What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

iexplore.exe suspected of browser hijacking - highjackthis log include

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
First of all I would like to thank anyone and everyone in advance for assisting.

My experience level: I have been an I.T. professional at a small college for 6 months now and students come in all the time infected with malware. I mainly look after the network infrastructure but from time to time I clean up some infected computers. The main problem with the students computers seems to be outdated antivirus and file-sharing programs.

My current project is a friends dell laptop running Win XP that had 2 outdated antivirus programs installed, 2 file-sharing programs installed, and multiple toolbars installed. She was infected with malware called Memory Fixer which I thought I was able to remove successfully but either something remains or there is a 2nd infection.

So now she has 2 iexplore.exe tasks running even when there is no browser open. The problem is browser highjacking/redirecting. If I use a search agent (i.e. google) from the toolbar to search for anything on the web then the page with the search results shows up fine. If I click a link on the page with the search results then the browser goes to a page that is not the intended page. If I kill the 2 questionable iexplore.exe processes just before clicking the link then the browser goes to the intended page.

I have done a lot of research on this and there seems to be alot of opinions out there about similar problems. I began cleaning the computer by removing the 2 outdated anti-virus programs, removing toolbars, running rkill and then malware bytes in safe mode. I installed Microsoft Secuirty Essentails and scanned with no problems found. I unistalled microsoft security essentials and then installed Comodo Anti-virus - found a couple of things but the problems remains. The hijackthis log is included below. Any assistance will be greatly appreciated.


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 3:09:53 PM, on 1/21/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\COMODO Internet Security\cfp.exe" -h
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…cab?129553269...
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0…oUploader55.cab
O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://picture.vzw.com/activex/VerizonWire…loadControl.cab
O16 - DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader2.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Microsoft Antimalware Service (MsMpSvc) - Unknown owner - c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (file missing)
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

–
End of file - 6021 bytes
Post #2
Hi,

:welcome:

My name is NoodleTech. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.
As I'm still in training at What The Tech, all my posts needs to be checked by an expert first. This may cause a delay, but I will do my best to keep it as short as possible.
Post #3
Hi kor0000,

Please do the following.

Please download DDS by sUBs from one of the following links and save it to your desktop.
    • DDS.scr
    • DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scrolling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.
===================================================

Scan With RootKitUnHooker

  • Please choose one link and download Rootkit Unhooker and save it to your desktop.
    Link 1
    Link 2
    Link 3
  • Now double-click on RKUnhookerLE.exe to run it.
  • Click the Report tab, then click Scan.
  • Check (Tick) Drivers and Stealth
  • Uncheck the rest. then click OK
  • When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
  • Wait till the scanner has finished and then click File > Save Report.
  • Save the report somewhere where you can find it. Click Close.
  • Copy the entire contents of the report and paste it in your next reply.

Note** you may get the following warning, just click OK and continue.

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

===================================================

Please download MBRCheck.exe to your desktop.
  • Be sure to disable your security programs
  • Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
  • A window will open on your desktop
  • if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
  • If nothing unusual is found just press Enter
  • A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
  • Please post the contents of that file.
===================================================

In your next reply, please post:
  • DDS log
  • Attach log
  • Rootkit Unhooker Log
  • MBRCheck Log
Post #4
Thanks for the assistance. I will follow your instructions first thing Monday morn when I get back to the computer and then post the requested logs.
Post #6
DDS log below DDS (Ver_10-12-12.02) - NTFSx86 Run by [removed] at 8:45:54.65 on Mon 01/24/2011 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_15 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.446.202 [GMT -5:00] AV: COMODO Antivirus *Disabled/Updated* {043803A5-4F86-4ef7-AFC5-F6E02A79969B} ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe C:\WINDOWS\system32\svchost.exe -k netsvcs svchost.exe C:\WINDOWS\system32\Ati2evxx.exe svchost.exe C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe C:\WINDOWS\System32\svchost.exe -k Akamai C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Java\jre6\bin\jqs.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\WLTRAY.exe C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe C:\Program Files\COMODO\COMODO Internet Security\cfp.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wscntfy.exe C:\Documents and Settings\Stephanie\Desktop\dds.scr ============== Pseudo HJT Report =============== BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe mRun: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\CLIStart.exe" mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\cfp.exe" -h IE: E&xport; to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1295532697546 DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} - hxxp://picture.vzw.com/activex/VerizonWirelessUploadControl.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} - hxxp://lads.myspace.com/upload/MySpaceUploader2.cab DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab Notify: AtiExtEvent - Ati2evxx.dll AppInit_DLLs: c:\windows\system32\guard32.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\stepha~1\applic~1\mozilla\firefox\profiles\1wkjvfk7.default\ FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} FF - Ext: Java Quick Starter: [removed] - c:\program files\java\jre6\lib\deploy\jqs\ff ============= SERVICES / DRIVERS =============== R0 atiide;atiide;c:\windows\system32\drivers\atiide.sys [2009-9-17 3456] R1 cmderd;COMODO Internet Security Eradication Driver;c:\windows\system32\drivers\cmderd.sys [2011-1-6 15592] R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [2011-1-6 239368] R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2008-4-14 14336] R2 cmdAgent;COMODO Internet Security Helper Service;c:\program files\comodo\comodo internet security\cmdagent.exe [2011-1-17 1803224] S1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\mpfilter.sys –> c:\windows\system32\drivers\MpFilter.sys [?] =============== Created Last 30 ================ 2011-01-21 20:09:05 388096 —-a-r- c:\docume~1\stepha~1\applic~1\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe 2011-01-21 17:59:44 ——– d–h–w- c:\windows\system32\GroupPolicy 2011-01-21 16:32:40 ——– d—–w- c:\windows\pss 2011-01-21 13:59:18 ——– d–h–w- C:\VritualRoot 2011-01-21 13:57:40 618081 —-a-w- c:\windows\system32\drivers\sfi.dat 2011-01-21 13:34:48 ——– d—–w- c:\docume~1\alluse~1\applic~1\Comodo 2011-01-21 13:34:42 ——– d—–w- c:\program files\COMODO 2011-01-21 13:34:41 1700352 —-a-w- c:\windows\system32\gdiplus.dll 2011-01-21 12:56:38 ——– d—–w- c:\windows\SQL9_KB970892_ENU 2011-01-20 20:49:11 ——– d—–w- c:\program files\Trend Micro 2011-01-20 20:27:15 ——– d—–w- c:\program files\CCleaner 2011-01-20 20:12:18 89088 —-a-w- c:\windows\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll 2011-01-20 20:11:54 89088 -c—-w- c:\windows\system32\dllcache\filterpipelineprintproc.dll 2011-01-20 20:11:54 597504 -c—-w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe 2011-01-20 20:11:54 597504 ——w- c:\windows\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe 2011-01-20 20:11:54 575488 -c—-w- c:\windows\system32\dllcache\xpsshhdr.dll 2011-01-20 20:11:54 575488 ——w- c:\windows\system32\xpsshhdr.dll 2011-01-20 20:11:54 117760 ——w- c:\windows\system32\prntvpt.dll 2011-01-20 20:11:53 1676288 -c—-w- c:\windows\system32\dllcache\xpssvcs.dll 2011-01-20 20:11:53 1676288 ——w- c:\windows\system32\xpssvcs.dll 2011-01-20 20:11:52 ——– d—–w- C:\6a40ca2892629626c7c2b4 2011-01-20 19:48:57 ——– d-sh–w- c:\documents and settings\stephanie\PrivacIE 2011-01-20 19:48:48 ——– d—–w- C:\2b4c57dcf272092d6864d8ad 2011-01-20 19:48:40 ——– d—–w- C:\e31042ab64406dec4dee3dff 2011-01-20 19:41:38 ——– d-sh–w- c:\documents and settings\stephanie\IETldCache 2011-01-20 19:34:32 7680 -c—-w- c:\windows\system32\dllcache\iecompat.dll 2011-01-20 19:32:40 ——– d—–w- c:\windows\ie8updates 2011-01-20 19:31:40 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll 2011-01-20 19:31:37 55296 -c—-w- c:\windows\system32\dllcache\msfeedsbs.dll 2011-01-20 19:31:36 602112 -c—-w- c:\windows\system32\dllcache\msfeeds.dll 2011-01-20 19:31:34 247808 -c—-w- c:\windows\system32\dllcache\ieproxy.dll 2011-01-20 19:31:34 1991680 -c—-w- c:\windows\system32\dllcache\iertutil.dll 2011-01-20 19:31:32 743424 -c—-w- c:\windows\system32\dllcache\iedvtool.dll 2011-01-20 19:31:32 11080704 -c—-w- c:\windows\system32\dllcache\ieframe.dll 2011-01-20 19:28:45 ——– dc-h–w- c:\windows\ie8 2011-01-20 18:14:37 ——– d—–w- c:\program files\MSXML 6.0 2011-01-20 16:39:26 ——– d—–w- c:\program files\MB 2011-01-20 16:04:24 553696 —-a-w- c:\program files\mozilla firefox\uninstall\helper.exe 2011-01-20 16:04:21 912344 —-a-w- c:\program files\mozilla firefox\firefox.exe 2011-01-20 16:04:21 719832 —-a-w- c:\program files\mozilla firefox\mozcpp19.dll 2011-01-20 16:04:21 16856 —-a-w- c:\program files\mozilla firefox\plugin-container.exe 2011-01-20 14:59:17 272128 -c—-w- c:\windows\system32\dllcache\bthport.sys 2011-01-20 14:59:17 272128 ——w- c:\windows\system32\drivers\bthport.sys 2011-01-20 14:53:03 455680 -c—-w- c:\windows\system32\dllcache\mrxsmb.sys 2011-01-20 14:48:32 16736 —-a-w- c:\windows\system32\mucltui.dll.mui 2011-01-20 14:48:31 274288 —-a-w- c:\windows\system32\mucltui.dll 2011-01-20 14:14:31 5120 —-a-w- c:\windows\system32\xpsp4res.dll 2011-01-19 19:49:09 ——– d—–w- c:\windows\system32\PreInstall 2011-01-19 19:49:08 26144 —-a-w- c:\windows\system32\spupdsvc.exe 2011-01-19 19:49:07 ——– d–h–w- c:\windows\$hf_mig$ 2011-01-19 17:16:29 222080 ——w- c:\windows\system32\MpSigStub.exe 2011-01-19 17:07:00 ——– d—–w- c:\windows\system32\SoftwareDistribution 2011-01-19 15:14:13 ——– d—–w- c:\docume~1\stepha~1\applic~1\Malwarebytes 2011-01-19 14:56:12 ——– d—–w- c:\docume~1\alluse~1\applic~1\Malwarebytes 2011-01-19 14:56:08 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware 2011-01-06 22:37:04 27576 —-a-w- c:\windows\system32\drivers\cmdhlp.sys 2011-01-06 22:37:02 239368 —-a-w- c:\windows\system32\drivers\cmdGuard.sys 2011-01-06 22:37:02 15592 —-a-w- c:\windows\system32\drivers\cmderd.sys 2011-01-06 01:55:03 ——– d—–w- c:\windows\system32\appmgmt 2011-01-06 01:13:41 53248 —-a-w- c:\windows\system32\drivers\sst10A.sys 2011-01-06 01:13:41 0 —-a-w- c:\windows\system32\drivers\sst10A.tmp 2010-12-30 04:58:42 5632 —-a-w- c:\windows\system32\ptpusb.dll 2010-12-30 04:58:41 159232 —-a-w- c:\windows\system32\ptpusd.dll 2010-12-30 04:58:39 15104 -c–a-w- c:\windows\system32\dllcache\usbscan.sys 2010-12-30 04:58:39 15104 —-a-w- c:\windows\system32\drivers\usbscan.sys 2010-12-30 03:57:45 ——– d—–w- c:\docume~1\stepha~1\applic~1\FrostWire 2010-12-30 03:57:31 ——– d—–w- c:\docume~1\stepha~1\locals~1\applic~1\OpenCandy 2010-12-30 03:56:44 ——– d—–w- c:\docume~1\stepha~1\applic~1\OpenCandy 2010-12-29 06:42:04 285480 —-a-w- c:\windows\system32\guard32.dll ==================== Find3M ==================== 2010-11-18 18:12:44 81920 —-a-w- c:\windows\system32\isign32.dll 2010-11-09 14:52:35 249856 —-a-w- c:\windows\system32\odbc32.dll 2010-11-06 00:26:58 916480 —-a-w- c:\windows\system32\wininet.dll 2010-11-06 00:26:58 43520 ——w- c:\windows\system32\licmgr10.dll 2010-11-06 00:26:58 1469440 ——w- c:\windows\system32\inetcpl.cpl 2010-11-03 12:25:54 385024 ——w- c:\windows\system32\html.iec 2010-10-28 13:13:22 290048 —-a-w- c:\windows\system32\atmfd.dll ============= FINISH: 8:53:19.04 =============== ————————————————————————————————————————————————————————————————— RootkitReport Below: RkU Version: 3.8.388.590, Type LE (SR2) ============================================== OS Name: Windows XP Version 5.1.2600 (Service Pack 3) Number of processors #1 ============================================== >Drivers ============================================== 0xBF0E3000 C:\WINDOWS\System32\ati3duag.dll 2519040 bytes (ATI Technologies Inc. , ati3duag.dll) 0x804D7000 C:\WINDOWS\system32\ntkrnlpa.exe 2065792 bytes (Microsoft Corporation, NT Kernel & System) 0x804D7000 PnpManager 2065792 bytes 0x804D7000 RAW 2065792 bytes 0x804D7000 WMIxWDM 2065792 bytes 0xBF800000 Win32k 1855488 bytes 0xBF800000 C:\WINDOWS\System32\win32k.sys 1855488 bytes (Microsoft Corporation, Multi-User Win32 Driver) 0xF64E2000 C:\WINDOWS\system32\DRIVERS\ati2mtag.sys 1847296 bytes (ATI Technologies Inc., ATI Radeon WindowsNT Miniport Driver) 0xEE570000 C:\WINDOWS\system32\drivers\sthda.sys 1171456 bytes (SigmaTel, Inc., NDRC) 0xBF34A000 C:\WINDOWS\System32\ativvaxx.dll 1093632 bytes (ATI Technologies Inc. , Radeon Video Acceleration Universal Driver) 0xEF9F9000 C:\WINDOWS\system32\DRIVERS\HSX_DPV.sys 1011712 bytes (Conexant Systems, Inc., HSF_DP driver) 0xEF943000 C:\WINDOWS\system32\DRIVERS\HSX_CNXT.sys 745472 bytes (Conexant Systems, Inc., HSF_CNXT driver) 0xF643A000 C:\WINDOWS\system32\DRIVERS\bcmwl5.sys 606208 bytes (Broadcom Corporation, Broadcom 802.11 Network Adapter wireless driver) 0xF722B000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver) 0xEE007000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr) 0xF5F9A000 C:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver) 0xEE0EC000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver) 0xB85EB000 C:\WINDOWS\system32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver) 0xBF055000 C:\WINDOWS\System32\ati2cqag.dll 294912 bytes (ATI Technologies Inc., Central Memory Manager / Queue Server Module) 0xBFFA0000 C:\WINDOWS\System32\ATMFD.DLL 290816 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver) 0xBF09D000 C:\WINDOWS\System32\atikvmag.dll 286720 bytes (ATI Technologies Inc., Virtual Command And Memory Manager) 0xBF012000 C:\WINDOWS\System32\ati2dvag.dll 274432 bytes (ATI Technologies Inc., ATI Radeon WindowsNT Display Driver) 0xB7E87000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack) 0xEFAF0000 C:\WINDOWS\system32\DRIVERS\HSXHWAZL.sys 237568 bytes (Conexant Systems, Inc., HSF_HWAZL WDM driver) 0xEE178000 C:\WINDOWS\System32\DRIVERS\cmdguard.sys 233472 bytes (COMODO, COMODO Internet Security Sandbox Driver) 0xF6382000 C:\WINDOWS\system32\DRIVERS\rdpdr.sys 196608 bytes (Microsoft Corporation, Microsoft RDP Device redirector) 0xF736F000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT) 0xB86BB000 C:\WINDOWS\system32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr) 0xF71FE000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver) 0xB627E000 C:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer) 0xEE077000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver) 0xF63EE000 C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 163840 bytes (Windows ® Server 2003 DDK provider, High Definition Audio Bus Driver v1.0a) 0xEE0C4000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver) 0xF7319000 dmio.sys 155648 bytes (Microsoft Corp., Veritas Software, NT Disk Manager I/O Driver) 0xEDFE1000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator) 0xB625A000 C:\WINDOWS\System32\Drivers\Fastfat.SYS 147456 bytes (Microsoft Corporation, Fast FAT File System Driver) 0xEE54C000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices)) 0xF6416000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver) 0xF635F000 C:\WINDOWS\system32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library) 0xEE0A2000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock) 0x806D0000 ACPI_HAL 131840 bytes 0x806D0000 C:\WINDOWS\system32\hal.dll 131840 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL) 0xF72E1000 fltMgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager) 0xF733F000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver) 0xF71E4000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver) 0xF7301000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver) 0xEB183000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes 0xF72B8000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface) 0xF63C3000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption)) 0xB82B6000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper) 0xF63DA000 C:\WINDOWS\system32\DRIVERS\sdbus.sys 81920 bytes (Microsoft Corporation, SecureDigital Bus Driver) 0xF64CE000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver) 0xEE145000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver) 0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver) 0xF72CF000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver) 0xF735E000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator) 0xF63B2000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler) 0xF769E000 C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys 65536 bytes (Broadcom Corporation, Broadcom Corporation NDIS 5.1 ethernet driver) 0xEED87000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter) 0xEBC9F000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter) 0xF66D5000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB) 0xF767E000 C:\WINDOWS\system32\DRIVERS\AmdK8.sys 57344 bytes (Advanced Micro Devices, AMD Processor Driver) 0xF76AE000 C:\WINDOWS\system32\DRIVERS\rimmptsk.sys 57344 bytes (REDC, RICOH MMC Driver) 0xF74DE000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll) 0xF768E000 C:\WINDOWS\system32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver) 0xF76BE000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver) 0xF74BE000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver) 0xF76DE000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol) 0xF66E5000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver) 0xF74AE000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager) 0xF76CE000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver) 0xF749E000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver) 0xF6725000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy) 0xF75AE000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver) 0xF74CE000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver) 0xF76FE000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier) 0xEED37000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver) 0xB7B17000 C:\WINDOWS\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver) 0xF757E000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver) 0xF7866000 C:\WINDOWS\System32\Drivers\Modem.SYS 32768 bytes (Microsoft Corporation, Modem Device Driver) 0xEF054000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver) 0xF77B6000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver) 0xF7796000 C:\DOCUME~1\STEPHA~1\LOCALS~1\Temp\mbr.sys 28672 bytes 0xF771E000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension) 0xF77BE000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver) 0xF77C6000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver) 0xEF064000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver) 0xEF05C000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver) 0xF7726000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager) 0xF77D6000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library) 0xF77DE000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel® mini-port/call-manager driver) 0xF77CE000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper) 0xF77AE000 C:\WINDOWS\system32\DRIVERS\usbohci.sys 20480 bytes (Microsoft Corporation, OHCI USB Miniport Driver) 0xEBDB5000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver) 0xF78B6000 C:\WINDOWS\system32\DRIVERS\BATTC.SYS 16384 bytes (Microsoft Corporation, Battery Class Driver) 0xF71B4000 C:\WINDOWS\system32\DRIVERS\CmBatt.sys 16384 bytes (Microsoft Corporation, Control Method Battery Driver) 0xB87CC000 C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys 16384 bytes (Conexant, Diagnostic Interface DRIVER) 0xF6CCE000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver) 0xEC6AC000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver) 0xF78BA000 ACPIEC.sys 12288 bytes (Microsoft Corporation, ACPI Embedded Controller Driver) 0xF78AE000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver) 0xEF5E2000 C:\WINDOWS\System32\DRIVERS\cmderd.sys 12288 bytes (COMODO, COMODO Internet Security Eradication Driver) 0xF78B2000 compbatt.sys 12288 bytes (Microsoft Corporation, Composite Battery Driver) 0xEBB33000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver) 0xF71B0000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver) 0xF7966000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver) 0xF7A5E000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver) 0xF79A2000 dmload.sys 8192 bytes (Microsoft Corp., Veritas Software., NT Disk Manager Startup Driver) 0xF79FA000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes 0xF7A5C000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver) 0xF799E000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL) 0xF7A60000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator) 0xF7A62000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport) 0xF79D4000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator) 0xF79D8000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver) 0xF79A0000 C:\WINDOWS\system32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll) 0xF7A68000 atiide.sys 4096 bytes (ATI Technologies Inc., ATI SATA(IDE Mode) Controller Driver) 0xF7B2A000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver) 0xEB1A4000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk) 0xF7B65000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver) 0xF7A67000 C:\WINDOWS\system32\DRIVERS\OPRGHDLR.SYS 4096 bytes (Microsoft Corporation, ACPI Operation Registration Driver) 0xF7A66000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver) ============================================== >Stealth ============================================== 0x03A00000 Hidden Image–>CLI.Aspect.DeviceCV.Graphics.Wizard.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 1241088 bytes 0x03C60000 Hidden Image–>CLI.Aspect.DeviceCV2.Graphics.Wizard.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 1241088 bytes 0x046E0000 Hidden Image–>CLI.Aspect.Radeon3D.Graphics.Wizard.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 135168 bytes 0x03FE0000 Hidden Image–>CLI.Aspect.DeviceTV2.Graphics.Wizard.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 159744 bytes 0x03F80000 Hidden Image–>CLI.Aspect.DeviceTV.Graphics.Wizard.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 159744 bytes 0x04460000 Hidden Image–>CLI.Aspect.DisplaysManager.Graphics.Wizard.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 2379776 bytes 0x03AF0000 Hidden Image–>CLI.Aspect.IntegratedUMAFrameBuffer.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 28672 bytes 0x03650000 Hidden Image–>ATICCCom.dll [ EPROCESS 0x844764B0 ] PID: 2476, 28672 bytes 0x032D0000 Hidden Image–>LOG.Foundation.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 28672 bytes 0x03870000 Hidden Image–>DEM.Foundation.dll [ EPROCESS 0x844764B0 ] PID: 2476, 28672 bytes 0x04500000 Hidden Image–>ACE.Graphics.VideoOverlay.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 28672 bytes 0x04A40000 Hidden Image–>CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll [ EPROCESS 0x844764B0 ] PID: 2476, 28672 bytes 0x049E0000 Hidden Image–>CLI.Aspect.IntegratedUMAFrameBuffer.Graphics.Runtime.dll [ EPROCESS 0x844764B0 ] PID: 2476, 28672 bytes 0x04A60000 Hidden Image–>CLI.Aspect.HotkeysHandling.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 28672 bytes 0x04DB0000 Hidden Image–>CLI.Aspect.OverDrive2.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 28672 bytes 0x04C30000 Hidden Image–>DEM.Graphics.I0600.dll [ EPROCESS 0x844764B0 ] PID: 2476, 28672 bytes 0x04C90000 Hidden Image–>DEM.Graphics.I0602.dll [ EPROCESS 0x844764B0 ] PID: 2476, 28672 bytes 0x04CB0000 Hidden Image–>CLI.Aspect.DeviceProperty.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 28672 bytes 0x04CE0000 Hidden Image–>CLI.Aspect.DeviceProperty2.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 28672 bytes 0x032D0000 Hidden Image–>LOG.Foundation.Shared.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 28672 bytes 0x037E0000 Hidden Image–>ATICCCom.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 28672 bytes 0x038B0000 Hidden Image–>CLI.Caste.Graphics.Wizard.Shared.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 28672 bytes 0x04A10000 Hidden Image–>CLI.Aspect.DeviceProperty.Graphics.Shared.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 28672 bytes 0x04A70000 Hidden Image–>CLI.Aspect.DeviceProperty2.Graphics.Shared.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 28672 bytes 0x04C70000 Hidden Image–>atixclib.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 28672 bytes 0x04C10000 Hidden Image–>CLI.Aspect.TransCode.Local.Shared.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 299008 bytes 0x037F0000 Hidden Image–>CLI.Caste.Graphics.Runtime.dll [ EPROCESS 0x844764B0 ] PID: 2476, 307200 bytes 0x03310000 Hidden Image–>System.Runtime.Remoting.dll [ EPROCESS 0x844764B0 ] PID: 2476, 307200 bytes 0x03310000 Hidden Image–>System.Runtime.Remoting.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 307200 bytes 0x84AFA3CC Unknown page with executable code, 3124 bytes 0x03C40000 Hidden Image–>ATIDEMGR.dll [ EPROCESS 0x844764B0 ] PID: 2476, 315392 bytes 0x049A0000 Hidden Image–>CLI.Aspect.InfoCentre.Graphics.Wizard.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 339968 bytes 0x84AF928A Unknown page with executable code, 3446 bytes 0x04960000 Hidden Image–>CLI.Aspect.OverDrive2.Graphics.Runtime.dll [ EPROCESS 0x844764B0 ] PID: 2476, 36864 bytes 0x032F0000 Hidden Image–>CLI.Foundation.XManifestation.dll [ EPROCESS 0x844764B0 ] PID: 2476, 36864 bytes 0x03670000 Hidden Image–>AEM.Foundation.dll [ EPROCESS 0x844764B0 ] PID: 2476, 36864 bytes 0x038B0000 Hidden Image–>ACE.Graphics.DisplaysManager.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 36864 bytes 0x03B20000 Hidden Image–>APM.Foundation.dll [ EPROCESS 0x844764B0 ] PID: 2476, 36864 bytes 0x03E90000 Hidden Image–>CLI.Aspect.MultiVPU3.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 36864 bytes 0x03EE0000 Hidden Image–>CLI.Aspect.MultiVPU2.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 36864 bytes 0x04030000 Hidden Image–>CLI.Aspect.DeviceLCD.Graphics.Runtime.dll [ EPROCESS 0x844764B0 ] PID: 2476, 36864 bytes 0x04050000 Hidden Image–>CLI.Aspect.DeviceLCD.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 36864 bytes 0x04070000 Hidden Image–>CLI.Aspect.DeviceLCD2.Graphics.Runtime.dll [ EPROCESS 0x844764B0 ] PID: 2476, 36864 bytes 0x04090000 Hidden Image–>CLI.Aspect.DeviceLCD2.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 36864 bytes 0x04110000 Hidden Image–>CLI.Aspect.CustomFormats.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 36864 bytes 0x04320000 Hidden Image–>CLI.Aspect.MultiVPU.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 36864 bytes 0x04360000 Hidden Image–>CLI.Aspect.VeryLargeDesktop.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 36864 bytes 0x04410000 Hidden Image–>CLI.Aspect.DisplaysColour2.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 36864 bytes 0x04460000 Hidden Image–>CLI.Aspect.DisplaysColour.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 36864 bytes 0x04560000 Hidden Image–>CLI.Aspect.VPURecover.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 36864 bytes 0x044E0000 Hidden Image–>CLI.Aspect.VideoOverlay.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 36864 bytes 0x04520000 Hidden Image–>CLI.Aspect.SmartGart.Graphics.Runtime.dll [ EPROCESS 0x844764B0 ] PID: 2476, 36864 bytes 0x04540000 Hidden Image–>CLI.Aspect.VPURecover.Graphics.Runtime.dll [ EPROCESS 0x844764B0 ] PID: 2476, 36864 bytes 0x04940000 Hidden Image–>CLI.Aspect.OverDrive3.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 36864 bytes 0x049A0000 Hidden Image–>CLI.Aspect.PowerPlay3.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 36864 bytes 0x04A20000 Hidden Image–>CLI.Aspect.InfoCentre.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 36864 bytes 0x04C50000 Hidden Image–>CLI.Aspect.SmartGart.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 36864 bytes 0x04DD0000 Hidden Image–>CLI.Aspect.DisplaysOptions.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 36864 bytes 0x03840000 Hidden Image–>ACE.Graphics.DisplaysManager.Shared.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 36864 bytes 0x032F0000 Hidden Image–>CLI.Foundation.XManifestation.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 36864 bytes 0x03770000 Hidden Image–>CLI.Component.Wizard.Shared.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 36864 bytes 0x03820000 Hidden Image–>AEM.Foundation.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 36864 bytes 0x04A30000 Hidden Image–>CLI.Aspect.CustomFormats.Graphics.Shared.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 36864 bytes 0x04A90000 Hidden Image–>CLI.Aspect.DeviceLCD.Graphics.Shared.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 36864 bytes 0x04AC0000 Hidden Image–>CLI.Aspect.DeviceLCD2.Graphics.Shared.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 36864 bytes 0x04CA0000 Hidden Image–>CLI.Aspect.InfoCentre.Graphics.Shared.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 36864 bytes 0x84AFF143 Unknown page with executable code, 3773 bytes 0x03C90000 Hidden Image–>System.Management.dll [ EPROCESS 0x844764B0 ] PID: 2476, 380928 bytes 0x03E00000 Hidden Image–>CLI.Aspect.DeviceLCD.Graphics.Wizard.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 421888 bytes 0x03EE0000 Hidden Image–>CLI.Aspect.DeviceLCD2.Graphics.Wizard.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 421888 bytes 0x00C40000 Hidden Image–>CLI.Implementation.dll [ EPROCESS 0x844764B0 ] PID: 2476, 45056 bytes 0x01240000 Hidden Image–>LOG.Foundation.dll [ EPROCESS 0x844764B0 ] PID: 2476, 45056 bytes 0x03850000 Hidden Image–>CLI.Component.Runtime.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 45056 bytes 0x03E60000 Hidden Image–>CLI.Aspect.MultiVPU3.Graphics.Runtime.dll [ EPROCESS 0x844764B0 ] PID: 2476, 45056 bytes 0x03EC0000 Hidden Image–>CLI.Aspect.MultiVPU2.Graphics.Runtime.dll [ EPROCESS 0x844764B0 ] PID: 2476, 45056 bytes 0x03F00000 Hidden Image–>CLI.Aspect.MultiVPU.Graphics.Runtime.dll [ EPROCESS 0x844764B0 ] PID: 2476, 45056 bytes 0x040F0000 Hidden Image–>CLI.Aspect.DeviceCV.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 45056 bytes 0x04340000 Hidden Image–>CLI.Aspect.VeryLargeDesktop.Graphics.Runtime.dll [ EPROCESS 0x844764B0 ] PID: 2476, 45056 bytes 0x044C0000 Hidden Image–>CLI.Aspect.VideoOverlay.Graphics.Runtime.dll [ EPROCESS 0x844764B0 ] PID: 2476, 45056 bytes 0x044A0000 Hidden Image–>CLI.Aspect.MMVideo.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 45056 bytes 0x045B0000 Hidden Image–>CLI.Aspect.DeviceCRT.Graphics.Runtime.dll [ EPROCESS 0x844764B0 ] PID: 2476, 45056 bytes 0x04580000 Hidden Image–>CLI.Aspect.WorkstationConfig.Graphics.Runtime.dll [ EPROCESS 0x844764B0 ] PID: 2476, 45056 bytes 0x04610000 Hidden Image–>CLI.Aspect.DeviceCRT2.Graphics.Runtime.dll [ EPROCESS 0x844764B0 ] PID: 2476, 45056 bytes 0x049C0000 Hidden Image–>CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll [ EPROCESS 0x844764B0 ] PID: 2476, 45056 bytes 0x04A00000 Hidden Image–>CLI.Aspect.InfoCentre.Graphics.Runtime.dll [ EPROCESS 0x844764B0 ] PID: 2476, 45056 bytes 0x04C70000 Hidden Image–>CLI.Aspect.WorkstationConfig.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 45056 bytes 0x00C40000 Hidden Image–>CLI.Implementation.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 45056 bytes 0x01240000 Hidden Image–>LOG.Foundation.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 45056 bytes 0x046D0000 Hidden Image–>CLI.Aspect.DeviceCV.Graphics.Shared.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 45056 bytes 0x04BB0000 Hidden Image–>CLI.Aspect.MMVideo.Graphics.Shared.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 45056 bytes 0x047C0000 Hidden Image–>CLI.Aspect.MMVideo.Graphics.Wizard.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 471040 bytes 0x048C0000 Hidden Image–>CLI.Aspect.TransCode.Local.Wizard.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 520192 bytes 0x04480000 Hidden Image–>CLI.Aspect.MMVideo.Graphics.Runtime.dll [ EPROCESS 0x844764B0 ] PID: 2476, 53248 bytes 0x012A0000 Hidden Image–>LOG.Foundation.Service.dll [ EPROCESS 0x844764B0 ] PID: 2476, 53248 bytes 0x03890000 Hidden Image–>DEM.Graphics.I0601.dll [ EPROCESS 0x844764B0 ] PID: 2476, 53248 bytes 0x043F0000 Hidden Image–>CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll [ EPROCESS 0x844764B0 ] PID: 2476, 53248 bytes 0x043D0000 Hidden Image–>CLI.Aspect.Radeon3DLegacy.Graphics.Runtime.dll [ EPROCESS 0x844764B0 ] PID: 2476, 53248 bytes 0x04440000 Hidden Image–>CLI.Aspect.DisplaysColour.Graphics.Runtime.dll [ EPROCESS 0x844764B0 ] PID: 2476, 53248 bytes 0x04790000 Hidden Image–>CLI.Aspect.DeviceDFP.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 53248 bytes 0x046C0000 Hidden Image–>CLI.Aspect.DeviceCV2.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 53248 bytes 0x04770000 Hidden Image–>CLI.Aspect.DeviceDFP.Graphics.Runtime.dll [ EPROCESS 0x844764B0 ] PID: 2476, 53248 bytes 0x047D0000 Hidden Image–>CLI.Aspect.DeviceDFP2.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 53248 bytes 0x047B0000 Hidden Image–>CLI.Aspect.DeviceDFP2.Graphics.Runtime.dll [ EPROCESS 0x844764B0 ] PID: 2476, 53248 bytes 0x012A0000 Hidden Image–>LOG.Foundation.Service.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 53248 bytes 0x03750000 Hidden Image–>CLI.Foundation.Clients.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 53248 bytes 0x04A50000 Hidden Image–>CLI.Aspect.DeviceCV2.Graphics.Shared.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 53248 bytes 0xF74BE000 WARNING: Virus alike driver modification [VolSnap.sys], 53248 bytes 0x84AFD53C Unknown thread object [ ETHREAD 0x84B80698 ] TID: 124, 600 bytes 0x84AFF52D Unknown thread object [ ETHREAD 0x84B6F020 ] TID: 128, 600 bytes 0x84AFD23F Unknown thread object [ ETHREAD 0x84B6FDA8 ] , 600 bytes 0x03790000 Hidden Image–>CLI.Caste.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 61440 bytes 0x04980000 Hidden Image–>CLI.Aspect.PowerPlay3.Graphics.Runtime.dll [ EPROCESS 0x844764B0 ] PID: 2476, 61440 bytes 0x04AD0000 Hidden Image–>CLI.Aspect.Radeon3DLegacy.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 61440 bytes 0x03800000 Hidden Image–>CLI.Caste.Graphics.Shared.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 61440 bytes 0x036A0000 Hidden Image–>CLI.Component.Wizard.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 634880 bytes 0x040C0000 Hidden Image–>CLI.Aspect.DeviceCV.Graphics.Runtime.dll [ EPROCESS 0x844764B0 ] PID: 2476, 69632 bytes 0x04390000 Hidden Image–>CLI.Aspect.Radeon3D.Graphics.Runtime.dll [ EPROCESS 0x844764B0 ] PID: 2476, 69632 bytes 0x045E0000 Hidden Image–>CLI.Aspect.DeviceCRT.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 69632 bytes 0x04640000 Hidden Image–>CLI.Aspect.DeviceCRT2.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 69632 bytes 0x046F0000 Hidden Image–>CLI.Aspect.DeviceTV2.Graphics.Runtime.dll [ EPROCESS 0x844764B0 ] PID: 2476, 69632 bytes 0x04690000 Hidden Image–>CLI.Aspect.DeviceCV2.Graphics.Runtime.dll [ EPROCESS 0x844764B0 ] PID: 2476, 69632 bytes 0x04730000 Hidden Image–>CLI.Aspect.DeviceTV.Graphics.Runtime.dll [ EPROCESS 0x844764B0 ] PID: 2476, 69632 bytes 0x04AB0000 Hidden Image–>CLI.Aspect.Radeon3D.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 69632 bytes 0x04D10000 Hidden Image–>CLI.Aspect.DeviceTV2.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 69632 bytes 0x04D70000 Hidden Image–>CLI.Aspect.DeviceTV.Graphics.Shared.dll [ EPROCESS 0x844764B0 ] PID: 2476, 69632 bytes 0x04AF0000 Hidden Image–>CLI.Aspect.DeviceTV.Graphics.Shared.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 69632 bytes 0x04B40000 Hidden Image–>CLI.Aspect.DeviceTV2.Graphics.Shared.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 69632 bytes 0x04B80000 Hidden Image–>CLI.Aspect.Radeon3D.Graphics.Shared.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 69632 bytes 0x01270000 Hidden Image–>CLI.Foundation.dll [ EPROCESS 0x844764B0 ] PID: 2476, 77824 bytes 0x01270000 Hidden Image–>CLI.Foundation.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 77824 bytes 0x04810000 Hidden Image–>CLI.Aspect.OverDrive3.Graphics.Runtime.dll [ EPROCESS 0x844764B0 ] PID: 2476, 86016 bytes 0x03620000 Hidden Image–>CLI.Component.Runtime.dll [ EPROCESS 0x844764B0 ] PID: 2476, 94208 bytes 0x037B0000 Hidden Image–>CLI.Component.Runtime.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 94208 bytes 0x03880000 Hidden Image–>CLI.Caste.Graphics.Wizard.dll [ EPROCESS 0x84A1F9F8 ] PID: 2772, 94208 bytes ————————————————————————————————————————————————————————————————— MBRCheck Report Below: MBRCheck, version 1.2.3 © 2010, AD Command-line: Windows Version: Windows XP Professional Windows Information: Service Pack 3 (build 2600) Logical Drives Mask: 0x00000004 Kernel Drivers (total 117): 0x804D7000 \WINDOWS\system32\ntkrnlpa.exe 0x806D0000 \WINDOWS\system32\hal.dll 0xF799E000 \WINDOWS\system32\KDCOM.DLL 0xF78AE000 \WINDOWS\system32\BOOTVID.dll 0xF736F000 ACPI.sys 0xF79A0000 \WINDOWS\system32\DRIVERS\WMILIB.SYS 0xF735E000 pci.sys 0xF749E000 isapnp.sys 0xF78B2000 compbatt.sys 0xF78B6000 \WINDOWS\system32\DRIVERS\BATTC.SYS 0xF7A66000 pciide.sys 0xF771E000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS 0xF74AE000 MountMgr.sys 0xF733F000 ftdisk.sys 0xF79A2000 dmload.sys 0xF7319000 dmio.sys 0xF78BA000 ACPIEC.sys 0xF7A67000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS 0xF7726000 PartMgr.sys 0xF7A68000 atiide.sys 0xF74BE000 VolSnap.sys 0xF7301000 atapi.sys 0xF74CE000 disk.sys 0xF74DE000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS 0xF72E1000 fltMgr.sys 0xF72CF000 sr.sys 0xF72B8000 KSecDD.sys 0xF722B000 Ntfs.sys 0xF71FE000 NDIS.sys 0xF71E4000 Mup.sys 0xF767E000 \SystemRoot\system32\DRIVERS\AmdK8.sys 0xF64E2000 \SystemRoot\system32\DRIVERS\ati2mtag.sys 0xF64CE000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS 0xF643A000 \SystemRoot\system32\DRIVERS\bcmwl5.sys 0xF77AE000 \SystemRoot\system32\DRIVERS\usbohci.sys 0xF6416000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0xF77B6000 \SystemRoot\system32\DRIVERS\usbehci.sys 0xF63EE000 \SystemRoot\system32\DRIVERS\HDAudBus.sys 0xF768E000 \SystemRoot\system32\DRIVERS\i8042prt.sys 0xF77BE000 \SystemRoot\system32\DRIVERS\kbdclass.sys 0xF77C6000 \SystemRoot\system32\DRIVERS\mouclass.sys 0xF769E000 \SystemRoot\system32\DRIVERS\bcm4sbxp.sys 0xF63DA000 \SystemRoot\system32\DRIVERS\sdbus.sys 0xF76AE000 \SystemRoot\system32\DRIVERS\rimmptsk.sys 0xF71B4000 \SystemRoot\system32\DRIVERS\CmBatt.sys 0xF7B2A000 \SystemRoot\system32\DRIVERS\audstub.sys 0xF76BE000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0xF71B0000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0xF63C3000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0xF76CE000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0xF76DE000 \SystemRoot\system32\DRIVERS\raspptp.sys 0xF77CE000 \SystemRoot\system32\DRIVERS\TDI.SYS 0xF63B2000 \SystemRoot\system32\DRIVERS\psched.sys 0xF76FE000 \SystemRoot\system32\DRIVERS\msgpc.sys 0xF77D6000 \SystemRoot\system32\DRIVERS\ptilink.sys 0xF77DE000 \SystemRoot\system32\DRIVERS\raspti.sys 0xF6382000 \SystemRoot\system32\DRIVERS\rdpdr.sys 0xF75AE000 \SystemRoot\system32\DRIVERS\termdd.sys 0xF79D4000 \SystemRoot\system32\DRIVERS\swenum.sys 0xF635F000 \SystemRoot\system32\DRIVERS\ks.sys 0xF5F9A000 \SystemRoot\system32\DRIVERS\update.sys 0xF6CCE000 \SystemRoot\system32\DRIVERS\mssmbios.sys 0xF6725000 \SystemRoot\System32\Drivers\NDProxy.SYS 0xF66D5000 \SystemRoot\system32\DRIVERS\usbhub.sys 0xF79D8000 \SystemRoot\system32\DRIVERS\USBD.SYS 0xEFAF0000 \SystemRoot\system32\DRIVERS\HSXHWAZL.sys 0xEF9F9000 \SystemRoot\system32\DRIVERS\HSX_DPV.sys 0xEF943000 \SystemRoot\system32\DRIVERS\HSX_CNXT.sys 0xF7866000 \SystemRoot\System32\Drivers\Modem.SYS 0xEE570000 \SystemRoot\system32\drivers\sthda.sys 0xEE54C000 \SystemRoot\system32\drivers\portcls.sys 0xEED87000 \SystemRoot\system32\drivers\drmk.sys 0xEF5E2000 \SystemRoot\System32\DRIVERS\cmderd.sys 0xEE178000 \SystemRoot\System32\DRIVERS\cmdguard.sys 0xF7A5C000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0xF7B65000 \SystemRoot\System32\Drivers\Null.SYS 0xF7A5E000 \SystemRoot\System32\Drivers\Beep.SYS 0xEF064000 \SystemRoot\System32\drivers\vga.sys 0xF7A60000 \SystemRoot\System32\Drivers\mnmdd.SYS 0xF7A62000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0xEF05C000 \SystemRoot\System32\Drivers\Msfs.SYS 0xEF054000 \SystemRoot\System32\Drivers\Npfs.SYS 0xF7966000 \SystemRoot\system32\DRIVERS\rasacd.sys 0xEE145000 \SystemRoot\system32\DRIVERS\ipsec.sys 0xEE0EC000 \SystemRoot\system32\DRIVERS\tcpip.sys 0xEE0C4000 \SystemRoot\system32\DRIVERS\netbt.sys 0xEE0A2000 \SystemRoot\System32\drivers\afd.sys 0xEED37000 \SystemRoot\system32\DRIVERS\netbios.sys 0xEE077000 \SystemRoot\system32\DRIVERS\rdbss.sys 0xEE007000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0xF66E5000 \SystemRoot\System32\Drivers\Fips.SYS 0xEDFE1000 \SystemRoot\system32\DRIVERS\ipnat.sys 0xF757E000 \SystemRoot\system32\DRIVERS\wanarp.sys 0xEB183000 \SystemRoot\System32\Drivers\dump_atapi.sys 0xF79FA000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS 0xBF800000 \SystemRoot\System32\win32k.sys 0xEBB33000 \SystemRoot\System32\drivers\Dxapi.sys 0xEBDB5000 \SystemRoot\System32\watchdog.sys 0xBF000000 \SystemRoot\System32\drivers\dxg.sys 0xEB1A4000 \SystemRoot\System32\drivers\dxgthk.sys 0xBF012000 \SystemRoot\System32\ati2dvag.dll 0xBF055000 \SystemRoot\System32\ati2cqag.dll 0xBF09D000 \SystemRoot\System32\atikvmag.dll 0xBF0E3000 \SystemRoot\System32\ati3duag.dll 0xBF34A000 \SystemRoot\System32\ativvaxx.dll 0xBFFA0000 \SystemRoot\System32\ATMFD.DLL 0xEC6AC000 \SystemRoot\system32\DRIVERS\ndisuio.sys 0xB86BB000 \SystemRoot\system32\DRIVERS\mrxdav.sys 0xB87CC000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys 0xB85EB000 \SystemRoot\system32\DRIVERS\srv.sys 0xB82B6000 \SystemRoot\system32\drivers\wdmaud.sys 0xEBC9F000 \SystemRoot\system32\drivers\sysaudio.sys 0xB7E87000 \SystemRoot\System32\Drivers\HTTP.sys 0xB627E000 \SystemRoot\system32\drivers\kmixer.sys 0xB625A000 \SystemRoot\System32\Drivers\Fastfat.SYS 0xF7796000 \??\C:\DOCUME~1\STEPHA~1\LOCALS~1\Temp\mbr.sys 0x7C900000 \WINDOWS\system32\ntdll.dll Processes (total 41): 0 System Idle Process 4 System 776 C:\WINDOWS\system32\smss.exe 824 csrss.exe 856 C:\WINDOWS\system32\winlogon.exe 900 C:\WINDOWS\system32\services.exe 912 C:\WINDOWS\system32\lsass.exe 1072 C:\WINDOWS\system32\ati2evxx.exe 1088 C:\WINDOWS\system32\svchost.exe 1192 svchost.exe 1236 C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe 1268 C:\WINDOWS\system32\svchost.exe 1392 svchost.exe 1484 C:\WINDOWS\system32\ati2evxx.exe 1564 svchost.exe 1736 C:\WINDOWS\system32\WLTRYSVC.EXE 1748 C:\WINDOWS\system32\BCMWLTRY.EXE 1784 C:\WINDOWS\system32\spoolsv.exe 1904 C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe 1916 C:\WINDOWS\system32\svchost.exe 1936 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 1996 C:\Program Files\Java\jre6\bin\jqs.exe 2024 sqlservr.exe 244 sqlbrowser.exe 260 C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe 304 C:\WINDOWS\system32\svchost.exe 1648 alg.exe 308 C:\WINDOWS\explorer.exe 2352 C:\WINDOWS\system32\WLTRAY.EXE 2384 C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe 2404 C:\Program Files\Java\jre6\bin\jusched.exe 2412 C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe 2428 C:\Program Files\COMODO\COMODO Internet Security\cfp.exe 2440 C:\WINDOWS\system32\ctfmon.exe 2460 C:\Program Files\Messenger\msmsgs.exe 2476 C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe 2616 C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac 2772 C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe 512 C:\WINDOWS\system32\wuauclt.exe 3548 C:\WINDOWS\system32\wscntfy.exe 2064 C:\Documents and Settings\Stephanie\Desktop\MBRCheck.exe \\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS) PhysicalDrive0 Model Number: TOSHIBAMK6034GSX, Rev: AH101D Size Device Name MBR Status ——————————————– 55 GB \\.\PhysicalDrive0 Windows XP MBR code detected SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A Done! ————————————————————————————————————————————————————————————————— Attach Report is Attached. ————————————————————————————————————————————————————————————————— Thanks NoodleTech!!!

Attachments:

Post #7
Hi kor0000,

Let's give ComboFix a run. Just a warning, ComboFix may seem to be running slow, but that is normal.

Please read through the instructions to familiarize yourself with what to expect when the tool runs.

It is vitally important that combofix is renamed before it has even started to download

Please download ComboFix from Link 1 or Link 2 to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

  • If you are using Firefox, make sure that your download settings are as follows:
    -Tools->Options->Main tab
    -Set to "Always ask me where to Save the files".
  • During the download, before you save it to your desktop, rename Combofix to jgh.exe

  • It is important you rename Combofix during the download, but not after.
  • Please do not rename Combofix to other names, but only to the one indicated.
  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix

———————————————————–


  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

    ———————————————————–

  • Double click on ComboFix.exe (jgh.exe in your case) & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Please post back with
  • combofix log
How is the computer?

Thanks
Post #8
After the Combo Fix the computer seems a little faster at boot time other than that there is no change. Still getting redirected/hijacked.

The ComboFix log is below:

ComboFix 11-01-24.02 - Stephanie 01/25/2011 6:51.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.446.182 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\jgh.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\sst10A.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_sst10A
——-\Service_sst10A


((((((((((((((((((((((((( Files Created from 2010-12-25 to 2011-01-25 )))))))))))))))))))))))))))))))
.

2011-01-24 14:41 . 2011-01-24 14:41 ——– d—–w- c:\documents and settings\Stephanie\Application Data\ElevatedDiagnostics
2011-01-21 20:09 . 2011-01-21 20:09 388096 —-a-r- c:\documents and settings\Stephanie\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-01-21 17:59 . 2011-01-21 17:59 ——– d–h–w- c:\windows\system32\GroupPolicy
2011-01-21 13:59 . 2011-01-21 13:59 ——– d—–w- C:\VritualRoot
2011-01-21 13:57 . 2011-01-25 12:20 618081 —-a-w- c:\windows\system32\drivers\sfi.dat
2011-01-21 13:34 . 2011-01-21 13:59 ——– d—–w- c:\documents and settings\All Users\Application Data\Comodo
2011-01-21 13:34 . 2011-01-21 19:49 ——– d—–w- c:\program files\COMODO
2011-01-21 13:34 . 2011-01-21 13:34 1700352 —-a-w- c:\windows\system32\gdiplus.dll
2011-01-21 12:56 . 2011-01-21 12:56 ——– d—–w- c:\windows\SQL9_KB970892_ENU
2011-01-20 20:49 . 2011-01-20 20:49 ——– d—–w- c:\program files\Trend Micro
2011-01-20 20:27 . 2011-01-20 20:27 ——– d—–w- c:\program files\CCleaner
2011-01-20 20:12 . 2008-07-06 12:06 89088 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2011-01-20 20:11 . 2008-07-06 12:06 89088 -c—-w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2011-01-20 20:11 . 2008-07-06 12:06 575488 -c—-w- c:\windows\system32\dllcache\xpsshhdr.dll
2011-01-20 20:11 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll
2011-01-20 20:11 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll
2011-01-20 20:11 . 2008-07-06 10:50 597504 -c—-w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2011-01-20 20:11 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2011-01-20 20:11 . 2008-07-06 12:06 1676288 -c—-w- c:\windows\system32\dllcache\xpssvcs.dll
2011-01-20 20:11 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll
2011-01-20 20:11 . 2011-01-20 20:12 ——– d—–w- C:\6a40ca2892629626c7c2b4
2011-01-20 19:48 . 2011-01-20 19:48 ——– d-sh–w- c:\documents and settings\Stephanie\PrivacIE
2011-01-20 19:48 . 2011-01-20 19:49 ——– d—–w- C:\2b4c57dcf272092d6864d8ad
2011-01-20 19:48 . 2011-01-20 19:56 ——– d—–w- C:\e31042ab64406dec4dee3dff
2011-01-20 19:45 . 2011-01-20 19:45 ——– d-sh–w- c:\windows\system32\config\systemprofile\IETldCache
2011-01-20 19:41 . 2011-01-20 19:41 ——– d-sh–w- c:\documents and settings\Stephanie\IETldCache
2011-01-20 19:34 . 2010-10-18 11:10 7680 -c—-w- c:\windows\system32\dllcache\iecompat.dll
2011-01-20 19:31 . 2010-11-06 00:26 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll
2011-01-20 19:31 . 2010-11-06 00:26 55296 -c—-w- c:\windows\system32\dllcache\msfeedsbs.dll
2011-01-20 19:31 . 2010-11-06 00:26 602112 -c—-w- c:\windows\system32\dllcache\msfeeds.dll
2011-01-20 19:31 . 2010-11-06 00:26 1991680 -c—-w- c:\windows\system32\dllcache\iertutil.dll
2011-01-20 19:31 . 2010-11-06 00:26 247808 -c—-w- c:\windows\system32\dllcache\ieproxy.dll
2011-01-20 19:31 . 2010-11-06 00:26 743424 -c—-w- c:\windows\system32\dllcache\iedvtool.dll
2011-01-20 19:31 . 2010-11-06 00:26 11080704 -c—-w- c:\windows\system32\dllcache\ieframe.dll
2011-01-20 19:28 . 2011-01-20 19:31 ——– dc-h–w- c:\windows\ie8
2011-01-20 18:14 . 2011-01-20 18:14 ——– d—–w- c:\program files\MSXML 6.0
2011-01-20 16:39 . 2011-01-21 19:45 ——– d—–w- c:\program files\MB
2011-01-20 16:04 . 2010-12-03 19:35 553696 —-a-w- c:\program files\Mozilla Firefox\uninstall\helper.exe
2011-01-20 16:04 . 2010-12-03 19:35 912344 —-a-w- c:\program files\Mozilla Firefox\firefox.exe
2011-01-20 16:04 . 2010-12-03 19:35 719832 —-a-w- c:\program files\Mozilla Firefox\mozcpp19.dll
2011-01-20 16:04 . 2010-12-03 19:35 16856 —-a-w- c:\program files\Mozilla Firefox\plugin-container.exe
2011-01-20 14:59 . 2008-06-13 11:05 272128 -c—-w- c:\windows\system32\dllcache\bthport.sys
2011-01-20 14:59 . 2008-06-13 11:05 272128 ——w- c:\windows\system32\drivers\bthport.sys
2011-01-20 14:53 . 2010-02-24 13:11 455680 -c—-w- c:\windows\system32\dllcache\mrxsmb.sys
2011-01-20 14:48 . 2009-08-07 00:23 274288 —-a-w- c:\windows\system32\mucltui.dll
2011-01-20 14:14 . 2010-08-26 12:52 5120 —-a-w- c:\windows\system32\xpsp4res.dll
2011-01-19 19:49 . 2009-01-07 23:21 26144 —-a-w- c:\windows\system32\spupdsvc.exe
2011-01-19 19:49 . 2011-01-21 13:04 ——– d–h–w- c:\windows\$hf_mig$
2011-01-19 17:16 . 2010-10-19 20:51 222080 ——w- c:\windows\system32\MpSigStub.exe
2011-01-19 15:14 . 2011-01-19 15:14 ——– d—–w- c:\documents and settings\Stephanie\Application Data\Malwarebytes
2011-01-19 14:56 . 2011-01-19 14:56 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-01-19 14:56 . 2011-01-20 16:23 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-01-18 21:14 . 2011-01-21 13:08 ——– d—–w- c:\documents and settings\Administrator
2011-01-06 22:37 . 2011-01-06 22:37 94784 —-a-w- c:\windows\system32\drivers\inspect.sys
2011-01-06 22:37 . 2011-01-06 22:37 27576 —-a-w- c:\windows\system32\drivers\cmdhlp.sys
2011-01-06 22:37 . 2011-01-06 22:37 239368 —-a-w- c:\windows\system32\drivers\cmdGuard.sys
2011-01-06 22:37 . 2011-01-06 22:37 15592 —-a-w- c:\windows\system32\drivers\cmderd.sys
2011-01-06 01:13 . 2011-01-06 01:13 0 —-a-w- c:\windows\system32\drivers\sst10A.tmp
2010-12-30 04:58 . 2001-08-18 03:36 5632 —-a-w- c:\windows\system32\ptpusb.dll
2010-12-30 04:58 . 2008-04-14 10:42 159232 —-a-w- c:\windows\system32\ptpusd.dll
2010-12-30 04:58 . 2008-04-14 05:15 15104 -c–a-w- c:\windows\system32\dllcache\usbscan.sys
2010-12-30 04:58 . 2008-04-14 05:15 15104 —-a-w- c:\windows\system32\drivers\usbscan.sys
2010-12-30 03:57 . 2010-12-30 04:38 ——– d—–w- c:\documents and settings\Stephanie\Application Data\FrostWire
2010-12-30 03:57 . 2010-12-30 04:03 ——– d—–w- c:\documents and settings\Stephanie\Local Settings\Application Data\OpenCandy
2010-12-30 03:56 . 2010-12-30 03:56 ——– d—–w- c:\documents and settings\Stephanie\Application Data\OpenCandy
2010-12-29 06:42 . 2010-12-29 06:42 285480 —-a-w- c:\windows\system32\guard32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-18 18:12 . 2009-09-16 15:07 81920 —-a-w- c:\windows\system32\isign32.dll
2010-11-09 14:52 . 2008-04-14 12:00 249856 —-a-w- c:\windows\system32\odbc32.dll
2010-11-06 00:26 . 2008-04-14 12:00 916480 —-a-w- c:\windows\system32\wininet.dll
2010-11-06 00:26 . 2008-04-14 12:00 43520 ——w- c:\windows\system32\licmgr10.dll
2010-11-06 00:26 . 2008-04-14 12:00 1469440 ——w- c:\windows\system32\inetcpl.cpl
2010-11-03 12:25 . 2008-04-14 12:00 385024 ——w- c:\windows\system32\html.iec
2010-11-02 15:17 . 2008-04-14 12:00 40960 —-a-w- c:\windows\system32\drivers\ndproxy.sys
2010-10-28 13:13 . 2008-04-14 12:00 290048 —-a-w- c:\windows\system32\atmfd.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-03-16 1392640]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 90112]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-03-18 207360]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2011-01-18 2548552]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\guard32.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-11-18 01:59 421160 —-a-w- c:\program files\iTunes\iTunesHelper.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1068:TCP"= 1068:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface

R0 atiide;atiide;c:\windows\system32\drivers\atiide.sys [9/17/2009 11:47 AM 3456]
R1 cmderd;COMODO Internet Security Eradication Driver;c:\windows\system32\drivers\cmderd.sys [1/6/2011 5:37 PM 15592]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [1/6/2011 5:37 PM 239368]
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [4/14/2008 7:00 AM 14336]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
Contents of the 'Scheduled Tasks' folder

2011-01-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 16:50]
.
.
——- Supplementary Scan ——-
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} - hxxp://lads.myspace.com/upload/MySpaceUploader2.cab
FF - ProfilePath - c:\documents and settings\Stephanie\Application Data\Mozilla\Firefox\Profiles\1wkjvfk7.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Java Quick Starter: [removed] - c:\program files\Java\jre6\lib\deploy\jqs\ff
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKLM-Run-SigmatelSysTrayApp - %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-25 07:22
Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:
ZwClose, ZwOpenFile

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(864)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(920)
c:\windows\system32\guard32.dll

- - - - - - - > 'explorer.exe'(3244)
c:\windows\system32\WININET.dll
c:\windows\system32\guard32.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\Ati2evxx.exe
c:\program files\COMODO\COMODO Internet Security\cmdagent.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\bcmwltry.exe
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\windows\system32\wscntfy.exe
c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe
c:\program files\ATI Technologies\ATI.ACE\CLI.EXE
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
c:\program files\ATI Technologies\ATI.ACE\cli.exe
c:\program files\Internet Explorer\iexplore.exe
c:\program files\Internet Explorer\iexplore.exe
.
**************************************************************************
.
Completion time: 2011-01-25 07:40:32 - machine was rebooted
ComboFix-quarantined-files.txt 2011-01-25 12:40

Pre-Run: 42,478,465,024 bytes free
Post-Run: 42,868,908,032 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - F407FB5DD4F8E1925D8D96B0D1EC3A4D
Post #9
Hi kor0000, let's try TDSSKiller.

Please download TDSSKiller.zip
  • Extract it to your desktop
  • Double click TDSSKiller.exe
  • Press Start Scan
    • Only if Malicious objects are found then ensure Cure is selected
    • Then click Continue > Reboot now
  • Copy and paste the log in your next reply
    • A copy of the log will be saved automatically to the root of the drive (typically C:\)
Post #10 last edited
Booooooo…………………. yahhhhhhhhhhh Thank you so much NoodleTech. Redirects are gone. Malwarebytes able to scan in safe mode now. Malwarebytes shows a clean computer. This is a great forum!!! TDSS log and Malwarebytes log below. TDSSKiller log below: 2011/01/26 08:08:07.0625 TDSS rootkit removing tool 2.4.15.0 Jan 22 2011 19:37:53 2011/01/26 08:08:07.0625 ================================================================================ 2011/01/26 08:08:07.0625 SystemInfo: 2011/01/26 08:08:07.0625 2011/01/26 08:08:07.0625 OS Version: 5.1.2600 ServicePack: 3.0 2011/01/26 08:08:07.0625 Product type: Workstation 2011/01/26 08:08:07.0640 ComputerName: INSPIRON-1501 2011/01/26 08:08:07.0671 UserName: Stephanie 2011/01/26 08:08:07.0671 Windows directory: C:\WINDOWS 2011/01/26 08:08:07.0671 System windows directory: C:\WINDOWS 2011/01/26 08:08:07.0671 Processor architecture: Intel x86 2011/01/26 08:08:07.0671 Number of processors: 1 2011/01/26 08:08:07.0671 Page size: 0x1000 2011/01/26 08:08:07.0671 Boot type: Normal boot 2011/01/26 08:08:07.0671 ================================================================================ 2011/01/26 08:08:08.0937 Initialize success 2011/01/26 08:08:20.0968 ================================================================================ 2011/01/26 08:08:20.0968 Scan started 2011/01/26 08:08:20.0968 Mode: Manual; 2011/01/26 08:08:20.0968 ================================================================================ 2011/01/26 08:08:25.0140 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys 2011/01/26 08:08:25.0406 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys 2011/01/26 08:08:25.0734 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys 2011/01/26 08:08:26.0046 Afc (fe3ea6e9afc1a78e6edca121e006afb7) C:\WINDOWS\system32\drivers\Afc.sys 2011/01/26 08:08:26.0218 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys 2011/01/26 08:08:27.0046 AmdK8 (efbb0956baed786e137351b5ca272aef) C:\WINDOWS\system32\DRIVERS\AmdK8.sys 2011/01/26 08:08:28.0265 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys 2011/01/26 08:08:28.0453 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys 2011/01/26 08:08:29.0265 ati2mtag (e78b73eb84c257d0d940e041742d2699) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys 2011/01/26 08:08:30.0015 atiide (1842b56b3d3f195c36f62708d266b95e) C:\WINDOWS\system32\DRIVERS\atiide.sys 2011/01/26 08:08:30.0109 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys 2011/01/26 08:08:30.0421 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys 2011/01/26 08:08:30.0687 BCM43XX (b89bcf0a25aeb3b47030ac83287f894a) C:\WINDOWS\system32\DRIVERS\bcmwl5.sys 2011/01/26 08:08:31.0015 bcm4sbxp (cd4646067cc7dcba1907fa0acf7e3966) C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys 2011/01/26 08:08:31.0140 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys 2011/01/26 08:08:31.0656 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys 2011/01/26 08:08:31.0968 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys 2011/01/26 08:08:32.0140 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys 2011/01/26 08:08:32.0281 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys 2011/01/26 08:08:32.0765 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys 2011/01/26 08:08:33.0171 cmderd (61b20ca85950870fa23587b26f3e4d7d) C:\WINDOWS\system32\DRIVERS\cmderd.sys 2011/01/26 08:08:33.0671 cmdGuard (dd530ee7d9efbb0ec42aebe7226b8a93) C:\WINDOWS\system32\DRIVERS\cmdguard.sys 2011/01/26 08:08:34.0015 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys 2011/01/26 08:08:34.0609 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys 2011/01/26 08:08:35.0078 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys 2011/01/26 08:08:35.0421 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys 2011/01/26 08:08:35.0593 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys 2011/01/26 08:08:35.0906 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys 2011/01/26 08:08:36.0312 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys 2011/01/26 08:08:36.0625 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys 2011/01/26 08:08:36.0859 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys 2011/01/26 08:08:37.0062 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys 2011/01/26 08:08:37.0328 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys 2011/01/26 08:08:37.0531 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys 2011/01/26 08:08:37.0734 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys 2011/01/26 08:08:37.0875 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys 2011/01/26 08:08:38.0015 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys 2011/01/26 08:08:38.0234 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys 2011/01/26 08:08:38.0421 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 2011/01/26 08:08:39.0000 HSF_DPV (e8ec1767ea315a39a0dd8989952ca0e9) C:\WINDOWS\system32\DRIVERS\HSX_DPV.sys 2011/01/26 08:08:39.0406 HSXHWAZL (61478fa42ee04562e7f11f4dca87e9c8) C:\WINDOWS\system32\DRIVERS\HSXHWAZL.sys 2011/01/26 08:08:39.0718 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys 2011/01/26 08:08:40.0250 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys 2011/01/26 08:08:40.0609 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys 2011/01/26 08:08:41.0015 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys 2011/01/26 08:08:41.0203 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 2011/01/26 08:08:41.0406 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys 2011/01/26 08:08:41.0656 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys 2011/01/26 08:08:41.0859 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys 2011/01/26 08:08:42.0171 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys 2011/01/26 08:08:42.0359 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys 2011/01/26 08:08:42.0656 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys 2011/01/26 08:08:42.0828 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys 2011/01/26 08:08:43.0046 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys 2011/01/26 08:08:43.0531 mdmxsdk (e246a32c445056996074a397da56e815) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys 2011/01/26 08:08:43.0687 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys 2011/01/26 08:08:43.0984 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys 2011/01/26 08:08:44.0171 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys 2011/01/26 08:08:44.0421 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys 2011/01/26 08:08:44.0687 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys 2011/01/26 08:08:44.0828 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 2011/01/26 08:08:45.0218 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys 2011/01/26 08:08:45.0390 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys 2011/01/26 08:08:45.0671 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys 2011/01/26 08:08:45.0796 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys 2011/01/26 08:08:46.0046 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys 2011/01/26 08:08:46.0218 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys 2011/01/26 08:08:46.0640 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys 2011/01/26 08:08:46.0937 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys 2011/01/26 08:08:47.0140 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys 2011/01/26 08:08:47.0406 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys 2011/01/26 08:08:47.0609 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys 2011/01/26 08:08:47.0890 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys 2011/01/26 08:08:48.0046 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys 2011/01/26 08:08:48.0484 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys 2011/01/26 08:08:48.0671 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys 2011/01/26 08:08:49.0015 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys 2011/01/26 08:08:49.0140 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 2011/01/26 08:08:49.0453 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 2011/01/26 08:08:49.0625 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys 2011/01/26 08:08:49.0890 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys 2011/01/26 08:08:50.0015 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys 2011/01/26 08:08:50.0125 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys 2011/01/26 08:08:50.0453 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys 2011/01/26 08:08:50.0609 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys 2011/01/26 08:08:51.0671 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys 2011/01/26 08:08:51.0781 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys 2011/01/26 08:08:52.0046 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys 2011/01/26 08:08:52.0187 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys 2011/01/26 08:08:53.0296 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys 2011/01/26 08:08:53.0453 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 2011/01/26 08:08:53.0703 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys 2011/01/26 08:08:53.0828 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys 2011/01/26 08:08:54.0015 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys 2011/01/26 08:08:54.0343 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 2011/01/26 08:08:54.0515 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys 2011/01/26 08:08:54.0843 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys 2011/01/26 08:08:54.0984 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys 2011/01/26 08:08:55.0343 rimmptsk (d85e3fa9f5b1f29bb4ed185c450d1470) C:\WINDOWS\system32\DRIVERS\rimmptsk.sys 2011/01/26 08:08:55.0812 sdbus (8d04819a3ce51b9eb47e5689b44d43c4) C:\WINDOWS\system32\DRIVERS\sdbus.sys 2011/01/26 08:08:56.0078 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys 2011/01/26 08:08:56.0187 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\drivers\Serial.sys 2011/01/26 08:08:56.0531 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys 2011/01/26 08:08:56.0734 SONYPVU1 (a1eceeaa5c5e74b2499eb51d38185b84) C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS 2011/01/26 08:08:57.0093 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys 2011/01/26 08:08:57.0437 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys 2011/01/26 08:08:57.0671 Srv (0f6aefad3641a657e18081f52d0c15af) C:\WINDOWS\system32\DRIVERS\srv.sys 2011/01/26 08:08:58.0265 STHDA (951801dfb54d86f611f0af47825476f9) C:\WINDOWS\system32\drivers\sthda.sys 2011/01/26 08:08:58.0687 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys 2011/01/26 08:08:58.0765 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys 2011/01/26 08:08:59.0609 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys 2011/01/26 08:09:00.0062 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys 2011/01/26 08:09:00.0453 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys 2011/01/26 08:09:00.0640 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys 2011/01/26 08:09:00.0843 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys 2011/01/26 08:09:01.0515 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys 2011/01/26 08:09:01.0968 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys 2011/01/26 08:09:02.0359 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys 2011/01/26 08:09:02.0468 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys 2011/01/26 08:09:02.0609 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys 2011/01/26 08:09:02.0890 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys 2011/01/26 08:09:03.0093 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 2011/01/26 08:09:03.0296 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys 2011/01/26 08:09:03.0531 VolSnap (7d6322d2567d94acf1e8c4b79ea1c880) C:\WINDOWS\system32\drivers\VolSnap.sys 2011/01/26 08:09:03.0562 Suspicious file (Forged): C:\WINDOWS\system32\drivers\VolSnap.sys. Real md5: 7d6322d2567d94acf1e8c4b79ea1c880, Fake md5: 4c8fcb5cc53aab716d810740fe59d025 2011/01/26 08:09:03.0578 VolSnap - detected Rootkit.Win32.TDSS.tdl3 (0) 2011/01/26 08:09:03.0828 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys 2011/01/26 08:09:04.0296 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys 2011/01/26 08:09:04.0640 winachsf (ba6b6fb242a6ba4068c8b763063beb63) C:\WINDOWS\system32\DRIVERS\HSX_CNXT.sys 2011/01/26 08:09:05.0953 ================================================================================ 2011/01/26 08:09:05.0953 Scan finished 2011/01/26 08:09:05.0953 ================================================================================ 2011/01/26 08:09:06.0031 Detected object count: 1 2011/01/26 08:40:08.0359 VolSnap (7d6322d2567d94acf1e8c4b79ea1c880) C:\WINDOWS\system32\drivers\VolSnap.sys 2011/01/26 08:40:08.0375 Suspicious file (Forged): C:\WINDOWS\system32\drivers\VolSnap.sys. Real md5: 7d6322d2567d94acf1e8c4b79ea1c880, Fake md5: 4c8fcb5cc53aab716d810740fe59d025 2011/01/26 08:40:10.0171 Backup copy found, using it.. 2011/01/26 08:40:10.0250 C:\WINDOWS\system32\drivers\VolSnap.sys - will be cured after reboot 2011/01/26 08:40:10.0250 Rootkit.Win32.TDSS.tdl3(VolSnap) - User select action: Cure 2011/01/26 08:40:23.0171 Deinitialize success ———————————————————————————————————————————————————————————————————————- Malwarebytes log below: Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 5597 Windows 5.1.2600 Service Pack 3 (Safe Mode) Internet Explorer 8.0.6001.18702 1/26/2011 9:12:21 AM mbam-log-2011-01-26 (09-12-20).txt Scan type: Full scan (C:\|D:\|) Objects scanned: 185927 Time elapsed: 18 minute(s), 39 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) ———————————————————————————————————————————————————————————————————————- Thanks!!!
Post #11
:thumbup:

There's a couple more things we need to do.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Updating Java:
  • Download the latest version of Java Runtime Environment (JRE) 6 Update 23.
  • Scroll down to where it says "The Java SE Runtime Environment (JRE) allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • In the pull down menu next to Platform select Windows
  • Check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement"
  • Click Continue
  • Click on the link to download Windows Offline Installation and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u23-windows-i586-p.exe to install the newest version.
Now to Clean out the Java cache:

Go into the Control Panel and double-click the Java Icon. [external image: Posted Image]
  • Under Temporary Internet Files, click the Settings… button
  • click the Delete Files button.
  • There are three options in the window to clear the cache - Leave all 3 Checked
    • Downloaded Applets
      Downloaded Applications
      Other Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Settings
  • Click OK to leave the Java Control Panel.
===================================================

I need you to run the following scan: Eset Online Scanner
  • Place a check mark in the box YES, I accept the Terms Of Use
  • Click the Start button.
  • Now click the Install button.
  • Click Start. The scanner engine will initialize and update.
  • Do Not place a check mark in the box beside Remove found threats.
  • Click the Scan button. The scan will now run, please be patient.
  • When the scan finishes click the Details tab.
  • Copy and paste the contents of the C:\Program Files\ESET\log.txt into your next reply.
Post #15
Hey NoodleTech, sorry I haven't gotten back to you. I've been sick since about Friday. I had planned on following your suggestions for completing the process of cleaning up the computer but the user seems to think that the computer is clean and is performing as it should. I have suggested that we need to complete the process but trying to make her schedule and my schedule coincide is not easy. I think for now the job is done. I do appreciate your assistance very much.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI