CatByte
usually there is no password, so you should be able to just press enter and it will pass the password prompt…the windows is the correct one to log onto… so yes - select #2,
Spyware / Malware / Virus Removal
[Closed] Trojan Horse BackDoor.Generic 12 AAVT
19 min read
Bikerider
OK here we go looklog.txt
Run from C:\Documents and Settings\Owner\Desktop\maxlook.exe on Fri 02/12/2010 at 21:52:04.75
No infected file found
Rogue configuration file = C:\WINDOWS\system32\config\mmakmqna.sav
CatByte
Hi,
Please do the following:
Download ComboFix from one of the following locations:
Link 1
Link 2
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
[external image: Posted Image]
[external image: Posted Image]
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
Please do the following:
Download ComboFix from one of the following locations:
Link 1
Link 2
VERY IMPORTANT !!! Save ComboFix.exe to your Desktop
* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
- Double click on ComboFix.exe & follow the prompts.
- Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
[external image: Posted Image]
- Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
[external image: Posted Image]
- Click on Yes, to continue scanning for malware.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
Bikerider
Hi
Here is the combofix log
Thank You
ComboFix 10-02-09.03 - Owner 02/13/2010 15:21:50.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.895.385 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\Mozilla Firefox\plc4.dll
c:\recycler\S-1-5-21-743215221-2294755417-2734125906-1003
c:\windows\system32\Thumbs.db
D:\Autorun.inf
Infected copy of c:\windows\system32\DRIVERS\raspppoe.sys was found and disinfected
Restored copy from - The cat ate it
.
((((((((((((((((((((((((( Files Created from 2010-01-13 to 2010-02-13 )))))))))))))))))))))))))))))))
.
2010-02-12 04:36 . 2010-02-13 05:21 ——– d—–w- c:\windows\maxdriver
2010-02-07 02:49 . 2008-11-18 19:15 417136 —-a-w- c:\windows\handle.exe
2010-02-04 05:51 . 2010-02-04 06:03 ——– d—–w- c:\documents and settings\Owner\DoctorWeb
2010-02-03 05:46 . 2010-02-03 05:46 52224 —-a-w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-02-03 05:46 . 2010-02-03 05:46 117760 —-a-w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-02-03 05:44 . 2010-02-03 05:44 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-02-03 05:44 . 2010-02-03 05:44 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-02-03 05:44 . 2010-02-03 05:44 ——– d—–w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com
2010-02-03 05:43 . 2010-02-03 05:43 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2010-01-31 00:55 . 2010-01-21 14:39 1260800 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgfrw.exe
2010-01-31 00:55 . 2010-01-21 14:39 3777280 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\setup.exe
2010-01-31 00:41 . 2010-01-07 22:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-31 00:41 . 2010-01-07 22:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-29 03:38 . 2010-01-29 03:38 ——– d—–w- c:\documents and settings\Owner\Application Data\Malwarebytes
2010-01-29 03:38 . 2010-01-29 03:38 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-29 03:38 . 2010-01-31 00:41 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-29 03:29 . 2010-01-29 03:30 ——– d—–w- c:\program files\ERUNT
2010-01-25 04:19 . 2010-01-25 04:19 ——– d—–w- c:\program files\Trend Micro
2010-01-21 14:30 . 2010-01-21 14:30 ——– d—–w- c:\windows\system32\wbem\Repository
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-11 04:14 . 2009-09-18 03:38 890 -c–a-w- c:\documents and settings\Owner\Application Data\wklnhst.dat
2010-02-10 03:31 . 2007-11-10 04:28 ——– d—–w- c:\documents and settings\Owner\Application Data\Spare Backup
2010-01-30 23:44 . 2009-01-17 23:51 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-01-27 02:59 . 2008-01-21 01:49 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-01-24 02:26 . 2009-07-04 14:39 862040 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\threatwork.exe
2010-01-24 02:25 . 2009-07-04 14:39 206944 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavamessage.dll
2010-01-24 02:25 . 2009-07-04 14:39 390288 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavalicense.dll
2010-01-24 02:25 . 2009-10-30 01:45 537576 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\aawapi.dll
2010-01-24 02:24 . 2009-07-04 14:39 372280 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2010-01-24 02:24 . 2009-07-04 14:39 194104 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Savapibridge.dll
2010-01-24 02:23 . 2009-07-04 14:39 6296864 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Resources.dll
2010-01-24 02:21 . 2009-07-04 14:39 933120 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2010-01-24 02:20 . 2009-09-21 16:48 3803208 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2010-01-24 02:19 . 2009-07-04 14:39 816272 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2010-01-24 02:18 . 2009-07-04 14:39 823928 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2010-01-24 02:17 . 2009-07-04 14:38 1643272 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2010-01-24 02:16 . 2009-07-04 14:38 788880 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe
2010-01-24 02:15 . 2009-07-04 14:38 1181328 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2010-01-21 14:29 . 2009-01-17 23:51 ——– d—–w- c:\program files\Spyware Doctor
2009-12-31 16:50 . 2006-05-07 00:24 353792 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-16 18:43 . 2006-05-07 00:35 343040 —-a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 2006-05-07 00:24 33280 —-a-w- c:\windows\system32\csrsrv.dll
2009-12-04 18:22 . 2006-05-07 00:24 455424 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-11-27 17:11 . 2006-05-07 00:24 1291776 —-a-w- c:\windows\system32\quartz.dll
2009-11-27 17:11 . 2004-08-04 07:56 17920 —-a-w- c:\windows\system32\msyuv.dll
2009-11-27 16:07 . 2006-05-07 00:24 28672 —-a-w- c:\windows\system32\msvidc32.dll
2009-11-27 16:07 . 2001-08-18 05:36 8704 —-a-w- c:\windows\system32\tsbyuv.dll
2009-11-27 16:07 . 2006-05-07 00:24 11264 —-a-w- c:\windows\system32\msrle32.dll
2009-11-27 16:07 . 2006-05-07 00:24 84992 —-a-w- c:\windows\system32\avifil32.dll
2009-11-27 16:07 . 2004-08-04 07:56 48128 —-a-w- c:\windows\system32\iyuv_32.dll
2009-11-21 15:51 . 2006-05-07 00:24 471552 —-a-w- c:\windows\AppPatch\aclayers.dll
2009-11-20 02:48 . 2009-07-04 14:39 163728 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\ShellExt.dll
2009-11-20 02:48 . 2009-07-04 14:39 327000 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\RPAPI.dll
2009-11-20 02:48 . 2009-07-04 14:39 87496 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1119488]
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1119488]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1119488]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Power2GoExpress"="NA" [X]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-02-27 39408]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
BigFix.lnk - c:\program files\BigFix\bigfix.exe [2007-11-9 2348584]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= "c:\program files\Qualcomm\Eudora\EuShlExt.dll" [2006-08-17 86016]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 20:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-11-06 15:59 12464 —-a-w- c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [7/3/2009 10:44 AM 64288]
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [5/31/2009 7:39 AM 130936]
R1 ATMhelpr;ATMhelpr;c:\windows\system32\drivers\ATMHELPR.SYS [2/3/2008 10:35 AM 4064]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [4/16/2009 10:09 AM 333192]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [4/16/2009 10:09 AM 360584]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [1/5/2010 7:56 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [1/5/2010 7:56 AM 74480]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [11/6/2009 9:59 AM 906520]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [11/6/2009 9:58 AM 285392]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [9/24/2009 5:17 AM 1181328]
S3 el575nd5;3Com Megahertz 10/100 LAN CardBus PC Card Driver;c:\windows\system32\drivers\el575ND5.sys [6/30/2006 10:44 PM 69692]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [1/30/2010 6:41 PM 38224]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [1/5/2010 7:56 AM 7408]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [1/17/2009 7:11 PM 348752]
.
Contents of the 'Scheduled Tasks' folder
2010-02-13 c:\windows\Tasks\Ad-Aware Update (Daily 1).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 02:18]
2010-02-13 c:\windows\Tasks\Ad-Aware Update (Daily 2).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 02:18]
2010-02-13 c:\windows\Tasks\Ad-Aware Update (Daily 3).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 02:18]
2010-02-13 c:\windows\Tasks\Ad-Aware Update (Daily 4).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 02:18]
2010-02-13 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 02:18]
2010-02-13 c:\windows\Tasks\User_Feed_Synchronization-{5ADBB937-B690-4056-926C-6C21BB99172C}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 09:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&SubCH;=nofound&Br;=EM&Loc;=ENG_US&Sys;=DTP&M;=W3644
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\5eo35kw1.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr;=ytff-&p;=
FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
FF - prefs.js: browser.startup.homepage - hxxp://www.winfieldcourier.com/
FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type;=yahoo_avg_hs2-tb-web_us&p;=
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
FF - plugin: c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\5eo35kw1.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-13 15:29
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys >>UNKNOWN [0xF4932BDE]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf756bf28
\Driver\ACPI -> ACPI.sys @ 0xf735ecb8
\Driver\atapi -> atapi.sys @ 0xf72e0852
IoDeviceObjectType -> ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
\Device\Harddisk0\DR0 -> ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
NDIS: NVIDIA nForce Networking Controller -> SendCompleteHandler -> NDIS.sys @ 0xf7167bb0
PacketIndicateHandler -> NDIS.sys @ 0xf7156a0d
SendHandler -> NDIS.sys @ 0xf716ab40
user & kernel MBR OK
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'winlogon.exe'(672)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
- - - - - - - > 'lsass.exe'(728)
max++.00.x86 35670000 49152 \\74.117.114.86\max++.x86.dll
c:\windows\system32\jscript.dll
.
Completion time: 2010-02-13 15:32:13
ComboFix-quarantined-files.txt 2010-02-13 21:32
Pre-Run: 130,875,207,680 bytes free
Post-Run: 130,875,146,240 bytes free
- - End Of File - - 7B807928354637297487DBB6D1FF4F32
Here is the combofix log
Thank You
ComboFix 10-02-09.03 - Owner 02/13/2010 15:21:50.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.895.385 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\Mozilla Firefox\plc4.dll
c:\recycler\S-1-5-21-743215221-2294755417-2734125906-1003
c:\windows\system32\Thumbs.db
D:\Autorun.inf
Infected copy of c:\windows\system32\DRIVERS\raspppoe.sys was found and disinfected
Restored copy from - The cat ate it
.
((((((((((((((((((((((((( Files Created from 2010-01-13 to 2010-02-13 )))))))))))))))))))))))))))))))
.
2010-02-12 04:36 . 2010-02-13 05:21 ——– d—–w- c:\windows\maxdriver
2010-02-07 02:49 . 2008-11-18 19:15 417136 —-a-w- c:\windows\handle.exe
2010-02-04 05:51 . 2010-02-04 06:03 ——– d—–w- c:\documents and settings\Owner\DoctorWeb
2010-02-03 05:46 . 2010-02-03 05:46 52224 —-a-w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-02-03 05:46 . 2010-02-03 05:46 117760 —-a-w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-02-03 05:44 . 2010-02-03 05:44 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-02-03 05:44 . 2010-02-03 05:44 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-02-03 05:44 . 2010-02-03 05:44 ——– d—–w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com
2010-02-03 05:43 . 2010-02-03 05:43 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2010-01-31 00:55 . 2010-01-21 14:39 1260800 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgfrw.exe
2010-01-31 00:55 . 2010-01-21 14:39 3777280 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\setup.exe
2010-01-31 00:41 . 2010-01-07 22:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-31 00:41 . 2010-01-07 22:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-29 03:38 . 2010-01-29 03:38 ——– d—–w- c:\documents and settings\Owner\Application Data\Malwarebytes
2010-01-29 03:38 . 2010-01-29 03:38 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-29 03:38 . 2010-01-31 00:41 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-29 03:29 . 2010-01-29 03:30 ——– d—–w- c:\program files\ERUNT
2010-01-25 04:19 . 2010-01-25 04:19 ——– d—–w- c:\program files\Trend Micro
2010-01-21 14:30 . 2010-01-21 14:30 ——– d—–w- c:\windows\system32\wbem\Repository
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-11 04:14 . 2009-09-18 03:38 890 -c–a-w- c:\documents and settings\Owner\Application Data\wklnhst.dat
2010-02-10 03:31 . 2007-11-10 04:28 ——– d—–w- c:\documents and settings\Owner\Application Data\Spare Backup
2010-01-30 23:44 . 2009-01-17 23:51 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-01-27 02:59 . 2008-01-21 01:49 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-01-24 02:26 . 2009-07-04 14:39 862040 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\threatwork.exe
2010-01-24 02:25 . 2009-07-04 14:39 206944 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavamessage.dll
2010-01-24 02:25 . 2009-07-04 14:39 390288 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavalicense.dll
2010-01-24 02:25 . 2009-10-30 01:45 537576 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\aawapi.dll
2010-01-24 02:24 . 2009-07-04 14:39 372280 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2010-01-24 02:24 . 2009-07-04 14:39 194104 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Savapibridge.dll
2010-01-24 02:23 . 2009-07-04 14:39 6296864 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Resources.dll
2010-01-24 02:21 . 2009-07-04 14:39 933120 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2010-01-24 02:20 . 2009-09-21 16:48 3803208 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2010-01-24 02:19 . 2009-07-04 14:39 816272 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2010-01-24 02:18 . 2009-07-04 14:39 823928 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2010-01-24 02:17 . 2009-07-04 14:38 1643272 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2010-01-24 02:16 . 2009-07-04 14:38 788880 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe
2010-01-24 02:15 . 2009-07-04 14:38 1181328 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2010-01-21 14:29 . 2009-01-17 23:51 ——– d—–w- c:\program files\Spyware Doctor
2009-12-31 16:50 . 2006-05-07 00:24 353792 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-16 18:43 . 2006-05-07 00:35 343040 —-a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 2006-05-07 00:24 33280 —-a-w- c:\windows\system32\csrsrv.dll
2009-12-04 18:22 . 2006-05-07 00:24 455424 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-11-27 17:11 . 2006-05-07 00:24 1291776 —-a-w- c:\windows\system32\quartz.dll
2009-11-27 17:11 . 2004-08-04 07:56 17920 —-a-w- c:\windows\system32\msyuv.dll
2009-11-27 16:07 . 2006-05-07 00:24 28672 —-a-w- c:\windows\system32\msvidc32.dll
2009-11-27 16:07 . 2001-08-18 05:36 8704 —-a-w- c:\windows\system32\tsbyuv.dll
2009-11-27 16:07 . 2006-05-07 00:24 11264 —-a-w- c:\windows\system32\msrle32.dll
2009-11-27 16:07 . 2006-05-07 00:24 84992 —-a-w- c:\windows\system32\avifil32.dll
2009-11-27 16:07 . 2004-08-04 07:56 48128 —-a-w- c:\windows\system32\iyuv_32.dll
2009-11-21 15:51 . 2006-05-07 00:24 471552 —-a-w- c:\windows\AppPatch\aclayers.dll
2009-11-20 02:48 . 2009-07-04 14:39 163728 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\ShellExt.dll
2009-11-20 02:48 . 2009-07-04 14:39 327000 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\RPAPI.dll
2009-11-20 02:48 . 2009-07-04 14:39 87496 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1119488]
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1119488]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1119488]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Power2GoExpress"="NA" [X]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-02-27 39408]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
BigFix.lnk - c:\program files\BigFix\bigfix.exe [2007-11-9 2348584]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= "c:\program files\Qualcomm\Eudora\EuShlExt.dll" [2006-08-17 86016]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 20:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-11-06 15:59 12464 —-a-w- c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [7/3/2009 10:44 AM 64288]
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [5/31/2009 7:39 AM 130936]
R1 ATMhelpr;ATMhelpr;c:\windows\system32\drivers\ATMHELPR.SYS [2/3/2008 10:35 AM 4064]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [4/16/2009 10:09 AM 333192]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [4/16/2009 10:09 AM 360584]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [1/5/2010 7:56 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [1/5/2010 7:56 AM 74480]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [11/6/2009 9:59 AM 906520]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [11/6/2009 9:58 AM 285392]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [9/24/2009 5:17 AM 1181328]
S3 el575nd5;3Com Megahertz 10/100 LAN CardBus PC Card Driver;c:\windows\system32\drivers\el575ND5.sys [6/30/2006 10:44 PM 69692]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [1/30/2010 6:41 PM 38224]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [1/5/2010 7:56 AM 7408]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [1/17/2009 7:11 PM 348752]
.
Contents of the 'Scheduled Tasks' folder
2010-02-13 c:\windows\Tasks\Ad-Aware Update (Daily 1).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 02:18]
2010-02-13 c:\windows\Tasks\Ad-Aware Update (Daily 2).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 02:18]
2010-02-13 c:\windows\Tasks\Ad-Aware Update (Daily 3).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 02:18]
2010-02-13 c:\windows\Tasks\Ad-Aware Update (Daily 4).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 02:18]
2010-02-13 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 02:18]
2010-02-13 c:\windows\Tasks\User_Feed_Synchronization-{5ADBB937-B690-4056-926C-6C21BB99172C}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 09:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&SubCH;=nofound&Br;=EM&Loc;=ENG_US&Sys;=DTP&M;=W3644
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\5eo35kw1.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr;=ytff-&p;=
FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
FF - prefs.js: browser.startup.homepage - hxxp://www.winfieldcourier.com/
FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type;=yahoo_avg_hs2-tb-web_us&p;=
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
FF - plugin: c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\5eo35kw1.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-13 15:29
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys >>UNKNOWN [0xF4932BDE]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf756bf28
\Driver\ACPI -> ACPI.sys @ 0xf735ecb8
\Driver\atapi -> atapi.sys @ 0xf72e0852
IoDeviceObjectType -> ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
\Device\Harddisk0\DR0 -> ParseProcedure -> ntkrnlpa.exe @ 0x80577c84
NDIS: NVIDIA nForce Networking Controller -> SendCompleteHandler -> NDIS.sys @ 0xf7167bb0
PacketIndicateHandler -> NDIS.sys @ 0xf7156a0d
SendHandler -> NDIS.sys @ 0xf716ab40
user & kernel MBR OK
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'winlogon.exe'(672)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
- - - - - - - > 'lsass.exe'(728)
max++.00.x86 35670000 49152 \\74.117.114.86\max++.x86.dll
c:\windows\system32\jscript.dll
.
Completion time: 2010-02-13 15:32:13
ComboFix-quarantined-files.txt 2010-02-13 21:32
Pre-Run: 130,875,207,680 bytes free
Post-Run: 130,875,146,240 bytes free
- - End Of File - - 7B807928354637297487DBB6D1FF4F32
CatByte
Hi,
Please do the following:
Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:
Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')
Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')
Save this file to your desktop, Save this as "CFScript"
Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …
[external image: Posted Image]
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
**Note**
When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
NEXT
Extract the file and run it.
Once completed it will create a log in your C:\ drive called TDSSKiller_* (* denotes version & date)
please post the content of that log TDSSKiller
Please do the following:
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
- They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:
Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')
http://forums.whatthetech.com/Trojan_Horse_BackDoor_Generic_12_AAVT_t109934.html&view=findpost&p=632785#entry632785 Collect:: C:\WINDOWS\system32\config\mmakmqna.sav
Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')
Save this file to your desktop, Save this as "CFScript"
Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …
[external image: Posted Image]
- Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
- ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
- When finished, it shall produce a log for you.
- Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
**Note**
When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
- Ensure you are connected to the internet and click OK on the message box.
NEXT
- Download TDSSKiller and save it to your Desktop.
Extract the file and run it.
Once completed it will create a log in your C:\ drive called TDSSKiller_* (* denotes version & date)
please post the content of that log TDSSKiller
Bikerider
Hi
Question
the first time I ran combofix it detected rootkit activity and said it needed to reboot machine, I clicked on OK and it rebooted.
This time when I clicked on ok the pop-up screen went away but the machine did not reboot, just sets there with a blue screen. Should I manually reboot it?
CatByte
look in task manager and see if there are any processes there by the name of Pev.exe, sed.exe, grep.exe, cfxxx.exe > end process, that should free up ComboFix to continue.
If not. end CF with the X, then run TDSS killer, then go back to the CF script.
Bikerider
Does combofix need a dialup connection to run? Nun of the things you mentioned in task manager were there. Other than task manager I have a blank blue screen so how to proceed?
CatByte
Did you reboot
Bikerider
OK
I rebooted and combofix ran on its own, it finished and rebooted the computer, the computer gos to start windows and reboots in to an error in starting screen.
CatByte
We need to replace a driver so you can reboot normally again:
This was the reason for the installation of the Recovery Console, there was always the possibility of this happening:
please boot into the recovery console:
once at the command prompt, type carefully
then press enter
Agree to overwrite if prompted
then type exit at the command prompt, press enter and that will exit the Recovery Console and attempt to restart your machine
If you do not get the message "one file copied"
try this command:
This was the reason for the installation of the Recovery Console, there was always the possibility of this happening:
please boot into the recovery console:
once at the command prompt, type carefully
copy ServicePackFiles\i386\raspppoe.sys system32\drivers
then press enter
Agree to overwrite if prompted
then type exit at the command prompt, press enter and that will exit the Recovery Console and attempt to restart your machine
If you do not get the message "one file copied"
try this command:
copy system32\dllcache\raspppoe.sys system32\drivers
Bikerider
OK Success
Combofix finished and produced a log, here it is (I will go ahead and run TDSSKiller )
ComboFix 10-02-09.03 - Owner 02/13/2010 16:45:38.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.895.405 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
file zipped: c:\windows\system32\config\mmakmqna.sav
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\config\mmakmqna.sav
Infected copy of c:\windows\system32\DRIVERS\raspppoe.sys was found and disinfected
Restored copy from - The cat ate it
Infected copy of c:\windows\system32\drivers\raspppoe.sys was found and disinfected
Restored copy from - c:\windows\system32\dllcache\raspppoe.sys
.
((((((((((((((((((((((((( Files Created from 2010-01-13 to 2010-02-13 )))))))))))))))))))))))))))))))
.
2010-02-12 04:36 . 2010-02-13 05:21 ——– d—–w- c:\windows\maxdriver
2010-02-07 02:49 . 2008-11-18 19:15 417136 —-a-w- c:\windows\handle.exe
2010-02-04 05:51 . 2010-02-04 06:03 ——– d—–w- c:\documents and settings\Owner\DoctorWeb
2010-02-03 05:44 . 2010-02-03 05:44 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-02-03 05:44 . 2010-02-03 05:44 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-02-03 05:44 . 2010-02-03 05:44 ——– d—–w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com
2010-02-03 05:43 . 2010-02-03 05:43 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2010-01-31 00:41 . 2010-01-07 22:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-31 00:41 . 2010-01-07 22:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-29 03:38 . 2010-01-29 03:38 ——– d—–w- c:\documents and settings\Owner\Application Data\Malwarebytes
2010-01-29 03:38 . 2010-01-29 03:38 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-29 03:38 . 2010-01-31 00:41 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-29 03:29 . 2010-01-29 03:30 ——– d—–w- c:\program files\ERUNT
2010-01-25 04:19 . 2010-01-25 04:19 ——– d—–w- c:\program files\Trend Micro
2010-01-21 14:30 . 2010-01-21 14:30 ——– d—–w- c:\windows\system32\wbem\Repository
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-11 04:14 . 2009-09-18 03:38 890 -c–a-w- c:\documents and settings\Owner\Application Data\wklnhst.dat
2010-02-10 03:31 . 2007-11-10 04:28 ——– d—–w- c:\documents and settings\Owner\Application Data\Spare Backup
2010-02-03 05:46 . 2010-02-03 05:46 52224 —-a-w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-02-03 05:46 . 2010-02-03 05:46 117760 —-a-w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-01-30 23:44 . 2009-01-17 23:51 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-01-27 02:59 . 2008-01-21 01:49 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-01-24 02:26 . 2009-07-04 14:39 862040 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\threatwork.exe
2010-01-24 02:25 . 2009-07-04 14:39 206944 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavamessage.dll
2010-01-24 02:25 . 2009-07-04 14:39 390288 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavalicense.dll
2010-01-24 02:25 . 2009-10-30 01:45 537576 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\aawapi.dll
2010-01-24 02:24 . 2009-07-04 14:39 372280 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2010-01-24 02:24 . 2009-07-04 14:39 194104 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Savapibridge.dll
2010-01-24 02:23 . 2009-07-04 14:39 6296864 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Resources.dll
2010-01-24 02:21 . 2009-07-04 14:39 933120 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2010-01-24 02:20 . 2009-09-21 16:48 3803208 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2010-01-24 02:19 . 2009-07-04 14:39 816272 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2010-01-24 02:18 . 2009-07-04 14:39 823928 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2010-01-24 02:17 . 2009-07-04 14:38 1643272 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2010-01-24 02:16 . 2009-07-04 14:38 788880 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe
2010-01-24 02:15 . 2009-07-04 14:38 1181328 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2010-01-21 14:39 . 2010-01-31 00:55 1260800 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgfrw.exe
2010-01-21 14:39 . 2010-01-31 00:55 3777280 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\setup.exe
2010-01-21 14:29 . 2009-01-17 23:51 ——– d—–w- c:\program files\Spyware Doctor
2009-12-31 16:50 . 2006-05-07 00:24 353792 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-16 18:43 . 2006-05-07 00:35 343040 —-a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 2006-05-07 00:24 33280 —-a-w- c:\windows\system32\csrsrv.dll
2009-12-04 18:22 . 2006-05-07 00:24 455424 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-11-27 17:11 . 2006-05-07 00:24 1291776 —-a-w- c:\windows\system32\quartz.dll
2009-11-27 17:11 . 2004-08-04 07:56 17920 —-a-w- c:\windows\system32\msyuv.dll
2009-11-27 16:07 . 2006-05-07 00:24 28672 —-a-w- c:\windows\system32\msvidc32.dll
2009-11-27 16:07 . 2001-08-18 05:36 8704 —-a-w- c:\windows\system32\tsbyuv.dll
2009-11-27 16:07 . 2006-05-07 00:24 11264 —-a-w- c:\windows\system32\msrle32.dll
2009-11-27 16:07 . 2006-05-07 00:24 84992 —-a-w- c:\windows\system32\avifil32.dll
2009-11-27 16:07 . 2004-08-04 07:56 48128 —-a-w- c:\windows\system32\iyuv_32.dll
2009-11-21 15:51 . 2006-05-07 00:24 471552 —-a-w- c:\windows\AppPatch\aclayers.dll
2009-11-20 02:48 . 2009-07-04 14:39 163728 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\ShellExt.dll
2009-11-20 02:48 . 2009-07-04 14:39 327000 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\RPAPI.dll
2009-11-20 02:48 . 2009-07-04 14:39 87496 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1119488]
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-10-16 18:12 1119488 —-a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1119488]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1119488]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Power2GoExpress"="NA" [X]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-02-27 39408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-31 7634944]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
BigFix.lnk - c:\program files\BigFix\bigfix.exe [2007-11-9 2348584]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= "c:\program files\Qualcomm\Eudora\EuShlExt.dll" [2006-08-17 86016]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 20:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-11-06 15:59 12464 —-a-w- c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [7/3/2009 10:44 AM 64288]
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [5/31/2009 7:39 AM 130936]
R1 ATMhelpr;ATMhelpr;c:\windows\system32\drivers\ATMHELPR.SYS [2/3/2008 10:35 AM 4064]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [4/16/2009 10:09 AM 333192]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [4/16/2009 10:09 AM 360584]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [1/5/2010 7:56 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [1/5/2010 7:56 AM 74480]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [11/6/2009 9:59 AM 906520]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [11/6/2009 9:58 AM 285392]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [9/24/2009 5:17 AM 1181328]
S3 el575nd5;3Com Megahertz 10/100 LAN CardBus PC Card Driver;c:\windows\system32\drivers\el575ND5.sys [6/30/2006 10:44 PM 69692]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [1/30/2010 6:41 PM 38224]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [1/5/2010 7:56 AM 7408]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [1/17/2009 7:11 PM 348752]
.
Contents of the 'Scheduled Tasks' folder
2010-02-13 c:\windows\Tasks\Ad-Aware Update (Daily 1).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 02:18]
2010-02-13 c:\windows\Tasks\Ad-Aware Update (Daily 2).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 02:18]
2010-02-13 c:\windows\Tasks\Ad-Aware Update (Daily 3).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 02:18]
2010-02-13 c:\windows\Tasks\Ad-Aware Update (Daily 4).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 02:18]
2010-02-13 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 02:18]
2010-02-13 c:\windows\Tasks\User_Feed_Synchronization-{5ADBB937-B690-4056-926C-6C21BB99172C}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 09:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&SubCH;=nofound&Br;=EM&Loc;=ENG_US&Sys;=DTP&M;=W3644
uInternet Settings,ProxyOverride =
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\5eo35kw1.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr;=ytff-&p;=
FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
FF - prefs.js: browser.startup.homepage - hxxp://www.winfieldcourier.com/
FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type;=yahoo_avg_hs2-tb-web_us&p;=
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
FF - plugin: c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\5eo35kw1.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-13 17:31
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'winlogon.exe'(672)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
- - - - - - - > 'explorer.exe'(5500)
c:\windows\system32\WININET.dll
c:\windows\TEMP\logishrd\LVPrcInj01.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\AVG\AVG9\avgchsvx.exe
c:\program files\AVG\AVG9\avgrsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\program files\AVG\AVG9\avgnsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\wscntfy.exe
c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
.
**************************************************************************
.
Completion time: 2010-02-13 17:39:49 - machine was rebooted
ComboFix-quarantined-files.txt 2010-02-13 23:39
ComboFix2.txt 2010-02-13 21:32
Pre-Run: 130,883,215,360 bytes free
Post-Run: 130,847,465,472 bytes free
- - End Of File - - C895BB9EBC4DEA000D8BD64EC5888E87
Combofix finished and produced a log, here it is (I will go ahead and run TDSSKiller )
ComboFix 10-02-09.03 - Owner 02/13/2010 16:45:38.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.895.405 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
file zipped: c:\windows\system32\config\mmakmqna.sav
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\config\mmakmqna.sav
Infected copy of c:\windows\system32\DRIVERS\raspppoe.sys was found and disinfected
Restored copy from - The cat ate it
Infected copy of c:\windows\system32\drivers\raspppoe.sys was found and disinfected
Restored copy from - c:\windows\system32\dllcache\raspppoe.sys
.
((((((((((((((((((((((((( Files Created from 2010-01-13 to 2010-02-13 )))))))))))))))))))))))))))))))
.
2010-02-12 04:36 . 2010-02-13 05:21 ——– d—–w- c:\windows\maxdriver
2010-02-07 02:49 . 2008-11-18 19:15 417136 —-a-w- c:\windows\handle.exe
2010-02-04 05:51 . 2010-02-04 06:03 ——– d—–w- c:\documents and settings\Owner\DoctorWeb
2010-02-03 05:44 . 2010-02-03 05:44 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-02-03 05:44 . 2010-02-03 05:44 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-02-03 05:44 . 2010-02-03 05:44 ——– d—–w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com
2010-02-03 05:43 . 2010-02-03 05:43 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2010-01-31 00:41 . 2010-01-07 22:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-31 00:41 . 2010-01-07 22:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-29 03:38 . 2010-01-29 03:38 ——– d—–w- c:\documents and settings\Owner\Application Data\Malwarebytes
2010-01-29 03:38 . 2010-01-29 03:38 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-29 03:38 . 2010-01-31 00:41 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-29 03:29 . 2010-01-29 03:30 ——– d—–w- c:\program files\ERUNT
2010-01-25 04:19 . 2010-01-25 04:19 ——– d—–w- c:\program files\Trend Micro
2010-01-21 14:30 . 2010-01-21 14:30 ——– d—–w- c:\windows\system32\wbem\Repository
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-11 04:14 . 2009-09-18 03:38 890 -c–a-w- c:\documents and settings\Owner\Application Data\wklnhst.dat
2010-02-10 03:31 . 2007-11-10 04:28 ——– d—–w- c:\documents and settings\Owner\Application Data\Spare Backup
2010-02-03 05:46 . 2010-02-03 05:46 52224 —-a-w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-02-03 05:46 . 2010-02-03 05:46 117760 —-a-w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-01-30 23:44 . 2009-01-17 23:51 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-01-27 02:59 . 2008-01-21 01:49 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-01-24 02:26 . 2009-07-04 14:39 862040 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\threatwork.exe
2010-01-24 02:25 . 2009-07-04 14:39 206944 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavamessage.dll
2010-01-24 02:25 . 2009-07-04 14:39 390288 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavalicense.dll
2010-01-24 02:25 . 2009-10-30 01:45 537576 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\aawapi.dll
2010-01-24 02:24 . 2009-07-04 14:39 372280 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2010-01-24 02:24 . 2009-07-04 14:39 194104 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Savapibridge.dll
2010-01-24 02:23 . 2009-07-04 14:39 6296864 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Resources.dll
2010-01-24 02:21 . 2009-07-04 14:39 933120 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2010-01-24 02:20 . 2009-09-21 16:48 3803208 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AutoLaunch.exe
2010-01-24 02:19 . 2009-07-04 14:39 816272 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2010-01-24 02:18 . 2009-07-04 14:39 823928 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2010-01-24 02:17 . 2009-07-04 14:38 1643272 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2010-01-24 02:16 . 2009-07-04 14:38 788880 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe
2010-01-24 02:15 . 2009-07-04 14:38 1181328 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe
2010-01-21 14:39 . 2010-01-31 00:55 1260800 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\avgfrw.exe
2010-01-21 14:39 . 2010-01-31 00:55 3777280 —-a-w- c:\documents and settings\All Users\Application Data\avg9\update\backup\setup.exe
2010-01-21 14:29 . 2009-01-17 23:51 ——– d—–w- c:\program files\Spyware Doctor
2009-12-31 16:50 . 2006-05-07 00:24 353792 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-16 18:43 . 2006-05-07 00:35 343040 —-a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 2006-05-07 00:24 33280 —-a-w- c:\windows\system32\csrsrv.dll
2009-12-04 18:22 . 2006-05-07 00:24 455424 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-11-27 17:11 . 2006-05-07 00:24 1291776 —-a-w- c:\windows\system32\quartz.dll
2009-11-27 17:11 . 2004-08-04 07:56 17920 —-a-w- c:\windows\system32\msyuv.dll
2009-11-27 16:07 . 2006-05-07 00:24 28672 —-a-w- c:\windows\system32\msvidc32.dll
2009-11-27 16:07 . 2001-08-18 05:36 8704 —-a-w- c:\windows\system32\tsbyuv.dll
2009-11-27 16:07 . 2006-05-07 00:24 11264 —-a-w- c:\windows\system32\msrle32.dll
2009-11-27 16:07 . 2006-05-07 00:24 84992 —-a-w- c:\windows\system32\avifil32.dll
2009-11-27 16:07 . 2004-08-04 07:56 48128 —-a-w- c:\windows\system32\iyuv_32.dll
2009-11-21 15:51 . 2006-05-07 00:24 471552 —-a-w- c:\windows\AppPatch\aclayers.dll
2009-11-20 02:48 . 2009-07-04 14:39 163728 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\ShellExt.dll
2009-11-20 02:48 . 2009-07-04 14:39 327000 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\RPAPI.dll
2009-11-20 02:48 . 2009-07-04 14:39 87496 —-a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1119488]
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-10-16 18:12 1119488 —-a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1119488]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-10-16 1119488]
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Power2GoExpress"="NA" [X]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-02-27 39408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-31 7634944]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
BigFix.lnk - c:\program files\BigFix\bigfix.exe [2007-11-9 2348584]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= "c:\program files\Qualcomm\Eudora\EuShlExt.dll" [2006-08-17 86016]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 20:21 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-11-06 15:59 12464 —-a-w- c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [7/3/2009 10:44 AM 64288]
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [5/31/2009 7:39 AM 130936]
R1 ATMhelpr;ATMhelpr;c:\windows\system32\drivers\ATMHELPR.SYS [2/3/2008 10:35 AM 4064]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [4/16/2009 10:09 AM 333192]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [4/16/2009 10:09 AM 360584]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [1/5/2010 7:56 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [1/5/2010 7:56 AM 74480]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [11/6/2009 9:59 AM 906520]
R2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [11/6/2009 9:58 AM 285392]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [9/24/2009 5:17 AM 1181328]
S3 el575nd5;3Com Megahertz 10/100 LAN CardBus PC Card Driver;c:\windows\system32\drivers\el575ND5.sys [6/30/2006 10:44 PM 69692]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [1/30/2010 6:41 PM 38224]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [1/5/2010 7:56 AM 7408]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [1/17/2009 7:11 PM 348752]
.
Contents of the 'Scheduled Tasks' folder
2010-02-13 c:\windows\Tasks\Ad-Aware Update (Daily 1).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 02:18]
2010-02-13 c:\windows\Tasks\Ad-Aware Update (Daily 2).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 02:18]
2010-02-13 c:\windows\Tasks\Ad-Aware Update (Daily 3).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 02:18]
2010-02-13 c:\windows\Tasks\Ad-Aware Update (Daily 4).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 02:18]
2010-02-13 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-10-01 02:18]
2010-02-13 c:\windows\Tasks\User_Feed_Synchronization-{5ADBB937-B690-4056-926C-6C21BB99172C}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 09:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&SubCH;=nofound&Br;=EM&Loc;=ENG_US&Sys;=DTP&M;=W3644
uInternet Settings,ProxyOverride =
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\5eo35kw1.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr;=ytff-&p;=
FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
FF - prefs.js: browser.startup.homepage - hxxp://www.winfieldcourier.com/
FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type;=yahoo_avg_hs2-tb-web_us&p;=
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\AVG\AVG9\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
FF - plugin: c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\5eo35kw1.default\extensions\[removed]\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-13 17:31
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'winlogon.exe'(672)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
- - - - - - - > 'explorer.exe'(5500)
c:\windows\system32\WININET.dll
c:\windows\TEMP\logishrd\LVPrcInj01.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\AVG\AVG9\avgchsvx.exe
c:\program files\AVG\AVG9\avgrsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\program files\AVG\AVG9\avgnsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\wscntfy.exe
c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
.
**************************************************************************
.
Completion time: 2010-02-13 17:39:49 - machine was rebooted
ComboFix-quarantined-files.txt 2010-02-13 23:39
ComboFix2.txt 2010-02-13 21:32
Pre-Run: 130,883,215,360 bytes free
Post-Run: 130,847,465,472 bytes free
- - End Of File - - C895BB9EBC4DEA000D8BD64EC5888E87
Bikerider
Hi
Here is the TDSSKiller log
17:56:29:906 3808 TDSS rootkit removing tool 2.2.3 Feb 4 2010 14:34:00
17:56:29:906 3808 ================================================================================
17:56:29:906 3808 SystemInfo:
17:56:29:906 3808 OS Version: 5.1.2600 ServicePack: 3.0
17:56:29:906 3808 Product type: Workstation
17:56:29:906 3808 ComputerName: DEBBIE
17:56:29:906 3808 UserName: Owner
17:56:29:906 3808 Windows directory: C:\WINDOWS
17:56:29:906 3808 Processor architecture: Intel x86
17:56:29:906 3808 Number of processors: 1
17:56:29:906 3808 Page size: 0x1000
17:56:29:906 3808 Boot type: Normal boot
17:56:29:906 3808 ================================================================================
17:56:29:906 3808 UnloadDriverW: NtUnloadDriver error 2
17:56:29:906 3808 ForceUnloadDriverW: UnloadDriverW(klmd21) error 2
17:56:29:906 3808 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\drivers\klmd.sys) returned status 00000000
17:56:29:937 3808 UtilityInit: KLMD drop and load success
17:56:29:937 3808 KLMD_OpenDevice: Trying to open KLMD Device(KLMD201010)
17:56:29:937 3808 UtilityInit: KLMD open success
17:56:29:937 3808 UtilityInit: Initialize success
17:56:29:937 3808
17:56:29:937 3808 Scanning Services …
17:56:29:937 3808 CreateRegParser: Registry parser init started
17:56:29:937 3808 DisableWow64Redirection: GetProcAddress(Wow64DisableWow64FsRedirection) error 127
17:56:29:937 3808 CreateRegParser: DisableWow64Redirection error
17:56:29:937 3808 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\system
17:56:29:937 3808 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\config\system) returned status C0000043
17:56:29:937 3808 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
17:56:29:937 3808 wfopen_ex: Trying to KLMD file open
17:56:29:937 3808 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\config\system
17:56:29:937 3808 wfopen_ex: File opened ok (Flags 2)
17:56:29:937 3808 CreateRegParser: HIVE_ADAPTER(C:\WINDOWS\system32\config\system) init success: 384C20
17:56:29:937 3808 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\software
17:56:29:937 3808 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\config\software) returned status C0000043
17:56:29:937 3808 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
17:56:29:937 3808 wfopen_ex: Trying to KLMD file open
17:56:29:937 3808 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\config\software
17:56:29:937 3808 wfopen_ex: File opened ok (Flags 2)
17:56:29:937 3808 CreateRegParser: HIVE_ADAPTER(C:\WINDOWS\system32\config\software) init success: 384CC8
17:56:29:937 3808 EnableWow64Redirection: GetProcAddress(Wow64RevertWow64FsRedirection) error 127
17:56:29:937 3808 CreateRegParser: EnableWow64Redirection error
17:56:29:937 3808 CreateRegParser: RegParser init completed
17:56:29:984 3808 GetAdvancedServicesInfo: Raw services enum returned 367 services
17:56:29:984 3808 fclose_ex: Trying to close file C:\WINDOWS\system32\config\system
17:56:29:984 3808 fclose_ex: Trying to close file C:\WINDOWS\system32\config\software
17:56:29:984 3808
17:56:29:984 3808 Scanning Kernel memory …
17:56:29:984 3808 KLMD_GetSystemObjectAddressByNameW: Trying to get system object address by name \Driver\Disk
17:56:29:984 3808 DetectCureTDL3: \Driver\Disk PDRIVER_OBJECT: 854AA630
17:56:29:984 3808 DetectCureTDL3: KLMD_GetDeviceObjectList returned 3 DevObjects
17:56:29:984 3808
17:56:29:984 3808 DetectCureTDL3: DEVICE_OBJECT: 8546E4E8
17:56:29:984 3808 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8546E4E8
17:56:30:000 3808 KLMD_ReadMem: Trying to ReadMemory 0x8546E4E8[0x38]
17:56:30:000 3808 DetectCureTDL3: DRIVER_OBJECT: 854AA630
17:56:30:000 3808 KLMD_ReadMem: Trying to ReadMemory 0x854AA630[0xA8]
17:56:30:000 3808 KLMD_ReadMem: Trying to ReadMemory 0xE18E9490[0x18]
17:56:30:000 3808 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
17:56:30:000 3808 DetectCureTDL3: IrpHandler (0) addr: F756DBB0
17:56:30:000 3808 DetectCureTDL3: IrpHandler (1) addr: 804F355A
17:56:30:000 3808 DetectCureTDL3: IrpHandler (2) addr: F756DBB0
17:56:30:000 3808 DetectCureTDL3: IrpHandler (3) addr: F7567D1F
17:56:30:000 3808 DetectCureTDL3: IrpHandler (4) addr: F7567D1F
17:56:30:000 3808 DetectCureTDL3: IrpHandler (5) addr: 804F355A
17:56:30:000 3808 DetectCureTDL3: IrpHandler (6) addr: 804F355A
17:56:30:000 3808 DetectCureTDL3: IrpHandler (7) addr: 804F355A
17:56:30:000 3808 DetectCureTDL3: IrpHandler (8) addr: 804F355A
17:56:30:000 3808 DetectCureTDL3: IrpHandler (9) addr: F75682E2
17:56:30:000 3808 DetectCureTDL3: IrpHandler (10) addr: 804F355A
17:56:30:000 3808 DetectCureTDL3: IrpHandler (11) addr: 804F355A
17:56:30:000 3808 DetectCureTDL3: IrpHandler (12) addr: 804F355A
17:56:30:000 3808 DetectCureTDL3: IrpHandler (13) addr: 804F355A
17:56:30:000 3808 DetectCureTDL3: IrpHandler (14) addr: F75683BB
17:56:30:000 3808 DetectCureTDL3: IrpHandler (15) addr: F756BF28
17:56:30:000 3808 DetectCureTDL3: IrpHandler (16) addr: F75682E2
17:56:30:000 3808 DetectCureTDL3: IrpHandler (17) addr: 804F355A
17:56:30:000 3808 DetectCureTDL3: IrpHandler (18) addr: 804F355A
17:56:30:000 3808 DetectCureTDL3: IrpHandler (19) addr: 804F355A
17:56:30:000 3808 DetectCureTDL3: IrpHandler (20) addr: 804F355A
17:56:30:000 3808 DetectCureTDL3: IrpHandler (21) addr: 804F355A
17:56:30:000 3808 DetectCureTDL3: IrpHandler (22) addr: F7569C82
17:56:30:000 3808 DetectCureTDL3: IrpHandler (23) addr: F756E99E
17:56:30:000 3808 DetectCureTDL3: IrpHandler (24) addr: 804F355A
17:56:30:000 3808 DetectCureTDL3: IrpHandler (25) addr: 804F355A
17:56:30:000 3808 DetectCureTDL3: IrpHandler (26) addr: 804F355A
17:56:30:000 3808 TDL3_FileDetect: Processing driver: Disk
17:56:30:000 3808 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\disk.sys
17:56:30:000 3808 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\disk.sys
17:56:30:000 3808 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean
17:56:30:000 3808
17:56:30:000 3808 DetectCureTDL3: DEVICE_OBJECT: 854366F0
17:56:30:000 3808 KLMD_GetLowerDeviceObject: Trying to get lower device object for 854366F0
17:56:30:000 3808 KLMD_ReadMem: Trying to ReadMemory 0x854366F0[0x38]
17:56:30:000 3808 DetectCureTDL3: DRIVER_OBJECT: 854AA630
17:56:30:000 3808 KLMD_ReadMem: Trying to ReadMemory 0x854AA630[0xA8]
17:56:30:000 3808 KLMD_ReadMem: Trying to ReadMemory 0xE18E9490[0x18]
17:56:30:000 3808 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
17:56:30:000 3808 DetectCureTDL3: IrpHandler (0) addr: F756DBB0
17:56:30:000 3808 DetectCureTDL3: IrpHandler (1) addr: 804F355A
17:56:30:000 3808 DetectCureTDL3: IrpHandler (2) addr: F756DBB0
17:56:30:000 3808 DetectCureTDL3: IrpHandler (3) addr: F7567D1F
17:56:30:000 3808 DetectCureTDL3: IrpHandler (4) addr: F7567D1F
17:56:30:000 3808 DetectCureTDL3: IrpHandler (5) addr: 804F355A
17:56:30:000 3808 DetectCureTDL3: IrpHandler (6) addr: 804F355A
17:56:30:000 3808 DetectCureTDL3: IrpHandler (7) addr: 804F355A
17:56:30:000 3808 DetectCureTDL3: IrpHandler (8) addr: 804F355A
17:56:30:000 3808 DetectCureTDL3: IrpHandler (9) addr: F75682E2
17:56:30:000 3808 DetectCureTDL3: IrpHandler (10) addr: 804F355A
17:56:30:000 3808 DetectCureTDL3: IrpHandler (11) addr: 804F355A
17:56:30:000 3808 DetectCureTDL3: IrpHandler (12) addr: 804F355A
17:56:30:000 3808 DetectCureTDL3: IrpHandler (13) addr: 804F355A
17:56:30:000 3808 DetectCureTDL3: IrpHandler (14) addr: F75683BB
17:56:30:000 3808 DetectCureTDL3: IrpHandler (15) addr: F756BF28
17:56:30:000 3808 DetectCureTDL3: IrpHandler (16) addr: F75682E2
17:56:30:000 3808 DetectCureTDL3: IrpHandler (17) addr: 804F355A
17:56:30:000 3808 DetectCureTDL3: IrpHandler (18) addr: 804F355A
17:56:30:000 3808 DetectCureTDL3: IrpHandler (19) addr: 804F355A
17:56:30:000 3808 DetectCureTDL3: IrpHandler (20) addr: 804F355A
17:56:30:000 3808 DetectCureTDL3: IrpHandler (21) addr: 804F355A
17:56:30:000 3808 DetectCureTDL3: IrpHandler (22) addr: F7569C82
17:56:30:000 3808 DetectCureTDL3: IrpHandler (23) addr: F756E99E
17:56:30:000 3808 DetectCureTDL3: IrpHandler (24) addr: 804F355A
17:56:30:000 3808 DetectCureTDL3: IrpHandler (25) addr: 804F355A
17:56:30:000 3808 DetectCureTDL3: IrpHandler (26) addr: 804F355A
17:56:30:000 3808 TDL3_FileDetect: Processing driver: Disk
17:56:30:000 3808 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\disk.sys
17:56:30:000 3808 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\disk.sys
17:56:30:015 3808 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean
17:56:30:015 3808
17:56:30:015 3808 DetectCureTDL3: DEVICE_OBJECT: 85436AB8
17:56:30:015 3808 KLMD_GetLowerDeviceObject: Trying to get lower device object for 85436AB8
17:56:30:015 3808 DetectCureTDL3: DEVICE_OBJECT: 8540F610
17:56:30:015 3808 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8540F610
17:56:30:015 3808 DetectCureTDL3: DEVICE_OBJECT: 8540EA38
17:56:30:015 3808 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8540EA38
17:56:30:015 3808 KLMD_ReadMem: Trying to ReadMemory 0x8540EA38[0x38]
17:56:30:015 3808 DetectCureTDL3: DRIVER_OBJECT: 854BE510
17:56:30:015 3808 KLMD_ReadMem: Trying to ReadMemory 0x854BE510[0xA8]
17:56:30:015 3808 KLMD_ReadMem: Trying to ReadMemory 0xE187B538[0x1A]
17:56:30:015 3808 DetectCureTDL3: DRIVER_OBJECT name: \Driver\nvgts, Driver Name: nvgts
17:56:30:015 3808 DetectCureTDL3: IrpHandler (0) addr: F72F244C
17:56:30:015 3808 DetectCureTDL3: IrpHandler (1) addr: 804F355A
17:56:30:015 3808 DetectCureTDL3: IrpHandler (2) addr: F72F244C
17:56:30:015 3808 DetectCureTDL3: IrpHandler (3) addr: 804F355A
17:56:30:015 3808 DetectCureTDL3: IrpHandler (4) addr: 804F355A
17:56:30:015 3808 DetectCureTDL3: IrpHandler (5) addr: 804F355A
17:56:30:015 3808 DetectCureTDL3: IrpHandler (6) addr: 804F355A
17:56:30:015 3808 DetectCureTDL3: IrpHandler (7) addr: 804F355A
17:56:30:015 3808 DetectCureTDL3: IrpHandler (8) addr: 804F355A
17:56:30:015 3808 DetectCureTDL3: IrpHandler (9) addr: 804F355A
17:56:30:015 3808 DetectCureTDL3: IrpHandler (10) addr: 804F355A
17:56:30:015 3808 DetectCureTDL3: IrpHandler (11) addr: 804F355A
17:56:30:015 3808 DetectCureTDL3: IrpHandler (12) addr: 804F355A
17:56:30:015 3808 DetectCureTDL3: IrpHandler (13) addr: 804F355A
17:56:30:015 3808 DetectCureTDL3: IrpHandler (14) addr: F72F244C
17:56:30:015 3808 DetectCureTDL3: IrpHandler (15) addr: F72F244C
17:56:30:015 3808 DetectCureTDL3: IrpHandler (16) addr: 804F355A
17:56:30:015 3808 DetectCureTDL3: IrpHandler (17) addr: 804F355A
17:56:30:015 3808 DetectCureTDL3: IrpHandler (18) addr: 804F355A
17:56:30:015 3808 DetectCureTDL3: IrpHandler (19) addr: 804F355A
17:56:30:015 3808 DetectCureTDL3: IrpHandler (20) addr: 804F355A
17:56:30:015 3808 DetectCureTDL3: IrpHandler (21) addr: 804F355A
17:56:30:015 3808 DetectCureTDL3: IrpHandler (22) addr: F72F244C
17:56:30:015 3808 DetectCureTDL3: IrpHandler (23) addr: F72F244C
17:56:30:015 3808 DetectCureTDL3: IrpHandler (24) addr: 804F355A
17:56:30:015 3808 DetectCureTDL3: IrpHandler (25) addr: 804F355A
17:56:30:015 3808 DetectCureTDL3: IrpHandler (26) addr: 804F355A
17:56:30:015 3808 KLMD_ReadMem: Trying to ReadMemory 0xF72F540E[0x400]
17:56:30:015 3808 TDL3_StartIoHookDetect: CheckParameters: 1, F72F917C, 0
17:56:30:015 3808 TDL3_FileDetect: Processing driver: nvgts
17:56:30:015 3808 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\NVGTS.SYS
17:56:30:015 3808 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\NVGTS.SYS
17:56:30:031 3808 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\NVGTS.SYS - Verdict: Clean
17:56:30:031 3808
17:56:30:031 3808 Completed
17:56:30:031 3808
17:56:30:031 3808 Results:
17:56:30:031 3808 Memory objects infected / cured / cured on reboot: 0 / 0 / 0
17:56:30:031 3808 Registry objects infected / cured / cured on reboot: 0 / 0 / 0
17:56:30:031 3808 File objects infected / cured / cured on reboot: 0 / 0 / 0
17:56:30:031 3808
17:56:30:031 3808 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\drivers\klmd.sys) returned status 00000000
17:56:30:031 3808 UtilityDeinit: KLMD(ARK) unloaded successfully
CatByte
Hi,
Please do the following:
please open a run box
Go to Start > run > copy/paste the following into the open run box > hit OK
Post the resulting log
Please do the following:
please open a run box
Go to Start > run > copy/paste the following into the open run box > hit OK
maxlook -sig
Post the resulting log
Bikerider
OK here is the looklog
Run from C:\Documents and Settings\Owner\Desktop\maxlook.exe on Sat 02/13/2010 at 18:32:32.23 ——— maxlook unsigned files ——— c:\windows\maxdriver\ATMHELPR.SYS: Verified: Unsigned File date: 3:00 AM 6/17/1997 Publisher: Adobe Systems Incorporated Description: Windows NT Font Driver Helper Product: Adobe Type Manager Deluxe Version: 4.0 Build 85 File version: 4.0 Build 85 ——— system32\drivers unsigned files ——— c:\windows\system32\drivers\ATMHELPR.SYS: Verified: Unsigned File date: 3:00 AM 6/17/1997 Publisher: Adobe Systems Incorporated Description: Windows NT Font Driver Helper Product: Adobe Type Manager Deluxe Version: 4.0 Build 85 File version: 4.0 Build 85 raspppoe.sys has gone missing!
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI