IE7 search hijacked?

Hello rlw1138 and

My name is JonTom

• Malware Logs can sometimes take a lot of time to research and interpret.
  
• Please be patient while I try to assist with your problem. If at any time you do not understand what is required, please ask for further explanation.
  
• Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
  
• Read every reply you receive carefully and thoroughly before carrying out the instructions. You may also find it helpful to print out the instructions you receive, as in some instances you may have to disconnect your computer from the Internet.
  
• PLEASE NOTE: If you do not reply after 5 days your thread will be closed.

I can see malware on your system but before we begin cleaning, I would like to see the results of an ARK scan:

• Please scan your system with GMER
  
  
  [external image: Posted Image]
  Download GMER Rootkit Scanner from here or here.
  
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent.
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
• Save it where you can easily find it, such as your desktop, and post it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOTKIT" entries

Please post the GMER log in your next reply. If you enconter any problems with the scan come back and let me know.

JonTom, gmer.exe won't run…..it re-boots me before I can change any options. russw

Hello rlw1138

Lets try running it from Safe Mode:

• Reboot Your System in Safe Mode
  
  
  
• Restart your computer.
• As soon as BIOS is loaded begin tapping the F8 key until the "Advanced Options" menu appears.
• Use the arrow keys to select the Safe mode menu item.
• Press Enter.

If you are still having problems from Safe Mode let me know

Hello rlw1138

Lets see if we can get the following tool to run:

• Combofix
  
  
  
• Download ComboFix from one of the following locations:
  
  Link 1
  Link 2

• VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

• IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here .
• Double click on ComboFix.exe & follow the prompts.

• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
• Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

• Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

• Click on Yes, to continue scanning for malware.
• When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
• Notes: Do not mouse-click Combofix's window while it is running. That may cause it to stall.
• Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

JonTom, combofix could only get to the point where it tried to install the Recovery Console. A dialog popped saying "couldn't enumerate disk drive" and then it re-booted. Same sorts of error messages in the event log. But, the System Restore Service is now starting automatically (not sure if it was already doing that…..) it actually said: "Boot Partition cannot be enumerated correctly"

Hello rlw1138

The system reboot issue you describe may be due to the malware present on the machine. It sounds as though certain files may have been damaged as a result of the infection.

Lets try the following:

• Please make a backup of your Registry
  
  
  
  • The following fix requires altering your Windows Registry. Therefore we need to back it up in case we run into problems:
  • Download ERUNT to your Desktop (Right click the link, select "Save Link/Target As"…, select your Desktop and press Save).
  • Right click erunt.zip, choose "Extract All…" and follow the prompts to unzip the program.
  • Open the ERUNT folder on your Desktop and double click ERUNT.exe to start the program.
  • Click OK for all the prompts to back up your registry to the default location.
  • Note: if it becomes necessary to restore the registry, open the backup folder and start ERDNT.exe.
  
  
• Please download OTM
  
  
  
  • Please download OTM by OldTimer by clicking here.
  • Save the file (called OTM.exe) to your desktop.
  • Double click on the OTM.exe icon to run the program. (Note: If you are running on Vista/Windows 7, right-click on the file and choose Run As Administrator).
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  

  :Processes 
  explorer.exe
  
  :Files
  c:\docume~1\russ\locals~1\temp\wldkevveg\axvrheysjmo.exe
  c:\docume~1\russ\locals~1\temp\wldkevveg
  C:\muamgrd.exe /s
  
  :Reg
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "sbqxesap"=-
  
  [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "Microsoft Update"=-
  
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
  "ProxyServer"=-
  "ProxyOverride"=-
  
  :Commands
  [Purity]
  [EmptyTemp]
  [Emptyflash]
  [Start Explorer]
  [Reboot]

  
  
  
  
  
  • Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTM.
  • Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File -> Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.
  
  If the tool runs, please post the OTM log in your next reply along with a new DDS log (please post BOTH logs that are created).

Hello rlw1138

You are not wasting my time at all

When you ran DDS, two logs should have been produced (dds.txt which you posted and attach.txt, which I still need to see). Please make sure you post the attach.txt log in your next reply.

• Trusted Zones:
  
  
  
  • I can see that you have web sites stored in the "Trusted Zones" section of your log. The only advantage to having a domain stored in your Trusted Zones, is that the domain will not prompt you for any permission before installing software or updates from the "trusted" site. This also means however, that if a malware exploit comes out where a site can spoof their domain name to match one stored in your Trusted Zones, then you will never know when (or what) they install on your machine.
  • If you remove the zones, these sites will still be able to install software, but only after receiving permission from you to do so, putting you back in control.
  • I suggest you remove the following entries:

  
  Trusted Zone: follett.com
  Trusted Zone: quill.com\certificate
  Trusted Zone: quill.com\citrix
  Trusted Zone: quill.com\workfromhome
  

  • You can remove sites from your Trusted Zones via:
  • IE > Tools > Internet Options > Security tab > Trusted Zone > Sites.
  • For more information regarding the addition of sites to your Trusted Zones, click here.
  
  
• Please perform the following scan:
  
  
  
  • Please download MalwareBytes AntiMalware by clicking here and save the file (called mbam-setup.exe) to your desktop.
  
  
  • Double click on the mbam-setup.exe icon to install the program.
  • Follow the prompts during installation and have the Installation Wizzard create a desktop icon.
  • Once installed, double click on the MalwareBytes AntiMalware icon to launch the program.
  • Click on the "Update" tab and then on "Check for Updates".
  • The program will now install the latest Malware definition files.
  • Once complete, click on the "Scanner" tab, select "Perform Quick Scan"and then click on "Scan".
  • Once the program has scanned your computer, a log file will be created in Notepad.
  • Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
  
  
  
  • If the scan detects any Malware-related objects, make sure that everything is checked, and click "Remove Selected" <– Very Important.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to restart your computer.
  • The log is automatically saved by MBAM and can be viewed by clicking the "Logs" tab.
  • Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process. If asked to restart your computer, please do so immediately.
  • Come back here to this thread and Paste the log in your next reply.
  
  Please post the attach.txt log along with the MBAM log in your next reply.
  
  Also, please let me know if you have your XP installation disk.

I do have a WinXP installer, but it's a slipstreamed (includes sp1 and sp2) collection that was created by my company's IS dept (they have an enterprise license and make us use their discs if we want to connect in to the corp network remotely). Also, three of the trusted sites are required in order for me to work remotedly…..but I think I can safely delete the follett.com one. A new attach.txt log is attached as a zip. And here is the MBAM log……I'm about to re-boot, per MBAM…. Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 5662 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.11 2/2/2011 6:05:49 PM mbam-log-2011-02-02 (18-05-49).txt Scan type: Quick scan Objects scanned: 145698 Time elapsed: 7 minute(s), 57 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 0 Registry Data Items Infected: 2 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\ineufbr1v (Malware.Trace) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogoff (PUM.Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

Is this a company machine or is it your own personal system?

It's my machine, at home, but because I also use it to connect to the corporate network, all of my Microsoft products are provided by my company. I do applications software development and support.

Hello rlw1138

It's my machine

Thank you for letting me know.

I really would like to see a rootkit scan of this machine if at all possible. Lets try the following:

• Please update your Java
  
  
  
  • To update your Java, Click on "Start" then on "Control Panel" and then on the Java icon (looks like a coffee cup).
  • In the window that opens, click on the "Update" tab, and then on "Update Now".
  • Your Java should begin to update. Please follow any prompts that you receive.
  
  
• GMER
  
  
  
  • Please give GMER another try as described in post number 2. If you still have problems with GMER please try Rootkit Unhooker:
  
  
• Rootkit Unhooker
  
  
  
  • Please Download Rootkit Unhooker and Save it to your desktop.
  • Now double-click on RKUnhookerLE.exe to run it.
  • Click the Report tab, then click Scan.
  • Check (Tick) Drivers, Stealth. Uncheck the rest, then Click OK.
  • Wait till the scanner has finished and then click File, Save Report.
  • Save the report somewhere where you can find it. Click Close.
  
  Copy the entire contents of the report and paste it in your next reply here.
  
  Note: You may get the following warning, just click OK and continue.
  
  "Rootkit Unhooker has detected a parasite inside itself!
  It is recommended to remove parasite, okay?"
  
  Please provide the GMER/Rootkit Unhooker log in your next reply. If you are still having trouble, come back and let me know.

JonTom, Java updated OK, GMER still reboots me, but here's the report.txt from rootkit unhooker: RkU Version: 3.8.388.590, Type LE (SR2) ============================================== OS Name: Windows XP Version 5.1.2600 (Service Pack 3) Number of processors #1 ============================================== >Drivers ============================================== 0xBF012000 C:\windows\System32\G400DHD.dll 2400256 bytes (Matrox Graphics Inc., Matrox G400DH Display Driver) 0x804D7000 C:\windows\system32\ntoskrnl.exe 2189952 bytes (Microsoft Corporation, NT Kernel & System) 0x804D7000 PnpManager 2189952 bytes 0x804D7000 RAW 2189952 bytes 0x804D7000 WMIxWDM 2189952 bytes 0xBF800000 Win32k 1855488 bytes 0xBF800000 C:\windows\System32\win32k.sys 1855488 bytes (Microsoft Corporation, Multi-User Win32 Driver) 0xF7B52000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver) 0xB5567000 C:\windows\System32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr) 0xB9070000 C:\windows\System32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver) 0xB575B000 C:\windows\System32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver) 0xADE36000 C:\windows\System32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver) 0xB9218000 C:\windows\system32\DRIVERS\g400dhm.sys 352256 bytes (Matrox Graphics Inc., Matrox G400DH Miniport Driver) 0xB9194000 C:\windows\system32\drivers\delta.sys 303104 bytes (Midiman/M-Audio, M-Audio Delta Audio Driver (WDM)) 0xB5520000 C:\windows\System32\Drivers\aswSP.SYS 290816 bytes (AVAST Software, avast! self protection module) 0xADC65000 C:\windows\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack) 0xB90CE000 C:\windows\System32\DRIVERS\rdpdr.sys 196608 bytes (Microsoft Corporation, Microsoft RDP Device redirector) 0xF75A8000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT) 0xADEDE000 C:\windows\System32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr) 0xF740F000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver) 0xB55FF000 C:\windows\System32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver) 0xB5733000 C:\windows\System32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver) 0xF74B2000 dmio.sys 155648 bytes (Microsoft Corp., Veritas Software, NT Disk Manager I/O Driver) 0xB91DE000 C:\windows\System32\DRIVERS\e100b325.sys 155648 bytes (Intel Corporation, Intel® PRO/100 Adapter NDIS 5.1 driver) 0xB562A000 C:\windows\System32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator) 0xAFA17000 C:\windows\System32\Drivers\Fastfat.SYS 147456 bytes (Microsoft Corporation, Fast FAT File System Driver) 0xB9170000 C:\windows\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices)) 0xB9129000 C:\windows\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver) 0xB914D000 C:\windows\system32\drivers\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library) 0xAD859000 C:\windows\System32\Drivers\RDPWD.SYS 143360 bytes (Microsoft Corporation, RDP Terminal Stack Driver (US/Canada Only, Not for Export)) 0xB5711000 C:\windows\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock) 0xB5650000 C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys 135168 bytes (SUPERAdBlocker.com and SUPERAntiSpyware.com, SASKUTIL.SYS) 0x806EE000 ACPI_HAL 131840 bytes 0x806EE000 C:\windows\system32\hal.dll 131840 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL) 0xF7465000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager) 0xF74D8000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver) 0xF787D000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver) 0xF7864000 IPVNMon.sys 102400 bytes (Visual Networks, IPVNMon) 0xF749A000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver) 0xAE743000 C:\windows\System32\Drivers\aswMon2.SYS 94208 bytes (AVAST Software, avast! File System Filter Driver for Windows XP) 0xF743C000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface) 0xB90FE000 C:\windows\System32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption)) 0xAFA02000 C:\windows\System32\Drivers\dump_IdeChnDr.sys 86016 bytes 0xF7485000 IdeChnDr.sys 86016 bytes (Intel Corporation, Intel Application Accelerator Driver) 0xADF59000 C:\windows\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper) 0xB9115000 C:\windows\System32\DRIVERS\parport.sys 81920 bytes (Microsoft Corporation, Parallel Port Driver) 0xB9204000 C:\windows\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver) 0xB57B4000 C:\windows\System32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver) 0xBF000000 C:\windows\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver) 0xF7453000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver) 0xF7597000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator) 0xADFEE000 C:\windows\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver) 0xF76B7000 C:\windows\System32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver) 0xF76A7000 C:\windows\System32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver) 0xF7687000 C:\windows\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter) 0xF76C7000 C:\windows\System32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver) 0xB063F000 C:\windows\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter) 0xF7557000 C:\windows\System32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB) 0xF7637000 C:\windows\System32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll) 0xF7697000 C:\windows\System32\DRIVERS\i8042prt.sys 53248 bytes (Microsoft Corporation, i8042 Port Driver) 0xF76E7000 C:\windows\System32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver) 0xF7617000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver) 0xF7587000 C:\windows\System32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol) 0xF7657000 agp440.sys 45056 bytes (Microsoft Corporation, 440 NT AGP Filter) 0xBA7C8000 C:\windows\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver) 0xF76D7000 C:\windows\System32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver) 0xF7607000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager) 0xF76F7000 C:\windows\System32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver) 0xBA016000 C:\windows\System32\Drivers\aswTdi.SYS 40960 bytes (AVAST Software, avast! TDI Filter Driver) 0xF75F7000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver) 0xF7547000 C:\windows\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy) 0xF7647000 PxHelp20.sys 40960 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP) 0xF7577000 C:\windows\System32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver) 0xF7627000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver) 0xBA738000 C:\windows\System32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver) 0xBA026000 C:\windows\System32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier) 0xBA006000 C:\windows\System32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver) 0xADABD000 C:\windows\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver) 0xF74F7000 C:\windows\System32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver) 0xF7767000 C:\windows\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver) 0xF77FF000 C:\windows\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver) 0xF7817000 C:\windows\System32\DRIVERS\fdc.sys 28672 bytes (Microsoft Corporation, Floppy Disk Controller Driver) 0xF7707000 C:\windows\System32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension) 0xF7777000 C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS 28672 bytes (SUPERAdBlocker.com and SUPERAntiSpyware.com, SASDIFSV.SYS) 0xF779F000 C:\windows\System32\DRIVERS\USBSTOR.SYS 28672 bytes (Microsoft Corporation, USB Mass Storage Class Driver) 0xF778F000 C:\windows\System32\Drivers\Aavmker4.SYS 24576 bytes (AVAST Software, avast! Base Kernel-Mode Device Driver for Windows NT/2000/XP) 0xF780F000 C:\windows\System32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver) 0xF7807000 C:\windows\System32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver) 0xB4A47000 C:\windows\System32\Drivers\TDTCP.SYS 24576 bytes (Microsoft Corporation, TCP Transport Driver) 0xF781F000 C:\windows\System32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver) 0xF7757000 C:\windows\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver) 0xF776F000 C:\windows\System32\Drivers\aswRdr.SYS 20480 bytes (AVAST Software, avast! TDI RDR Driver) 0xB9407000 C:\windows\System32\DRIVERS\flpydisk.sys 20480 bytes (Microsoft Corporation, Floppy Driver) 0xF775F000 C:\windows\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver) 0xF770F000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager) 0xF771F000 C:\windows\System32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library) 0xF7727000 C:\windows\System32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel® mini-port/call-manager driver) 0xF7717000 C:\windows\System32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper) 0xF77F7000 C:\windows\system32\DRIVERS\usbohci.sys 20480 bytes (Microsoft Corporation, OHCI USB Miniport Driver) 0xB0842000 C:\windows\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver) 0xB8F1D000 C:\windows\System32\Drivers\ASPI32.SYS 16384 bytes (Adaptec, ASPI for WIN32 Kernel Driver) 0xBA734000 C:\windows\System32\DRIVERS\eawdmfd.sys 16384 bytes (Compaq Computer Corporation, Compaq EAWDMFD driver) 0xF789B000 IdeBusDr.sys 16384 bytes (Intel Corporation, Intel Application Accelerator Driver) 0xBA13F000 C:\windows\System32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver) 0xAFF10000 C:\windows\System32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver) 0xBA71C000 C:\windows\System32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator) 0xB11E4000 C:\windows\System32\Drivers\aswFsBlk.SYS 12288 bytes (AVAST Software, avast! File System Access Blocking Driver) 0xF7897000 C:\windows\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver) 0xB0BC5000 C:\windows\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver) 0xAE59F000 C:\windows\system32\DRIVERS\MaVc2K.sys 12288 bytes (Mobile Action Technology Inc., Mobile Action Virtual Control) 0xBA710000 C:\windows\System32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver) 0xBA730000 C:\windows\System32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver) 0xF79F3000 C:\windows\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver) 0xF798D000 dmload.sys 8192 bytes (Microsoft Corp., Veritas Software., NT Disk Manager Startup Driver) 0xF79F1000 C:\windows\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver) 0xF798B000 intelide.sys 8192 bytes (Microsoft Corporation, Intel PCI IDE Driver) 0xF7987000 C:\windows\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL) 0xF79F5000 C:\windows\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator) 0xB322B000 C:\windows\System32\Drivers\ParVdm.SYS 8192 bytes (Microsoft Corporation, VDM Parallel Driver) 0xF79F7000 C:\windows\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport) 0xF79C5000 C:\windows\System32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator) 0xF79C7000 C:\windows\System32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver) 0xF7989000 C:\windows\System32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll) 0xF7A77000 C:\windows\System32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver) 0xB812E000 C:\windows\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk) 0xB8129000 C:\Program Files\ewido anti-malware\guard.sys 4096 bytes 0xB9EBB000 C:\windows\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver) ============================================== >Stealth ============================================== WARNING: Virus alike driver modification [aswmon2.sys] WARNING: Virus alike driver modification [ndistapi.sys] WARNING: Virus alike driver modification [bthpan.sys] WARNING: Virus alike driver modification [sffp_mmc.sys] WARNING: Virus alike driver modification [hidusb.sys] WARNING: Virus alike driver modification [hsfdpsp2.sys] WARNING: Virus alike driver modification [dxapi.sys] WARNING: Virus alike driver modification [atinrvxx.sys] WARNING: Virus alike driver modification [mup.sys] WARNING: Virus alike driver modification [ndisip.sys] WARNING: Virus alike driver modification [sffp_sd.sys] WARNING: Virus alike driver modification [slip.sys] WARNING: Virus alike driver modification [irenum.sys] WARNING: Virus alike driver modification [wadv08nt.sys] WARNING: Virus alike driver modification [sfloppy.sys] WARNING: Virus alike driver modification [ati1mdxx.sys] WARNING: Virus alike driver modification [acpiec.sys] WARNING: Virus alike driver modification [cpqdap01.sys] WARNING: Virus alike driver modification [wadv07nt.sys] WARNING: Virus alike driver modification [mdmxsdk.sys] WARNING: Virus alike driver modification [wadv09nt.sys] WARNING: Virus alike driver modification [sffdisk.sys] WARNING: Virus alike driver modification [wadv11nt.sys] WARNING: Virus alike driver modification [MaVc2K.sys] WARNING: Virus alike driver modification [pcmcia.sys] WARNING: Virus alike driver modification [nikedrv.sys] WARNING: Virus alike driver modification [rio8drv.sys] WARNING: Virus alike driver modification [riodrv.sys] WARNING: Virus alike driver modification [ws2ifsl.sys] WARNING: Virus alike driver modification [tdpipe.sys] WARNING: Virus alike driver modification [ati1pdxx.sys] WARNING: Virus alike driver modification [fsvga.sys] WARNING: Virus alike driver modification [mouhid.sys] WARNING: Virus alike driver modification [usbvideo.sys] WARNING: Virus alike driver modification [tunmp.sys] WARNING: Virus alike driver modification [nwlnkflt.sys] WARNING: Virus alike driver modification [ftdisk.sys] WARNING: Virus alike driver modification [mtlmnt5.sys] WARNING: Virus alike driver modification [mutohpen.sys] WARNING: Virus alike driver modification [usb8023.sys] WARNING: Virus alike driver modification [usb8023x.sys] WARNING: Virus alike driver modification [slnt7554.sys] WARNING: Virus alike driver modification [fltmgr.sys] WARNING: Virus alike driver modification [mtlstrm.sys] WARNING: Virus alike driver modification [slwdmsup.sys] WARNING: Virus alike driver modification [recagent.sys] WARNING: Virus alike driver modification [IdeBusDr.sys] WARNING: Virus alike driver modification [atinmdxx.sys] WARNING: Virus alike driver modification [atinttxx.sys] WARNING: Virus alike driver modification [afd.sys] WARNING: Virus alike driver modification [cbidf2k.sys] WARNING: Virus alike driver modification [dne2000.sys] WARNING: Virus alike driver modification [rdpwd.sys] WARNING: Virus alike driver modification [ks.sys] WARNING: Virus alike driver modification [diskdump.sys] WARNING: Virus alike driver modification [wacompen.sys] WARNING: Virus alike driver modification [asyncmac.sys] WARNING: Virus alike driver modification [atinpdxx.sys] WARNING: Virus alike driver modification [fastfat.sys] WARNING: Virus alike driver modification [usbport.sys] WARNING: Virus alike driver modification [hdaudbus.sys] WARNING: Virus alike driver modification [ndisuio.sys] WARNING: Virus alike driver modification [smclib.sys] WARNING: Virus alike driver modification [portcls.sys] WARNING: Virus alike driver modification [tape.sys] WARNING: Virus alike driver modification [usbscan.sys] WARNING: Virus alike driver modification [streamip.sys] WARNING: Virus alike driver modification [ipnat.sys] WARNING: Virus alike driver modification [dmio.sys] WARNING: Virus alike driver modification [e100b325.sys] WARNING: Virus alike driver modification [mssmbios.sys] WARNING: Virus alike driver modification [serenum.sys] WARNING: Virus alike driver modification [usbintel.sys] WARNING: Virus alike driver modification [KMW_SYS.sys] WARNING: Virus alike driver modification [MODEMCSA.sys] WARNING: Virus alike driver modification [netbt.sys] WARNING: Virus alike driver modification [KID_USB.sys] WARNING: Virus alike driver modification [nwrdr.sys] WARNING: Virus alike driver modification [HPZipr12.sys] WARNING: Virus alike driver modification [raspti.sys] WARNING: Virus alike driver modification [s3gnbm.sys] WARNING: Virus alike driver modification [hcwPP2.sys] WARNING: Virus alike driver modification [bthenum.sys] WARNING: Virus alike driver modification [ccdecode.sys] WARNING: Virus alike driver modification [usbohci.sys] WARNING: Virus alike driver modification [kmixer.sys] WARNING: Virus alike driver modification [rdbss.sys] WARNING: Virus alike driver modification [ptilink.sys] WARNING: Virus alike driver modification [ntmtlfax.sys] WARNING: Virus alike driver modification [mrxdav.sys] WARNING: Virus alike driver modification [ndis.sys] WARNING: Virus alike driver modification [cdaudio.sys] WARNING: Virus alike driver modification [acpi.sys] WARNING: Virus alike driver modification [bthusb.sys] WARNING: Virus alike driver modification [wpdusb.sys] WARNING: Virus alike driver modification [nv4_mini.sys] WARNING: Virus alike driver modification [msfs.sys] WARNING: Virus alike driver modification [tdi.sys] WARNING: Virus alike driver modification [hidir.sys] WARNING: Virus alike driver modification [wstcodec.sys] WARNING: Virus alike driver modification [rdpdr.sys] WARNING: Virus alike driver modification [partmgr.sys] WARNING: Virus alike driver modification [rmcast.sys] WARNING: Virus alike driver modification [flpydisk.sys] WARNING: Virus alike driver modification [secdrv.sys] WARNING: Virus alike driver modification [usbuhci.sys] WARNING: Virus alike driver modification [ipinip.sys] WARNING: Virus alike driver modification [vga.sys] WARNING: Virus alike driver modification [ati1ttxx.sys] WARNING: Virus alike driver modification [tsbvcap.sys] WARNING: Virus alike driver modification [HPZius12.sys] WARNING: Virus alike driver modification [tdtcp.sys] WARNING: Virus alike driver modification [hsfbs2s2.sys] WARNING: Virus alike driver modification [watv06nt.sys] WARNING: Virus alike driver modification [tcpip6.sys] WARNING: Virus alike driver modification [mouclass.sys] WARNING: Virus alike driver modification [TVICHW32.SYS] WARNING: Virus alike driver modification [aswRdr.sys] WARNING: Virus alike driver modification [eaps2kbd.sys] WARNING: Virus alike driver modification [EAWDMFD.SYS] WARNING: Virus alike driver modification [kbdclass.sys] WARNING: Virus alike driver modification [hidparse.sys] WARNING: Virus alike driver modification [pciidex.sys] WARNING: Virus alike driver modification [maz500m.sys] WARNING: Virus alike driver modification [ASPI32.SYS] WARNING: Virus alike driver modification [MaVctrl.sys] WARNING: Virus alike driver modification [sonydcam.sys] WARNING: Virus alike driver modification [watv10nt.sys] WARNING: Virus alike driver modification [hidbth.sys] WARNING: Virus alike driver modification [usbcamd.sys] WARNING: Virus alike driver modification [usbcamd2.sys] WARNING: Virus alike driver modification [usbprint.sys] WARNING: Virus alike driver modification [cinemst2.sys] WARNING: Virus alike driver modification [ati1snxx.sys] WARNING: Virus alike driver modification [usbstor.sys] WARNING: Virus alike driver modification [http.sys] WARNING: Virus alike driver modification [bthport.sys] WARNING: Virus alike driver modification [fdc.sys] WARNING: Virus alike driver modification [atinsnxx.sys] WARNING: Virus alike driver modification [aavmker4.sys] WARNING: Virus alike driver modification [ati1xbxx.sys] WARNING: Virus alike driver modification [modem.sys] WARNING: Virus alike driver modification [usbehci.sys] WARNING: Virus alike driver modification [delta.sys] WARNING: Virus alike driver modification [rndismp.sys] WARNING: Virus alike driver modification [rndismpx.sys] WARNING: Virus alike driver modification [ati1raxx.sys] WARNING: Virus alike driver modification [npfs.sys] WARNING: Virus alike driver modification [atmepvc.sys] WARNING: Virus alike driver modification [atinxbxx.sys] WARNING: Virus alike driver modification [usbccgp.sys] WARNING: Virus alike driver modification [G400m.sys] WARNING: Virus alike driver modification [nwlnkfwd.sys] WARNING: Virus alike driver modification [ati2mtaa.sys] WARNING: Virus alike driver modification [ipfltdrv.sys] WARNING: Virus alike driver modification [rawwan.sys] WARNING: Virus alike driver modification [wanarp.sys] WARNING: Virus alike driver modification [netbios.sys] WARNING: Virus alike driver modification [ati1xsxx.sys] WARNING: Virus alike driver modification [msgpc.sys] WARNING: Virus alike driver modification [atmuni.sys] WARNING: Virus alike driver modification [srv.sys] WARNING: Virus alike driver modification [processr.sys] WARNING: Virus alike driver modification [tcpip.sys] WARNING: Virus alike driver modification [disk.sys] WARNING: Virus alike driver modification [intelppm.sys] WARNING: Virus alike driver modification [ati1tuxx.sys] WARNING: Virus alike driver modification [bthprint.sys] WARNING: Virus alike driver modification [mavcomm.sys] WARNING: Virus alike driver modification [ip6fw.sys] WARNING: Virus alike driver modification [crusoe.sys] WARNING: Virus alike driver modification [hidclass.sys] WARNING: Virus alike driver modification [isapnp.sys] WARNING: Virus alike driver modification [amdk6.sys] WARNING: Virus alike driver modification [amdk7.sys] WARNING: Virus alike driver modification [bthmodem.sys] WARNING: Virus alike driver modification [update.sys] WARNING: Virus alike driver modification [vpctcom.sys] WARNING: Virus alike driver modification [nmnt.sys] WARNING: Virus alike driver modification [slntamr.sys] WARNING: Virus alike driver modification [termdd.sys] WARNING: Virus alike driver modification [sisagp.sys] WARNING: Virus alike driver modification [raspppoe.sys] WARNING: Virus alike driver modification [imapi.sys] WARNING: Virus alike driver modification [beep.sys] WARNING: Virus alike driver modification [mnmdd.sys] WARNING: Virus alike driver modification [rdpcdd.sys] WARNING: Virus alike driver modification [viaagp.sys] WARNING: Virus alike driver modification [agp440.sys] WARNING: Virus alike driver modification [mountmgr.sys] WARNING: Virus alike driver modification [alim1541.sys] WARNING: Virus alike driver modification [p3.sys] WARNING: Virus alike driver modification [amdagp.sys] WARNING: Virus alike driver modification [swenum.sys] WARNING: Virus alike driver modification [wmilib.sys] WARNING: Virus alike driver modification [fips.sys] WARNING: Virus alike driver modification [uagp35.sys] WARNING: Virus alike driver modification [agpcpq.sys] WARNING: Virus alike driver modification [mtxparhm.sys] WARNING: Virus alike driver modification [mrxsmb.sys] WARNING: Virus alike driver modification [gagp30kx.sys] WARNING: Virus alike driver modification [irbus.sys] WARNING: Virus alike driver modification [usbd.sys] WARNING: Virus alike driver modification [aswTdi.sys] WARNING: Virus alike driver modification [raspptp.sys] WARNING: Virus alike driver modification [stream.sys] WARNING: Virus alike driver modification [mardpnp.sys] WARNING: Virus alike driver modification [classpnp.sys] WARNING: Virus alike driver modification [mardp2k.sys] WARNING: Virus alike driver modification [mspqm.sys] WARNING: Virus alike driver modification [maz500u.sys] WARNING: Virus alike driver modification [HPZid412.sys] WARNING: Virus alike driver modification [rasl2tp.sys] WARNING: Virus alike driver modification [tosdvd.sys] WARNING: Virus alike driver modification [CVirtA.sys] WARNING: Virus alike driver modification [atinraxx.sys] WARNING: Virus alike driver modification [volsnap.sys] WARNING: Virus alike driver modification [i8042prt.sys] WARNING: Virus alike driver modification [dmusic.sys] WARNING: Virus alike driver modification [mspclock.sys] WARNING: Virus alike driver modification [intelide.sys] WARNING: Virus alike driver modification [mstee.sys] WARNING: Virus alike driver modification [atmlane.sys] WARNING: Virus alike driver modification [nwlnkspx.sys] WARNING: Virus alike driver modification [StarOpen.sys] WARNING: Virus alike driver modification [swmidi.sys] WARNING: Virus alike driver modification [ati1btxx.sys] WARNING: Virus alike driver modification [ntfs.sys] WARNING: Virus alike driver modification [redbook.sys] WARNING: Virus alike driver modification [atinbtxx.sys] WARNING: Virus alike driver modification [vdmindvd.sys] WARNING: Virus alike driver modification [dmload.sys] WARNING: Virus alike driver modification [rootmdm.sys] WARNING: Virus alike driver modification [smbali.sys] WARNING: Virus alike driver modification [rfcomm.sys] WARNING: Virus alike driver modification [usbhub.sys] WARNING: Virus alike driver modification [atmarpc.sys] WARNING: Virus alike driver modification [drmk.sys] WARNING: Virus alike driver modification [vmodem.sys] WARNING: Virus alike driver modification [arp1394.sys] WARNING: Virus alike driver modification [sysaudio.sys] WARNING: Virus alike driver modification [nic1394.sys] WARNING: Virus alike driver modification [splitter.sys] WARNING: Virus alike driver modification [cdrom.sys] WARNING: Virus alike driver modification [nwlnknb.sys] WARNING: Virus alike driver modification [atinxsxx.sys] WARNING: Virus alike driver modification [ati1rvxx.sys] WARNING: Virus alike driver modification [cdfs.sys] WARNING: Virus alike driver modification [mf.sys] WARNING: Virus alike driver modification [serial.sys] WARNING: Virus alike driver modification [vvoice.sys] WARNING: Virus alike driver modification [udfs.sys] WARNING: Virus alike driver modification [parvdm.sys] WARNING: Virus alike driver modification [serscan.sys] WARNING: Virus alike driver modification [pci.sys] WARNING: Virus alike driver modification [hsfcxts2.sys] WARNING: Virus alike driver modification [psched.sys] WARNING: Virus alike driver modification [ati2mtag.sys] WARNING: Virus alike driver modification [bridge.sys] WARNING: Virus alike driver modification [atintuxx.sys] WARNING: Virus alike driver modification [sr.sys] WARNING: Virus alike driver modification [ipsec.sys] WARNING: Virus alike driver modification [mskssrv.sys] WARNING: Virus alike driver modification [mcd.sys] WARNING: Virus alike driver modification [s3sav4m.sys] WARNING: Virus alike driver modification [sdbus.sys] WARNING: Virus alike driver modification [fs_rec.sys] WARNING: Virus alike driver modification [dmboot.sys] WARNING: Virus alike driver modification [parport.sys] WARNING: Virus alike driver modification [videoprt.sys] WARNING: Virus alike driver modification [wdmaud.sys] WARNING: Virus alike driver modification [nabtsfec.sys] WARNING: Virus alike driver modification [rasacd.sys] WARNING: Virus alike driver modification [nwlnkipx.sys] WARNING: Virus alike driver modification [IdeChnDr.sys] WARNING: Virus alike driver modification [ndiswan.sys] WARNING: Virus alike driver modification [KID_LIB.sys] WARNING: Virus alike driver modification [mqac.sys] WARNING: Virus alike driver modification [ksecdd.sys] WARNING: Virus alike driver modification [aswmon.sys] WARNING: Virus alike driver modification [slnthal.sys] WARNING: Virus alike driver modification [ac97intc.sys] WARNING: Virus alike driver modification [scsiport.sys] WARNING: Virus alike driver modification [atapi.sys] WARNING: Virus alike driver modification [ipvnmon.sys]