What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Firefox redirect to directrdr.com in Win XP

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #2
Hi,

I will be helping you on removing malwares on your computer. Log research takes time, so please be patient and I'd be grateful if you would note the following:
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Do not install/uninstall anything on your computer unless advised.
  • Do not run any other scanning tools other than those instructed for you to use.
  • Follow the instructions on the order they are given.
  • Stay with this thread until advised when your computer is clean. Absence of symptoms does not necessarily mean a clean computer.
  • If you are being helped regarding this problem on another forum please advice us so that we can close this thread.
  • If you do not reply within 3 days after my last response, I will be asking you whether you still need assistance and if you still don't reply within 24 hours then the topic will be closed.
  • And lastly, if you have any questions, please ask before proceeding with any of the advised fixes.

_________________________________________________


OTL:
  • Download OTL to your desktop.
  • Double click on OTL.exe to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output
  • Check the boxes beside LOP Check and Purity Check.
  • Copy and paste the following bold text into the box under Custom Scan

    netsvcs
    %SYSTEMDRIVE%\*.exe
    c:\windows\system32\drivers\*.sys /90
    /md5start
    eventlog.dll
    scecli.dll
    netlogon.dll
    cngaudit.dll
    sceclt.dll
    ntelogon.dll
    logevent.dll
    iaStor.sys
    nvstor.sys
    atapi.sys
    IdeChnDr.sys
    viasraid.sys
    AGP440.sys
    vaxscsi.sys
    nvatabus.sys
    viamraid.sys
    nvata.sys
    nvgts.sys
    iastorv.sys
    ViPrt.sys
    eNetHook.dll
    /md5stop
    CREATERESTOREPOINT

  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of the OTL.txt and post it with your next reply along with the Extras.txt log.

–Next–

Let's run GMER again but with these settings:
Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.
  • Double click GMER.exe.
    [external image: Posted Image]
  • If it gives you a warning about rootkit activity and asks if you want to run a full scan…click on NO, then use the following settings for a more complete scan..
  • In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKED …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
      [external image: Posted Image]
      Click the image to enlarge it
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "ark.txt"
  • Save the log where you can easily find it, such as your desktop.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Please copy and paste the report into your Post.

To post in your next reply, don't attach:
1. OTL logs.
2. GMER log.
Post #4
Hi,

Running Combofix and other advance tools without proper supervision can render your machine inoperable!


Please post the log created by Combofix, don't run it, which is located in C:\ComboFix.txt.

–Next–

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    :filefind
*atapi*

:dir
C:\WINDOWS\System32\3076
C:\WINDOWS\System32\2052
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

To post in your next reply:
1. Combofix log.
2. Systemlook log.
Post #5
ComboFix 10-04-15.05 - Administrator 16.04.2010 17:25:05.1.2 - x86
ausgeführt von:: c:\dokumente und einstellungen\Administrator\Desktop\Combo-Fix.exe
.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\msconfig.exe

c:\windows\system32\srsvc.dll . . . ist infiziert!!

c:\windows\system32\proquota.exe . . . fehlt!!

.
((((((((((((((((((((((( Dateien erstellt von 2010-03-16 bis 2010-04-16 ))))))))))))))))))))))))))))))
.

2010-04-16 14:41 . 2010-04-16 15:11 ——– d—–w- c:\windows\SxsCaPendDel
2010-04-16 14:19 . 2010-04-16 14:40 64 —-a-w- c:\windows\system32\rp_stats.dat
2010-04-16 14:19 . 2010-04-16 14:40 44 —-a-w- c:\windows\system32\statistics.dat
2010-04-16 14:19 . 2010-04-16 14:40 44 —-a-w- c:\windows\system32\rp_rules.dat
2010-04-16 14:19 . 2010-04-16 14:19 95024 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-04-16 14:16 . 2010-04-16 14:41 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Lavasoft
2010-04-16 14:16 . 2010-04-16 14:41 ——– d—–w- c:\programme\Lavasoft
2010-04-16 13:53 . 2010-04-16 14:04 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2010-04-16 12:10 . 2010-04-16 12:10 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\PPLive
2010-04-16 12:10 . 2010-04-16 12:10 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Jlcm
2010-04-16 12:10 . 2010-04-16 12:10 ——– d—–w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\PPLive
2010-04-16 12:09 . 2010-04-16 12:10 ——– d—–w- c:\programme\Gemeinsame Dateien\PPLiveNetwork
2010-04-14 23:59 . 2010-04-16 14:42 ——– d—–w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\RayV
2010-04-14 16:44 . 2010-04-14 16:44 1924976 —-a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\NOS\Adobe_Downloads\install_flash_player.exe
2010-04-14 16:44 . 2010-04-14 16:52 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\NOS
2010-04-14 16:43 . 2010-04-14 16:43 ——– d—–w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Malwarebytes
2010-04-14 16:43 . 2010-03-29 22:46 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-14 16:43 . 2010-04-14 16:43 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2010-04-14 16:43 . 2010-03-29 22:45 20824 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-04-14 16:17 . 2010-04-14 16:20 ——– d—–w- c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Temp
2010-04-14 16:17 . 2010-04-14 16:17 ——– d—–w- c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Google
2010-04-14 16:02 . 2010-04-14 16:03 ——– d—–w- c:\programme\Opera
2010-04-14 11:50 . 2010-04-14 11:50 331776 —-a-w- c:\windows\system32\pptv.scr
2010-04-13 08:17 . 2010-04-13 08:17 ——– d—–w- c:\dokumente und einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\Adobe
2010-04-07 01:21 . 2010-04-07 04:11 ——– d—–w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\ICQ
2010-04-07 01:09 . 2010-04-10 16:00 ——– d—–w- c:\dokumente und einstellungen\Administrator\dwhelper
2010-04-07 00:55 . 2007-05-05 16:18 5504 —-a-w- c:\windows\system32\drivers\MSTEE.sys
2010-04-07 00:55 . 2007-05-05 16:18 10880 —-a-w- c:\windows\system32\drivers\NdisIP.sys
2010-04-07 00:55 . 2004-08-03 21:10 15360 —-a-w- c:\windows\system32\drivers\StreamIP.sys
2010-04-07 00:55 . 2004-08-03 21:10 11136 —-a-w- c:\windows\system32\drivers\SLIP.sys
2010-04-07 00:55 . 2007-05-05 16:18 19328 —-a-w- c:\windows\system32\drivers\WSTCODEC.SYS
2010-04-07 00:55 . 2007-05-05 16:18 85376 —-a-w- c:\windows\system32\drivers\NABTSFEC.sys
2010-04-07 00:55 . 2007-05-05 16:18 17024 —-a-w- c:\windows\system32\drivers\CCDECODE.sys
2010-04-07 00:55 . 2007-05-05 16:18 54272 —-a-w- c:\windows\system32\vfwwdm32.dll
2010-04-07 00:55 . 2010-04-07 00:57 ——– d—–w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\ManyCam
2010-04-07 00:55 . 2010-04-07 00:55 ——– d—–w- c:\programme\Ask.com
2010-04-01 15:39 . 2010-03-22 09:25 780288 —-a-w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Octoshape\Octoshape Streaming Services\pmv306a-1003220-0-libOctoshapeClient.dll
2010-03-31 17:13 . 2010-03-31 17:13 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Trymedia
2010-03-31 02:41 . 2010-04-15 23:14 ——– d—–w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\HLSW
2010-03-29 16:53 . 2010-04-02 00:10 ——– d—–w- c:\programme\Gemeinsame Dateien\DVDVideoSoft
2010-03-29 16:47 . 2010-03-29 17:02 ——– d—–w- c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\WMTools Downloaded Files
2010-03-26 22:04 . 2010-03-26 22:04 666112 —-a-w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\pmv306a-1003220-0-main.dll
2010-03-26 18:43 . 2010-03-26 18:43 ——– d—–w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Ashampoo
2010-03-26 18:36 . 2010-03-26 18:36 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\ashampoo
2010-03-26 18:36 . 2010-03-26 18:36 ——– d—–w- c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\ashampoo
2010-03-26 03:28 . 2010-03-26 03:29 ——– d—–w- c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Adobe
2010-03-26 03:28 . 2010-03-26 03:28 ——– d—–w- c:\programme\Gemeinsame Dateien\Adobe
2010-03-26 02:40 . 2010-03-26 02:40 86016 —-a-w- c:\windows\system32\frapsvid.dll
2010-03-25 08:07 . 2010-04-14 16:51 ——– d—–w- c:\windows\Sun
2010-03-24 19:13 . 2010-03-24 19:13 8108 —ha-w- c:\windows\system32\mlfcache.dat
2010-03-24 05:59 . 2010-03-24 05:59 51528 —-a-w- c:\dokumente und einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
2010-03-24 05:59 . 2010-03-24 05:59 ——– d—–w- c:\programme\MSBuild
2010-03-24 05:58 . 2010-03-24 05:58 ——– d—–w- c:\windows\system32\XPSViewer
2010-03-24 05:58 . 2010-03-24 05:58 ——– d—–w- c:\programme\Reference Assemblies
2010-03-24 05:58 . 2006-06-29 12:07 14048 ——w- c:\windows\system32\spmsg2.dll
2010-03-24 05:58 . 2010-03-24 05:58 ——– d—–w- c:\windows\PCHEALTH
2010-03-23 02:57 . 2010-04-14 16:49 411368 —-a-w- c:\windows\system32\deploytk.dll
2010-03-22 00:30 . 2010-04-14 16:17 ——– d—–w- c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Procaster
2010-03-22 00:30 . 2010-03-22 00:30 ——– d—–w- c:\programme\Livestream Procaster
2010-03-21 16:46 . 2010-03-21 16:46 71960 —-a-w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Mozilla\Plugins\npoctoshape.dll
2010-03-21 16:46 . 2010-03-21 16:46 ——– d—–w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Octoshape
2010-03-21 16:46 . 2010-02-17 16:19 71960 —-a-w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Octoshape\Octoshape Streaming Services\sua-1002170-0-npoctoshape.dll
2010-03-21 16:46 . 2010-02-17 16:19 420352 —-a-w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Octoshape\Octoshape Streaming Services\sua-1002170-0-libOctoshapeClient.dll
2010-03-21 16:46 . 2010-02-17 16:19 124184 —-a-w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Octoshape\Octoshape Streaming Services\sua-1002170-0-apoctoshape.dll
2010-03-21 16:46 . 2009-01-08 13:44 70936 —-a-w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe
2010-03-20 00:59 . 2010-03-20 01:01 ——– d—–w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Ventrilo
2010-03-19 14:55 . 2010-03-19 14:55 319488 —-a-w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe
2010-03-19 14:46 . 2010-02-25 17:42 30536 —-a-w- c:\windows\system32\TURegOpt.exe
2010-03-19 14:46 . 2010-02-25 17:37 30024 —-a-w- c:\windows\system32\uxtuneup.dll
2010-03-19 14:46 . 2010-03-19 14:46 ——– d—–w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\TuneUp Software
2010-03-19 14:46 . 2010-03-19 14:46 ——– d—–w- c:\programme\TuneUp Utilities 2010
2010-03-19 14:46 . 2010-03-19 14:46 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\TuneUp Software
2010-03-19 14:46 . 2010-03-19 14:46 ——– d-sh–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2010-03-19 14:30 . 2010-03-19 14:31 ——– d—–w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\mIRC
2010-03-19 14:27 . 2010-03-19 14:27 ——– d—–w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Media Player Classic
2010-03-19 14:23 . 2010-03-19 14:25 ——– d—–w- c:\programme\Gemeinsame Dateien\Blizzard Entertainment
2010-03-19 14:23 . 2010-03-19 14:25 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Blizzard Entertainment
2010-03-19 14:23 . 2010-03-19 14:25 ——– d—–w- c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Blizzard Entertainment
2010-03-19 14:22 . 2010-03-19 14:22 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Blizzard

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-14 16:49 . 2010-04-14 16:49 ——– d—–w- c:\programme\Gemeinsame Dateien\Java
2010-04-14 16:49 . 2010-04-14 16:49 503808 —-a-w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-5158641c-n\msvcp71.dll
2010-04-14 16:49 . 2010-04-14 16:49 499712 —-a-w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-5158641c-n\jmc.dll
2010-04-14 16:49 . 2010-04-14 16:49 348160 —-a-w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-5158641c-n\msvcr71.dll
2010-04-14 16:49 . 2010-04-14 16:49 61440 —-a-w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-2e044038-n\decora-sse.dll
2010-04-14 16:49 . 2010-04-14 16:49 12800 —-a-w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-2e044038-n\decora-d3d.dll
2010-04-14 16:49 . 2010-04-14 16:49 ——– d—–w- c:\programme\Java
2010-04-14 16:49 . 2010-04-14 16:49 79488 —-a-w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Sun\Java\jre1.6.0_19\gtapi.dll
2010-04-14 16:49 . 2010-04-14 16:49 152576 —-a-w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Sun\Java\jre1.6.0_19\lzma.dll
2010-04-07 01:21 . 2010-03-19 13:43 ——– d–h–w- c:\programme\InstallShield Installation Information
2010-03-29 16:36 . 2010-03-19 13:51 8224 —-a-w- c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2010-03-28 18:22 . 2010-03-19 13:24 3416 —-a-w- c:\windows\system32\PerfStringBackup.TMP
2010-03-21 03:38 . 2010-03-19 14:18 90112 —-a-w- c:\windows\DUMP1ed2.tmp
2010-03-20 01:00 . 2010-03-19 13:48 ——– d—–w- c:\programme\Gemeinsame Dateien\Wise Installation Wizard
2010-03-19 14:09 . 2010-03-19 14:09 ——– d—–w- c:\dokumente und einstellungen\Administrator\Anwendungsdaten\InstallShield
2010-03-19 13:49 . 2010-03-19 13:48 ——– d—–w- c:\programme\NVIDIA Corporation
2010-03-19 13:48 . 2010-03-19 13:48 ——– d—–w- c:\programme\AGEIA Technologies
2010-03-19 13:48 . 2010-03-19 13:48 ——– d—–w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\NVIDIA Corporation
2010-03-19 13:46 . 2010-03-19 13:43 ——– d—–w- c:\programme\Realtek
.

——- Sigcheck ——-

[-] 2007-05-05 . 10D53E677A6962B964839073E492C84B . 508928 . . [5.1.2600.2815] . . c:\windows\system32\winlogon.exe

[-] 2007-05-05 . 7AA72CFFDE889BDAA03504C383AD0786 . 343040 . . [7.0.2600.3085] . . c:\windows\system32\msvcrt.dll




[-] 2007-05-05 . 106B3F67BD6237592A51051FEF96D09D . 1548288 . . [5.1.2600.2180] . . c:\windows\system32\sfcfiles.dll






[-] 2007-05-05 . 15E9565CF141152C3081715782AD2097 . 175616 . . [5.1.2600.2786] . . c:\windows\system32\appmgmts.dll

c:\windows\System32\srsvc.dll … Fehlt !!
c:\windows\System32\wscntfy.exe … Fehlt !!
c:\windows\System32\xmlprov.dll … Fehlt !!
c:\windows\System32\ctfmon.exe … Fehlt !!
c:\windows\System32\regsvc.dll … Fehlt !!
c:\windows\System32\schedsvc.dll … Fehlt !!
c:\windows\System32\ssdpsrv.dll … Fehlt !!
c:\windows\System32\termsrv.dll … Fehlt !!
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="f:\programme\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"RTHDCPL"="RTHDCPL.EXE" [2010-01-19 18790432]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-01-11 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-01-11 13666408]
"Krait"="f:\programme\Razer\Krait\razerhid.exe" [2007-02-16 126976]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"ShowDeskFix"="shell32" [X]
"nltide_3"="advpack.dll" [2007-05-05 124928]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-12-11 14:57 948672 —-a-r- c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Livestream Procaster]
2010-02-22 17:17 6513952 —-a-w- c:\programme\Livestream Procaster\Procaster.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2010-04-15 11:47 1238352 —-a-w- d:\steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AntiVirSchedulerService"=2 (0x2)
"UxTuneUp"=2 (0x2)
"TuneUp.UtilitiesSvc"=2 (0x2)
"TuneUp.Defrag"=3 (0x3)
"WMPNetworkSvc"=3 (0x3)
"TapiSrv"=3 (0x3)
"Spooler"=3 (0x3)
"JavaQuickStarterService"=2 (0x2)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Google Update"="c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Google\Update\GoogleUpdate.exe" /c
"PPAP"="c:\programme\Gemeinsame Dateien\PPLiveNetwork\PPAP.exe" -background
"RayV"=c:\programme\RayV\RayV\RayV.exe /background
"Octoshape Streaming Services"="c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" -inv:bootrun

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="f:\programme\Adobe\Reader\Reader_sl.exe"
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Steam\\Steam.exe"=
"d:\\StarCraft II Beta\\StarCraft II.exe"=
"f:\\Programme\\mIRC\\mirc.exe"=
"d:\\StarCraft II Beta\\Versions\\Base14356\\SC2.exe"=
"c:\\Dokumente und Einstellungen\\Administrator\\Anwendungsdaten\\Macromedia\\Flash Player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"=
"f:\\Programme\\Ventrilo\\Ventrilo.exe"=
"f:\\Programme\\QIP\\qip.exe"=
"c:\\Programme\\Java\\jre6\\bin\\javaw.exe"=
"d:\\StarCraft II Beta\\Versions\\Base14259\\SC2.exe"=
"d:\\StarCraft II Beta\\Versions\\Base14593\\SC2.exe"=
"c:\\Programme\\Java\\jre6\\bin\\java.exe"=
"d:\\StarCraft II Beta\\Versions\\Base14621\\SC2.exe"=
"f:\\Programme\\HLSW\\hlsw.exe"=
"c:\\Dokumente und Einstellungen\\Administrator\\Anwendungsdaten\\Octoshape\\Octoshape Streaming Services\\OctoshapeClient.exe"=
"d:\\StarCraft II Beta\\Versions\\Base14803\\SC2.exe"=
"d:\\Steam\\steamapps\\bsunnyboy\\condition zero\\hl.exe"=
"d:\\Steam\\steamapps\\bsunnyboy\\counter-strike\\hl.exe"=
"c:\\Programme\\Gemeinsame Dateien\\PPLiveNetwork\\PPAP.exe"=

R1 prio;Prio;c:\windows\system32\drivers\prio.sys [12.09.2009 19:25 51448]
R2 RtNdPt5x;Realtek NDIS Protocol Driver;c:\windows\system32\drivers\RtNdPt5x.sys [19.03.2010 15:46 22016]
R3 hidusbf;USB Mouse Rate Adjuster Lower Filter by SweetLow;c:\windows\system32\drivers\hidusbf.sys [19.03.2010 16:14 4544]
R3 krait03;Razer krait USB Filter Driver;c:\windows\system32\drivers\krait.sys [19.03.2010 16:09 13324]
S2 prio_svc;Prio Service;f:\programme\Prio\prio_svc.exe [12.09.2009 19:25 5120]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [19.03.2010 15:43 1691480]
S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam.sys –> c:\windows\system32\DRIVERS\ManyCam.sys [?]
S3 RTLTEAMING;Realtek Intermediate Driver for Ethernet Extended Features;c:\windows\system32\drivers\RTLTEAMING.SYS [19.03.2010 15:46 29440]
S3 RTLVLAN;Realtek VLAN Intermediate Driver;c:\windows\system32\drivers\RTLVLAN.SYS [19.03.2010 15:46 17536]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\programme\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [25.02.2010 11:18 10064]
S4 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [19.03.2010 15:36 108289]
S4 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [25.02.2010 19:40 1047880]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
DcomLaunch REG_MULTI_SZ DcomLaunch

NETSVCS BENÖTIGT REPARATUR - Derzeitig vorhandene Einträge:
6to4
AppMgmt
AudioSrv
Browser
CryptSvc
DMServer
DHCP
EventSystem
FastUserSwitchingCompatibility
HidServ
Ias
Iprip
Irmon
LanmanServer
LanmanWorkstation
Netman
Nla
Ntmssvc
NWCWorkstation
Nwsapagent
Rasauto
Rasman
Seclogon
SENS
Sharedaccess
Tapisrv
Themes
UxTuneUp
WZCSVC
Wmi
WmdmPmSp
winmgmt
BITS
wuauserv
ShellHWDetection
WmdmPmSN

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

.
.
——- Zusätzlicher Suchlauf ——-
.
uStart Page = hxxp://qip.ru
uDefault_Search_URL = hxxp://search.qip.ru
uInternet Connection Wizard,ShellNext = hxxp://www1.mpnrs.com:80/tracker/tracker2?adl=2128&adc=2705&adm=7956&adr=3&ada=2&rid=1269212550765&turl=http://ad.adnet.de/adneti.php?s=10665&c=35139&t=1
uSearchAssistant = hxxp://search.qip.ru/ie
FF - ProfilePath - c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Mozilla\Firefox\Profiles\avkhu5oz.affenmett\
FF - plugin: c:\dokumente und einstellungen\Administrator\Anwendungsdaten\Mozilla\plugins\npoctoshape.dll
FF - plugin: c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: f:\programme\Adobe\Reader\browser\nppdf32.dll

—- FIREFOX Richtlinien —-
f:\programme\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
f:\programme\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
f:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
f:\programme\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
f:\programme\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
f:\programme\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
f:\programme\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
f:\programme\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
f:\programme\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
f:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
f:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
f:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
f:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
f:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
f:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
f:\programme\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
f:\programme\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
f:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
f:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
f:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
f:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
f:\programme\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
f:\programme\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
f:\programme\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
f:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
f:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
f:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
f:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
f:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
f:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
f:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
f:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
f:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
f:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
f:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
f:\programme\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
MSConfigStartUp-ICQ - f:\programme\ICQ6.5\ICQ.exe
MSConfigStartUp-ManyCam - f:\programme\ManyCam 2.4\ManyCam.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-16 17:29
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse…

Scanne versteckte Autostarteinträge…

Scanne versteckte Dateien…

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x897C7AC8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf74bbf10
\Driver\ACPI -> ACPI.sys @ 0xf735dcb8
\Driver\atapi -> atapi.sys @ 0xf72ef816
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x8058244a
ParseProcedure -> ntkrnlpa.exe @ 0x8058158a
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x8058244a
ParseProcedure -> ntkrnlpa.exe @ 0x8058158a
NDIS: Realtek PCIe GBE Family Controller -> SendCompleteHandler -> NDIS.sys @ 0xf720dbb0
PacketIndicateHandler -> NDIS.sys @ 0xf721aa21
SendHandler -> NDIS.sys @ 0xf71f887b
user & kernel MBR OK

**************************************************************************
.
——————— Durch laufende Prozesse gestartete DLLs ———————

- - - - - - - > 'winlogon.exe'(576)
f:\programme\Prio\prio.dll

- - - - - - - > 'lsass.exe'(668)
f:\programme\Prio\prio.dll
.
Zeit der Fertigstellung: 2010-04-16 17:31:42
ComboFix-quarantined-files.txt 2010-04-16 15:31

Vor Suchlauf: 9.997.631.488 Bytes frei
Nach Suchlauf: 9.993.981.952 Bytes frei

WindowsXP-KB310994-SP2-Home-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 3536231DA502BEEC0AA57FF763C1E8E8

SystemLook v1.0 by jpshortstuff (11.01.10)
Log created at 06:56 on 18/04/2010 by Administrator (Administrator - Elevation successful)

========== filefind ==========

Searching for "*atapi*"
C:\cmdcons\ATAPI.SY_ –a— 49558 bytes [20:59 03/08/2004] [20:59 03/08/2004] 28541D14647BB58502D09D1CEAEE6684
C:\WINDOWS\ERDNT\cache\atapi.sys –a— 96384 bytes [15:29 16/04/2010] [17:18 05/05/2007] 6A1CE66D51CF9AF719A7D2FD9FE15DE2
C:\WINDOWS\system32\drivers\atapi.sys –a— 96384 bytes [16:19 05/05/2007] [17:18 05/05/2007] 6A1CE66D51CF9AF719A7D2FD9FE15DE2
C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\atapi.sys –a— 96384 bytes [13:42 19/03/2010] [16:19 05/05/2007] 6A1CE66D51CF9AF719A7D2FD9FE15DE2

========== dir ==========

C:\WINDOWS\System32\3076 - Parameters: "(none)"

—Files—
None found.

—Folders—
None found.

C:\WINDOWS\System32\2052 - Parameters: "(none)"

—Files—
None found.

—Folders—
None found.

-=End Of File=-
Post #6
Hi,

Translate for me these please:
Weitere Löschungen
ist infiziert
fehlt

–Next–

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order in which they are mentioned below. If there's anything that you don't understand, please ask your question(s) before proceeding with the fixes.


Open a new Notepad session
  • Click the Start button, click Run.
  • In the run box type notepad.
  • click OK.
  • In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  • Copy and paste all of the text in the code box below into Notepad, Do not copy the word code.

    @ECHO OFF
copy /y C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\i386\atapi.sys c:\
del %0
  • Click File, Save as…, and set the Save in to your Desktop
  • In the File name box, type fix.bat
  • In the Save as type: box, choose All Files
  • Choose a location to save. Preferably on your desktop.
  • Click Save
It should look like this: [external image: Posted Image]

Double click on fix.bat & allow it to run. A small black box should open and close - this is normal.

–Next–

Open a new Notepad session
  • Click the Start button, click Run.
  • In the run box type notepad.
  • click OK.
  • In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  • Copy and paste all of the text in the code box below into Notepad, Do not copy the word code.

    ren C:\WINDOWS\system32\drivers\atapi.sys atapi.old
copy c:\atapi.sys c:\windows\system32\drivers\atapi.sys 
exit
  • Click File, Save as….
  • In the File name box, type C:\runme.txt
  • Click Save

–Next–

We need to run this fix in Recovery Console, to do this:

Print out these instructions to use while in the Recovery Console:
  • Restart your computer.
  • Before Windows loads, you will be prompted to choose which Operating System to start.
  • Use the up and down arrow key to select Microsoft Windows Recovery Console
  • You must enter which Windows installation to log onto. Type 1 and press 'Enter'.
  • At the C:\Windows prompt, type the following bolded entries, and press 'Enter' (note the space between …ch C:\…):

    batch C:\runme.txt
  • Reboot your computer.
To post in your next reply:
1. The translations.
2. How was it? Were you able to complete the steps without errors?
Post #7
Hi, It's been several days. Do you still need help on this? This thread will be closed if you don't respond within 48 hours.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI