Spyware / Malware / Virus Removal

[Resolved] Help needed! All kinds symptoms on XP laptop (HJT log

32 min read

Looking for the outcome? Ask AI

seanakaforty Topic Starter

Post #1February 20, 2010, 4:44 AM UTC

**HJT log posted below**

Hi guys! Long time no see (wait… that's a good thing, right?). I'm working on a friend's laptop (Windows XP home, SP3), and I'm having all sorts of trouble sorting things out. First wierd thing I notice is that when you login and the desktop loads, her background is gone, replaced by a plain white background. The next symptom I see is that almost immediately after loging in, a folder called "Common" located at C:\Program Files\Common automatically opens up. There is nothing at all inside this folder, and I have no idea why it's opening for no apparent reason. The third symptom occurs when using the internet (Internet Explorer). It usually works for the first couple of pages, but then I start getting redirected to random search-type pages. For instance, I can usually get to google.com with no problem. I can even complete a search successfully. But whenever I click on a link to actually visit a site, I get sent to some random, unrelated page.

Now, there are a couple more symptoms that I've noticed, but I saved them for last 'cause they may or not be related to whatever problem/malware is causing the other issues. For one, I can't start the computer is Safe Mode! It freezes on mup.sys (I've since learned that this is a pretty common problem, for which there are few proven solutions). Secondly, the laptop failed a memory test when I tried to run Diagnostics at startup. Now, either one or both of these problems could be hardware related, so this may not be the appropriate place to mention them, but I figured there's no such thing as too much information when describing a problem/symptoms.

I should mention that I've already tried many things and the computer is actually running better than before, even with all of these remaining problems. I've ran a full system scan with SUPERAntispyware. It found a couple hundred problems and deleted/quarantined them. I also ran CCleaner, and ran both the cleaning utility and the registry scan/fix. I tried to run MalwareBytes Anti-Malware, too. I was able to run a quick scan, which found and fixed several problems, but when I try to run a full system scan, it eventually freezes, and then the whole computer locks up and a loud, constant beep blares from the speakers. The only way to fix it is to unplug the laptop and take the battery out as well. THIS HAS HAPPENED TO ME TWICE (only on the full MBAM scan, though). Below is a HiJackThis log that I just grabbed from the computer:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:06:06 PM, on 2/19/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16981)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.mirarsearch.com/?useie5=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-21-3815763222-3064897543-3983984708-501\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime (User 'Guest')
O4 - HKUS\S-1-5-21-3815763222-3064897543-3983984708-501\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Guest')
O4 - HKUS\S-1-5-21-3815763222-3064897543-3983984708-501\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" (User 'Guest')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [searching] Search from the Address bar
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {95D88B35-A521-472B-A182-BB1A98356421} (Pearson Installation Assistant 2) - http://asp.mathxl.com/books/_Players/PearsonInstallAsst2.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://a.download.toontown.com/sv1.0.34.13/ttinst.cab
O16 - DPF: {E6D23284-0E9B-417D-A782-03E4487FC947} (Pearson MathXL Player) - http://asp.mathxl.com/books/_Players/MathPlayer.cab
O18 - Filter hijack: text/html - {b053d8f2-75cf-483f-9f1e-2fe3c1ae2e46} - (no file)
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MBackMonitor - McAfee - C:\Program Files\McAfee\MBK\MBackMonitor.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O24 - Desktop Component 0: Privacy Protection - (no file)

–
End of file - 9091 bytes

LDTate

Post #2February 21, 2010, 1:53 PM UTC

[external image: Posted Image]

Chances are you've removed the infections but also have a hardware issue. Lets try this and see what it finds.

DO NOT use any TOOLS such as Combofix, Vundofix, or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:
1. These tools MUST be run from the executable. (.exe) every time you run them
2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

XP Users

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Uncheck "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Uncheck "Hide protected operating system files."
Click Apply, and then click OK.

Vista Users

To enable the viewing of hidden and protected system files in Windows Vista please follow these steps:

Close all programs so that you are at your desktop.
Click on the Start button. This is the small round button with the Windows flag in the lower left corner.

Click on the Control Panel menu option.
When the control panel opens you can either be in Classic View or Control Panel Home view:

If you are in the Classic View do the following:
Double-click on the Folder Options icon.
Click on the View tab.

If you are in the Control Panel Home view do the following:

Click on the Appearance and Personalization link.
Click on Show Hidden Files or Folders.
Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
Remove the checkmark from the checkbox labeled Hide extensions for known file types.
Remove the checkmark from the checkbox labeled Hide protected operating system files.

Please do not delete anything unless instructed to.

We've been seeing some Java infections lately.
Go here and follow the instructions to clear your Java Cache

Next:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:

Download ComboFix from one of these locations:

Link 1
Link 2 If using this link, Right Click and select Save As.

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
Double click on ComboFix.exe & follow the prompts.

Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.

Note: If you have SP3, use the SP2 package.If Vista or Windows 7, skip the Recovery Console part
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Also please describe how your computer behaves at the moment.

seanakaforty

Post #3February 21, 2010, 9:55 PM UTC

Did everything you recommended. Combofix ran for aout 10-15 minutes, and then said that the computer would restart. When the computer restarted, combofix automatically relaunched, I'm guessing to conclude the scan or report its findings. A line popped up saying that "system32\drivers\combofix.sys" (or something similar at least; it dissappeared before I could write it down) could not be found. After about a minute, combofix went to another screen that said it was waiting for a log to be generated, and told me not to open any programs until Combofix was finished. That page remained for about 5 minutes without changing. Then the whole system froze and a loud constant beep started. I had to unplug the computer and battery at this point. This is exactly the same thing that happened when I tried to do a full system scan with MBAM as I reported above. So I'm not really sure if the combofix scan was completed or not, or maybe it did finish but just didn't get to produce a log. I'm not sure. When I turned on the computer the next time, Combofix did not launch on is own.

As far as how the system is running now, I did notice that the "Common" file did not appear on boot up. I think combofix deleted the folder altogether. But I'm still having the internet issue. For instance, googled "espn." The search results page appeared fine, but when I clicked on the "espn.com" link, it redirects me to the following page: "www.mylocalhero.com/profile.php?id=4959221&cf=espn&l=rnod%2Cmd."

Also, I'm noticing a new problem as well. A windows error message pops up occasionally that says "Generic Host Processfor Win32 Services has encountered a problem and needs to close" and asks me if I want to send an error report or not. The error doesn't seem to interrupt any applications or cause any noticeable changes in performance, but I don't recall seeing it before.

I grabbed another HJT log just now and it is posted below:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:53:41 PM, on 2/21/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16981)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [searching] Search from the Address bar
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {95D88B35-A521-472B-A182-BB1A98356421} (Pearson Installation Assistant 2) - http://asp.mathxl.com/books/_Players/PearsonInstallAsst2.cab
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://a.download.toontown.com/sv1.0.34.13/ttinst.cab
O16 - DPF: {E6D23284-0E9B-417D-A782-03E4487FC947} (Pearson MathXL Player) - http://asp.mathxl.com/books/_Players/MathPlayer.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MBackMonitor - McAfee - C:\Program Files\McAfee\MBK\MBackMonitor.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O24 - Desktop Component 0: Privacy Protection - (no file)

–
End of file - 8120 bytes

LDTate

Post #4February 21, 2010, 10:05 PM UTC

You did download Combofix to the deasktop, right? See if you can find combofix.txt. look in the root: C:\combofix.txt or c:\combofix\combofix.txt If you find it, open with Notepad and post the results.

seanakaforty

Post #5February 21, 2010, 10:17 PM UTC

Yeah, I did put combofix on the desktop. And I found the log file right where you said it would be. Here it is: ComboFix 10-02-21.02 - Brittany 02/21/2010 15:32:19.4.2 - x86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.894.434 [GMT -5:00] Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83} FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\elekuwobaw.vbs C:\Documents and Settings\All Users\Application Data\udufikesut.vbs C:\Documents and Settings\All Users\Application Data\ugunemulyg.bat C:\Documents and Settings\All Users\Documents\ihelo.bat C:\Documents and Settings\All Users\Documents\jozofij.bat C:\Documents and Settings\All Users\Documents\regozepe.bat C:\Documents and Settings\All Users\Documents\tepajutoru.bat C:\Documents and Settings\All Users\Documents\vujyqajy.inf C:\Documents and Settings\Brittany\Application Data\eqocyfi.inf C:\Documents and Settings\Brittany\Application Data\udany.bat C:\Documents and Settings\Brittany\Application Data\ukazyl.bat C:\Documents and Settings\Brittany\Application Data\uxazuvejos.inf C:\Documents and Settings\Brittany\Application Data\wevot.vbs C:\Documents and Settings\Brittany\Local Settings\Application Data\azadu.reg C:\Documents and Settings\Brittany\Local Settings\Application Data\gujoziqic.vbs C:\Documents and Settings\Brittany\Local Settings\Application Data\jagolaluxy.reg C:\Documents and Settings\Brittany\Local Settings\Application Data\vymaruxu.inf C:\Program Files\Common Files\odiwiwe.inf C:\Program Files\Common C:\Program Files\Shared C:\WINDOWS\fupejifit.inf C:\WINDOWS\hirucoxuf.inf C:\WINDOWS\ivalyg.dll C:\WINDOWS\system32\config\systemprofile\Application Data\gadcom C:\WINDOWS\system32\isylet.inf C:\WINDOWS\vuhed._sy C:\WINDOWS\yvuq.scr C:\WINDOWS\zoqi.vbs C:\WINDOWS\zulofuha.bat . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . ——-\Legacy_6TO4 ——-\Legacy_WINSTS ——-\Service_6to4 ((((((((((((((((((((((((( Files Created from 2010-01-21 to 2010-02-21 ))))))))))))))))))))))))))))))) . 2010-02-19 03:17:20 . 2010-02-20 01:31:31 52224 —-a-w- C:\Documents and Settings\Brittany\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll 2010-02-19 03:16:35 . 2010-02-21 20:49:14 117760 —-a-w- C:\Documents and Settings\Brittany\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL 2010-02-19 03:15:41 . 2010-02-19 03:15:41 ——– d—–w- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2010-02-19 03:15:24 . 2010-02-19 04:15:52 ——– d—–w- C:\Program Files\SUPERAntiSpyware 2010-02-19 03:15:24 . 2010-02-19 03:15:24 ——– d—–w- C:\Documents and Settings\Brittany\Application Data\SUPERAntiSpyware.com 2010-02-04 04:41:56 . 2010-02-04 04:43:30 ——– dc-h–w- C:\WINDOWS\ie8 2010-02-04 04:38:12 . 2010-02-04 04:38:18 ——– d—–w- C:\68c56d1c6c07c5dd1b 2010-02-04 03:35:00 . 2010-02-04 03:35:00 ——– d—–w- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google 2010-02-04 03:30:48 . 2010-02-04 03:30:48 ——– d—–w- C:\Documents and Settings\LocalService\Local Settings\Application Data\Google . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-02-19 03:15:09 . 2008-09-26 20:33:57 ——– d—–w- C:\Program Files\Common Files\Wise Installation Wizard 2010-02-19 01:19:54 . 2008-09-28 17:46:53 ——– d—–w- C:\Program Files\Malwarebytes' Anti-Malware 2010-02-19 01:19:40 . 2008-09-28 17:48:15 5115824 —-a-w- C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe 2010-02-04 03:30:15 . 2007-04-30 02:14:15 ——– d—–w- C:\Program Files\Google 2010-02-01 20:04:29 . 2007-05-12 13:22:51 5908 —-a-w- C:\Documents and Settings\Brittany\Application Data\wklnhst.dat 2010-01-27 18:05:06 . 2009-11-01 22:49:14 664 —-a-w- C:\WINDOWS\system32\d3d9caps.dat 2010-01-27 17:26:23 . 2010-01-11 23:44:08 28409 —-a-w- C:\WINDOWS\system32\C0HZ5L6MTU.dat 2010-01-18 05:00:48 . 2007-05-05 15:46:29 ——– d—–w- C:\Documents and Settings\Brittany\Application Data\LimeWire 2010-01-11 23:44:08 . 2010-01-11 23:44:08 1860 —-a-w- C:\WINDOWS\system32\I1000QG70.dat 2010-01-08 02:49:24 . 2010-01-08 02:48:35 ——– d—–w- C:\Program Files\iTunes 2010-01-08 02:48:42 . 2010-01-08 02:48:42 ——– d—–w- C:\Program Files\iPod 2010-01-08 02:48:39 . 2009-10-18 00:55:36 ——– d—–w- C:\Program Files\Common Files\Apple 2010-01-08 02:45:01 . 2010-01-08 02:44:07 ——– d—–w- C:\Program Files\QuickTime 2010-01-08 02:40:06 . 2010-01-08 02:40:06 79144 —-a-w- C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe 2010-01-07 21:07:14 . 2008-09-28 17:46:55 38224 —-a-w- C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2010-01-07 21:07:04 . 2008-09-28 17:46:56 19160 —-a-w- C:\WINDOWS\system32\drivers\mbam.sys 2010-01-05 10:00:29 . 2004-08-04 12:00:00 832512 —-a-w- C:\WINDOWS\system32\wininet.dll 2010-01-05 10:00:21 . 2004-08-04 12:00:00 78336 —-a-w- C:\WINDOWS\system32\ieencode.dll 2010-01-05 10:00:20 . 2004-08-04 12:00:00 17408 ——w- C:\WINDOWS\system32\corpol.dll 2009-12-27 03:25:38 . 2009-12-27 03:25:38 ——– d—–w- C:\Program Files\Common Files\Adobe AIR 2009-12-27 03:24:46 . 2009-12-27 03:24:04 ——– d—–w- C:\Program Files\Common Files\Adobe 2009-12-27 02:50:11 . 2009-12-27 02:50:11 ——– d—–w- C:\Program Files\Linksys 2009-12-12 15:06:06 . 2004-08-04 12:00:00 96512 —-a-w- C:\WINDOWS\system32\drivers\atapi.sys 2008-11-02 21:58:15 . 2008-11-02 21:58:15 17788 —-a-w- C:\Program Files\Common Files\covu.pif 2008-11-02 21:58:15 . 2008-11-02 21:58:15 11232 —-a-w- C:\Program Files\Common Files\opom.dat 2008-10-12 03:44:33 . 2008-10-12 03:44:33 11308 —-a-w- C:\Program Files\Common Files\oxawuw.sys 2008-10-12 03:44:32 . 2008-10-12 03:44:32 17233 —-a-w- C:\Program Files\Common Files\ajorynuha.exe 2008-10-12 03:44:32 . 2008-10-12 03:44:32 12853 —-a-w- C:\Program Files\Common Files\gabokejepy.bin 2008-10-09 21:00:50 . 2008-10-09 21:00:50 12356 —-a-w- C:\Program Files\Common Files\ufybiziso.lib 2008-10-09 21:00:49 . 2008-10-09 21:00:49 13150 —-a-w- C:\Program Files\Common Files\anyw._dl . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-14 00:12:28 1695232] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-05-26 15:05:52 1830128] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-10 16:10:14 68856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-09-22 16:47:54 761947] "Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2005-12-19 20:08:42 1347584] "SigmatelSysTrayApp"="stsystra.exe" [2006-09-22 16:06:26 282624] "mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2009-10-29 11:54:44 1218008] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 07:38:00 34672] "AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 20:51:42 177440] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2009-11-11 04:08:18 417792] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2009-11-12 21:33:10 141600] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-04 10:00:00 44544] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 15:13:36 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2008-12-22 17:05:34 356352 —-a-w- C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package Menu.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Picture Package Menu.lnk backup=C:\WINDOWS\pss\Picture Package Menu.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package VCD Maker.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Picture Package VCD Maker.lnk backup=C:\WINDOWS\pss\Picture Package VCD Maker.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck] C:\WINDOWS\system32\dumprep 0 -u [X]

LDTate

Post #6February 21, 2010, 10:29 PM UTC

It didn't finish but maybe it will because of the bad guys getting removed.

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

http://forums.whatthetech.com/Help_needed_All_kinds_symptoms_XP_laptop_HJT_log_included_t110389.html#entry6349
09

collect::
C:\WINDOWS\system32\C0HZ5L6MTU.dat
C:\WINDOWS\system32\I1000QG70.dat
C:\Program Files\Common Files\covu.pif
C:\Program Files\Common Files\opom.dat
C:\Program Files\Common Files\oxawuw.sys
C:\Program Files\Common Files\ajorynuha.exe
C:\Program Files\Common Files\gabokejepy.bin
C:\Program Files\Common Files\ufybiziso.lib
C:\Program Files\Common Files\anyw._dl

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste

Also please describe how your computer behaves at the moment.

seanakaforty

Post #7February 21, 2010, 11:27 PM UTC

Done. Combofix seemed to run fine. But it never needed to restart the computer. Not sure if that is normal or not. Also, told me to make sure I was connected to the internet so that it could upload something for analysis. That completed and then a log was generated.

The computer seems to be running pretty close to normally now. I've been on the internet for about 5 minutes now and not seen any stange redirects. Of course, this does not mean that I'm in the clear yet because sometimes, IE has behaved normally for the first couple of pages, and then started redirecting everything, but so far, so good (I've visited about 7 links so far without redirecting incidents).

Here's the Combofix log:

ComboFix 10-02-21.02 - Brittany 02/21/2010 17:46:42.5.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.894.449 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Brittany\Desktop\CFScript.txt
AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

file zipped: c:\program files\Common Files\ajorynuha.exe
file zipped: c:\program files\Common Files\anyw._dl
file zipped: c:\program files\Common Files\covu.pif
file zipped: c:\program files\Common Files\gabokejepy.bin
file zipped: c:\program files\Common Files\opom.dat
file zipped: c:\program files\Common Files\oxawuw.sys
file zipped: c:\program files\Common Files\ufybiziso.lib
file zipped: c:\windows\system32\C0HZ5L6MTU.dat
file zipped: c:\windows\system32\I1000QG70.dat
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Common Files\ajorynuha.exe
c:\program files\Common Files\anyw._dl
c:\program files\Common Files\covu.pif
c:\program files\Common Files\gabokejepy.bin
c:\program files\Common Files\opom.dat
c:\program files\Common Files\oxawuw.sys
c:\program files\Common Files\ufybiziso.lib
c:\windows\system32\C0HZ5L6MTU.dat
c:\windows\system32\I1000QG70.dat
.
—- Previous Run ——-
.
c:\documents and settings\All Users\Application Data\elekuwobaw.vbs
c:\documents and settings\All Users\Application Data\udufikesut.vbs
c:\documents and settings\All Users\Application Data\ugunemulyg.bat
c:\documents and settings\All Users\Documents\ihelo.bat
c:\documents and settings\All Users\Documents\jozofij.bat
c:\documents and settings\All Users\Documents\regozepe.bat
c:\documents and settings\All Users\Documents\tepajutoru.bat
c:\documents and settings\All Users\Documents\vujyqajy.inf
c:\documents and settings\Brittany\Application Data\eqocyfi.inf
c:\documents and settings\Brittany\Application Data\udany.bat
c:\documents and settings\Brittany\Application Data\ukazyl.bat
c:\documents and settings\Brittany\Application Data\uxazuvejos.inf
c:\documents and settings\Brittany\Application Data\wevot.vbs
c:\documents and settings\Brittany\Local Settings\Application Data\azadu.reg
c:\documents and settings\Brittany\Local Settings\Application Data\gujoziqic.vbs
c:\documents and settings\Brittany\Local Settings\Application Data\jagolaluxy.reg
c:\documents and settings\Brittany\Local Settings\Application Data\vymaruxu.inf
c:\program files\Common Files\odiwiwe.inf
c:\windows\fupejifit.inf
c:\windows\hirucoxuf.inf
c:\windows\ivalyg.dll
c:\windows\system32\isylet.inf
c:\windows\vuhed._sy
c:\windows\yvuq.scr
c:\windows\zoqi.vbs
c:\windows\zulofuha.bat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_6TO4
——-\Legacy_WINSTS
——-\Service_6to4

((((((((((((((((((((((((( Files Created from 2010-01-21 to 2010-02-21 )))))))))))))))))))))))))))))))
.

2010-02-19 03:17 . 2010-02-20 01:31 52224 —-a-w- c:\documents and settings\Brittany\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-02-19 03:16 . 2010-02-21 21:51 117760 —-a-w- c:\documents and settings\Brittany\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-02-19 03:15 . 2010-02-19 03:15 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-02-19 03:15 . 2010-02-19 04:15 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-02-19 03:15 . 2010-02-19 03:15 ——– d—–w- c:\documents and settings\Brittany\Application Data\SUPERAntiSpyware.com
2010-02-04 04:41 . 2010-02-04 04:43 ——– dc-h–w- c:\windows\ie8
2010-02-04 04:38 . 2010-02-04 04:38 ——– d—–w- C:\68c56d1c6c07c5dd1b
2010-02-04 03:35 . 2010-02-04 03:35 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2010-02-04 03:30 . 2010-02-04 03:30 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Google

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-19 03:15 . 2008-09-26 20:33 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2010-02-19 01:19 . 2008-09-28 17:46 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-02-19 01:19 . 2008-09-28 17:48 5115824 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-02-04 03:30 . 2007-04-30 02:14 ——– d—–w- c:\program files\Google
2010-02-01 20:04 . 2007-05-12 13:22 5908 —-a-w- c:\documents and settings\Brittany\Application Data\wklnhst.dat
2010-01-27 18:05 . 2009-11-01 22:49 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-01-18 05:00 . 2007-05-05 15:46 ——– d—–w- c:\documents and settings\Brittany\Application Data\LimeWire
2010-01-08 02:49 . 2010-01-08 02:48 ——– d—–w- c:\program files\iTunes
2010-01-08 02:48 . 2010-01-08 02:48 ——– d—–w- c:\program files\iPod
2010-01-08 02:48 . 2009-10-18 00:55 ——– d—–w- c:\program files\Common Files\Apple
2010-01-08 02:45 . 2010-01-08 02:44 ——– d—–w- c:\program files\QuickTime
2010-01-08 02:40 . 2010-01-08 02:40 79144 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2010-01-07 21:07 . 2008-09-28 17:46 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 21:07 . 2008-09-28 17:46 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-05 10:00 . 2004-08-04 12:00 832512 ——w- c:\windows\system32\wininet.dll
2010-01-05 10:00 . 2004-08-04 12:00 78336 —-a-w- c:\windows\system32\ieencode.dll
2010-01-05 10:00 . 2004-08-04 12:00 17408 ——w- c:\windows\system32\corpol.dll
2009-12-27 03:25 . 2009-12-27 03:25 ——– d—–w- c:\program files\Common Files\Adobe AIR
2009-12-27 03:24 . 2009-12-27 03:24 ——– d—–w- c:\program files\Common Files\Adobe
2009-12-27 02:50 . 2009-12-27 02:50 ——– d—–w- c:\program files\Linksys
2009-12-12 15:06 . 2004-08-04 12:00 96512 ——w- c:\windows\system32\drivers\atapi.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-05-26 1830128]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-10 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-09-22 761947]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584]
"SigmatelSysTrayApp"="stsystra.exe" [2006-09-22 282624]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-10-29 1218008]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-04 44544]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 17:05 356352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package Menu.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Picture Package Menu.lnk
backup=c:\windows\pss\Picture Package Menu.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package VCD Maker.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Picture Package VCD Maker.lnk
backup=c:\windows\pss\Picture Package VCD Maker.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
c:\windows\system32\dumprep 0 -u [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\74783618868514978128427622574289]
c:\program files\Antivirus 2009\av2009.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
2006-05-10 15:12 90112 —-a-w- c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\brastk]
brastk.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ——w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]
2006-08-23 21:14 1032192 —-a-w- c:\program files\Dell\QuickSet\quickset.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
2006-08-29 02:57 395776 —-a-w- c:\program files\Dell Support\DSAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
2005-12-10 01:29 49152 —-a-w- c:\program files\CyberLink\PowerDVD\DVDLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2007-04-30 02:14 169984 —-a-w- c:\program files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gool]
c:\documents and settings\Brittany\Application Data\Gool\Gool.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
2006-11-13 17:39 1289000 —-a-w- c:\program files\Microsoft ActiveSync\wcescomm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mcagent_exe]
2009-10-29 11:54 1218008 —-a-w- c:\program files\McAfee.com\Agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\modemonhold]
2003-09-10 07:24 20480 —-a-w- c:\program files\NetWaiting\netwaiting.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msmsgs]
2008-04-14 00:12 1695232 ——w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sfkg6wip]
c:\documents and settings\Brittany\Application Data\Microsoft\Windows\cxwhou.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2007-07-10 16:10 68856 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\XP Antispyware 2009]
c:\program files\XP_Antispyware\XP_Antispyware.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"2479:TCP"= 2479:TCP:Services
"4032:TCP"= 4032:TCP:Services
"3389:TCP"= 3389:TCP:Remote Desktop
"3246:TCP"= 3246:TCP:Services

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [5/26/2009 10:05 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/26/2009 10:05 AM 72944]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [5/26/2009 10:05 AM 7408]
S1 47ea49;47ea49;c:\windows\system32\drivers\47ea49.sys [10/23/2008 10:05 PM 0]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/3/2010 10:30 PM 135664]
S3 diskmgr;diskmgr;\??\c:\windows\system32\diskmgr.sys –> c:\windows\system32\diskmgr.sys [?]
S3 rt2870;Linksys 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [12/26/2009 9:47 PM 644096]
.
Contents of the 'Scheduled Tasks' folder

2010-02-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-04 03:30]

2010-02-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-04 03:30]

2009-10-15 c:\windows\Tasks\McDefragTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-04-30 16:22]

2009-11-01 c:\windows\Tasks\McQcTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-04-30 16:22]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.yahoo.com/
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
.
- - - - ORPHANS REMOVED - - - -

AddRemove-CS - c:\program files\CS\cs.exe
AddRemove-DealAssistant - c:\documents and settings\Brittany\Application Data\DealAssistant\DAUninstall.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-21 17:57
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys >>UNKNOWN [0x8510D310]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf76c8f28
\Driver\ACPI -> ACPI.sys @ 0xf755bcb8
\Driver\atapi -> atapi.sys @ 0xf7513852
IoDeviceObjectType -> ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
NDIS: Broadcom 440x 10/100 Integrated Controller -> SendCompleteHandler -> 0x85015330
PacketIndicateHandler -> NDIS.sys @ 0xf73f5a0d
SendHandler -> NDIS.sys @ 0xf7409b40
user & kernel MBR OK

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-3815763222-3064897543-3983984708-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{6DC1DA2E-C4CE-1EBC-D343-CFBBEB8A7834}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"iakmfaglkfllcjdnoe"=hex:6a,61,6a,6c,67,6b,69,67,6c,62,66,68,65,67,64,66,6c,6e,
6c,6d,00,00
"haenpfehgndjmbnd"=hex:6a,61,69,6b,62,68,68,66,65,65,66,61,65,69,6f,6a,65,68,
66,6c,00,00
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(880)
c:\windows\system32\WININET.dll
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(940)
c:\windows\system32\WININET.dll
.
Completion time: 2010-02-21 18:01:51
ComboFix-quarantined-files.txt 2010-02-21 23:01
ComboFix2.txt 2009-01-31 10:02
ComboFix3.txt 2008-12-24 14:27

Pre-Run: 28,688,949,248 bytes free
Post-Run: 28,683,280,384 bytes free

Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 40DEBF0E83E276240DC879F2C74E8E49
Upload was successful

LDTate

Post #8February 21, 2010, 11:43 PM UTC

They are showing their face now

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

File::
c:\program files\Antivirus 2009\av2009.exe
c:\documents and settings\Brittany\Application Data\Gool\Gool.exe
c:\documents and settings\Brittany\Application Data\Microsoft\Windows\cxwhou.exe
c:\windows\system32\diskmgr.sys

Folder::
c:\program files\Antivirus 2009
c:\documents and settings\Brittany\Application Data\Gool

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\74783618868514978128427622574289]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\brastk]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gool]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sfkg6wip]

seanakaforty

Post #9February 22, 2010, 12:43 AM UTC last edited February 22, 2010, 12:44 AM UTC

Done. I'm still having issues with the internet, though. This time, I successfully went to about 5 different websites before I got a random redirect. I googled the term "Internet Explorer." When I clicked on the microsoft link to check out the features of IE8, I got redirected to "www.manufacturersdirectory.com/search-results.asx?keywordsmicrosoft+internet+explorer" Here's the latest combofix log:

ComboFix 10-02-21.02 - Brittany 02/21/2010 19:19:09.6.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.894.403 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Brittany\Desktop\CFScript.txt
AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

FILE ::
"c:\documents and settings\Brittany\Application Data\Gool\Gool.exe"
"c:\documents and settings\Brittany\Application Data\Microsoft\Windows\cxwhou.exe"
"c:\program files\Antivirus 2009\av2009.exe"
"c:\windows\system32\diskmgr.sys"
.

((((((((((((((((((((((((( Files Created from 2010-01-22 to 2010-02-22 )))))))))))))))))))))))))))))))
.

2010-02-19 03:17 . 2010-02-20 01:31 52224 —-a-w- c:\documents and settings\Brittany\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-02-19 03:16 . 2010-02-21 21:51 117760 —-a-w- c:\documents and settings\Brittany\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-02-19 03:15 . 2010-02-19 03:15 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-02-19 03:15 . 2010-02-19 04:15 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-02-19 03:15 . 2010-02-19 03:15 ——– d—–w- c:\documents and settings\Brittany\Application Data\SUPERAntiSpyware.com
2010-02-04 04:41 . 2010-02-04 04:43 ——– dc-h–w- c:\windows\ie8
2010-02-04 04:38 . 2010-02-04 04:38 ——– d—–w- C:\68c56d1c6c07c5dd1b
2010-02-04 03:35 . 2010-02-04 03:35 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2010-02-04 03:30 . 2010-02-04 03:30 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Google

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-21 23:58 . 2004-08-04 12:00 96512 —-a-w- c:\windows\system32\drivers\atapi.sys
2010-02-19 03:15 . 2008-09-26 20:33 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2010-02-19 01:19 . 2008-09-28 17:46 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-02-19 01:19 . 2008-09-28 17:48 5115824 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-02-04 03:30 . 2007-04-30 02:14 ——– d—–w- c:\program files\Google
2010-02-01 20:04 . 2007-05-12 13:22 5908 —-a-w- c:\documents and settings\Brittany\Application Data\wklnhst.dat
2010-01-27 18:05 . 2009-11-01 22:49 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-01-18 05:00 . 2007-05-05 15:46 ——– d—–w- c:\documents and settings\Brittany\Application Data\LimeWire
2010-01-08 02:49 . 2010-01-08 02:48 ——– d—–w- c:\program files\iTunes
2010-01-08 02:48 . 2010-01-08 02:48 ——– d—–w- c:\program files\iPod
2010-01-08 02:48 . 2009-10-18 00:55 ——– d—–w- c:\program files\Common Files\Apple
2010-01-08 02:45 . 2010-01-08 02:44 ——– d—–w- c:\program files\QuickTime
2010-01-08 02:40 . 2010-01-08 02:40 79144 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2010-01-07 21:07 . 2008-09-28 17:46 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 21:07 . 2008-09-28 17:46 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-05 10:00 . 2004-08-04 12:00 832512 ——w- c:\windows\system32\wininet.dll
2010-01-05 10:00 . 2004-08-04 12:00 78336 —-a-w- c:\windows\system32\ieencode.dll
2010-01-05 10:00 . 2004-08-04 12:00 17408 ——w- c:\windows\system32\corpol.dll
2009-12-27 03:25 . 2009-12-27 03:25 ——– d—–w- c:\program files\Common Files\Adobe AIR
2009-12-27 03:24 . 2009-12-27 03:24 ——– d—–w- c:\program files\Common Files\Adobe
2009-12-27 02:50 . 2009-12-27 02:50 ——– d—–w- c:\program files\Linksys
.

((((((((((((((((((((((((((((( SnapShot@2010-02-21_22.57.30 )))))))))))))))))))))))))))))))))))))))))
.
+ 2004-08-04 12:00 . 2010-02-21 23:58 96512 c:\windows\system32\dllcache\atapi.sys
- 2004-08-04 12:00 . 2009-12-12 15:06 96512 c:\windows\system32\dllcache\atapi.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-05-26 1830128]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-10 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-09-22 761947]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584]
"SigmatelSysTrayApp"="stsystra.exe" [2006-09-22 282624]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-10-29 1218008]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-04 44544]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 17:05 356352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package Menu.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Picture Package Menu.lnk
backup=c:\windows\pss\Picture Package Menu.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package VCD Maker.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Picture Package VCD Maker.lnk
backup=c:\windows\pss\Picture Package VCD Maker.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
c:\windows\system32\dumprep 0 -u [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
2006-05-10 15:12 90112 —-a-w- c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ——w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]
2006-08-23 21:14 1032192 —-a-w- c:\program files\Dell\QuickSet\quickset.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
2006-08-29 02:57 395776 —-a-w- c:\program files\Dell Support\DSAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
2005-12-10 01:29 49152 —-a-w- c:\program files\CyberLink\PowerDVD\DVDLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2007-04-30 02:14 169984 —-a-w- c:\program files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
2006-11-13 17:39 1289000 —-a-w- c:\program files\Microsoft ActiveSync\wcescomm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mcagent_exe]
2009-10-29 11:54 1218008 —-a-w- c:\program files\McAfee.com\Agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\modemonhold]
2003-09-10 07:24 20480 —-a-w- c:\program files\NetWaiting\netwaiting.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msmsgs]
2008-04-14 00:12 1695232 ——w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2007-07-10 16:10 68856 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\XP Antispyware 2009]
c:\program files\XP_Antispyware\XP_Antispyware.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"2479:TCP"= 2479:TCP:Services
"4032:TCP"= 4032:TCP:Services
"3389:TCP"= 3389:TCP:Remote Desktop
"3246:TCP"= 3246:TCP:Services

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [5/26/2009 10:05 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/26/2009 10:05 AM 72944]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [5/26/2009 10:05 AM 7408]
S1 47ea49;47ea49;c:\windows\system32\drivers\47ea49.sys [10/23/2008 10:05 PM 0]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/3/2010 10:30 PM 135664]
S3 diskmgr;diskmgr;\??\c:\windows\system32\diskmgr.sys –> c:\windows\system32\diskmgr.sys [?]
S3 rt2870;Linksys 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [12/26/2009 9:47 PM 644096]
.
Contents of the 'Scheduled Tasks' folder

2010-02-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-04 03:30]

2010-02-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-04 03:30]

2009-10-15 c:\windows\Tasks\McDefragTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-04-30 16:22]

2009-11-01 c:\windows\Tasks\McQcTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-04-30 16:22]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.yahoo.com/
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-21 19:29
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys >>UNKNOWN [0x8510D310]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf76c8f28
\Driver\ACPI -> ACPI.sys @ 0xf755bcb8
\Driver\atapi -> atapi.sys @ 0xf7513852
IoDeviceObjectType -> ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
NDIS: Broadcom 440x 10/100 Integrated Controller -> SendCompleteHandler -> 0x85015330
PacketIndicateHandler -> NDIS.sys @ 0xf73f5a0d
SendHandler -> NDIS.sys @ 0xf7409b40
user & kernel MBR OK

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-3815763222-3064897543-3983984708-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{6DC1DA2E-C4CE-1EBC-D343-CFBBEB8A7834}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"iakmfaglkfllcjdnoe"=hex:6a,61,6a,6c,67,6b,69,67,6c,62,66,68,65,67,64,66,6c,6e,
6c,6d,00,00
"haenpfehgndjmbnd"=hex:6a,61,69,6b,62,68,68,66,65,65,66,61,65,69,6f,6a,65,68,
66,6c,00,00
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(880)
c:\windows\system32\WININET.dll
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(940)
c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(328)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2010-02-21 19:32:43
ComboFix-quarantined-files.txt 2010-02-22 00:32
ComboFix2.txt 2010-02-21 23:04
ComboFix3.txt 2009-01-31 10:02
ComboFix4.txt 2008-12-24 14:27

Pre-Run: 28,684,443,648 bytes free
Post-Run: 28,677,623,808 bytes free

Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 5FC3DB42BB12E007405B944A4DF7418F

LDTate

Post #10February 22, 2010, 12:49 AM UTC

Download TDSSKiller and save it to your Desktop.
http://support.kaspersky.com/downloads/utils/tdsskiller.zip

Extract the file and run it.
Once completed it will create a log in your C:\ drive
Please post the contents of that log

LDTate

Post #11February 23, 2010, 9:50 PM UTC

Do you still need help with this?

seanakaforty

Post #12February 23, 2010, 11:22 PM UTC last edited February 23, 2010, 11:28 PM UTC

Yeah, I still need help. I just got really busy as the work week started back up. Sorry about that. Also, I should mention that I've descovered another symptom on this laptop. It doesn't go into "standby mode." When I attempt to do so, it gets to the "windows is preparing to standby" page, before locking up and not doing anything. I then have to "panic power off" (i.e. hold down the power button until it cuts off). Finally, the laptop apparently has some windows automatic updates that it wants to do. Do you think I should let it complete the updates, or instead wait until I get the system running smoothly before I proceed with the updates? Here's the TDSSKiller log: 18:16:59:187 3836 TDSS rootkit removing tool 2.2.4 Feb 15 2010 19:38:31 18:16:59:187 3836 ================================================================================ 18:16:59:187 3836 SystemInfo: 18:16:59:187 3836 OS Version: 5.1.2600 ServicePack: 3.0 18:16:59:187 3836 Product type: Workstation 18:16:59:187 3836 ComputerName: BRIT 18:16:59:187 3836 UserName: Brittany 18:16:59:187 3836 Windows directory: C:\WINDOWS 18:16:59:187 3836 Processor architecture: Intel x86 18:16:59:187 3836 Number of processors: 2 18:16:59:187 3836 Page size: 0x1000 18:16:59:203 3836 Boot type: Normal boot 18:16:59:203 3836 ================================================================================ 18:16:59:203 3836 UnloadDriverW: NtUnloadDriver error 2 18:16:59:203 3836 ForceUnloadDriverW: UnloadDriverW(klmd21) error 2 18:16:59:203 3836 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\drivers\klmd.sys) returned status 00000000 18:16:59:468 3836 UtilityInit: KLMD drop and load success 18:16:59:468 3836 KLMD_OpenDevice: Trying to open KLMD Device(KLMD201010) 18:16:59:468 3836 UtilityInit: KLMD open success 18:16:59:468 3836 UtilityInit: Initialize success 18:16:59:468 3836 18:16:59:468 3836 Scanning Services … 18:16:59:468 3836 CreateRegParser: Registry parser init started 18:16:59:468 3836 DisableWow64Redirection: GetProcAddress(Wow64DisableWow64FsRedirection) error 127 18:16:59:468 3836 CreateRegParser: DisableWow64Redirection error 18:16:59:468 3836 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\system 18:16:59:468 3836 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\config\system) returned status C0000043 18:16:59:468 3836 wfopen_ex: MyNtCreateFileW error 32 (C0000043) 18:16:59:468 3836 wfopen_ex: Trying to KLMD file open 18:16:59:468 3836 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\config\system 18:16:59:468 3836 wfopen_ex: File opened ok (Flags 2) 18:16:59:468 3836 CreateRegParser: HIVE_ADAPTER(C:\WINDOWS\system32\config\system) init success: 274920 18:16:59:468 3836 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\software 18:16:59:468 3836 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\config\software) returned status C0000043 18:16:59:468 3836 wfopen_ex: MyNtCreateFileW error 32 (C0000043) 18:16:59:468 3836 wfopen_ex: Trying to KLMD file open 18:16:59:468 3836 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\config\software 18:16:59:468 3836 wfopen_ex: File opened ok (Flags 2) 18:16:59:468 3836 CreateRegParser: HIVE_ADAPTER(C:\WINDOWS\system32\config\software) init success: 2749C8 18:16:59:468 3836 EnableWow64Redirection: GetProcAddress(Wow64RevertWow64FsRedirection) error 127 18:16:59:468 3836 CreateRegParser: EnableWow64Redirection error 18:16:59:468 3836 CreateRegParser: RegParser init completed 18:17:01:578 3836 GetAdvancedServicesInfo: Raw services enum returned 364 services 18:17:01:578 3836 fclose_ex: Trying to close file C:\WINDOWS\system32\config\system 18:17:01:578 3836 fclose_ex: Trying to close file C:\WINDOWS\system32\config\software 18:17:01:578 3836 18:17:01:578 3836 Scanning Kernel memory … 18:17:01:578 3836 KLMD_GetSystemObjectAddressByNameW: Trying to get system object address by name \Driver\Disk 18:17:01:578 3836 DetectCureTDL3: \Driver\Disk PDRIVER_OBJECT: 85760910 18:17:01:578 3836 DetectCureTDL3: KLMD_GetDeviceObjectList returned 6 DevObjects 18:17:01:578 3836 18:17:01:578 3836 DetectCureTDL3: DEVICE_OBJECT: 848BD5A8 18:17:01:578 3836 KLMD_GetLowerDeviceObject: Trying to get lower device object for 848BD5A8 18:17:01:578 3836 KLMD_ReadMem: Trying to ReadMemory 0x848BD5A8[0x38] 18:17:01:578 3836 DetectCureTDL3: DRIVER_OBJECT: 85760910 18:17:01:578 3836 KLMD_ReadMem: Trying to ReadMemory 0x85760910[0xA8] 18:17:01:578 3836 KLMD_ReadMem: Trying to ReadMemory 0xE18C8D38[0x18] 18:17:01:578 3836 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk 18:17:01:578 3836 DetectCureTDL3: IRP_MJ_CREATE : F76CABB0 18:17:01:578 3836 DetectCureTDL3: IRP_MJ_CREATE_NAMED_PIPE : 804F4562 18:17:01:578 3836 DetectCureTDL3: IRP_MJ_CLOSE : F76CABB0 18:17:01:578 3836 DetectCureTDL3: IRP_MJ_READ : F76C4D1F 18:17:01:578 3836 DetectCureTDL3: IRP_MJ_WRITE : F76C4D1F 18:17:01:578 3836 DetectCureTDL3: IRP_MJ_QUERY_INFORMATION : 804F4562 18:17:01:578 3836 DetectCureTDL3: IRP_MJ_SET_INFORMATION : 804F4562 18:17:01:578 3836 DetectCureTDL3: IRP_MJ_QUERY_EA : 804F4562 18:17:01:578 3836 DetectCureTDL3: IRP_MJ_SET_EA : 804F4562 18:17:01:578 3836 DetectCureTDL3: IRP_MJ_FLUSH_BUFFERS : F76C52E2 18:17:01:578 3836 DetectCureTDL3: IRP_MJ_QUERY_VOLUME_INFORMATION : 804F4562 18:17:01:578 3836 DetectCureTDL3: IRP_MJ_SET_VOLUME_INFORMATION : 804F4562 18:17:01:593 3836 DetectCureTDL3: IRP_MJ_DIRECTORY_CONTROL : 804F4562 18:17:01:593 3836 DetectCureTDL3: IRP_MJ_FILE_SYSTEM_CONTROL : 804F4562 18:17:01:593 3836 DetectCureTDL3: IRP_MJ_DEVICE_CONTROL : F76C53BB 18:17:01:593 3836 DetectCureTDL3: IRP_MJ_INTERNAL_DEVICE_CONTROL : F76C8F28 18:17:01:593 3836 DetectCureTDL3: IRP_MJ_SHUTDOWN : F76C52E2 18:17:01:593 3836 DetectCureTDL3: IRP_MJ_LOCK_CONTROL : 804F4562 18:17:01:593 3836 DetectCureTDL3: IRP_MJ_CLEANUP : 804F4562 18:17:01:593 3836 DetectCureTDL3: IRP_MJ_CREATE_MAILSLOT : 804F4562 18:17:01:593 3836 DetectCureTDL3: IRP_MJ_QUERY_SECURITY : 804F4562 18:17:01:593 3836 DetectCureTDL3: IRP_MJ_SET_SECURITY : 804F4562 18:17:01:593 3836 DetectCureTDL3: IRP_MJ_POWER : F76C6C82 18:17:01:593 3836 DetectCureTDL3: IRP_MJ_SYSTEM_CONTROL : F76CB99E 18:17:01:593 3836 DetectCureTDL3: IRP_MJ_DEVICE_CHANGE : 804F4562 18:17:01:593 3836 DetectCureTDL3: IRP_MJ_QUERY_QUOTA : 804F4562 18:17:01:593 3836 DetectCureTDL3: IRP_MJ_SET_QUOTA : 804F4562 18:17:01:593 3836 TDL3_FileDetect: Processing driver: Disk 18:17:01:593 3836 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\disk.sys 18:17:01:593 3836 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\disk.sys 18:17:01:734 3836 TDL3_FileDetect: Processing driver: Disk 18:17:01:734 3836 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\disk.sys 18:17:01:734 3836 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\disk.sys 18:17:01:765 3836 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean 18:17:01:765 3836 18:17:01:765 3836 DetectCureTDL3: DEVICE_OBJECT: 848E8800 18:17:01:765 3836 KLMD_GetLowerDeviceObject: Trying to get lower device object for 848E8800 18:17:01:765 3836 DetectCureTDL3: DEVICE_OBJECT: 8483FDA0 18:17:01:765 3836 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8483FDA0 18:17:01:765 3836 KLMD_ReadMem: Trying to ReadMemory 0x8483FDA0[0x38] 18:17:01:765 3836 DetectCureTDL3: DRIVER_OBJECT: 856B6CB0 18:17:01:765 3836 KLMD_ReadMem: Trying to ReadMemory 0x856B6CB0[0xA8] 18:17:01:765 3836 KLMD_ReadMem: Trying to ReadMemory 0xE1F62360[0x1E] 18:17:01:765 3836 DetectCureTDL3: DRIVER_OBJECT name: \Driver\USBSTOR, Driver Name: USBSTOR 18:17:01:765 3836 DetectCureTDL3: IRP_MJ_CREATE : F7A11218 18:17:01:765 3836 DetectCureTDL3: IRP_MJ_CREATE_NAMED_PIPE : 804F4562 18:17:01:765 3836 DetectCureTDL3: IRP_MJ_CLOSE : F7A11218 18:17:01:765 3836 DetectCureTDL3: IRP_MJ_READ : F7A1123C 18:17:01:765 3836 DetectCureTDL3: IRP_MJ_WRITE : F7A1123C 18:17:01:765 3836 DetectCureTDL3: IRP_MJ_QUERY_INFORMATION : 804F4562 18:17:01:765 3836 DetectCureTDL3: IRP_MJ_SET_INFORMATION : 804F4562 18:17:01:765 3836 DetectCureTDL3: IRP_MJ_QUERY_EA : 804F4562 18:17:01:765 3836 DetectCureTDL3: IRP_MJ_SET_EA : 804F4562 18:17:01:765 3836 DetectCureTDL3: IRP_MJ_FLUSH_BUFFERS : 804F4562 18:17:01:828 3836 DetectCureTDL3: IRP_MJ_QUERY_VOLUME_INFORMATION : 804F4562 18:17:01:828 3836 DetectCureTDL3: IRP_MJ_SET_VOLUME_INFORMATION : 804F4562 18:17:01:828 3836 DetectCureTDL3: IRP_MJ_DIRECTORY_CONTROL : 804F4562 18:17:01:828 3836 DetectCureTDL3: IRP_MJ_FILE_SYSTEM_CONTROL : 804F4562 18:17:01:828 3836 DetectCureTDL3: IRP_MJ_DEVICE_CONTROL : F7A11180 18:17:01:828 3836 DetectCureTDL3: IRP_MJ_INTERNAL_DEVICE_CONTROL : F7A0C9E6 18:17:01:828 3836 DetectCureTDL3: IRP_MJ_SHUTDOWN : 804F4562 18:17:01:828 3836 DetectCureTDL3: IRP_MJ_LOCK_CONTROL : 804F4562 18:17:01:828 3836 DetectCureTDL3: IRP_MJ_CLEANUP : 804F4562 18:17:01:828 3836 DetectCureTDL3: IRP_MJ_CREATE_MAILSLOT : 804F4562 18:17:01:828 3836 DetectCureTDL3: IRP_MJ_QUERY_SECURITY : 804F4562 18:17:01:828 3836 DetectCureTDL3: IRP_MJ_SET_SECURITY : 804F4562 18:17:01:828 3836 DetectCureTDL3: IRP_MJ_POWER : F7A105F0 18:17:01:828 3836 DetectCureTDL3: IRP_MJ_SYSTEM_CONTROL : F7A0EA6E 18:17:01:828 3836 DetectCureTDL3: IRP_MJ_DEVICE_CHANGE : 804F4562 18:17:01:828 3836 DetectCureTDL3: IRP_MJ_QUERY_QUOTA : 804F4562 18:17:01:828 3836 DetectCureTDL3: IRP_MJ_SET_QUOTA : 804F4562 18:17:01:828 3836 TDL3_FileDetect: Processing driver: USBSTOR 18:17:01:828 3836 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 18:17:01:828 3836 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 18:17:01:890 3836 KLMD_ReadMem: Trying to ReadMemory 0xF7A0DF26[0x400] 18:17:01:890 3836 TDL3_StartIoHookDetect: CheckParameters: 0, 00000000, 0 18:17:01:890 3836 TDL3_FileDetect: Processing driver: USBSTOR 18:17:01:890 3836 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 18:17:01:890 3836 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 18:17:01:906 3836 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS - Verdict: Clean 18:17:01:906 3836 18:17:01:906 3836 DetectCureTDL3: DEVICE_OBJECT: 85758C68 18:17:01:906 3836 KLMD_GetLowerDeviceObject: Trying to get lower device object for 85758C68 18:17:01:906 3836 KLMD_ReadMem: Trying to ReadMemory 0x85758C68[0x38] 18:17:01:906 3836 DetectCureTDL3: DRIVER_OBJECT: 85760910 18:17:01:921 3836 KLMD_ReadMem: Trying to ReadMemory 0x85760910[0xA8] 18:17:01:921 3836 KLMD_ReadMem: Trying to ReadMemory 0xE18C8D38[0x18] 18:17:01:921 3836 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk 18:17:01:921 3836 DetectCureTDL3: IRP_MJ_CREATE : F76CABB0 18:17:01:921 3836 DetectCureTDL3: IRP_MJ_CREATE_NAMED_PIPE : 804F4562 18:17:01:921 3836 DetectCureTDL3: IRP_MJ_CLOSE : F76CABB0 18:17:01:921 3836 DetectCureTDL3: IRP_MJ_READ : F76C4D1F 18:17:01:921 3836 DetectCureTDL3: IRP_MJ_WRITE : F76C4D1F 18:17:01:921 3836 DetectCureTDL3: IRP_MJ_QUERY_INFORMATION : 804F4562 18:17:01:921 3836 DetectCureTDL3: IRP_MJ_SET_INFORMATION : 804F4562 18:17:01:921 3836 DetectCureTDL3: IRP_MJ_QUERY_EA : 804F4562 18:17:01:921 3836 DetectCureTDL3: IRP_MJ_SET_EA : 804F4562 18:17:01:921 3836 DetectCureTDL3: IRP_MJ_FLUSH_BUFFERS : F76C52E2 18:17:01:921 3836 DetectCureTDL3: IRP_MJ_QUERY_VOLUME_INFORMATION : 804F4562 18:17:01:921 3836 DetectCureTDL3: IRP_MJ_SET_VOLUME_INFORMATION : 804F4562 18:17:01:921 3836 DetectCureTDL3: IRP_MJ_DIRECTORY_CONTROL : 804F4562 18:17:01:921 3836 DetectCureTDL3: IRP_MJ_FILE_SYSTEM_CONTROL : 804F4562 18:17:01:921 3836 DetectCureTDL3: IRP_MJ_DEVICE_CONTROL : F76C53BB 18:17:01:921 3836 DetectCureTDL3: IRP_MJ_INTERNAL_DEVICE_CONTROL : F76C8F28 18:17:01:921 3836 DetectCureTDL3: IRP_MJ_SHUTDOWN : F76C52E2 18:17:01:921 3836 DetectCureTDL3: IRP_MJ_LOCK_CONTROL : 804F4562 18:17:01:921 3836 DetectCureTDL3: IRP_MJ_CLEANUP : 804F4562 18:17:01:921 3836 DetectCureTDL3: IRP_MJ_CREATE_MAILSLOT : 804F4562 18:17:01:921 3836 DetectCureTDL3: IRP_MJ_QUERY_SECURITY : 804F4562 18:17:01:921 3836 DetectCureTDL3: IRP_MJ_SET_SECURITY : 804F4562 18:17:01:921 3836 DetectCureTDL3: IRP_MJ_POWER : F76C6C82 18:17:01:921 3836 DetectCureTDL3: IRP_MJ_SYSTEM_CONTROL : F76CB99E 18:17:01:921 3836 DetectCureTDL3: IRP_MJ_DEVICE_CHANGE : 804F4562 18:17:01:921 3836 DetectCureTDL3: IRP_MJ_QUERY_QUOTA : 804F4562 18:17:01:921 3836 DetectCureTDL3: IRP_MJ_SET_QUOTA : 804F4562 18:17:01:921 3836 TDL3_FileDetect: Processing driver: Disk 18:17:01:921 3836 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\disk.sys 18:17:01:921 3836 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\disk.sys 18:17:01:968 3836 TDL3_FileDetect: Processing driver: Disk 18:17:01:968 3836 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\disk.sys 18:17:01:968 3836 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\disk.sys 18:17:02:015 3836 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean 18:17:02:015 3836 18:17:02:015 3836 DetectCureTDL3: DEVICE_OBJECT: 85717C68 18:17:02:015 3836 KLMD_GetLowerDeviceObject: Trying to get lower device object for 85717C68 18:17:02:015 3836 KLMD_ReadMem: Trying to ReadMemory 0x85717C68[0x38] 18:17:02:015 3836 DetectCureTDL3: DRIVER_OBJECT: 85760910 18:17:02:015 3836 KLMD_ReadMem: Trying to ReadMemory 0x85760910[0xA8] 18:17:02:015 3836 KLMD_ReadMem: Trying to ReadMemory 0xE18C8D38[0x18] 18:17:02:015 3836 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk 18:17:02:015 3836 DetectCureTDL3: IRP_MJ_CREATE : F76CABB0 18:17:02:015 3836 DetectCureTDL3: IRP_MJ_CREATE_NAMED_PIPE : 804F4562 18:17:02:015 3836 DetectCureTDL3: IRP_MJ_CLOSE : F76CABB0 18:17:02:015 3836 DetectCureTDL3: IRP_MJ_READ : F76C4D1F 18:17:02:015 3836 DetectCureTDL3: IRP_MJ_WRITE : F76C4D1F 18:17:02:015 3836 DetectCureTDL3: IRP_MJ_QUERY_INFORMATION : 804F4562 18:17:02:015 3836 DetectCureTDL3: IRP_MJ_SET_INFORMATION : 804F4562 18:17:02:015 3836 DetectCureTDL3: IRP_MJ_QUERY_EA : 804F4562 18:17:02:015 3836 DetectCureTDL3: IRP_MJ_SET_EA : 804F4562 18:17:02:015 3836 DetectCureTDL3: IRP_MJ_FLUSH_BUFFERS : F76C52E2 18:17:02:015 3836 DetectCureTDL3: IRP_MJ_QUERY_VOLUME_INFORMATION : 804F4562 18:17:02:015 3836 DetectCureTDL3: IRP_MJ_SET_VOLUME_INFORMATION : 804F4562 18:17:02:015 3836 DetectCureTDL3: IRP_MJ_DIRECTORY_CONTROL : 804F4562 18:17:02:015 3836 DetectCureTDL3: IRP_MJ_FILE_SYSTEM_CONTROL : 804F4562 18:17:02:015 3836 DetectCureTDL3: IRP_MJ_DEVICE_CONTROL : F76C53BB 18:17:02:015 3836 DetectCureTDL3: IRP_MJ_INTERNAL_DEVICE_CONTROL : F76C8F28 18:17:02:015 3836 DetectCureTDL3: IRP_MJ_SHUTDOWN : F76C52E2 18:17:02:015 3836 DetectCureTDL3: IRP_MJ_LOCK_CONTROL : 804F4562 18:17:02:015 3836 DetectCureTDL3: IRP_MJ_CLEANUP : 804F4562 18:17:02:015 3836 DetectCureTDL3: IRP_MJ_CREATE_MAILSLOT : 804F4562 18:17:02:015 3836 DetectCureTDL3: IRP_MJ_QUERY_SECURITY : 804F4562 18:17:02:015 3836 DetectCureTDL3: IRP_MJ_SET_SECURITY : 804F4562 18:17:02:015 3836 DetectCureTDL3: IRP_MJ_POWER : F76C6C82 18:17:02:015 3836 DetectCureTDL3: IRP_MJ_SYSTEM_CONTROL : F76CB99E 18:17:02:015 3836 DetectCureTDL3: IRP_MJ_DEVICE_CHANGE : 804F4562 18:17:02:015 3836 DetectCureTDL3: IRP_MJ_QUERY_QUOTA : 804F4562 18:17:02:015 3836 DetectCureTDL3: IRP_MJ_SET_QUOTA : 804F4562 18:17:02:015 3836 TDL3_FileDetect: Processing driver: Disk 18:17:02:015 3836 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\disk.sys 18:17:02:015 3836 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\disk.sys 18:17:02:031 3836 TDL3_FileDetect: Processing driver: Disk 18:17:02:031 3836 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\disk.sys 18:17:02:031 3836 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\disk.sys 18:17:02:031 3836 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean 18:17:02:031 3836 18:17:02:031 3836 DetectCureTDL3: DEVICE_OBJECT: 85759C68 18:17:02:031 3836 KLMD_GetLowerDeviceObject: Trying to get lower device object for 85759C68 18:17:02:031 3836 KLMD_ReadMem: Trying to ReadMemory 0x85759C68[0x38] 18:17:02:031 3836 DetectCureTDL3: DRIVER_OBJECT: 85760910 18:17:02:031 3836 KLMD_ReadMem: Trying to ReadMemory 0x85760910[0xA8] 18:17:02:031 3836 KLMD_ReadMem: Trying to ReadMemory 0xE18C8D38[0x18] 18:17:02:031 3836 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk 18:17:02:031 3836 DetectCureTDL3: IRP_MJ_CREATE : F76CABB0 18:17:02:031 3836 DetectCureTDL3: IRP_MJ_CREATE_NAMED_PIPE : 804F4562 18:17:02:031 3836 DetectCureTDL3: IRP_MJ_CLOSE : F76CABB0 18:17:02:031 3836 DetectCureTDL3: IRP_MJ_READ : F76C4D1F 18:17:02:031 3836 DetectCureTDL3: IRP_MJ_WRITE : F76C4D1F 18:17:02:031 3836 DetectCureTDL3: IRP_MJ_QUERY_INFORMATION : 804F4562 18:17:02:031 3836 DetectCureTDL3: IRP_MJ_SET_INFORMATION : 804F4562 18:17:02:031 3836 DetectCureTDL3: IRP_MJ_QUERY_EA : 804F4562 18:17:02:031 3836 DetectCureTDL3: IRP_MJ_SET_EA : 804F4562 18:17:02:031 3836 DetectCureTDL3: IRP_MJ_FLUSH_BUFFERS : F76C52E2 18:17:02:031 3836 DetectCureTDL3: IRP_MJ_QUERY_VOLUME_INFORMATION : 804F4562 18:17:02:031 3836 DetectCureTDL3: IRP_MJ_SET_VOLUME_INFORMATION : 804F4562 18:17:02:031 3836 DetectCureTDL3: IRP_MJ_DIRECTORY_CONTROL : 804F4562 18:17:02:031 3836 DetectCureTDL3: IRP_MJ_FILE_SYSTEM_CONTROL : 804F4562 18:17:02:031 3836 DetectCureTDL3: IRP_MJ_DEVICE_CONTROL : F76C53BB 18:17:02:031 3836 DetectCureTDL3: IRP_MJ_INTERNAL_DEVICE_CONTROL : F76C8F28 18:17:02:031 3836 DetectCureTDL3: IRP_MJ_SHUTDOWN : F76C52E2 18:17:02:031 3836 DetectCureTDL3: IRP_MJ_LOCK_CONTROL : 804F4562 18:17:02:031 3836 DetectCureTDL3: IRP_MJ_CLEANUP : 804F4562 18:17:02:031 3836 DetectCureTDL3: IRP_MJ_CREATE_MAILSLOT : 804F4562 18:17:02:031 3836 DetectCureTDL3: IRP_MJ_QUERY_SECURITY : 804F4562 18:17:02:031 3836 DetectCureTDL3: IRP_MJ_SET_SECURITY : 804F4562 18:17:02:031 3836 DetectCureTDL3: IRP_MJ_POWER : F76C6C82 18:17:02:031 3836 DetectCureTDL3: IRP_MJ_SYSTEM_CONTROL : F76CB99E 18:17:02:031 3836 DetectCureTDL3: IRP_MJ_DEVICE_CHANGE : 804F4562 18:17:02:031 3836 DetectCureTDL3: IRP_MJ_QUERY_QUOTA : 804F4562 18:17:02:031 3836 DetectCureTDL3: IRP_MJ_SET_QUOTA : 804F4562 18:17:02:031 3836 TDL3_FileDetect: Processing driver: Disk 18:17:02:031 3836 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\disk.sys 18:17:02:031 3836 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\disk.sys 18:17:02:078 3836 TDL3_FileDetect: Processing driver: Disk 18:17:02:078 3836 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\disk.sys 18:17:02:078 3836 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\disk.sys 18:17:02:156 3836 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean 18:17:02:156 3836 18:17:02:156 3836 DetectCureTDL3: DEVICE_OBJECT: 8575BAB8 18:17:02:156 3836 KLMD_GetLowerDeviceObject: Trying to get lower device object for 8575BAB8 18:17:02:156 3836 DetectCureTDL3: DEVICE_OBJECT: 85722B00 18:17:02:156 3836 KLMD_GetLowerDeviceObject: Trying to get lower device object for 85722B00 18:17:02:156 3836 KLMD_ReadMem: Trying to ReadMemory 0x85722B00[0x38] 18:17:02:156 3836 DetectCureTDL3: DRIVER_OBJECT: 8575A078 18:17:02:156 3836 KLMD_ReadMem: Trying to ReadMemory 0x8575A078[0xA8] 18:17:02:156 3836 KLMD_ReadMem: Trying to ReadMemory 0x85728030[0x38] 18:17:02:156 3836 KLMD_ReadMem: Trying to ReadMemory 0x857ADE20[0xA8] 18:17:02:156 3836 KLMD_ReadMem: Trying to ReadMemory 0xE18EB1C8[0x1A] 18:17:02:156 3836 DetectCureTDL3: DRIVER_OBJECT name: \Driver\atapi, Driver Name: atapi 18:17:02:156 3836 DetectCureTDL3: IRP_MJ_CREATE : 85767618 18:17:02:156 3836 DetectCureTDL3: IRP_MJ_CREATE_NAMED_PIPE : 85767618 18:17:02:156 3836 DetectCureTDL3: IRP_MJ_CLOSE : 85767618 18:17:02:156 3836 DetectCureTDL3: IRP_MJ_READ : 85767618 18:17:02:156 3836 DetectCureTDL3: IRP_MJ_WRITE : 85767618 18:17:02:156 3836 DetectCureTDL3: IRP_MJ_QUERY_INFORMATION : 85767618 18:17:02:156 3836 DetectCureTDL3: IRP_MJ_SET_INFORMATION : 85767618 18:17:02:156 3836 DetectCureTDL3: IRP_MJ_QUERY_EA : 85767618 18:17:02:156 3836 DetectCureTDL3: IRP_MJ_SET_EA : 85767618 18:17:02:156 3836 DetectCureTDL3: IRP_MJ_FLUSH_BUFFERS : 85767618 18:17:02:156 3836 DetectCureTDL3: IRP_MJ_QUERY_VOLUME_INFORMATION : 85767618 18:17:02:156 3836 DetectCureTDL3: IRP_MJ_SET_VOLUME_INFORMATION : 85767618 18:17:02:156 3836 DetectCureTDL3: IRP_MJ_DIRECTORY_CONTROL : 85767618 18:17:02:156 3836 DetectCureTDL3: IRP_MJ_FILE_SYSTEM_CONTROL : 85767618 18:17:02:156 3836 DetectCureTDL3: IRP_MJ_DEVICE_CONTROL : 85767618 18:17:02:156 3836 DetectCureTDL3: IRP_MJ_INTERNAL_DEVICE_CONTROL : 8501EEF0 18:17:02:156 3836 DetectCureTDL3: IRP_MJ_SHUTDOWN : 85767618 18:17:02:156 3836 DetectCureTDL3: IRP_MJ_LOCK_CONTROL : 85767618 18:17:02:156 3836 DetectCureTDL3: IRP_MJ_CLEANUP : 85767618 18:17:02:156 3836 DetectCureTDL3: IRP_MJ_CREATE_MAILSLOT : 85767618 18:17:02:156 3836 DetectCureTDL3: IRP_MJ_QUERY_SECURITY : 85767618 18:17:02:156 3836 DetectCureTDL3: IRP_MJ_SET_SECURITY : 85767618 18:17:02:156 3836 DetectCureTDL3: IRP_MJ_POWER : 85767618 18:17:02:156 3836 DetectCureTDL3: IRP_MJ_SYSTEM_CONTROL : 85767618 18:17:02:156 3836 DetectCureTDL3: IRP_MJ_DEVICE_CHANGE : 85767618 18:17:02:156 3836 DetectCureTDL3: IRP_MJ_QUERY_QUOTA : 85767618 18:17:02:156 3836 DetectCureTDL3: IRP_MJ_SET_QUOTA : 85767618 18:17:02:156 3836 TDL3_FileDetect: Processing driver: atapi 18:17:02:156 3836 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\atapi.sys 18:17:02:156 3836 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\atapi.sys 18:17:02:156 3836 KLMD_ReadMem: Trying to ReadMemory 0x857674BF[0x400] 18:17:02:156 3836 TDL3_StartIoHookDetect: CheckParameters: 9, FFDF0308, 1 18:17:02:156 3836 Driver "atapi" StartIo handler infected by TDSS rootkit … 18:17:02:156 3836 TDL3_StartIoHookCure: Number of patches 1 18:17:02:156 3836 KLMD_WriteMem: Trying to WriteMemory 0x857675B6[0x6] 18:17:02:156 3836 cured 18:17:02:156 3836 TDL3_FileDetect: Processing driver: atapi 18:17:02:156 3836 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\atapi.sys 18:17:02:156 3836 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\atapi.sys 18:17:02:156 3836 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\atapi.sys - Verdict: Clean 18:17:02:171 3836 18:17:02:171 3836 Completed 18:17:02:171 3836 18:17:02:171 3836 Results: 18:17:02:171 3836 Memory objects infected / cured / cured on reboot: 1 / 1 / 0 18:17:02:171 3836 Registry objects infected / cured / cured on reboot: 0 / 0 / 0 18:17:02:171 3836 File objects infected / cured / cured on reboot: 0 / 0 / 0 18:17:02:171 3836 18:17:02:203 3836 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\drivers\klmd.sys) returned status 00000000 18:17:02:203 3836 UtilityDeinit: KLMD(ARK) unloaded successfully

LDTate

Post #13February 23, 2010, 11:26 PM UTC

18:17:02:156 3836 Driver "atapi" StartIo handler infected by TDSS rootkit … 18:17:02:156 3836 TDL3_StartIoHookCure: Number of patches 1 Now I need you to run a new Combofix scan and make sure you update it if it ask you to.

seanakaforty

Post #14February 23, 2010, 11:32 PM UTC

I'm running Combofix now. Just for my clarification, were you saying to let combofix update if it asks to, or were you responding to my last question about letting Windows Automatic Update do whatever update it is requesting?

LDTate

Post #15February 23, 2010, 11:35 PM UTC

I'm running Combofix now. Just for my clarification, were you saying to let combofix update if it asks to, or were you responding to my last question about letting Windows Automatic Update do whatever update it is requesting?

Just combofix right now.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Help needed! All kinds symptoms on XP laptop (HJT log

✨ Ask AI

Ask AI