmBatt.sys Loaded driver \SystemRoot\system32\DRIVERS\ati2mtag.sys Loaded driver \SystemRoot\system32\DRIVERS\HDAudBus.sys Loaded driver \SystemRoot\system32\DRIVERS\bcmwl5.sys Loaded driver \SystemRoot\system32\DRIVERS\usbuhci.sys Loaded driver \SystemRoot\system32\DRIVERS\usbehci.sys Loaded driver \SystemRoot\system32\DRIVERS\bcm4sbxp.sys Loaded driver \SystemRoot\system32\DRIVERS\nic1394.sys Loaded driver \SystemRoot\system32\DRIVERS\sdbus.sys Loaded driver \SystemRoot\system32\DRIVERS\rimmptsk.sys Loaded driver \SystemRoot\system32\DRIVERS\rimsptsk.sys Loaded driver \SystemRoot\system32\DRIVERS\rixdptsk.sys Loaded driver \SystemRoot\system32\DRIVERS\i8042prt.sys Loaded driver \SystemRoot\system32\DRIVERS\SynTP.sys Loaded driver \SystemRoot\system32\DRIVERS\mouclass.sys Loaded driver \SystemRoot\system32\DRIVERS\kbdclass.sys Loaded driver \SystemRoot\system32\DRIVERS\imapi.sys Loaded driver \SystemRoot\system32\DRIVERS\cdrom.sys Loaded driver \SystemRoot\system32\DRIVERS\redbook.sys Loaded driver \SystemRoot\System32\Drivers\GEARAspiWDM.sys Loaded driver \SystemRoot\system32\DRIVERS\audstub.sys Loaded driver \SystemRoot\system32\DRIVERS\rasl2tp.sys Loaded driver \SystemRoot\system32\DRIVERS\ndistapi.sys Loaded driver \SystemRoot\system32\DRIVERS\ndiswan.sys Loaded driver \SystemRoot\system32\DRIVERS\raspppoe.sys Loaded driver \SystemRoot\system32\DRIVERS\raspptp.sys Loaded driver \SystemRoot\system32\DRIVERS\msgpc.sys Loaded driver \SystemRoot\system32\DRIVERS\psched.sys Loaded driver \SystemRoot\system32\DRIVERS\ptilink.sys Loaded driver \SystemRoot\system32\DRIVERS\raspti.sys Loaded driver \SystemRoot\System32\Drivers\pcouffin.sys Loaded driver \SystemRoot\system32\DRIVERS\rdpdr.sys Loaded driver \SystemRoot\system32\DRIVERS\termdd.sys Loaded driver \SystemRoot\system32\DRIVERS\mcdbus.sys Loaded driver \SystemRoot\system32\DRIVERS\swenum.sys Loaded driver \SystemRoot\system32\DRIVERS\update.sys Loaded driver \SystemRoot\system32\DRIVERS\mssmbios.sys Loaded driver \SystemRoot\system32\DRIVERS\NWADIenum.sys Loaded driver \SystemRoot\System32\Drivers\NDProxy.SYS Did not load driver \SystemRoot\System32\Drivers\NDProxy.SYS Loaded driver \SystemRoot\system32\drivers\sthda.sys Loaded driver \SystemRoot\system32\DRIVERS\HSXHWAZL.sys Loaded driver \SystemRoot\system32\DRIVERS\HSX_DPV.sys Loaded driver \SystemRoot\system32\DRIVERS\HSX_CNXT.sys Loaded driver \SystemRoot\System32\Drivers\Modem.SYS Loaded driver \SystemRoot\system32\DRIVERS\usbhub.sys Did not load driver \SystemRoot\System32\Drivers\lbrtfdc.SYS Did not load driver \SystemRoot\System32\Drivers\Fdc.SYS Did not load driver \SystemRoot\System32\Drivers\Flpydisk.SYS Did not load driver \SystemRoot\System32\Drivers\Sfloppy.SYS Did not load driver \SystemRoot\System32\Drivers\i2omgmt.SYS Did not load driver \SystemRoot\System32\Drivers\Changer.SYS Did not load driver \SystemRoot\System32\Drivers\Cdaudio.SYS Loaded driver \SystemRoot\System32\Drivers\Fs_Rec.SYS Loaded driver \SystemRoot\System32\Drivers\Null.SYS Loaded driver \SystemRoot\System32\Drivers\Beep.SYS Did not load driver \SystemRoot\system32\DRIVERS\kbdhid.sys Loaded driver \SystemRoot\System32\drivers\vga.sys Loaded driver \SystemRoot\System32\Drivers\mnmdd.SYS Loaded driver \SystemRoot\System32\DRIVERS\RDPCDD.sys Loaded driver \SystemRoot\System32\Drivers\Msfs.SYS Loaded driver \SystemRoot\System32\Drivers\Npfs.SYS Loaded driver \SystemRoot\system32\DRIVERS\rasacd.sys Loaded driver \SystemRoot\system32\DRIVERS\ipsec.sys Loaded driver \SystemRoot\system32\DRIVERS\tcpip.sys Loaded driver \SystemRoot\System32\Drivers\avgtdix.sys Loaded driver \SystemRoot\system32\DRIVERS\ipnat.sys Loaded driver \SystemRoot\system32\DRIVERS\wanarp.sys Loaded driver \SystemRoot\system32\DRIVERS\netbt.sys Loaded driver \SystemRoot\System32\drivers\afd.sys Loaded driver \SystemRoot\system32\DRIVERS\arp1394.sys Loaded driver \SystemRoot\system32\DRIVERS\netbios.sys Did not load driver \SystemRoot\System32\Drivers\PCIDump.SYS Loaded driver \SystemRoot\system32\DRIVERS\rdbss.sys Loaded driver \SystemRoot\system32\DRIVERS\mrxsmb.sys Did not load driver \systemroot\system32\drivers\ivrcrpvrtqbwwxwh.sys Loaded driver \SystemRoot\System32\Drivers\Fips.SYS Loaded driver \SystemRoot\System32\Drivers\avgmfx86.sys Loaded driver \SystemRoot\System32\Drivers\avgldx86.sys Loaded driver \SystemRoot\System32\Drivers\Cdfs.SYS Loaded driver \SystemRoot\system32\DRIVERS\ndisuio.sys Did not load driver \SystemRoot\system32\DRIVERS\rdbss.sys Did not load driver \SystemRoot\system32\DRIVERS\mrxsmb.sys Loaded driver \SystemRoot\system32\DRIVERS\mrxdav.sys Did not load driver \SystemRoot\System32\Drivers\Parport.SYS Did not load driver \SystemRoot\System32\Drivers\Serial.SYS Loaded driver \SystemRoot\system32\drivers\wdmaud.sys Loaded driver \SystemRoot\system32\drivers\sysaudio.sys Loaded driver \SystemRoot\system32\drivers\splitter.sys Loaded driver \SystemRoot\system32\drivers\aec.sys Loaded driver \SystemRoot\system32\drivers\swmidi.sys Loaded driver \SystemRoot\system32\drivers\DMusic.sys Loaded driver \SystemRoot\system32\drivers\kmixer.sys Loaded driver \SystemRoot\system32\drivers\drmkaud.sys Loaded driver \SystemRoot\System32\Drivers\HTTP.sys Loaded driver \SystemRoot\system32\DRIVERS\mdmxsdk.sys Loaded driver \SystemRoot\system32\DRIVERS\srv.sys Did not load driver \SystemRoot\system32\DRIVERS\ipnat.sys Loaded driver \SystemRoot\system32\drivers\kmixer.sys Service Pack 3 9 24 2009 09:46:07.375 Loaded driver \WINDOWS\system32\ntkrnlpa.exe Loaded driver \WINDOWS\system32\hal.dll Loaded driver \WINDOWS\system32\KDCOM.DLL Loaded driver \WINDOWS\system32\BOOTVID.dll Loaded driver ACPI.sys Loaded driver \WINDOWS\system32\DRIVERS\WMILIB.SYS Loaded driver pci.sys Loaded driver isapnp.sys Loaded driver ohci1394.sys Loaded driver \WINDOWS\system32\DRIVERS\1394BUS.SYS Loaded driver compbatt.sys Loaded driver \WINDOWS\system32\DRIVERS\BATTC.SYS Loaded driver pciide.sys Loaded driver \WINDOWS\system32\DRIVERS\PCIIDEX.SYS Loaded driver MountMgr.sys Loaded driver ftdisk.sys Loaded driver dmload.sys Loaded driver dmio.sys Loaded driver PartMgr.sys Loaded driver VolSnap.sys Loaded driver atapi.sys Loaded driver disk.sys Loaded driver \WINDOWS\system32\DRIVERS\CLASSPNP.SYS Loaded driver fltmgr.sys Loaded driver sr.sys Loaded driver KSecDD.sys Loaded driver Ntfs.sys Loaded driver NDIS.sys Loaded driver Mup.sys Loaded driver \SystemRoot\system32\DRIVERS\intelppm.sys Loaded driver \SystemRoot\system32\DRIVERS\wmiacpi.sys Loaded driver \SystemRoot\system32\DRIVERS\CmBatt.sys Loaded driver \SystemRoot\system32\DRIVERS\ati2mtag.sys Loaded driver \SystemRoot\system32\DRIVERS\HDAudBus.sys Loaded driver \SystemRoot\system32\DRIVERS\bcmwl5.sys Loaded driver \SystemRoot\system32\DRIVERS\usbuhci.sys Loaded driver \SystemRoot\system32\DRIVERS\usbehci.sys Loaded driver \SystemRoot\system32\DRIVERS\bcm4sbxp.sys Loaded driver \SystemRoot\system32\DRIVERS\nic1394.sys Loaded driver \SystemRoot\system32\DRIVERS\sdbus.sys Loaded driver \SystemRoot\system32\DRIVERS\rimmptsk.sys Loaded driver \SystemRoot\system32\DRIVERS\rimsptsk.sys Loaded driver \SystemRoot\system32\DRIVERS\rixdptsk.sys Loaded driver \SystemRoot\system32\DRIVERS\i8042prt.sys Loaded driver \SystemRoot\system32\DRIVERS\SynTP.sys Loaded driver \SystemRoot\system32\DRIVERS\mouclass.sys Loaded driver \SystemRoot\system32\DRIVERS\kbdclass.sys Loaded driver \SystemRoot\system32\DRIVERS\imapi.sys Loaded driver \SystemRoot\system32\DRIVERS\cdrom.sys Loaded driver \SystemRoot\system32\DRIVERS\redbook.sys Loaded driver \SystemRoot\System32\Drivers\GEARAspiWDM.sys Loaded driver \SystemRoot\system32\DRIVERS\audstub.sys Loaded driver \SystemRoot\system32\DRIVERS\rasl2tp.sys Loaded driver \SystemRoot\system32\DRIVERS\ndistapi.sys Loaded driver \SystemRoot\system32\DRIVERS\ndiswan.sys Loaded driver \SystemRoot\system32\DRIVERS\raspppoe.sys Loaded driver \SystemRoot\system32\DRIVERS\raspptp.sys Loaded driver \SystemRoot\system32\DRIVERS\msgpc.sys Loaded driver \SystemRoot\system32\DRIVERS\psched.sys Loaded driver \SystemRoot\system32\DRIVERS\ptilink.sys Loaded driver \SystemRoot\system32\DRIVERS\raspti.sys Loaded driver \SystemRoot\System32\Drivers\pcouffin.sys Loaded driver \SystemRoot\system32\DRIVERS\rdpdr.sys Loaded driver \SystemRoot\system32\DRIVERS\termdd.sys Loaded driver \SystemRoot\system32\DRIVERS\mcdbus.sys Loaded driver \SystemRoot\system32\DRIVERS\swenum.sys Loaded driver \SystemRoot\system32\DRIVERS\update.sys Loaded driver \SystemRoot\system32\DRIVERS\mssmbios.sys Loaded driver \SystemRoot\system32\DRIVERS\NWADIenum.sys Loaded driver \SystemRoot\System32\Drivers\NDProxy.SYS Did not load driver \SystemRoot\System32\Drivers\NDProxy.SYS Loaded driver \SystemRoot\system32\drivers\sthda.sys Loaded driver \SystemRoot\system32\DRIVERS\HSXHWAZL.sys Loaded driver \SystemRoot\system32\DRIVERS\HSX_DPV.sys Loaded driver \SystemRoot\system32\DRIVERS\HSX_CNXT.sys Loaded driver \SystemRoot\System32\Drivers\Modem.SYS Loaded driver \SystemRoot\system32\DRIVERS\usbhub.sys Did not load driver \SystemRoot\System32\Drivers\lbrtfdc.SYS Did not load driver \SystemRoot\System32\Drivers\Fdc.SYS Did not load driver \SystemRoot\System32\Drivers\Flpydisk.SYS Did not load driver \SystemRoot\System32\Drivers\Sfloppy.SYS Did not load driver \SystemRoot\System32\Drivers\i2omgmt.SYS Did not load driver \SystemRoot\System32\Drivers\Changer.SYS Did not load driver \SystemRoot\System32\Drivers\Cdaudio.SYS Loaded driver \SystemRoot\System32\Drivers\Fs_Rec.SYS Loaded driver \SystemRoot\System32\Drivers\Null.SYS Loaded driver \SystemRoot\System32\Drivers\Beep.SYS Did not load driver \SystemRoot\system32\DRIVERS\kbdhid.sys Loaded driver \SystemRoot\System32\drivers\vga.sys Loaded driver \SystemRoot\System32\Drivers\mnmdd.SYS Loaded driver \SystemRoot\System32\DRIVERS\RDPCDD.sys Loaded driver \SystemRoot\System32\Drivers\Msfs.SYS Loaded driver \SystemRoot\System32\Drivers\Npfs.SYS Loaded driver \SystemRoot\system32\DRIVERS\rasacd.sys Loaded driver \SystemRoot\system32\DRIVERS\ipsec.sys Loaded driver \SystemRoot\system32\DRIVERS\tcpip.sys Loaded driver \SystemRoot\System32\Drivers\avgtdix.sys Loaded driver \SystemRoot\system32\DRIVERS\ipnat.sys Loaded driver \SystemRoot\system32\DRIVERS\wanarp.sys Loaded driver \SystemRoot\system32\DRIVERS\netbt.sys Loaded driver \SystemRoot\System32\drivers\afd.sys Loaded driver \SystemRoot\system32\DRIVERS\arp1394.sys Loaded driver \SystemRoot\system32\DRIVERS\netbios.sys Did not load driver \SystemRoot\System32\Drivers\PCIDump.SYS Loaded driver \SystemRoot\system32\DRIVERS\rdbss.sys Loaded driver \SystemRoot\system32\DRIVERS\mrxsmb.sys Did not load driver \systemroot\system32\drivers\ivrcrpvrtqbwwxwh.sys Loaded driver \SystemRoot\System32\Drivers\Fips.SYS Loaded driver \SystemRoot\System32\Drivers\avgmfx86.sys Loaded driver \SystemRoot\System32\Drivers\avgldx86.sys Loaded driver \SystemRoot\System32\Drivers\Cdfs.SYS Loaded driver \SystemRoot\system32\DRIVERS\ndisuio.sys Did not load driver \SystemRoot\system32\DRIVERS\rdbss.sys Did not load driver \SystemRoot\system32\DRIVERS\mrxsmb.sys Loaded driver \SystemRoot\system32\DRIVERS\mrxdav.sys Did not load driver \SystemRoot\System32\Drivers\Parport.SYS Did not load driver \SystemRoot\System32\Drivers\Serial.SYS Loaded driver \SystemRoot\System32\Drivers\HTTP.sys Loaded driver \SystemRoot\system32\DRIVERS\mdmxsdk.sys Loaded driver \SystemRoot\system32\DRIVERS\srv.sys Did not load driver \SystemRoot\system32\DRIVERS\ipnat.sys Loaded driver \SystemRoot\system32\drivers\wdmaud.sys Loaded driver \SystemRoot\system32\drivers\sysaudio.sys Loaded driver \SystemRoot\system32\drivers\splitter.sys Loaded driver \SystemRoot\system32\drivers\aec.sys Loaded driver \SystemRoot\system32\drivers\swmidi.sys Loaded driver \SystemRoot\system32\drivers\DMusic.sys Loaded driver \SystemRoot\system32\drivers\kmixer.sys Loaded driver \SystemRoot\system32\drivers\drmkaud.sys Loaded driver \SystemRoot\system32\drivers\kmixer.sys

Hi,

Please do the following:

• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
• They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

sysrst::

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

• Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
• ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
• When finished, it shall produce a log for you.
• Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.


The log will be really large. Please zip it up and attach it to your next post.

If it is too large to attach, please upload it to media fire and post the sharing link:

www.mediafire.com

NEXT

• Please open your MalwareBytes AntiMalware Program
• Click the Update Tab and search for updates
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish, so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected. <– very important
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

Ok, I just zipped all the logs, but the Combofix log doesn't seem any bigger than normal.

Reboot your machine if you haven't already done so and please rerun GMER (sorry to keep making you run so many scans, but as this is a new infection, we need to find out as much as we can - thanks so much for your co-operation in this)

Hi,

Please do the following after running the GMER program

Earlier on ComboFix installed the Recovery Console. We're going to use that now.

Reboot your machine and when the Boot Menu flashes up - select "Microsoft Windows Recovery Console"
(you need to be very fast with the arrow key as you only have a couple of seconds before it defaults to the windows XP bootup)

[external image: Posted Image]

[external image: Posted Image]

When you get to the above screen, take note of the number that references your operating system.
If it's '1' like the picture above, type 1 and press Enter

[external image: Posted Image]

Next type FIXMBR

[external image: Posted Image]

If it ask if you're sure you want to write a new MBR, answer 'Y'

Then type EXIT to reboot the machine.

Boot into safe mode and do a quick scan with MalwareBytes and let me know if it still detects tdlwsp.dll have mbam remove it and then reboot back into normal mode.

Before I follow these instructions, is there any chance this could make my hard disk inaccessible?

Hi, There is always a risk doing anything that rips out malware, I cannot guarantee what will happen with your system, I do know however, you are infected at the deepest level with a new infection, I am not working on this alone, but have the assistance of the best experts and tool developers in the business. Make sure your data is backed up fully. Combofix installed Erunt - the registry backup, which we can access if necessary.

Ok, instructions followed. However, Malwarebytes is still detecting tdlwsp.dll even after removing and rebooting.

OK, thanks for your patience. can you please run GMER again and we'll try something else

Hi,

One of the experts working on this infection would like to collect some information if you don't mind:

Could you please do the following:

Click Start>Run and type cmd then hit Enter to open a command window.
Highlight and copy the contents of the code box below, then right click in the command window and select Paste.

echo.>%systemroot%\list.txt
echo dir>%systemroot%\listit.txt
echo.>%systemroot%\system32\list.txt
echo dir>%systemroot%\system32\listit.txt
echo.>%systemroot%\system32\drivers\list.txt
echo dir>%systemroot%\system32\drivers\listit.txt
exit
cls

The commands pasted should complete quickly and the command window will close on it's own.

Download Process Monitor from Microsoft's Sysinternals from here.
Save the zip file to your desktop then extract it to it's own folder.
Open the folder and double click Procmon.exe to run it.
On the menu, click Filter>Enable Advanced Output
On the menu, click Options>Enable Boot Logging
You should receive a message that 'Process Monitor is configured to log activity during the next boot'.
Click OK then close Process Monitor

Please write down the following or print it out so that you have it available for use in the Recovery Console.
Reboot the machine and select Microsoft Windows Recovery Console from the startup menu (you have 2 seconds to select it).
When prompted, type 1 then hit Enter to logon to the C:\Windows operating system.
The italicized text below is the command prompt you will see, the bolded text is the commands you will type, hitting Enter after each line.

C:\Windows>batch listit.txt list.txt
C:\Windows>cd system32
C:\Windows\system32>batch listit.txt list.txt
C:\Windows>cd drivers
C:\Windows\system32\drivers>batch listit.txt list.txt
C:\Windows\system32\drivers>exit

** Be sure to leave a space between the words batch and listit.txt, and another space between the words listit.txt and list.txt **

After typing exit your machine will restart.
Allow it to boot into normal mode.
Once logged into normal mode, open Process Monitor again. (this is important to do right away - it causes Process Monitor to stop logging information)
You should receive a message that 'A log of boot-time activity was created by a previous instance of Process Monitor. Do you wish to save the collected data now?'
Click Yes
Name it bootlog, leave the Save as type: Procmon Log (*.PML) and save it to your desktop.
Close Process Monitor

**If you configure boot logging and the system crashes early in the boot you can deactivate boot logging by choosing the Last Known Good option from the Windows boot menu (which you access by pressing F8 during the boot).**

Please upload the following files to my submission channel, or attach them to an email to me, for review.

bootlog.PML from your desktop
C:\Windows\list.txt
C:\Windows\system32\list.txt
C:\Windows\system32\drivers\list.txt

One more to run if you would please:

Please do the following:

Click Start>Run then type cmd and hit Enter to open a command window.
Copy the contents of the code box below then right click in the command window and select Paste.

cd %systemroot%\system32\drivers
findstr /i /m "8TDL3uZ 8INITu" *.sys >look.txt
for /f "tokens=*" %i in (look.txt) do (
dir %systemdrive%\%i /a h /s >log.txt
)
start notepad log.txt
del /q look.txt
exit
cls

When the commands complete notepad should open log.txt and the command window will close on it's own.


Please post the contents of log.txt, if any, here in your next reply.