What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Google search results sometimes redirect to ads

16 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16 last edited
Hi,

OK, let's hit a bit harder this time.

1. Please open Notepad
  • Click Start , then Run
  • Type notepad.exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe,"

File::
C:\WINDOWS\system32\msqxjd32.exe
3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
  • Combofix.txt.

We need to run a batch file.
  • Copy the contents of the Code Box below to Notepad.
  • Name the file as mbr.bat
  • Change the Save as Type to All Files
  • and Save it on your Desktop
@echo off
copy C:\WINDOWS\mbr.exe "%userprofile%\Desktop\mbr.exe"
"%userprofile%\Desktop\mbr.exe" -t
notepad "%userprofile%\Desktop\mbr.log"
del /Q "%userprofile%\Desktop\mbr.exe"
del /Q %0
Then double-click on the mbr.bat file. A log will open, please post the contents of that log in your next reply. If it doesn't open, please check your Desktop for mbr.log and post that.



I'd like to give your system a thorough scan with a different AntiVirus program for a second opinion. It may pick up something vital that Avira is missing.

Please go to Kaspersky website and perform an online antivirus scan.
  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As….
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  • Please post this log in your next reply.
Post #17
Hey,

Have run those scans (Kaspersky took a few hours) and the results are below. I got the same pop-up from Avira again so this time I took a screen grab of it.

Here it is:

[external image: Posted Image]


Obviously I clicked "delete" but I think the same file might have come up again in Kaspersky afterwards so I'm not sure if it's gone, but here are the log files for you:

ComboFix Log:

ComboFix 10-01-02.05 - Jamey 03/01/2010 13:45:00.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.44.1033.18.3071.2574 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\Forums - Whatthetech\Combo-Fix.exe
Command switches used :: c:\documents and settings\Jamey\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: COMODO Antivirus *On-access scanning enabled* (Updated) {043803A5-4F86-4ef7-AFC5-F6E02A79969B}
FW: COMODO Firewall *enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
FW: Outpost Firewall *disabled* {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}

FILE ::
"c:\windows\system32\msqxjd32.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\Jamey\LOCALS~1\Temp\Adobelm_Cleanup.0001.dir.0000\~de2fd8.tmp
c:\docume~1\Jamey\LOCALS~1\Temp\Adobelm_Cleanup.0001.dir.0000\~df394b.tmp
c:\docume~1\Jamey\LOCALS~1\Temp\Adobelm_Cleanup.0001.dir.0001\~df394b.tmp
c:\documents and settings\Jamey\Local Settings\Temp\Adobelm_Cleanup.0001.dir.0000\~de2fd8.tmp
c:\documents and settings\Jamey\Local Settings\Temp\Adobelm_Cleanup.0001.dir.0000\~df394b.tmp
c:\documents and settings\Jamey\Local Settings\Temp\Adobelm_Cleanup.0001.dir.0001\~df394b.tmp

.
((((((((((((((((((((((((( Files Created from 2009-12-03 to 2010-01-03 )))))))))))))))))))))))))))))))
.

2010-01-02 19:43 . 2010-01-02 19:43 ——– d—–w- C:\spoolerlogs
2010-01-02 19:18 . 2010-01-02 19:18 ——– d—–w- c:\documents and settings\Jamey\Application Data\Malwarebytes
2010-01-02 19:18 . 2009-12-30 14:55 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-02 19:18 . 2010-01-02 19:18 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-02 19:18 . 2010-01-02 19:18 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-02 19:18 . 2009-12-30 14:54 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-02 19:15 . 2010-01-02 19:16 ——– d—–w- c:\program files\ERUNT
2010-01-01 03:24 . 2010-01-01 03:24 ——– d—–w- c:\program files\Trend Micro
2010-01-01 03:22 . 2010-01-01 03:22 8 —-a-w- c:\windows\crpf.bin
2010-01-01 03:22 . 2010-01-01 03:22 4 —-a-w- c:\windows\crpf_sdum.bin
2010-01-01 02:49 . 2009-12-02 13:19 15880 —-a-w- c:\windows\system32\lsdelete.exe
2010-01-01 02:24 . 2010-01-01 02:24 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
2010-01-01 02:24 . 2009-12-07 14:10 2953352 -c–a-w- c:\documents and settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}\Ad-AwareInstallation.exe
2010-01-01 02:24 . 2010-01-01 02:25 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-01-01 02:24 . 2010-01-01 02:24 ——– d—–w- c:\program files\Lavasoft
2009-12-31 16:34 . 2009-12-31 16:35 ——– d—–w- c:\program files\Spybot - Search & Destroy
2009-12-27 11:06 . 2009-12-28 13:40 56816 —-a-w- c:\windows\system32\drivers\avgntflt.sys
2009-12-27 11:06 . 2009-03-30 09:33 96104 —-a-w- c:\windows\system32\drivers\avipbb.sys
2009-12-27 11:06 . 2009-02-13 11:29 22360 —-a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-12-27 11:06 . 2009-02-13 11:17 45416 —-a-w- c:\windows\system32\drivers\avgntdd.sys
2009-12-27 11:06 . 2009-12-27 11:06 ——– d—–w- c:\program files\Avira
2009-12-27 11:06 . 2009-12-27 11:06 ——– d—–w- c:\documents and settings\All Users\Application Data\Avira
2009-12-27 10:58 . 2009-04-06 11:37 704384 —-a-w- c:\windows\system32\drivers\SandBox.sys
2009-12-27 10:58 . 2009-02-10 16:15 257432 —-a-w- c:\windows\system32\drivers\afwcore.sys
2009-12-27 10:56 . 2009-02-18 17:30 31128 —-a-w- c:\windows\system32\drivers\afw.sys
2009-12-27 10:56 . 2009-12-27 10:56 ——– d—–w- c:\program files\Agnitum
2009-12-27 10:56 . 2009-12-27 10:56 ——– d—–w- c:\documents and settings\All Users\Application Data\Agnitum
2009-12-18 13:10 . 2010-01-03 13:53 843781 —-a-w- c:\windows\cscmondump.bin
2009-12-18 12:59 . 2009-12-27 12:59 134173 —-a-w- c:\windows\cscmon.bin
2009-12-18 12:58 . 2009-10-27 15:46 132424 —-a-w- c:\windows\system32\drivers\CFRMD.sys
2009-12-18 12:58 . 2009-10-19 06:47 13824 —-a-w- c:\windows\system32\cnat.exe
2009-12-12 23:47 . 2009-12-13 00:59 ——– d—–w- c:\documents and settings\Jamey\Application Data\eMusic
2009-12-12 23:47 . 2009-12-12 23:47 ——– d—–w- c:\documents and settings\Jamey\Local Settings\Application Data\eMusic
2009-12-12 23:47 . 2009-12-13 00:59 ——– d—–w- c:\program files\eMusic Download Manager
2009-12-12 19:43 . 2009-12-12 19:43 ——– d—–w- c:\program files\Synchronization Technologies Inc
2009-12-09 22:52 . 2009-12-09 22:52 ——– d—–w- c:\documents and settings\Jamey\Local Settings\Application Data\Google
2009-12-09 22:52 . 2009-12-09 23:05 ——– d—–w- c:\program files\Google
2009-12-09 07:58 . 2009-12-09 07:58 ——– d—–w- c:\documents and settings\Jamey\Local Settings\Application Data\Microsoft_Corporation
2009-12-09 07:57 . 2009-12-09 07:57 ——– d—–w- c:\documents and settings\Jamey\Local Settings\Application Data\assembly
2009-12-08 23:17 . 2009-12-08 23:17 ——– d—–w- c:\documents and settings\Jamey\Local Settings\Application Data\Xenocode
2009-12-08 23:16 . 2009-12-08 23:20 ——– d—–w- c:\documents and settings\Jamey\Application Data\SyncMyCal

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-02 21:49 . 2007-08-24 18:50 ——– d—–w- c:\documents and settings\Jamey\Application Data\uTorrent
2009-12-31 17:05 . 2007-09-16 17:38 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-12-24 15:32 . 2009-06-22 20:54 ——– d—–w- c:\program files\COMODO
2009-12-24 13:53 . 2009-06-22 20:56 1474832 —-a-w- c:\windows\system32\drivers\sfi.dat
2009-12-22 22:22 . 2009-05-23 12:35 1984 —-a-w- c:\windows\system32\d3d9caps.dat
2009-12-03 19:10 . 2009-11-10 23:09 ——– d—–w- c:\documents and settings\Jamey\Application Data\Tyre
2009-12-02 13:19 . 2010-01-01 02:25 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
2009-11-30 18:49 . 2009-11-30 18:49 ——– d—–w- c:\program files\AGEIA Technologies
2009-11-30 18:47 . 2007-05-26 00:08 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-11-30 18:39 . 2007-05-26 00:00 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-11-29 13:59 . 2009-11-29 13:59 485 —-a-w- c:\windows\PowerReg.dat
2009-11-27 19:58 . 2009-11-27 19:57 ——– d—–w- c:\program files\iTunes
2009-11-27 19:57 . 2009-11-27 19:57 ——– d—–w- c:\program files\iPod
2009-11-27 19:57 . 2009-04-02 21:43 ——– d—–w- c:\program files\Common Files\Apple
2009-11-27 19:55 . 2009-10-19 19:57 ——– d—–w- c:\program files\QuickTime
2009-11-27 19:53 . 2009-11-27 19:53 79144 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-11-10 23:09 . 2009-11-10 23:09 ——– d—–w- c:\program files\Tyre
2009-11-10 23:09 . 2009-11-10 23:09 ——– d—–w- c:\documents and settings\All Users\Application Data\Tyre
2009-11-09 18:58 . 2009-11-09 16:32 ——– d—–w- c:\documents and settings\Jamey\Application Data\Bioshock
2009-11-09 16:25 . 2009-11-09 16:25 ——– d–h–r- c:\documents and settings\Jamey\Application Data\SecuROM
2009-11-08 18:55 . 2008-04-17 19:48 22328 —-a-w- c:\documents and settings\Jamey\Application Data\PnkBstrK.sys
2009-11-08 18:55 . 2008-04-17 19:48 22328 —-a-w- c:\documents and settings\Jamey\Application Data\PnkBstrK.sys
2009-11-08 18:51 . 2009-11-08 18:51 107832 —-a-w- c:\documents and settings\Jamey\Application Data\PnkBstrB.exe
2009-11-08 18:51 . 2009-11-08 18:51 107832 —-a-w- c:\documents and settings\Jamey\Application Data\PnkBstrB.exe
2009-11-08 18:51 . 2008-04-17 19:47 107832 —-a-w- c:\windows\system32\PnkBstrB.exe
2009-11-08 18:51 . 2008-04-17 19:46 66872 —-a-w- c:\windows\system32\PnkBstrA.exe
2009-11-08 18:51 . 2008-04-17 19:46 2337865 —-a-w- c:\windows\system32\pbsvc.exe
2009-10-27 09:53 . 2009-10-27 09:53 8192 —-a-w- c:\windows\system32\CSC.exe
2009-10-25 10:29 . 2007-08-19 13:10 60848 —-a-w- c:\documents and settings\Bex\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-24 15:15 . 2009-10-24 15:15 108144 —-a-w- c:\windows\system32\CmdLineExt.dll
2009-10-24 13:31 . 2009-10-24 13:31 9158 —-a-r- c:\documents and settings\Jamey\Application Data\Microsoft\Installer\{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}\ARPPRODUCTICON.exe
.

((((((((((((((((((((((((((((( SnapShot@2010-01-02_23.08.12 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-05-25 23:55 . 2010-01-03 13:32 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2007-05-25 23:55 . 2010-01-02 23:07 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2007-05-25 23:55 . 2010-01-03 13:32 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2007-05-25 23:55 . 2010-01-02 23:07 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2007-05-25 23:55 . 2010-01-03 13:32 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2007-05-25 23:55 . 2010-01-02 23:07 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OutpostMonitor"="c:\progra~1\Agnitum\OUTPOS~1\op_mon.exe" [2009-04-28 2374464]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Belkin Wireless Network Monitor Utility (USB).lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Belkin Wireless Network Monitor Utility (USB).lnk
backup=c:\windows\pss\Belkin Wireless Network Monitor Utility (USB).lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logo Calibration Loader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logo Calibration Loader.lnk
backup=c:\windows\pss\Logo Calibration Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ProfileReminder.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ProfileReminder.lnk
backup=c:\windows\pss\ProfileReminder.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^VIA RAID TOOL.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\VIA RAID TOOL.lnk
backup=c:\windows\pss\VIA RAID TOOL.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
2002-06-26 04:38 1044480 ——w- c:\program files\ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2001-07-09 10:50 155648 —-a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OutpostFeedBack]
2009-04-28 10:04 428032 —-a-w- c:\program files\Agnitum\Outpost Firewall\feedback.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OutpostMonitor]
2009-04-28 11:33 2374464 —-a-w- c:\progra~1\Agnitum\OUTPOS~1\op_mon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 23:08 417792 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
2005-08-17 17:39 90112 —-a-w- c:\windows\soundman.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2009-09-25 16:00 98304 —-a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2007-03-14 02:43 83608 —-a-w- c:\program files\Java\jre1.6.0_01\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
2009-11-13 11:31 247144 —-a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"UleadBurningHelper"=2 (0x2)
"TomTomHOMEService"=2 (0x2)
"PnkBstrA"=2 (0x2)
"cmdAgent"=2 (0x2)
"ATI Smart"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)
"Adobe LM Service"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\GreedyTorrent\\GTor.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\[removed]\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\[removed]\\counter-strike\\hl.exe"=
"d:\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=
"d:\\CoD4 MW\\iw3mp.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [13/12/2007 19:51 9344]
R0 CFRMD;cfrmd;c:\windows\system32\drivers\CFRMD.sys [18/12/2009 12:58 132424]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [01/01/2010 02:25 64288]
R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [26/05/2007 00:08 77312]
R1 SandBox;SandBox;c:\windows\system32\drivers\SandBox.sys [27/12/2009 10:58 704384]
R1 vcdrom;Virtual CD-ROM Device Driver;c:\windows\system32\drivers\VCdRom.sys [19/12/2001 10:45 8576]
R2 acssrv;Agnitum Client Security Service;c:\progra~1\Agnitum\OUTPOS~1\acs.exe [27/12/2009 10:56 1195008]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [27/12/2009 11:06 108289]
R2 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [13/12/2007 19:51 433920]
R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [16/10/2009 19:26 12672]
R2 PDIHWCTL;PDIHWCTL;c:\windows\system32\drivers\pdihwctl.sys [27/03/2005 05:01 14416]
R3 afw;Agnitum firewall driver;c:\windows\system32\drivers\afw.sys [27/12/2009 10:56 31128]
R3 afwcore;afwcore;c:\windows\system32\drivers\afwcore.sys [27/12/2009 10:58 257432]
R3 GETNDIS;VIA Networking Velocity Family Giga-bit Ethernet Adapter Driver;c:\windows\system32\drivers\getnd5b.sys [17/04/2008 22:32 44032]
S1 kbd;kbd;\??\c:\windows\system32\drivers\kbd.sys –> c:\windows\system32\drivers\kbd.sys [?]
S3 BEL6051(Belkin);Belkin 11Mbps Wireless USB Network Adapter Driver(Belkin);c:\windows\system32\drivers\BEL6051.SYS [26/05/2007 00:19 53376]
S3 eyeonedp;eye-one display;c:\windows\system32\drivers\EyeOneDp.sys [27/03/2005 05:06 44344]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [02/12/2009 13:19 1181328]
S3 mamotou;mamotou;c:\windows\system32\drivers\mamotou.sys [21/03/2009 21:13 49377]
S3 ZDNDIS5;ZDNDIS5 Protocol Driver;c:\windows\system32\ZDNDIS5.sys [26/05/2007 00:19 16157]
S4 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [13/11/2009 11:31 92008]
.
Contents of the 'Scheduled Tasks' folder

2010-01-01 c:\windows\Tasks\Ad-Aware Update (Daily 1).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 02:25]

2010-01-01 c:\windows\Tasks\Ad-Aware Update (Daily 2).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 02:25]

2010-01-01 c:\windows\Tasks\Ad-Aware Update (Daily 3).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 02:25]

2010-01-02 c:\windows\Tasks\Ad-Aware Update (Daily 4).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 02:25]

2010-01-01 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-12-02 02:25]

2009-12-27 c:\windows\Tasks\COMODO System Cleaner Update.job
- c:\program files\COMODO\COMODO System-Cleaner\UpdateApplications.exe [2009-10-27 18:18]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyOverride = *.local
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Jamey\Application Data\Mozilla\Firefox\Profiles\955uhwc5.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.co.uk
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-03 13:54
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-343818398-1078145449-725345543-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:25,33,e1,18,54,11,18,36,02,3d,d2,8f,e9,a6,5f,54,44,1c,17,2c,a4,02,a7,
4e,4d,38,60,1d,1c,c3,68,af,e6,de,14,ab,b6,f7,cb,81,27,07,67,af,07,f2,c1,a4,\
"??"=hex:cf,55,c7,95,2b,14,4d,f8,66,7b,0c,1b,19,52,fe,22
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1028)
c:\windows\system32\Ati2evxx.dll
.
———————— Other Running Processes ————————
.
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\System32\wdfmgr.exe
c:\windows\system32\wscntfy.exe
c:\program files\Microsoft ActiveSync\wcescomm.exe
c:\progra~1\MICROS~3\rapimgr.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2010-01-03 14:01:05 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-03 14:00
ComboFix2.txt 2010-01-02 23:16

Pre-Run: 39,557,046,272 bytes free
Post-Run: 39,609,249,792 bytes free

- - End Of File - - F6FC91025015C2E134F967D1F1E62772



MBR Log:

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys viaide.sys PCIIDEX.SYS
kernel: MBR read successfully
user & kernel MBR OK



Kaspersky Log:

——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0: scan report
Sunday, January 3, 2010
Operating system: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Sunday, January 03, 2010 13:48:25
Records in database: 3365371
——————————————————————————–

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
F:\
G:\
H:\
I:\
J:\

Scan statistics:
Objects scanned: 138950
Threats found: 6
Infected objects found: 9
Suspicious objects found: 0
Scan duration: 02:31:13


File name / Threat / Threats count
C:\Documents and Settings\Jamey\My Documents\install files\spyanywhere.zip Infected: not-a-virus:RemoteAdmin.Win32.SpyAnywhere.p 1
C:\Documents and Settings\Jamey\My Documents\install files\spyanywhere.zip Infected: not-a-virus:RemoteAdmin.Win32.SpyAnywhere.e 1
C:\Documents and Settings\Jamey\My Documents\install files\spyanywhere.zip Infected: not-a-virus:Monitor.Win32.SpyAgent.44103 1
C:\Documents and Settings\Jamey\My Documents\install files\vnc-3.3.7-x86_win32.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.c 2
C:\Documents and Settings\Jamey\My Documents\install files\WinRar\WinRAR 3\cash.exe Infected: not-a-virus:Downloader.Win32.Agent.db 1
C:\Documents and Settings\Jamey\My Documents\install files\WinRAR 3 (1).exe Infected: not-a-virus:Downloader.Win32.Agent.db 1
C:\System Volume Information\_restore{AF40F866-9500-4581-8825-33476F29E69C}\RP1\A0001019.dll Infected: Packed.Win32.TDSS.z 1
C:\WINDOWS\system32\tdlcmd.dll Infected: Packed.Win32.TDSS.z 1

Selected area has been scanned.
Post #18
Aha, well, now we know what we are up against. I'm kicking myself for not checking for this earlier.

Open notepad, and copy/paste the following text into the notepad window:
copy C:\WINDOWS\system32\atapi.sys C:\atapi.vir
copy C:\WINDOWS\system32\dllcache\atapi.sys C:\WINDOWS\system32\atapi.sys
del C:\WINDOWS\system32\tdlcmd.dll
Save this as C:\run.txt (make sure it saves to C:\).

(You may wish to print some of the following out, or write it down, since you wont have internet access for this next part)

Next, reboot your computer, and select Microsoft Windows Recovery Console when given the option (you've only got a couple of seconds, so stay sharp!)

You will be asked to select a partition, probably 1. C:\WINDOWS. Just type 1 and hit Enter. If prompted, type your Admin password.

OK, once you are through with all that, you should be presented with a prompt like this:
C:\WINDOWS>

At this prompt, type the follow commands, pressing Enter after each one:
cd C:\
batch run.txt
With any luck, after this second command you should see some text saying "Successful" or something along those lines. If you get any error messages, let me know what they say.

Finally, type Exit and hit Enter. This should reboot your computer, and you can continue into normal mode. Once back in normal mode, please check once more for redirects. Also, please go to this page and upload this file:
C:\atapi.vir

If you have any questions about any of this, do let me know.

Cheers.
Post #19
I tried to go into Windows Recovery Console but it crashes to a blue screen.

I took a photo with my camera, here:

[external image: Posted Image]


It happens after the initial loading part when it says "Starting Windows Recovery Console" and then asks you to insert a disc if you need additional RAID or SCSI drivers.

My C:\ drive is actually two HDDs in a RAID 1 array so maybe that might cause problems but I don't see why it would cause a full BSOD. I would normally expect that I wouldn't be able to view C:\ until I load a driver, if anything.
Post #21
TDSkiller ran fine, here's the log: 19:18:34:500 2980 TDSSKiller 2.1.1 Dec 20 2009 02:40:02 19:18:34:500 2980 ================================================================================ 19:18:34:500 2980 SystemInfo: 19:18:34:500 2980 OS Version: 5.1.2600 ServicePack: 2.0 19:18:34:500 2980 Product type: Workstation 19:18:34:500 2980 ComputerName: JAMEYS-PC 19:18:34:500 2980 UserName: Jamey 19:18:34:500 2980 Windows directory: C:\WINDOWS 19:18:34:500 2980 Processor architecture: Intel x86 19:18:34:500 2980 Number of processors: 1 19:18:34:500 2980 Page size: 0x1000 19:18:34:500 2980 Boot type: Normal boot 19:18:34:500 2980 ================================================================================ 19:18:34:546 2980 ForceUnloadDriver: NtUnloadDriver error 2 19:18:34:546 2980 ForceUnloadDriver: NtUnloadDriver error 2 19:18:34:546 2980 ForceUnloadDriver: NtUnloadDriver error 2 19:18:34:546 2980 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\Drivers\KLMD.sys) returned status 0 19:18:34:546 2980 main: Driver KLMD successfully dropped 19:18:34:578 2980 main: Driver KLMD successfully loaded 19:18:34:578 2980 Scanning Registry … 19:18:34:593 2980 ScanServices: Searching service UACd.sys 19:18:34:593 2980 ScanServices: Open/Create key error 2 19:18:34:593 2980 ScanServices: Searching service TDSSserv.sys 19:18:34:593 2980 ScanServices: Open/Create key error 2 19:18:34:593 2980 ScanServices: Searching service gaopdxserv.sys 19:18:34:593 2980 ScanServices: Open/Create key error 2 19:18:34:593 2980 ScanServices: Searching service gxvxcserv.sys 19:18:34:593 2980 ScanServices: Open/Create key error 2 19:18:34:593 2980 ScanServices: Searching service MSIVXserv.sys 19:18:34:593 2980 ScanServices: Open/Create key error 2 19:18:34:609 2980 UnhookRegistry: Kernel module file name: C:\windows\system32\ntkrnlpa.exe, base addr: 804D7000 19:18:34:890 2980 UnhookRegistry: Kernel local addr: D80000 19:18:34:890 2980 UnhookRegistry: KeServiceDescriptorTable addr: DFB180 19:18:34:921 2980 UnhookRegistry: KiServiceTable addr: DAA030 19:18:34:921 2980 UnhookRegistry: NtEnumerateKey service number (local): 47 19:18:34:921 2980 UnhookRegistry: NtEnumerateKey local addr: EC2412 19:18:34:937 2980 KLMD_OpenDevice: Trying to open KLMD device 19:18:34:937 2980 KLMD_GetSystemRoutineAddressA: Trying to get system routine address ZwEnumerateKey 19:18:34:937 2980 KLMD_GetSystemRoutineAddressW: Trying to get system routine address ZwEnumerateKey 19:18:34:937 2980 KLMD_ReadMem: Trying to ReadMemory 0x804FD801[0x4] 19:18:34:937 2980 UnhookRegistry: NtEnumerateKey service number (kernel): 47 19:18:34:937 2980 KLMD_ReadMem: Trying to ReadMemory 0x8050114C[0x4] 19:18:34:937 2980 UnhookRegistry: NtEnumerateKey real addr: 80619412 19:18:34:937 2980 UnhookRegistry: NtEnumerateKey calc addr: 80619412 19:18:34:937 2980 UnhookRegistry: No SDT hooks found on NtEnumerateKey 19:18:34:937 2980 KLMD_ReadMem: Trying to ReadMemory 0x80619412[0xA] 19:18:34:937 2980 UnhookRegistry: No splicing found on NtEnumerateKey 19:18:34:937 2980 Scanning Kernel memory … 19:18:34:937 2980 KLMD_OpenDevice: Trying to open KLMD device 19:18:34:937 2980 KLMD_GetSystemObjectAddressByNameA: Trying to get system object address by name \Driver\Disk 19:18:34:937 2980 KLMD_GetSystemObjectAddressByNameW: Trying to get system object address by name \Driver\Disk 19:18:34:937 2980 DetectCureTDL3: \Driver\Disk PDRIVER_OBJECT: 8B010940 19:18:34:937 2980 DetectCureTDL3: KLMD_GetDeviceObjectList returned 4 DevObjects 19:18:34:937 2980 DetectCureTDL3: 0 Curr stack PDEVICE_OBJECT: 8B00EC68 19:18:34:937 2980 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8B00EC68 19:18:34:937 2980 KLMD_ReadMem: Trying to ReadMemory 0x8B00EC68[0x38] 19:18:34:937 2980 DetectCureTDL3: DRIVER_OBJECT addr: 8B010940 19:18:34:937 2980 KLMD_ReadMem: Trying to ReadMemory 0x8B010940[0xA8] 19:18:34:937 2980 KLMD_ReadMem: Trying to ReadMemory 0xE1966A60[0x208] 19:18:34:937 2980 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk 19:18:34:937 2980 DetectCureTDL3: IrpHandler (0) addr: BA10EC30 19:18:34:937 2980 DetectCureTDL3: IrpHandler (1) addr: 804F320E 19:18:34:937 2980 DetectCureTDL3: IrpHandler (2) addr: BA10EC30 19:18:34:937 2980 DetectCureTDL3: IrpHandler (3) addr: BA108D9B 19:18:34:937 2980 DetectCureTDL3: IrpHandler (4) addr: BA108D9B 19:18:34:937 2980 DetectCureTDL3: IrpHandler (5) addr: 804F320E 19:18:34:937 2980 DetectCureTDL3: IrpHandler (6) addr: 804F320E 19:18:34:937 2980 DetectCureTDL3: IrpHandler (7) addr: 804F320E 19:18:34:937 2980 DetectCureTDL3: IrpHandler (8) addr: 804F320E 19:18:34:937 2980 DetectCureTDL3: IrpHandler (9) addr: BA109366 19:18:34:937 2980 DetectCureTDL3: IrpHandler (10) addr: 804F320E 19:18:34:937 2980 DetectCureTDL3: IrpHandler (11) addr: 804F320E 19:18:34:937 2980 DetectCureTDL3: IrpHandler (12) addr: 804F320E 19:18:34:937 2980 DetectCureTDL3: IrpHandler (13) addr: 804F320E 19:18:34:937 2980 DetectCureTDL3: IrpHandler (14) addr: BA10944D 19:18:34:937 2980 DetectCureTDL3: IrpHandler (15) addr: BA10CFC3 19:18:34:937 2980 DetectCureTDL3: IrpHandler (16) addr: BA109366 19:18:34:937 2980 DetectCureTDL3: IrpHandler (17) addr: 804F320E 19:18:34:937 2980 DetectCureTDL3: IrpHandler (18) addr: 804F320E 19:18:34:937 2980 DetectCureTDL3: IrpHandler (19) addr: 804F320E 19:18:34:937 2980 DetectCureTDL3: IrpHandler (20) addr: 804F320E 19:18:34:937 2980 DetectCureTDL3: IrpHandler (21) addr: 804F320E 19:18:34:937 2980 DetectCureTDL3: IrpHandler (22) addr: BA10AEF3 19:18:34:937 2980 DetectCureTDL3: IrpHandler (23) addr: BA10FA24 19:18:34:937 2980 DetectCureTDL3: IrpHandler (24) addr: 804F320E 19:18:34:937 2980 DetectCureTDL3: IrpHandler (25) addr: 804F320E 19:18:34:937 2980 DetectCureTDL3: IrpHandler (26) addr: 804F320E 19:18:34:937 2980 KLMD_ReadMem: Trying to ReadMemory 0x0[0x400] 19:18:34:937 2980 KLMD_ReadMem: DeviceIoControl error 1 19:18:34:937 2980 TDL3_StartIoHookDetect: Unable to get StartIo handler code 19:18:34:937 2980 TDL3_FileDetect: Processing driver: Disk 19:18:34:937 2980 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\disk.sys, C:\WINDOWS\system32\Drivers\disk.tsk, SYSTEM\CurrentControlSet\Services\Disk, system32\Drivers\disk.tsk 19:18:34:937 2980 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\disk.sys 19:18:34:937 2980 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\disk.sys 19:18:34:968 2980 DetectCureTDL3: 1 Curr stack PDEVICE_OBJECT: 8B02E9F0 19:18:34:968 2980 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8B02E9F0 19:18:34:968 2980 KLMD_ReadMem: Trying to ReadMemory 0x8B02E9F0[0x38] 19:18:34:968 2980 DetectCureTDL3: DRIVER_OBJECT addr: 8B010940 19:18:34:968 2980 KLMD_ReadMem: Trying to ReadMemory 0x8B010940[0xA8] 19:18:34:968 2980 KLMD_ReadMem: Trying to ReadMemory 0xE1966A60[0x208] 19:18:34:968 2980 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk 19:18:34:968 2980 DetectCureTDL3: IrpHandler (0) addr: BA10EC30 19:18:34:968 2980 DetectCureTDL3: IrpHandler (1) addr: 804F320E 19:18:34:968 2980 DetectCureTDL3: IrpHandler (2) addr: BA10EC30 19:18:34:968 2980 DetectCureTDL3: IrpHandler (3) addr: BA108D9B 19:18:34:968 2980 DetectCureTDL3: IrpHandler (4) addr: BA108D9B 19:18:34:968 2980 DetectCureTDL3: IrpHandler (5) addr: 804F320E 19:18:34:968 2980 DetectCureTDL3: IrpHandler (6) addr: 804F320E 19:18:34:968 2980 DetectCureTDL3: IrpHandler (7) addr: 804F320E 19:18:34:968 2980 DetectCureTDL3: IrpHandler (8) addr: 804F320E 19:18:34:968 2980 DetectCureTDL3: IrpHandler (9) addr: BA109366 19:18:34:968 2980 DetectCureTDL3: IrpHandler (10) addr: 804F320E 19:18:34:968 2980 DetectCureTDL3: IrpHandler (11) addr: 804F320E 19:18:34:968 2980 DetectCureTDL3: IrpHandler (12) addr: 804F320E 19:18:34:968 2980 DetectCureTDL3: IrpHandler (13) addr: 804F320E 19:18:34:968 2980 DetectCureTDL3: IrpHandler (14) addr: BA10944D 19:18:34:968 2980 DetectCureTDL3: IrpHandler (15) addr: BA10CFC3 19:18:34:968 2980 DetectCureTDL3: IrpHandler (16) addr: BA109366 19:18:34:968 2980 DetectCureTDL3: IrpHandler (17) addr: 804F320E 19:18:34:968 2980 DetectCureTDL3: IrpHandler (18) addr: 804F320E 19:18:34:968 2980 DetectCureTDL3: IrpHandler (19) addr: 804F320E 19:18:34:968 2980 DetectCureTDL3: IrpHandler (20) addr: 804F320E 19:18:34:968 2980 DetectCureTDL3: IrpHandler (21) addr: 804F320E 19:18:34:968 2980 DetectCureTDL3: IrpHandler (22) addr: BA10AEF3 19:18:34:968 2980 DetectCureTDL3: IrpHandler (23) addr: BA10FA24 19:18:34:968 2980 DetectCureTDL3: IrpHandler (24) addr: 804F320E 19:18:34:968 2980 DetectCureTDL3: IrpHandler (25) addr: 804F320E 19:18:34:968 2980 DetectCureTDL3: IrpHandler (26) addr: 804F320E 19:18:34:968 2980 KLMD_ReadMem: Trying to ReadMemory 0x0[0x400] 19:18:34:968 2980 KLMD_ReadMem: DeviceIoControl error 1 19:18:34:968 2980 TDL3_StartIoHookDetect: Unable to get StartIo handler code 19:18:34:968 2980 TDL3_FileDetect: Processing driver: Disk 19:18:34:968 2980 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\disk.sys, C:\WINDOWS\system32\Drivers\disk.tsk, SYSTEM\CurrentControlSet\Services\Disk, system32\Drivers\disk.tsk 19:18:34:968 2980 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\disk.sys 19:18:34:968 2980 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\disk.sys 19:18:34:968 2980 DetectCureTDL3: 2 Curr stack PDEVICE_OBJECT: 8B030AB8 19:18:34:968 2980 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8B030AB8 19:18:34:968 2980 DetectCureTDL3: 2 Curr stack PDEVICE_OBJECT: 8B010A38 19:18:34:968 2980 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8B010A38 19:18:34:968 2980 KLMD_ReadMem: Trying to ReadMemory 0x8B010A38[0x38] 19:18:34:968 2980 DetectCureTDL3: DRIVER_OBJECT addr: 8B032A08 19:18:34:968 2980 KLMD_ReadMem: Trying to ReadMemory 0x8B032A08[0xA8] 19:18:34:968 2980 KLMD_ReadMem: Trying to ReadMemory 0xE196B748[0x208] 19:18:34:968 2980 DetectCureTDL3: DRIVER_OBJECT name: \Driver\viasraid, Driver Name: viasraid 19:18:34:968 2980 DetectCureTDL3: IrpHandler (0) addr: B9F04298 19:18:34:968 2980 DetectCureTDL3: IrpHandler (1) addr: B9F04298 19:18:34:968 2980 DetectCureTDL3: IrpHandler (2) addr: B9F04298 19:18:34:968 2980 DetectCureTDL3: IrpHandler (3) addr: B9F04298 19:18:34:968 2980 DetectCureTDL3: IrpHandler (4) addr: B9F04298 19:18:34:968 2980 DetectCureTDL3: IrpHandler (5) addr: B9F04298 19:18:34:968 2980 DetectCureTDL3: IrpHandler (6) addr: B9F04298 19:18:34:968 2980 DetectCureTDL3: IrpHandler (7) addr: B9F04298 19:18:34:968 2980 DetectCureTDL3: IrpHandler (8) addr: B9F04298 19:18:34:968 2980 DetectCureTDL3: IrpHandler (9) addr: B9F04298 19:18:34:968 2980 DetectCureTDL3: IrpHandler (10) addr: B9F04298 19:18:34:968 2980 DetectCureTDL3: IrpHandler (11) addr: B9F04298 19:18:34:968 2980 DetectCureTDL3: IrpHandler (12) addr: B9F04298 19:18:34:968 2980 DetectCureTDL3: IrpHandler (13) addr: B9F04298 19:18:34:968 2980 DetectCureTDL3: IrpHandler (14) addr: B9F04298 19:18:34:968 2980 DetectCureTDL3: IrpHandler (15) addr: B9F04298 19:18:34:968 2980 DetectCureTDL3: IrpHandler (16) addr: B9F04298 19:18:34:968 2980 DetectCureTDL3: IrpHandler (17) addr: B9F04298 19:18:34:968 2980 DetectCureTDL3: IrpHandler (18) addr: B9F04298 19:18:34:968 2980 DetectCureTDL3: IrpHandler (19) addr: B9F04298 19:18:34:968 2980 DetectCureTDL3: IrpHandler (20) addr: B9F04298 19:18:34:968 2980 DetectCureTDL3: IrpHandler (21) addr: B9F04298 19:18:34:968 2980 DetectCureTDL3: IrpHandler (22) addr: B9F04298 19:18:34:968 2980 DetectCureTDL3: IrpHandler (23) addr: B9F04298 19:18:34:968 2980 DetectCureTDL3: IrpHandler (24) addr: B9F04298 19:18:34:968 2980 DetectCureTDL3: IrpHandler (25) addr: B9F04298 19:18:34:968 2980 DetectCureTDL3: IrpHandler (26) addr: B9F04298 19:18:34:968 2980 DetectCureTDL3: All IRP handlers pointed to one addr: B9F04298 19:18:34:968 2980 KLMD_ReadMem: Trying to ReadMemory 0xB9F04298[0x400] 19:18:34:984 2980 TDL3_IrpHookDetect: TDL3 Stub signature found, trying to get hook true addr 19:18:34:984 2980 KLMD_ReadMem: Trying to ReadMemory 0xFFDF0308[0x4] 19:18:34:984 2980 KLMD_ReadMem: Trying to ReadMemory 0x8AFD09FC[0x4] 19:18:34:984 2980 TDL3_IrpHookDetect: New IrpHandler addr: 8B03CF61 19:18:34:984 2980 KLMD_ReadMem: Trying to ReadMemory 0x8B03CF61[0x400] 19:18:34:984 2980 TDL3_IrpHookDetect: CheckParameters: 10, FFDF0308, 510, 134, 3, 120 19:18:34:984 2980 Driver "viasraid" Irp handler infected by TDSS rootkit … 19:18:34:984 2980 KLMD_WriteMem: Trying to WriteMemory 0x8B03CFE7[0xD] 19:18:34:984 2980 cured 19:18:34:984 2980 KLMD_ReadMem: Trying to ReadMemory 0xB9EE340E[0x400] 19:18:34:984 2980 TDL3_StartIoHookDetect: CheckParameters: 1, B9EE717C, 618, 0 19:18:34:984 2980 TDL3_FileDetect: Processing driver: viasraid 19:18:34:984 2980 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\viasraid.sys, C:\WINDOWS\system32\Drivers\viasraid.tsk, SYSTEM\CurrentControlSet\Services\viasraid, system32\Drivers\viasraid.tsk 19:18:34:984 2980 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\viasraid.sys 19:18:34:984 2980 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\viasraid.sys 19:18:35:000 2980 File C:\WINDOWS\system32\drivers\viasraid.sys infected by TDSS rootkit … 19:18:35:000 2980 TDL3_FileCure: Processing driver file: C:\WINDOWS\system32\drivers\viasraid.sys 19:18:35:000 2980 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\viasraid.sys 19:18:35:000 2980 TDL3_FileCure: Dumping cured buffer to file C:\WINDOWS\system32\Drivers\viasraid.tsk 19:18:35:000 2980 TDL3_FileCure: Image path (system32\Drivers\viasraid.tsk) was set for service (SYSTEM\CurrentControlSet\Services\viasraid) 19:18:35:000 2980 TDL3_FileCure: KLMD_PendCopyFileW (C:\WINDOWS\system32\Drivers\viasraid.tsk, C:\WINDOWS\system32\drivers\viasraid.sys) success 19:18:35:000 2980 will be cured on next reboot 19:18:35:000 2980 DetectCureTDL3: 3 Curr stack PDEVICE_OBJECT: 8B031AB8 19:18:35:000 2980 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8B031AB8 19:18:35:000 2980 DetectCureTDL3: 3 Curr stack PDEVICE_OBJECT: 8AFD19E8 19:18:35:000 2980 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8AFD19E8 19:18:35:000 2980 DetectCureTDL3: 3 Curr stack PDEVICE_OBJECT: 8B041940 19:18:35:000 2980 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8B041940 19:18:35:000 2980 KLMD_ReadMem: Trying to ReadMemory 0x8B041940[0x38] 19:18:35:000 2980 DetectCureTDL3: DRIVER_OBJECT addr: 8AFF5030 19:18:35:000 2980 KLMD_ReadMem: Trying to ReadMemory 0x8AFF5030[0xA8] 19:18:35:000 2980 KLMD_ReadMem: Trying to ReadMemory 0xE1004CC8[0x208] 19:18:35:000 2980 DetectCureTDL3: DRIVER_OBJECT name: \Driver\atapi, Driver Name: atapi 19:18:35:000 2980 DetectCureTDL3: IrpHandler (0) addr: B9F15572 19:18:35:000 2980 DetectCureTDL3: IrpHandler (1) addr: 804F320E 19:18:35:000 2980 DetectCureTDL3: IrpHandler (2) addr: B9F15572 19:18:35:000 2980 DetectCureTDL3: IrpHandler (3) addr: 804F320E 19:18:35:000 2980 DetectCureTDL3: IrpHandler (4) addr: 804F320E 19:18:35:000 2980 DetectCureTDL3: IrpHandler (5) addr: 804F320E 19:18:35:000 2980 DetectCureTDL3: IrpHandler (6) addr: 804F320E 19:18:35:000 2980 DetectCureTDL3: IrpHandler (7) addr: 804F320E 19:18:35:000 2980 DetectCureTDL3: IrpHandler (8) addr: 804F320E 19:18:35:000 2980 DetectCureTDL3: IrpHandler (9) addr: 804F320E 19:18:35:000 2980 DetectCureTDL3: IrpHandler (10) addr: 804F320E 19:18:35:000 2980 DetectCureTDL3: IrpHandler (11) addr: 804F320E 19:18:35:000 2980 DetectCureTDL3: IrpHandler (12) addr: 804F320E 19:18:35:000 2980 DetectCureTDL3: IrpHandler (13) addr: 804F320E 19:18:35:000 2980 DetectCureTDL3: IrpHandler (14) addr: B9F15592 19:18:35:000 2980 DetectCureTDL3: IrpHandler (15) addr: B9F117B4 19:18:35:000 2980 DetectCureTDL3: IrpHandler (16) addr: 804F320E 19:18:35:000 2980 DetectCureTDL3: IrpHandler (17) addr: 804F320E 19:18:35:000 2980 DetectCureTDL3: IrpHandler (18) addr: 804F320E 19:18:35:000 2980 DetectCureTDL3: IrpHandler (19) addr: 804F320E 19:18:35:000 2980 DetectCureTDL3: IrpHandler (20) addr: 804F320E 19:18:35:000 2980 DetectCureTDL3: IrpHandler (21) addr: 804F320E 19:18:35:000 2980 DetectCureTDL3: IrpHandler (22) addr: B9F155BC 19:18:35:000 2980 DetectCureTDL3: IrpHandler (23) addr: B9F1C164 19:18:35:000 2980 DetectCureTDL3: IrpHandler (24) addr: 804F320E 19:18:35:000 2980 DetectCureTDL3: IrpHandler (25) addr: 804F320E 19:18:35:000 2980 DetectCureTDL3: IrpHandler (26) addr: 804F320E 19:18:35:000 2980 KLMD_ReadMem: Trying to ReadMemory 0xB9F127C6[0x400] 19:18:35:000 2980 TDL3_StartIoHookDetect: CheckParameters: 0, 0, 229, 0 19:18:35:000 2980 TDL3_FileDetect: Processing driver: atapi 19:18:35:000 2980 TDL3_FileDetect: Parameters: C:\WINDOWS\system32\drivers\atapi.sys, C:\WINDOWS\system32\Drivers\atapi.tsk, SYSTEM\CurrentControlSet\Services\atapi, system32\Drivers\atapi.tsk 19:18:35:000 2980 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\drivers\atapi.sys 19:18:35:000 2980 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\drivers\atapi.sys 19:18:35:046 2980 Completed Results: 19:18:35:046 2980 Infected objects in memory: 1 19:18:35:046 2980 Cured objects in memory: 1 19:18:35:046 2980 Infected objects on disk: 1 19:18:35:062 2980 Objects on disk cured on reboot: 1 19:18:35:062 2980 Objects on disk deleted on reboot: 0 19:18:35:062 2980 Registry nodes deleted on reboot: 0 19:18:35:062 2980
Post #23
Redirects seem to be cured in both FF & IE, thanks a million. Also I can now boot in safe mode, but Recovery Console still crashes for some reason, but hopefully it won't be too much of a problem.
Post #24
Excellent :thumbup:

Delete this file if it exists:
C:\WINDOWS\system32\tdlcmd.dll

Can you try running GMER again now? I suspect it was the Malware causing the problems, just want to make sure there is nothing else.

Are you having any other problems? Please also run MBAM again, hopefully anything it finds this time round wont come back now that the main culprit is gone.
Post #25 last edited
C:\WINDOWS\system32\tdlcmd.dll didn't exist, so no action needed there. GMER seems to be running fine now but it's taking a while so I'll post the logs for that and MBAM later on this evening.
Post #27
MBAM Log:

Malwarebytes' Anti-Malware 1.43
Database version: 3483
Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

03/01/2010 22:57:58
mbam-log-2010-01-03 (22-57-58).txt

Scan type: Quick Scan
Objects scanned: 130036
Time elapsed: 4 minute(s), 52 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Not selected for removal.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


GMER Log:

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-01-03 22:51:08
Windows 5.1.2600 Service Pack 2
Running: gmer.exe; Driver: C:\DOCUME~1\Jamey\LOCALS~1\Temp\fwliqpow.sys


—- System - GMER 1.0.15 —-

SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwAssignProcessToJobObject [0xA1318A60]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwClose [0xA12FDBF0]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwConnectPort [0xA131A920]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwCreateFile [0xA12F9F60]
SSDT cfrmd.sys (COMODO Safe Delete Filter/COMODO Security Solutions Inc.) ZwCreateKey [0xB9E9C3E6]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwCreateProcess [0xA13112B0]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwCreateProcessEx [0xA1311BB0]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwCreateSection [0xA12F8D10]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwCreateSymbolicLinkObject [0xA1304E40]
SSDT BA718FBC ZwCreateThread
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwDebugActiveProcess [0xA131DF30]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwDeleteFile [0xA1303B20]
SSDT cfrmd.sys (COMODO Safe Delete Filter/COMODO Security Solutions Inc.) ZwDeleteKey [0xB9E9D0F2]
SSDT cfrmd.sys (COMODO Safe Delete Filter/COMODO Security Solutions Inc.) ZwDeleteValueKey [0xB9E9CB06]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwLoadDriver [0xA130EBB0]
SSDT BA718FDA ZwLoadKey
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwMakeTemporaryObject [0xA13046B0]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwOpenFile [0xA12FCC10]
SSDT cfrmd.sys (COMODO Safe Delete Filter/COMODO Security Solutions Inc.) ZwOpenKey [0xB9E9C684]
SSDT BA718FA8 ZwOpenProcess
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwOpenSection [0xA12F9580]
SSDT BA718FAD ZwOpenThread
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwProtectVirtualMemory [0xA1319DA0]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwQueryDirectoryFile [0xA12FE8A0]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwQueryKey [0xA1308750]
SSDT cfrmd.sys (COMODO Safe Delete Filter/COMODO Security Solutions Inc.) ZwQueryValueKey [0xB9E9C90A]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwQueueApcThread [0xA1317ED0]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwRenameKey [0xA130C590]
SSDT BA718FE4 ZwReplaceKey
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwRequestPort [0xA131CA50]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwRequestWaitReplyPort [0xA131CD70]
SSDT BA718FDF ZwRestoreKey
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwSaveKey [0xA130AC80]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwSaveKeyEx [0xA130B4D0]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwSecureConnectPort [0xA131B480]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwSetContextThread [0xA1317440]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwSetInformationDebugObject [0xA131E520]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwSetInformationFile [0xA12FFBF0]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwSetSystemInformation [0xA130E1C0]
SSDT cfrmd.sys (COMODO Safe Delete Filter/COMODO Security Solutions Inc.) ZwSetValueKey [0xB9E9CE82]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwSuspendProcess [0xA1316190]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwSuspendThread [0xA1316AC0]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwSystemDebugControl [0xA131D770]
SSDT BA718FB7 ZwTerminateProcess
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwTerminateThread [0xA1315620]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwUnloadDriver [0xA130F530]
SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwWriteVirtualMemory [0xA13192B0]

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs cfrmd.sys (COMODO Safe Delete Filter/COMODO Security Solutions Inc.)

Device \FileSystem\Udfs \UdfsCdRom BsUDF.SYS (UDF File System Driver (WindowsXP)/ahead software)
Device \FileSystem\Udfs \UdfsDisk BsUDF.SYS (UDF File System Driver (WindowsXP)/ahead software)
Device \Driver\Tcpip \Device\Ip afwcore.sys (Agnitum Firewall Core Driver/Agnitum Ltd.)
Device \Driver\Tcpip \Device\Tcp afwcore.sys (Agnitum Firewall Core Driver/Agnitum Ltd.)
Device \Driver\Tcpip \Device\Udp afwcore.sys (Agnitum Firewall Core Driver/Agnitum Ltd.)
Device \Driver\Tcpip \Device\RawIp afwcore.sys (Agnitum Firewall Core Driver/Agnitum Ltd.)
Device \Driver\Tcpip \Device\IPMULTICAST afwcore.sys (Agnitum Firewall Core Driver/Agnitum Ltd.)
Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer BsUDF.SYS (UDF File System Driver (WindowsXP)/ahead software)
Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer BsUDF.SYS (UDF File System Driver (WindowsXP)/ahead software)
Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer BsUDF.SYS (UDF File System Driver (WindowsXP)/ahead software)
Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer BsUDF.SYS (UDF File System Driver (WindowsXP)/ahead software)
Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer BsUDF.SYS (UDF File System Driver (WindowsXP)/ahead software)
Device \FileSystem\Cdfs \Cdfs BsUDF.SYS (UDF File System Driver (WindowsXP)/ahead software)

—- EOF - GMER 1.0.15 —-
Post #28
Looks good :thumbup:

We just need to make one small alteration to restore things back to normal. First, please navigate to C:\WINDOWS\system32, viasraid.sys and look at the the Modified field. If it shows the date/time that you ran TDSSKiller (and only if it does), please click Start >> Run and use the following command:
reg add "HKLM\SYSTEM\CurrentControlSet\Services\viasraid" /v ImagePath /t REG_EXPAND_SZ /d "system32\DRIVERS\viasraid.sys"

If it doesn't, let me know.

Is everything else back to normal now?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI