What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Refusing to open antimalware / spyware

20 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi, My computer isnt giving many signs of a virus or spyware other than a couple random pop ups yesterday. Today I tried to open AMW, Spybot, Adaware, and even downloaded combofix and none would open, even in safe mode. I checked hijack this and there is nothing new or changed from previous runs. Thoughts?
Post #2
Hi

Please do the following:



Please download MBRCheck.exe to your desktop.
  • Be sure to disable your security programs
  • Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
  • A window will open on your desktop
  • if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
  • If nothing unusual is found just press Enter
  • A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
  • Please post the contents of that file.



NEXT


Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.pif to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.



NEXT


Scan With RootKitUnHooker

  • Please Download Rootkit Unhooker and save it to your desktop.
  • Now double-click on RKUnhookerLE.exe to run it.
  • Click the Report tab, then click Scan.
  • Check (Tick) Drivers and Stealth
  • Uncheck the rest. then click OK
  • When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
  • Wait till the scanner has finished and then click File > Save Report.
  • Save the report somewhere where you can find it. Click Close.
  • Copy the entire contents of the report and paste it in your next reply.

Note** you may get the following warning, just click OK and continue.

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"
Post #3
Thank you for your reply. Here are the reports in the order that you gave them to me: DDS (Ver_10-10-21.02) - NTFSx86 Run by [removed] at 19:50:13.75 on Fri 10/22/2010 Internet Explorer: 8.0.6001.18702 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.383.183 [GMT -4:00] ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\DivX\DivX Update\DivXUpdate.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Java\jre6\bin\jqs.exe C:\PROGRA~1\Dantz\RETROS~1\retrorun.exe C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Documents and Settings\Jay C\Desktop\dds.com ============== Pseudo HJT Report =============== uStart Page = hxxp://www.yahoo.com/ mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html uInternet Settings,ProxyOverride = uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn2\yt.dll EB: &Yahoo! Messenger: {4528bbe0-4e08-11d5-ad55-00010333d0ad} - c:\program files\yahoo!\messenger\yhexbmes0521.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [Malwarebytes Anti-Malware (rootkit-scan)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Notify: WRNotifier - WRLogonNTF.dll SEH: CShellExecuteHookImpl Object: {54d9498b-cf93-414f-8984-8ce7fde0d391} - c:\program files\ewido anti-malware\shellhook.dll mASetup: {A509B1FF-37FF-4bFF-8CFF-4F3A747040FF} - c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,launchinfsectionex c:\program files\internet explorer\clrtour.inf,DefaultInstall.ResetTour,,12 ============= SERVICES / DRIVERS =============== R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-5-5 64160] S3 inibtmgr;WD Bridge Controller Driver;c:\windows\system32\drivers\inibtmgr.sys [2005-6-28 9728] S4 ewido security suite control;ewido security suite control;c:\program files\ewido anti-malware\ewidoctrl.exe [2005-11-30 13888] S4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-3-9 1028432] =============== Created Last 30 ================ ==================== Find3M ==================== 2010-09-22 20:38:38 1198163 —-a-w- c:\windows\system32\unins000.exe 2010-09-14 02:12:50 1409 —-a-w- c:\windows\QTFont.for 2010-09-08 13:45:00 100864 —-a-w- c:\windows\system32\ff_wmv9.dll 2010-09-08 13:09:46 108032 —-a-w- c:\windows\system32\ff_vfw.dll 2010-08-12 04:07:46 133616 ——w- c:\windows\system32\pxafs.dll 2010-08-12 04:07:46 126448 ——w- c:\windows\system32\pxinsi64.exe 2010-08-12 04:07:46 123888 ——w- c:\windows\system32\pxcpyi64.exe ============= FINISH: 19:52:31.98 =============== MBRCheck, version 1.2.3 © 2010, AD Command-line: Windows Version: Windows XP Professional Windows Information: Service Pack 2 (build 2600) Logical Drives Mask: 0x0000000d Kernel Drivers (total 113): 0x804D7000 \WINDOWS\system32\ntoskrnl.exe 0x806EC000 \WINDOWS\system32\hal.dll 0xF7BA9000 \WINDOWS\system32\KDCOM.DLL 0xF7AB9000 \WINDOWS\system32\BOOTVID.dll 0xF765A000 ACPI.sys 0xF7BAB000 \WINDOWS\system32\DRIVERS\WMILIB.SYS 0xF7649000 pci.sys 0xF76A9000 isapnp.sys 0xF76B9000 ohci1394.sys 0xF76C9000 \WINDOWS\system32\DRIVERS\1394BUS.SYS 0xF7BAD000 intelide.sys 0xF7929000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS 0xF76D9000 MountMgr.sys 0xF762A000 ftdisk.sys 0xF7BAF000 dmload.sys 0xF7604000 dmio.sys 0xF7931000 PartMgr.sys 0xF76E9000 sbp2port.sys 0xF76F9000 VolSnap.sys 0xF75EC000 atapi.sys 0xF7709000 disk.sys 0xF7719000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS 0xF75CC000 fltMgr.sys 0xF7729000 Lbd.sys 0xF7739000 PxHelp20.sys 0xF75B5000 KSecDD.sys 0xF75A2000 WudfPf.sys 0xF7515000 Ntfs.sys 0xF74E8000 NDIS.sys 0xF74CD000 Mup.sys 0xF7749000 agp440.sys 0xF7789000 \SystemRoot\system32\DRIVERS\nic1394.sys 0xF78A9000 \SystemRoot\system32\DRIVERS\processr.sys 0xF7424000 \SystemRoot\system32\DRIVERS\ati2mtaa.sys 0xF7410000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS 0xF73CF000 \SystemRoot\system32\DRIVERS\bcmwl5.sys 0xF79A9000 \SystemRoot\system32\DRIVERS\fdc.sys 0xF78B9000 \SystemRoot\system32\DRIVERS\i8042prt.sys 0xF79B1000 \SystemRoot\system32\DRIVERS\kbdclass.sys 0xF78C9000 \SystemRoot\system32\DRIVERS\serial.sys 0xF7B41000 \SystemRoot\system32\DRIVERS\serenum.sys 0xF739F000 \SystemRoot\system32\DRIVERS\parport.sys 0xF78D9000 \SystemRoot\system32\DRIVERS\imapi.sys 0xF78E9000 \SystemRoot\system32\DRIVERS\cdrom.sys 0xF78F9000 \SystemRoot\system32\DRIVERS\redbook.sys 0xF737C000 \SystemRoot\system32\DRIVERS\ks.sys 0xF79B9000 \SystemRoot\SYSTEM32\DRIVERS\GEARAspiWDM.sys 0xF79C1000 \SystemRoot\system32\DRIVERS\usbuhci.sys 0xF7359000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0xF7341000 \SystemRoot\system32\drivers\ac97intc.sys 0xF731D000 \SystemRoot\system32\drivers\portcls.sys 0xF7909000 \SystemRoot\system32\drivers\drmk.sys 0xF7CCE000 \SystemRoot\system32\DRIVERS\audstub.sys 0xF7919000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0xF7B49000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0xF7266000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0xF7769000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0xF7799000 \SystemRoot\system32\DRIVERS\raspptp.sys 0xF79C9000 \SystemRoot\system32\DRIVERS\TDI.SYS 0xF7255000 \SystemRoot\system32\DRIVERS\psched.sys 0xF77A9000 \SystemRoot\system32\DRIVERS\msgpc.sys 0xF79E9000 \SystemRoot\system32\DRIVERS\ptilink.sys 0xF79F1000 \SystemRoot\system32\DRIVERS\raspti.sys 0xF7224000 \SystemRoot\system32\DRIVERS\rdpdr.sys 0xF77E9000 \SystemRoot\system32\DRIVERS\termdd.sys 0xF79F9000 \SystemRoot\system32\DRIVERS\mouclass.sys 0xF7BC9000 \SystemRoot\system32\DRIVERS\swenum.sys 0xF71C8000 \SystemRoot\system32\DRIVERS\update.sys 0xF7B71000 \SystemRoot\system32\DRIVERS\mssmbios.sys 0xF7879000 \SystemRoot\System32\Drivers\NDProxy.SYS 0xF7889000 \SystemRoot\system32\DRIVERS\usbhub.sys 0xF7C2B000 \SystemRoot\system32\DRIVERS\USBD.SYS 0xF7A49000 \SystemRoot\system32\DRIVERS\flpydisk.sys 0xF7C2D000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0xF7CDD000 \SystemRoot\System32\Drivers\Null.SYS 0xF7C2F000 \SystemRoot\System32\Drivers\Beep.SYS 0xF7A59000 \SystemRoot\System32\drivers\vga.sys 0xF7C31000 \SystemRoot\System32\Drivers\mnmdd.SYS 0xF7C33000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0xF7A61000 \SystemRoot\System32\Drivers\Msfs.SYS 0xF7A69000 \SystemRoot\System32\Drivers\Npfs.SYS 0xF7200000 \SystemRoot\system32\DRIVERS\rasacd.sys 0xF412D000 \SystemRoot\system32\DRIVERS\ipsec.sys 0xF40D5000 \SystemRoot\system32\DRIVERS\tcpip.sys 0xF40AD000 \SystemRoot\system32\DRIVERS\netbt.sys 0xF408B000 \SystemRoot\System32\drivers\afd.sys 0xF730D000 \SystemRoot\system32\DRIVERS\netbios.sys 0xF4060000 \SystemRoot\system32\DRIVERS\rdbss.sys 0xF3FF1000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0xF72FD000 \SystemRoot\System32\Drivers\Fips.SYS 0xF3FD0000 \SystemRoot\system32\DRIVERS\ipnat.sys 0xF72ED000 \SystemRoot\system32\DRIVERS\wanarp.sys 0xF72DD000 \SystemRoot\system32\DRIVERS\arp1394.sys 0xF72BD000 \SystemRoot\System32\Drivers\Cdfs.SYS 0xF7BA5000 \SystemRoot\system32\DRIVERS\hidusb.sys 0xF72AD000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS 0xF7A79000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS 0xF7498000 \SystemRoot\system32\DRIVERS\mouhid.sys 0xBF800000 \SystemRoot\System32\win32k.sys 0xF7488000 \SystemRoot\System32\drivers\Dxapi.sys 0xF7A89000 \SystemRoot\System32\watchdog.sys 0xBF9C2000 \SystemRoot\System32\drivers\dxg.sys 0xF7C74000 \SystemRoot\System32\drivers\dxgthk.sys 0xBF9D4000 \SystemRoot\System32\ati2dvaa.dll 0xF39DC000 \SystemRoot\system32\DRIVERS\ndisuio.sys 0xF37A7000 \SystemRoot\system32\drivers\wdmaud.sys 0xF77F9000 \SystemRoot\system32\drivers\sysaudio.sys 0xF34CC000 \SystemRoot\system32\DRIVERS\mrxdav.sys 0xF7C63000 \SystemRoot\System32\Drivers\ParVdm.SYS 0xF3463000 \SystemRoot\System32\Drivers\HTTP.sys 0xF33E9000 \SystemRoot\system32\DRIVERS\srv.sys 0xF2E46000 \SystemRoot\system32\drivers\kmixer.sys 0x7C900000 \WINDOWS\system32\ntdll.dll Processes (total 29): 0 System Idle Process 4 System 596 C:\WINDOWS\system32\smss.exe 696 csrss.exe 728 C:\WINDOWS\system32\winlogon.exe 772 C:\WINDOWS\system32\services.exe 784 C:\WINDOWS\system32\lsass.exe 932 C:\WINDOWS\system32\svchost.exe 1008 svchost.exe 1084 C:\WINDOWS\system32\svchost.exe 1168 C:\WINDOWS\system32\svchost.exe 1224 svchost.exe 1288 svchost.exe 1500 C:\WINDOWS\system32\spoolsv.exe 1900 C:\WINDOWS\explorer.exe 224 C:\Program Files\DivX\DivX Update\DivXUpdate.exe 232 C:\WINDOWS\system32\ctfmon.exe 372 C:\Program Files\Internet Explorer\iexplore.exe 528 C:\Program Files\Java\jre6\bin\jqs.exe 584 C:\Program Files\Dantz\Retrospect\retrorun.exe 116 C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe 960 C:\WINDOWS\system32\svchost.exe 1236 wdfmgr.exe 1444 C:\WINDOWS\system32\wuauclt.exe 1652 C:\Program Files\Canon\CAL\CALMAIN.exe 348 alg.exe 2484 wmiprvse.exe 2588 C:\WINDOWS\system32\svchost.exe 288 C:\Documents and Settings\Jay C\Desktop\MBRCheck.exe \\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS) PhysicalDrive0 Model Number: WDCWD1600JB-00GVA0, Rev: 08.02D08 Size Device Name MBR Status ——————————————– 149 GB \\.\PhysicalDrive0 Windows XP MBR code detected SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A Done! MBRCheck, version 1.2.3 © 2010, AD Command-line: Windows Version: Windows XP Professional Windows Information: Service Pack 2 (build 2600) Logical Drives Mask: 0x0000000d Kernel Drivers (total 113): 0x804D7000 \WINDOWS\system32\ntoskrnl.exe 0x806EC000 \WINDOWS\system32\hal.dll 0xF7BA9000 \WINDOWS\system32\KDCOM.DLL 0xF7AB9000 \WINDOWS\system32\BOOTVID.dll 0xF765A000 ACPI.sys 0xF7BAB000 \WINDOWS\system32\DRIVERS\WMILIB.SYS 0xF7649000 pci.sys 0xF76A9000 isapnp.sys 0xF76B9000 ohci1394.sys 0xF76C9000 \WINDOWS\system32\DRIVERS\1394BUS.SYS 0xF7BAD000 intelide.sys 0xF7929000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS 0xF76D9000 MountMgr.sys 0xF762A000 ftdisk.sys 0xF7BAF000 dmload.sys 0xF7604000 dmio.sys 0xF7931000 PartMgr.sys 0xF76E9000 sbp2port.sys 0xF76F9000 VolSnap.sys 0xF75EC000 atapi.sys 0xF7709000 disk.sys 0xF7719000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS 0xF75CC000 fltMgr.sys 0xF7729000 Lbd.sys 0xF7739000 PxHelp20.sys 0xF75B5000 KSecDD.sys 0xF75A2000 WudfPf.sys 0xF7515000 Ntfs.sys 0xF74E8000 NDIS.sys 0xF74CD000 Mup.sys 0xF7749000 agp440.sys 0xF7789000 \SystemRoot\system32\DRIVERS\nic1394.sys 0xF78A9000 \SystemRoot\system32\DRIVERS\processr.sys 0xF7424000 \SystemRoot\system32\DRIVERS\ati2mtaa.sys 0xF7410000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS 0xF73CF000 \SystemRoot\system32\DRIVERS\bcmwl5.sys 0xF79A9000 \SystemRoot\system32\DRIVERS\fdc.sys 0xF78B9000 \SystemRoot\system32\DRIVERS\i8042prt.sys 0xF79B1000 \SystemRoot\system32\DRIVERS\kbdclass.sys 0xF78C9000 \SystemRoot\system32\DRIVERS\serial.sys 0xF7B41000 \SystemRoot\system32\DRIVERS\serenum.sys 0xF739F000 \SystemRoot\system32\DRIVERS\parport.sys 0xF78D9000 \SystemRoot\system32\DRIVERS\imapi.sys 0xF78E9000 \SystemRoot\system32\DRIVERS\cdrom.sys 0xF78F9000 \SystemRoot\system32\DRIVERS\redbook.sys 0xF737C000 \SystemRoot\system32\DRIVERS\ks.sys 0xF79B9000 \SystemRoot\SYSTEM32\DRIVERS\GEARAspiWDM.sys 0xF79C1000 \SystemRoot\system32\DRIVERS\usbuhci.sys 0xF7359000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0xF7341000 \SystemRoot\system32\drivers\ac97intc.sys 0xF731D000 \SystemRoot\system32\drivers\portcls.sys 0xF7909000 \SystemRoot\system32\drivers\drmk.sys 0xF7CCE000 \SystemRoot\system32\DRIVERS\audstub.sys 0xF7919000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0xF7B49000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0xF7266000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0xF7769000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0xF7799000 \SystemRoot\system32\DRIVERS\raspptp.sys 0xF79C9000 \SystemRoot\system32\DRIVERS\TDI.SYS 0xF7255000 \SystemRoot\system32\DRIVERS\psched.sys 0xF77A9000 \SystemRoot\system32\DRIVERS\msgpc.sys 0xF79E9000 \SystemRoot\system32\DRIVERS\ptilink.sys 0xF79F1000 \SystemRoot\system32\DRIVERS\raspti.sys 0xF7224000 \SystemRoot\system32\DRIVERS\rdpdr.sys 0xF77E9000 \SystemRoot\system32\DRIVERS\termdd.sys 0xF79F9000 \SystemRoot\system32\DRIVERS\mouclass.sys 0xF7BC9000 \SystemRoot\system32\DRIVERS\swenum.sys 0xF71C8000 \SystemRoot\system32\DRIVERS\update.sys 0xF7B71000 \SystemRoot\system32\DRIVERS\mssmbios.sys 0xF7879000 \SystemRoot\System32\Drivers\NDProxy.SYS 0xF7889000 \SystemRoot\system32\DRIVERS\usbhub.sys 0xF7C2B000 \SystemRoot\system32\DRIVERS\USBD.SYS 0xF7A49000 \SystemRoot\system32\DRIVERS\flpydisk.sys 0xF7C2D000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0xF7CDD000 \SystemRoot\System32\Drivers\Null.SYS 0xF7C2F000 \SystemRoot\System32\Drivers\Beep.SYS 0xF7A59000 \SystemRoot\System32\drivers\vga.sys 0xF7C31000 \SystemRoot\System32\Drivers\mnmdd.SYS 0xF7C33000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0xF7A61000 \SystemRoot\System32\Drivers\Msfs.SYS 0xF7A69000 \SystemRoot\System32\Drivers\Npfs.SYS 0xF7200000 \SystemRoot\system32\DRIVERS\rasacd.sys 0xF412D000 \SystemRoot\system32\DRIVERS\ipsec.sys 0xF40D5000 \SystemRoot\system32\DRIVERS\tcpip.sys 0xF40AD000 \SystemRoot\system32\DRIVERS\netbt.sys 0xF408B000 \SystemRoot\System32\drivers\afd.sys 0xF730D000 \SystemRoot\system32\DRIVERS\netbios.sys 0xF4060000 \SystemRoot\system32\DRIVERS\rdbss.sys 0xF3FF1000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0xF72FD000 \SystemRoot\System32\Drivers\Fips.SYS 0xF3FD0000 \SystemRoot\system32\DRIVERS\ipnat.sys 0xF72ED000 \SystemRoot\system32\DRIVERS\wanarp.sys 0xF72DD000 \SystemRoot\system32\DRIVERS\arp1394.sys 0xF72BD000 \SystemRoot\System32\Drivers\Cdfs.SYS 0xF7BA5000 \SystemRoot\system32\DRIVERS\hidusb.sys 0xF72AD000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS 0xF7A79000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS 0xF7498000 \SystemRoot\system32\DRIVERS\mouhid.sys 0xBF800000 \SystemRoot\System32\win32k.sys 0xF7488000 \SystemRoot\System32\drivers\Dxapi.sys 0xF7A89000 \SystemRoot\System32\watchdog.sys 0xBF9C2000 \SystemRoot\System32\drivers\dxg.sys 0xF7C74000 \SystemRoot\System32\drivers\dxgthk.sys 0xBF9D4000 \SystemRoot\System32\ati2dvaa.dll 0xF39DC000 \SystemRoot\system32\DRIVERS\ndisuio.sys 0xF37A7000 \SystemRoot\system32\drivers\wdmaud.sys 0xF77F9000 \SystemRoot\system32\drivers\sysaudio.sys 0xF34CC000 \SystemRoot\system32\DRIVERS\mrxdav.sys 0xF7C63000 \SystemRoot\System32\Drivers\ParVdm.SYS 0xF3463000 \SystemRoot\System32\Drivers\HTTP.sys 0xF33E9000 \SystemRoot\system32\DRIVERS\srv.sys 0xF2E46000 \SystemRoot\system32\drivers\kmixer.sys 0x7C900000 \WINDOWS\system32\ntdll.dll Processes (total 29): 0 System Idle Process 4 System 596 C:\WINDOWS\system32\smss.exe 696 csrss.exe 728 C:\WINDOWS\system32\winlogon.exe 772 C:\WINDOWS\system32\services.exe 784 C:\WINDOWS\system32\lsass.exe 932 C:\WINDOWS\system32\svchost.exe 1008 svchost.exe 1084 C:\WINDOWS\system32\svchost.exe 1168 C:\WINDOWS\system32\svchost.exe 1224 svchost.exe 1288 svchost.exe 1500 C:\WINDOWS\system32\spoolsv.exe 1900 C:\WINDOWS\explorer.exe 224 C:\Program Files\DivX\DivX Update\DivXUpdate.exe 232 C:\WINDOWS\system32\ctfmon.exe 372 C:\Program Files\Internet Explorer\iexplore.exe 528 C:\Program Files\Java\jre6\bin\jqs.exe 584 C:\Program Files\Dantz\Retrospect\retrorun.exe 116 C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe 960 C:\WINDOWS\system32\svchost.exe 1236 wdfmgr.exe 1444 C:\WINDOWS\system32\wuauclt.exe 1652 C:\Program Files\Canon\CAL\CALMAIN.exe 348 alg.exe 2484 wmiprvse.exe 2588 C:\WINDOWS\system32\svchost.exe 288 C:\Documents and Settings\Jay C\Desktop\MBRCheck.exe \\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS) PhysicalDrive0 Model Number: WDCWD1600JB-00GVA0, Rev: 08.02D08 Size Device Name MBR Status ——————————————– 149 GB \\.\PhysicalDrive0 Windows XP MBR code detected SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A Done! Thank you again, Jay
Post #4
Sorry, the RKunhooker log must not have copied and it repasted the MBR log. Here is the RKunhooker log: RkU Version: 3.8.388.590, Type LE (SR2) ============================================== OS Name: Windows XP Version 5.1.2600 (Service Pack 2) Number of processors #1 ============================================== >Drivers ============================================== 0x804D7000 C:\WINDOWS\system32\ntoskrnl.exe 2179328 bytes (Microsoft Corporation, NT Kernel & System) 0x804D7000 PnpManager 2179328 bytes 0x804D7000 RAW 2179328 bytes 0x804D7000 WMIxWDM 2179328 bytes 0xBF800000 Win32k 1843200 bytes 0xBF800000 C:\WINDOWS\System32\win32k.sys 1843200 bytes (Microsoft Corporation, Multi-User Win32 Driver) 0xF7515000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver) 0xF3FF1000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 454656 bytes (Microsoft Corporation, Windows NT SMB Minirdr) 0xBF9D4000 C:\WINDOWS\System32\ati2dvaa.dll 380928 bytes (ATI Technologies Inc., ATI RAGE 128 WindowsNT Display Driver) 0xF40D5000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 360448 bytes (Microsoft Corporation, TCP/IP Protocol Driver) 0xF33E9000 C:\WINDOWS\system32\DRIVERS\srv.sys 335872 bytes (Microsoft Corporation, Server driver) 0xF7424000 C:\WINDOWS\system32\DRIVERS\ati2mtaa.sys 327680 bytes (ATI Technologies Inc., ATI RAGE 128 Miniport Driver) 0xF73CF000 C:\WINDOWS\system32\DRIVERS\bcmwl5.sys 266240 bytes (Broadcom Corporation, Broadcom Corporation NDIS 5.0 wireless driver) 0xF3463000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack) 0xF71C8000 C:\WINDOWS\system32\DRIVERS\update.sys 212992 bytes (Microsoft Corporation, Update Driver) 0xF7224000 C:\WINDOWS\system32\DRIVERS\rdpdr.sys 200704 bytes (Microsoft Corporation, Microsoft RDP Device redirector) 0xF765A000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT) 0xF34CC000 C:\WINDOWS\system32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr) 0xF74E8000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver) 0xF2E23000 C:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer) 0xF4060000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver) 0xF40AD000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver) 0xF7604000 dmio.sys 155648 bytes (Microsoft Corp., Veritas Software, NT Disk Manager I/O Driver) 0xF731D000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices)) 0xF2E4E000 C:\WINDOWS\System32\Drivers\Fastfat.SYS 143360 bytes (Microsoft Corporation, Fast FAT File System Driver) 0xF737C000 C:\WINDOWS\system32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library) 0xF7359000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 143360 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver) 0xF408B000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock) 0xF3FD0000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 135168 bytes (Microsoft Corporation, IP Network Address Translator) 0x806EC000 ACPI_HAL 131968 bytes 0x806EC000 C:\WINDOWS\system32\hal.dll 131968 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL) 0xF75CC000 fltMgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager) 0xF762A000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver) 0xF74CD000 Mup.sys 110592 bytes (Microsoft Corporation, Multiple UNC Provider driver) 0xF7341000 C:\WINDOWS\system32\drivers\ac97intc.sys 98304 bytes (Intel Corporation, Intel® Integrated Controller Hub Audio Driver) 0xF75EC000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver) 0xF75B5000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface) 0xF7266000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption)) 0xF37A7000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper) 0xF739F000 C:\WINDOWS\system32\DRIVERS\parport.sys 81920 bytes (Microsoft Corporation, Parallel Port Driver) 0xF7410000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver) 0xF412D000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver) 0xF75A2000 WudfPf.sys 77824 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Platform Driver) 0xBF9C2000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver) 0xF7649000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator) 0xF7255000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler) 0xF72BD000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver) 0xF7789000 C:\WINDOWS\system32\DRIVERS\nic1394.sys 65536 bytes (Microsoft Corporation, IEEE1394 Ndis Miniport and Call Manager) 0xF78C9000 C:\WINDOWS\system32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver) 0xF72DD000 C:\WINDOWS\system32\DRIVERS\arp1394.sys 61440 bytes (Microsoft Corporation, IP/1394 Arp Client) 0xF7909000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter) 0xF7729000 Lbd.sys 61440 bytes (Lavasoft AB, Boot Driver) 0xF76B9000 ohci1394.sys 61440 bytes (Microsoft Corporation, 1394 OpenHCI Port Driver) 0xF78F9000 C:\WINDOWS\system32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver) 0xF77F9000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter) 0xF7889000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB) 0xF76C9000 C:\WINDOWS\system32\DRIVERS\1394BUS.SYS 53248 bytes (Microsoft Corporation, 1394 Bus Device Driver) 0xF78E9000 C:\WINDOWS\system32\DRIVERS\cdrom.sys 53248 bytes (Microsoft Corporation, SCSI CD-ROM Driver) 0xF7719000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll) 0xF78B9000 C:\WINDOWS\system32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver) 0xF7919000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver) 0xF76F9000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver) 0xF7799000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol) 0xF7749000 agp440.sys 45056 bytes (Microsoft Corporation, 440 NT AGP Filter) 0xF78D9000 C:\WINDOWS\system32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver) 0xF76D9000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager) 0xF7769000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver) 0xF76E9000 sbp2port.sys 45056 bytes (Microsoft Corporation, SBP-2 Protocol Driver) 0xF7879000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy) 0xF7739000 PxHelp20.sys 40960 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP) 0xF77E9000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes 0xF7709000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver) 0xF72FD000 C:\WINDOWS\System32\Drivers\Fips.SYS 36864 bytes (Microsoft Corporation, FIPS Crypto Driver) 0xF72AD000 C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library) 0xF76A9000 isapnp.sys 36864 bytes (Microsoft Corporation, PNP ISA Bus Driver) 0xF77A9000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier) 0xF730D000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver) 0xF34F9000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver) 0xF78A9000 C:\WINDOWS\system32\DRIVERS\processr.sys 36864 bytes (Microsoft Corporation, Processor Device Driver) 0xF72ED000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver) 0xF7A69000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver) 0xF79A9000 C:\WINDOWS\system32\DRIVERS\fdc.sys 28672 bytes (Microsoft Corporation, Floppy Disk Controller Driver) 0xF79B9000 C:\WINDOWS\SYSTEM32\DRIVERS\GEARAspiWDM.sys 28672 bytes (GEAR Software Inc., CDRom Class Filter Driver) 0xF7A79000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library) 0xF7929000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension) 0xF79B1000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver) 0xF79F9000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver) 0xF7A59000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver) 0xF7A49000 C:\WINDOWS\system32\DRIVERS\flpydisk.sys 20480 bytes (Microsoft Corporation, Floppy Driver) 0xF7A61000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver) 0xF7931000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager) 0xF79E9000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library) 0xF79F1000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel® mini-port/call-manager driver) 0xF79C9000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper) 0xF79C1000 C:\WINDOWS\system32\DRIVERS\usbuhci.sys 20480 bytes (Microsoft Corporation, UHCI USB Miniport Driver) 0xF7A89000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver) 0xF7B71000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver) 0xF39DC000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver) 0xF7B41000 C:\WINDOWS\system32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator) 0xF7AB9000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver) 0xF7488000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver) 0xF7BA5000 C:\WINDOWS\system32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices) 0xF7498000 C:\WINDOWS\system32\DRIVERS\mouhid.sys 12288 bytes (Microsoft Corporation, HID Mouse Filter Driver) 0xF7B49000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver) 0xF7200000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver) 0xF7C2F000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver) 0xF7BAF000 dmload.sys 8192 bytes (Microsoft Corp., Veritas Software., NT Disk Manager Startup Driver) 0xF7C2D000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver) 0xF7BAD000 intelide.sys 8192 bytes (Microsoft Corporation, Intel PCI IDE Driver) 0xF7BA9000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL) 0xF7C31000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator) 0xF7C63000 C:\WINDOWS\System32\Drivers\ParVdm.SYS 8192 bytes (Microsoft Corporation, VDM Parallel Driver) 0xF7C33000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport) 0xF7BC9000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator) 0xF7C2B000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver) 0xF7BAB000 C:\WINDOWS\system32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll) 0xF7CCE000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver) 0xF7C74000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk) 0xF7CDD000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver) !!!!!!!!!!!Hidden driver: 0x827DDAEA ?_empty_? 1302 bytes 0x827DDEC5 unknown_irp_handler 315 bytes !!!!!!!!!!!Hidden driver: 0x82948B10 ?_empty_? 0 bytes ============================================== >Stealth ============================================== 0xF75EC000 WARNING: suspicious driver modification [atapi.sys::0x827DDAEA] 0xF77E9000 WARNING: Virus alike driver modification [termdd.sys], 40960 bytes Once again, I appreciate your help and time. Jay
Post #5
Hi,

Please do the following:

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
Post #6
Combofix won't load. I downloaded it from both links. This was part of the original problem that lead me to believe there was something malicious on my comp. Suggestions? Thanks, Jay
Post #7
do you have access to another computer where you can download it to a USB then run it from the USB?

when you say it wont load, do you mean that you can't save it from your computer or you can save it, but when you try and run it, nothing happens?

If that is the case, delete the copy you have on your desktop and download a fresh copy but rename it to svchost.exe before saving it and try it again
Post #8
Yes, when I try to run it nothing happens. I saved as the svchost.exe and that worked, very smart! I will let you know how it goes. Thanks, Jay
Post #10
Here is the log:

ComboFix 10-10-22.05 - Jay C 10/23/2010 15:20:25.3.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.383.219 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\DRIVERS\termdd.sys . . . is infected!! . . . Failed to find a valid replacement.
Infected copy of c:\windows\system32\imm32.dll was found and disinfected
Restored copy from - c:\windows\ERDNT\cache\imm32.dll

.
((((((((((((((((((((((((( Files Created from 2010-09-23 to 2010-10-23 )))))))))))))))))))))))))))))))
.

2010-10-03 00:56 . 2010-10-03 00:56 ——– d-sh–w- c:\documents and settings\Public\IECompatCache
2010-10-03 00:53 . 2010-10-03 00:53 ——– d—–w- c:\documents and settings\Public\Application Data\Malwarebytes

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-22 20:38 . 2010-09-22 20:39 1198163 —-a-w- c:\windows\system32\unins000.exe
2010-09-14 02:12 . 2010-09-14 02:12 1409 —-a-w- c:\windows\QTFont.for
2010-09-08 14:46 . 2010-09-22 20:39 880220 —-a-w- c:\windows\system32\xvidcore.dll
2010-09-08 14:46 . 2010-09-22 20:39 324096 —-a-w- c:\windows\system32\TomsMoComp_ff.dll
2010-09-08 14:46 . 2010-09-22 20:39 248320 —-a-w- c:\windows\system32\ff_kernelDeint.dll
2010-09-08 14:46 . 2010-09-22 20:39 145408 —-a-w- c:\windows\system32\libmpeg2_ff.dll
2010-09-08 14:46 . 2010-09-22 20:39 97792 —-a-w- c:\windows\system32\ff_unrar.dll
2010-09-08 14:46 . 2010-09-22 20:39 336384 —-a-w- c:\windows\system32\ff_libfaad2.dll
2010-09-08 14:46 . 2010-09-22 20:39 216576 —-a-w- c:\windows\system32\ff_libdts.dll
2010-09-08 14:46 . 2010-09-22 20:39 1529856 —-a-w- c:\windows\system32\ff_samplerate.dll
2010-09-08 14:46 . 2010-09-22 20:39 151552 —-a-w- c:\windows\system32\ff_libmad.dll
2010-09-08 14:46 . 2010-09-22 20:39 121856 —-a-w- c:\windows\system32\ff_liba52.dll
2010-09-08 14:46 . 2010-09-22 20:39 1212665 —-a-w- c:\windows\system32\ffmpegmt.dll
2010-09-08 14:46 . 2010-09-22 20:39 116736 —-a-w- c:\windows\system32\ff_tremor.dll
2010-09-08 14:46 . 2008-12-19 16:26 3849216 —-a-w- c:\windows\system32\ffdshow.ax
2010-09-08 14:46 . 2008-12-19 15:15 4497993 —-a-w- c:\windows\system32\libavcodec.dll
2010-09-08 14:46 . 2008-12-17 17:41 903723 —-a-w- c:\windows\system32\ff_x264.dll
2010-09-08 14:46 . 2008-12-17 16:59 142291 —-a-w- c:\windows\system32\libmplayer.dll
2010-09-08 13:45 . 2008-12-17 17:22 100864 —-a-w- c:\windows\system32\ff_wmv9.dll
2010-09-08 13:09 . 2008-12-17 17:22 108032 —-a-w- c:\windows\system32\ff_vfw.dll
2010-08-12 04:07 . 2007-09-22 20:41 126448 ——w- c:\windows\system32\pxinsi64.exe
2010-08-12 04:07 . 2007-09-22 20:41 123888 ——w- c:\windows\system32\pxcpyi64.exe
2010-08-12 04:07 . 2007-09-22 20:41 133616 ——w- c:\windows\system32\pxafs.dll
2010-08-12 04:07 . 2006-09-27 21:53 45648 ——w- c:\windows\system32\drivers\pxhelp20.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-08-16 413696]
"Malwarebytes Anti-Malware (rootkit-scan)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-01 1164584]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ad-Watch]
2009-12-20 00:09 520024 —-a-w- c:\program files\Lavasoft\Ad-Aware\AAWTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-12 13:18 15360 —-a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-08-16 22:04 413696 —-a-w- c:\program files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-06-24 00:42 148888 —-a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ewido security suite control"=2 (0x2)
"YahooAUService"=2 (0x2)
"ose"=3 (0x3)
"Lavasoft Ad-Aware Service"=3 (0x3)
"IDriverT"=3 (0x3)
"gusvc"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

R3 inibtmgr;WD Bridge Controller Driver;c:\windows\system32\DRIVERS\inibtmgr.sys [2003-12-08 9728]
R4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-12-20 1028432]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-05-05 64160]


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 08:32 128512 —-a-w- c:\windows\system32\advpack.dll
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride =
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-10-23 15:36
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8275DEC5]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf771dfc3
\Driver\ACPI -> ACPI.sys @ 0xf7660cb8
\Driver\atapi -> atapi.sys @ 0xf75f27b4
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x8059c876
ParseProcedure -> ntoskrnl.exe @ 0x8057016c
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x8059c876
ParseProcedure -> ntoskrnl.exe @ 0x8057016c
NDIS: Wireless-G PCI Adapter -> SendCompleteHandler -> NDIS.sys @ 0xf74ebba0
PacketIndicateHandler -> NDIS.sys @ 0xf74f8b21
SendHandler -> NDIS.sys @ 0xf74d687b
user & kernel MBR OK

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(3228)
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
———————— Other Running Processes ————————
.
c:\program files\Java\jre6\bin\jqs.exe
c:\progra~1\Dantz\RETROS~1\retrorun.exe
c:\progra~1\Dantz\RETROS~1\wdsvc.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-10-23 15:44:25 - machine was rebooted
ComboFix-quarantined-files.txt 2010-10-23 19:43
ComboFix2.txt 2010-08-02 20:51

Pre-Run: 11,615,338,496 bytes free
Post-Run: 11,992,322,048 bytes free

- - End Of File - - D6FF5AEACF20F03C8A9E73B8C38F09D0
Post #11
Please do the following:


Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:

    :filefind
*termdd*
  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
Post #12
Here is the log: SystemLook 04.09.10 by jpshortstuff Log created at 16:45 on 23/10/2010 by Jay C Administrator - Elevation successful ========== filefind ========== Searching for "*termdd*" C:\WINDOWS\system32\drivers\termdd.sys –a—- 40840 bytes [02:21 28/06/2005] [05:01 04/08/2004] AD537577295F149B910ADABF043216A7 -= EOF =-
Post #13
OK

that is the only one on the machine and it's infected, so we need to get a replacement

Do you have your installation disk or access to another machine with the exact same OS as this one where we can get it from?

If not

download Service Pack 3

you will need to upgrade to that anyway as SP2 is no longer supported.

download SP3 to your desktop (don't install it just yet, till you advise me if you have access to that file elsewhere)

Windows XP Service Pack 3 Network Installation Package for IT Professionals and Developers
Post #15 last edited
I want to replace that infected file first, so that there is more chance of a successful installation of SP3

please do the following:

If you didn't download the installer directly to the C:\ drive, please move it there

Double click the installer and it will begin extracting it's files. (Note the folder it extracts to- it will be an alph-numeric named folder)

Once fully extracted, leave the setup screen sit, then browse to the folder the package extracted to.

The files will be in the i386 subfolder of the alpha-numeric folder, and they are compressed.


NEXT

Locate termdd.sy_ > right click the file > copy > then paste it into your c:\ drive



Next, please do the following:

Go to start > run type cmd OK

this will open a command window:

please copy/paste the following into the command window:

expand -r c:\termdd.sy_ c:\windows\system32\dllcache\termdd.sys

you should get a message "expanded to {xxxxxx} bytes, {xx}% increase"

type exit to leave the command window.

If the message is successful, then go ahead and continue with the installation of SP3


let me know how that goes

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI