Spyware / Malware / Virus Removal
computer may be infected but I'm not certain
12 min read
Page 1 of 2
Next →
This thread's last reply is from February 22, 2011, 10:53 AM UTC . Advice, software, and links
below may be out of date — treat specific steps and download links with caution.
Looking for the outcome? ✨ Ask AI
hi========== Extra Registry (SafeList) ========== ========== File Associations ========== ========== Shell Spawning ========== ========== Security Center Settings ========== ========== System Restore Settings ========== ========== Firewall Settings ========== ========== Authorized Applications List ========== ========== HKEY_LOCAL_MACHINE Uninstall List ========== ========== HKEY_CURRENT_USER Uninstall List ========== ========== Last 10 Event Log Errors ==========
OTL logfile created on: 19/02/2011 9:43:33 AM - Run 1========== Processes (SafeList) ========== ========== Modules (SafeList) ========== ========== Win32 Services (SafeList) ========== ========== Driver Services (SafeList) ========== ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== ========== FireFox ========== ========== Files/Folders - Created Within 30 Days ========== ========== Files - Modified Within 30 Days ========== ========== Files Created - No Company Name ========== ========== LOP Check ========== ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.* > < %systemroot%\Fonts\*.com > < %systemroot%\Fonts\*.dll > < %systemroot%\Fonts\*.ini > < %systemroot%\Fonts\*.ini2 > < %systemroot%\Fonts\*.exe > < %systemroot%\system32\spool\prtprocs\w32x86\*.* > < %systemroot%\REPAIR\*.bak1 > < %systemroot%\REPAIR\*.ini > < %systemroot%\system32\*.jpg > < %systemroot%\*.jpg > < %systemroot%\*.png > < %systemroot%\*.scr > < %systemroot%\*._sy > < %APPDATA%\Adobe\Update\*.* > < %ALLUSERSPROFILE%\Favorites\*.* > < %APPDATA%\Microsoft\*.* > < %PROGRAMFILES%\*.* > < %APPDATA%\Update\*.* > < %systemroot%\*. /mp /s > < %systemroot%\System32\config\*.sav > < %PROGRAMFILES%\bak. /s > < %systemroot%\system32\bak. /s > < %ALLUSERSPROFILE%\Start Menu\*.lnk /x > < %systemroot%\system32\config\systemprofile\*.dat /x > < %systemroot%\*.config > < %systemroot%\system32\*.db > < %PROGRAMFILES%\Internet Explorer\*.dat > < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x > < %USERPROFILE%\Desktop\*.exe > < %PROGRAMFILES%\Common Files\*.* > < %systemroot%\*.src > < %systemroot%\install\*.* > < %systemroot%\system32\DLL\*.* > < %systemroot%\system32\HelpFiles\*.* > < %systemroot%\system32\rundll\*.* > < %systemroot%\winn32\*.* > < %systemroot%\Java\*.* > < %systemroot%\system32\test\*.* > < %systemroot%\system32\Rundll32\*.* > < %systemroot%\AppPatch\Custom\*.* > < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > ========== Files - Unicode (All) ==========
**In any case where you happen to be busy or unable to give us a reply, we would be grateful if you keep us informed in advance and we will be more than happy to wait. Failure to do so we will have your thread closed in THREE(3) days.
Hello there,
MSB146
I'm
Conspire , I'll be glad to help you with your computer problems.
Please observe these rules while we work:
Read the entire procedure It is important to perform ALL actions in sequence. If you don't know, stop and ask! Please reply to this thread. Do not start a new topic. Stick with me till you're given the all clear. Remember, absence of symptoms does not mean the infection is all gone. Don't attempt to clean your computer with any tools other than the ones I ask you to use during the cleanup process. IMPORTANT NOTE : Please do not delete anything unless instructed to.
—————————————————————————————————
I'm seeing two possible security software which may or may not be the cause. There are traces of Kaspersky driver installed in your system and ZoneAlarm Extreme Security.
Assuming that you bought ZA, have you actually properly remove Kas with its removal tool?
—————————————————————————————————
Let's do a couple of scans just to be sure.
[external image: Posted Image] Please download GMER from one of the following locations, and save it to your desktop: Main Mirror This version will download a randomly named file (Recommended) Zip Mirror This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop. Extract the contents of the zipped file to desktop (applicable only to Zip mirror) . Double click [external image: Posted Image] or [external image: Posted Image] on your desktop. If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO .[external image: Posted Image] [external image: Posted Image] Click the image to enlarge it In the right panel, you will see several boxes that have been checked. Uncheck the following … IAT/EAT Drives/Partition other than Systemdrive (typically C:\) Show All (don't miss this one) Then click the Scan button & wait for it to finish. Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post. Save it where you can easily find it, such as your desktop, and attach it in your reply. **Caution**
=================================================== ESET Online Scanner I'd like us to scan your machine with ESET OnlineScan
Note: If you are using Windows Vista/7, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.
*Note It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time. Hold down Control and click on the following link to open ESET OnlineScan in a new window. Click the [external image: Posted Image] button. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop. Double click on the [external image: Posted Image] icon on your desktop. Check [external image: Posted Image] Click the [external image: Posted Image] button. Accept any security warnings from your browser. Check [external image: Posted Image] Make sure that the option "Remove found threats" is Unchecked Push the Start button. ESET will then download updates for itself, install itself, and begin Look for report in C:\Program Files\ESET\ESET Online Scanner\log.txt . Include the contents of this report in your next reply. Select Uninstall application on close check box and push [external image: Posted Image] =================================================== On your next reply please post : GMER log
Let me know if you have any problems in performing with the steps above or any questions you may have.
Good Day!
Hello Conspire
thank you for your assistance.
I have only ever purchased Zonealarm so I dont know how Kas got onto my system.
Here are the logs as requested
sorry Conspire, I am not sure if the previous posts will show the logs properly so I'll post the Gmer in 2 because its so large
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6419
# api_version=3.0.2
# EOSSerial=d95d937709facd45bbb51bd34f87a5a9
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-02-20 03:45:33
# local_time=2011-02-20 02:15:33 (+0930, Cen. Australia Daylight Time)
# country="Australia"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# compatibility_mode=9217 16776869 100 77 14703049 18546161 0 0
# scanned=75618
# found=4
# cleaned=0
# scan_time=6015
C:\Documents and Settings\All Users\Application Data\ReviverSoft\Registry Reviver\InstallCache\{05B64610-ED45-40AC-89A3-507F6B6A25B9}\Registry Reviver.msi a variant of Win32/SlowPCfighter application (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\John Niarhos\Application Data\OpenCandy\OpenCandy_86307C4674BA43DBBA6D16D9DC4F7649\p1v1_PPIRegistryReviver_w.exe a variant of Win32/SlowPCfighter application (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\John Niarhos\Application Data\OpenCandy\OpenCandy_86307C4674BA43DBBA6D16D9DC4F7649\PPIRegistryReviverSetup.exe a variant of Win32/SlowPCfighter application (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\John Niarhos\My Documents\LimeWire\Saved\tantra lounge - best track ever.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan (unable to clean) 00000000000000000000000000000000 I
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwReplaceKey [0xA4418F12]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwReplyPort [0xA454E32A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwReplyWaitReceivePort [0xA454E1F0]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRequestWaitReplyPort [0xA43FAE84]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRestoreKey [0xA441A07E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwResumeThread [0xA4550028]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwSaveKey [0xA454B1FE]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSecureConnectPort [0xA43FB5B8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwSetContextThread [0xA454CC76]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetInformationFile [0xA43F5B98]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwSetInformationToken [0xA454E86C]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetSecurityObject [0xA4419BA6]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwSetSystemInformation [0xA454FC90]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetValueKey [0xA4416BA8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwSuspendProcess [0xA454FD74]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwSuspendThread [0xA454FE9C]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSystemDebugControl [0xA44110A6]
SSDT \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0xA16D3620]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwTerminateThread [0xA454C80E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwUnmapViewOfSection [0xA454FA06]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) ZwWriteVirtualMemory [0xA454C998]
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) FsRtlCheckLockForReadAccess
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab) IoIsOperationSynchronous
—- Kernel code sections - GMER 1.0.15 —-
.text ntkrnlpa.exe!FsRtlCheckLockForReadAccess 804EAF84 5 Bytes JMP A45419D4 \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab)
.text ntkrnlpa.exe!IoIsOperationSynchronous 804EF912 5 Bytes JMP A4541DAE \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wxp_x86]/Kaspersky Lab)
.text ntkrnlpa.exe!ZwCallbackReturn + 2C9C 80504538 12 Bytes [BE, BA, 3F, A4, 82, FF, 40, …] {MOV ESI, 0x82a43fba; INC DWORD [EAX-0x5c]; STOSB ; ADD EAX, [ECX-0x5c]}
.text ntkrnlpa.exe!ZwCallbackReturn + 2CAC 80504548 16 Bytes [3C, A8, 41, A4, FE, DE, 54, …]
.text ntkrnlpa.exe!ZwCallbackReturn + 2D68 80504604 12 Bytes [08, F2, 54, A4, 58, 85, 41, …] {OR DL, DH; PUSH ESP; MOVSB ; POP EAX; TEST [ECX-0x5c], EAX; XCHG ESI, EAX; XCHG [ECX-0x5c], EAX}
.text ntkrnlpa.exe!ZwCallbackReturn + 2EE4 80504780 16 Bytes [1E, 96, 41, A4, 12, 8F, 41, …]
.text ntkrnlpa.exe!ZwCallbackReturn + 2F7C 80504818 4 Bytes CALL FAF2EC71
.text …
.text C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
I seem to be having difficulties posting the logs.
Do you have any suggestions
The logs are too long to fit into one post, that's why you had difficulty posting it. But no worries about that, I've downloaded the attachment.
Run
OTL.exe
=================================================== On your next reply please post : OTL fix log
Let me know if you have any problems in performing with the steps above or any questions you may have.
Good Day!
Thank you Conspire.========== Processes (SafeList) ========== ========== Modules (SafeList) ========== ========== Win32 Services (SafeList) ========== ========== Driver Services (SafeList) ========== ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== ========== Files/Folders - Created Within 30 Days ========== ========== Files - Modified Within 30 Days ========== ========== Files Created - No Company Name ========== ========== Files - Unicode (All) ==========
Hi,
I need you to make a batch file.
Open a new Notepad session
Click the Start button, click Run In the run box type notepad Click OK In the notepad, Click "Format " and be certain that Word Wrap is not checked. Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE@echo off
sc stop KLIF
sc delete KLIF
sc stop kl1
sc delete kl1
if exist C:\WINDOWS\system32\drivers\klif.sys attrib -s -h -r C:\WINDOWS\system32\drivers\klif.sys
if exist C:\WINDOWS\system32\drivers\klif.sys del /f /q C:\WINDOWS\system32\drivers\klif.sys
if exist C:\WINDOWS\System32\DRIVERS\kl1.sys attrib -s -h -r C:\WINDOWS\System32\DRIVERS\kl1.sys
if exist C:\WINDOWS\System32\DRIVERS\kl1.sys del /f /q C:\WINDOWS\System32\DRIVERS\kl1.sys
del /Q %0
In the notepad
Click File,
Save as… , and set the Save in to your Desktop
In the filename box, type (including quotation marks) as the filename:
"fix.bat"
Click
Save
You should now have a file on your desktop with an icon like this
[external image: Posted Image]
Double click on
fix.bat & allow it to run. A small black screen may briefly flash on and off, that's normal.
===================================================
Remove any attached USB drive on your computer before proceeding.
Run
OTL.exe
Copy/paste the following text written inside of the code box into the Custom Scans/Fixes :OTL
O33 - MountPoints2\{7f0272b9-f50f-11de-964b-00216b469a86}\Shell\AutoRun\command - "" = G:\InstallTomTomHOME.exe
O33 - MountPoints2\{aa1058a1-1f41-11df-9690-00216b469a86}\Shell - "" = AutoRun
O33 - MountPoints2\{aa1058a1-1f41-11df-9690-00216b469a86}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{aa1058a1-1f41-11df-9690-00216b469a86}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe MS32DLL.dll.vbs
O33 - MountPoints2\{b63ea508-f0ba-11dd-947f-00216b469a86}\Shell\AutoRun\command - "" = setupSNK.exe
:Commands
[REBOOT]
Then click the Run Fix Let the program run unhindered, reboot when it is done Then post Fix OTL log as well as a new OTL log and( don't check the boxes beside LOP Check or Purity this time ) =================================================== On your next reply please post : Fix OTL log
Let me know if you have any problems in performing with the steps above or any questions you may have.
Good Day!
Hi========== Processes (SafeList) ========== ========== Modules (SafeList) ========== ========== Win32 Services (SafeList) ========== ========== Driver Services (SafeList) ========== ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== ========== Files/Folders - Created Within 30 Days ========== ========== Files - Modified Within 30 Days ========== ========== Files Created - No Company Name ========== ========== Files - Unicode (All) ==========
Allow me to clarify your problem. You did a reinstallation on your toolbars or the firefox as a whole? Exactly which toolbars that you need to use?
I dont use zonealarm toolbar and am not sure if i need it. I do use bookmark toolbar and foxlingo toolbar. Whe I turned on my computer this morning the toolbars werent there. Only after disabling forcefield toolbar is firefox showing the toolbars. Starting to think its a zonealarm issue
Try uninstall zonealarm's toolbar since you don't need it.
