Spyware / Malware / Virus Removal

Please help - possible tdss.serv infection

17 min read

Looking for the outcome? Ask AI

dawooksta

Post #16July 11, 2011, 1:10 AM UTC

Hi again Satchfan

The bride-to-be is my gf's sister, so a large goup of her friends were out, with my other half acting as organiser. Apparently the damage was done at the last cocktail bar - v. tasty Mohitos. Can't blame her - a Mohito is my favourite too.

The PC is running well ….as well as it can in safe mode. None of the old problems like the hidden files, random internet redirects or even (very early on in the process) bogus messages claiming my PC is infected and I need to pay $20 to fix it. It still crashes to a blue screen during the windows loading stage if I try to boot in "normal" mode. Maybe some damage done as a legacy of the infection, even if the infection is now cured? I've backed up all the data from this machine now….if I really have to I'll do a format and reinstall windows, if that will fix the problem. If there's still a problem with the MBR would a format fix it though?

meanwhile here are the logs.

VIRUS TOTAL - ANALYSIS OF C:\Windows\System32\drivers\tbmlyorq.sys

File already submitted: The file sent has already been analysed by VirusTotal in the past. This is same basic info regarding the sample itself and its last analysis:
MD5: e6d35f3aa51a65eb35c1f2340154a25e
Date first seen: 2009-09-18 00:44:25 (UTC)
Date last seen: 2011-07-09 22:08:44 (UTC)
Detection ratio: 2/43

9 VT Community user(s) with a total of 10723 reputation credit(s) say(s) this sample is goodware. 4 VT Community user(s) with a total of 3406 reputation credit(s) say(s) this sample is malware.
File name:
tbmlyorq.sys
Submission date:
2011-07-10 18:09:09 (UTC)
Current status:
finished
Result:
2/ 43 (4.7%)

VT Community

goodware
Safety score: 75.9%
Compact
Print results
Antivirus Version Last Update Result
AhnLab-V3 2011.07.11.00 2011.07.10 -
AntiVir 7.11.11.46 2011.07.10 -
Antiy-AVL 2.0.3.7 2011.07.10 -
Avast 4.8.1351.0 2011.07.10 -
Avast5 5.0.677.0 2011.07.10 -
AVG 10.0.0.1190 2011.07.10 -
BitDefender 7.2 2011.07.10 -
CAT-QuickHeal 11.00 2011.07.10 -
ClamAV 0.97.0.0 2011.07.10 BC.Heuristics.Rootkit.B-11.MV
Commtouch 5.3.2.6 2011.07.10 -
Comodo 9339 2011.07.10 -
DrWeb 5.0.2.03300 2011.07.10 -
Emsisoft 5.1.0.8 2011.07.10 -
eSafe 7.0.17.0 2011.07.07 Win32.TrojanHorse
eTrust-Vet 36.1.8434 2011.07.08 -
F-Prot 4.6.2.117 2011.07.10 -
F-Secure 9.0.16440.0 2011.07.10 -
Fortinet 4.2.257.0 2011.07.10 -
GData 22 2011.07.10 -
Ikarus T3.1.1.104.0 2011.07.10 -
Jiangmin 13.0.900 2011.07.10 -
K7AntiVirus 9.108.4891 2011.07.10 -
Kaspersky 9.0.0.837 2011.07.10 -
McAfee 5.400.0.1158 2011.07.10 -
McAfee-GW-Edition 2010.1D 2011.07.10 -
Microsoft 1.7000 2011.07.10 -
NOD32 6282 2011.07.10 -
Norman 6.07.10 2011.07.10 -
nProtect 2011-07-10.01 2011.07.10 -
Panda 10.0.3.5 2011.07.10 -
PCTools 8.0.0.5 2011.07.08 -
Prevx 3.0 2011.07.10 -
Rising 23.65.04.03 2011.07.08 -
Sophos 4.67.0 2011.07.10 -
SUPERAntiSpyware 4.40.0.1006 2011.07.10 -
Symantec 20111.1.0.186 2011.07.10 -
TheHacker 6.7.0.1.252 2011.07.10 -
TrendMicro 9.200.0.1012 2011.07.10 -
TrendMicro-HouseCall 9.200.0.1012 2011.07.10 -
VBA32 3.12.16.4 2011.07.08 -
VIPRE 9826 2011.07.10 -
ViRobot 2011.7.9.4560 2011.07.10 -
VirusBuster 14.0.117.0 2011.07.10 -
Additional information
MD5 : e6d35f3aa51a65eb35c1f2340154a25e
SHA1 : aabbd57e20d2e7041f9e7abce6cfd8a53c366537
SHA256: 3da4f51682e7d42c5569f1fb1adc6295182962e36f748219e1d0c8f2389ba516

VT Community

User:
LT1
Reputation:
3403 credits
Comment date:
2010-09-29 17:53:30 (UTC)
Tags: Malware,

Was this comment helpful? Yes (1) | No (11) | Report abuse

User:
siri
Reputation:
2094 credits
Comment date:
2010-10-01 13:42:47 (UTC)
Legit tool: Avenger
Tags: Goodware, avenger, rootkit

Was this comment helpful? Yes (11) | No (3) | Report abuse

User:
Anonymous
Reputation:
1 credits
Comment date:
2010-10-04 15:58:28 (UTC)
SIRI IS CORRECT

This is part of Avenger, a low level driver to remove other malware. Delete it if you wish, Avenger always creates a new random driver when it needs to.
Tags: Goodware,

Was this comment helpful? Yes (10) | No (0) | Report abuse

User:
dr_Bora
Reputation:
437 credits
Comment date:
2010-10-08 21:30:18 (UTC)
Legit file.
Tags: Goodware, rootkit, avenger

ASWMBR version 0.9.7.705 Copyright© 2011 AVAST Software
Run date: 2011-07-10 18:01:32
—————————–
18:01:32.998 OS Version: Windows 6.0.6000
18:01:32.998 Number of processors: 2 586 0xF0D
18:01:32.998 ComputerName: SHANE-PC UserName: Shane
18:01:36.408 Initialize success
18:03:05.991 AVAST engine defs: 11071000
18:04:23.336 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
18:04:23.339 Disk 0 Vendor: Intel___ 1.0. Size: 953875MB BusType: 8
18:04:23.351 Disk 0 MBR read successfully
18:04:23.362 Disk 0 MBR scan
18:04:23.366 Disk 0 Windows VISTA default MBR code
18:04:23.376 Disk 0 scanning sectors +1953533952
18:04:23.402 Disk 0 scanning C:\Windows\system32\drivers
18:04:32.833 Service scanning
18:04:33.174 Service fdc C:\Windows\system32\DRIVERS\fdc.sys **HIDDEN**
18:04:33.182 Service flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys **HIDDEN**
18:04:33.194 Service i8042prt C:\Windows\system32\DRIVERS\i8042prt.sys **HIDDEN**
18:04:33.860 Disk 0 trace - called modules:
18:04:33.878 ntoskrnl.exe CLASSPNP.SYS disk.sys iastorv.sys hal.dll
18:04:33.884 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x84693030]
18:04:33.892 3 ntoskrnl.exe[81ca80af] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x841f5030]
18:04:36.956 AVAST engine scan C:\Windows
18:08:47.130 File: C:\Windows\System32\config\systemprofile\AppData\Local\amehapuvebuqavi.dll **INFECTED** Win32:MalOb-GC [Cryp]
18:13:57.006 File: C:\Windows\System32\config\systemprofile\AppData\Local\shneri.dll **INFECTED** Win32:MalOb-DT [Cryp]
19:21:11.482 AVAST engine scan C:\Users\Shane
19:21:21.414 File: C:\Users\Shane\AppData\Local\BluetoothHelpInit\Cdcrtmm.dll **INFECTED** Win32:Malware-gen
20:04:56.928 AVAST engine scan C:\ProgramData
20:07:20.973 Scan finished successfully
22:30:50.352 Disk 0 MBR has been saved successfully to "C:\Users\Shane\Desktop\10th july\MBR.dat"
22:30:50.360 The log file has been saved successfully to "C:\Users\Shane\Desktop\10th july\aswMBR.txt"

OTL TEXT

OTL logfile created on: 10/07/2011 23:59:03 - Run 1
OTL by OldTimer - Version 3.2.26.0 Folder = C:\Users\Shane\Desktop
Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16982)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

2.00 Gb Total Physical Memory | 1.45 Gb Available Physical Memory | 72.67% Memory free
2.17 Gb Paging File | 1.77 Gb Available in Paging File | 81.39% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 931.52 Gb Total Space | 506.48 Gb Free Space | 54.37% Space Free | Partition Type: NTFS
Drive D: | 2.49 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Drive F: | 495.48 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: SHANE-PC | User Name: Shane | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Program Files\Mozilla Firefox 4.0 Beta 12\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Mozilla Firefox 4.0 Beta 12\plugin-container.exe (Mozilla Corporation)
PRC - C:\Users\Shane\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Users\Shane\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_5d07289e07e1d100\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (TunngleService) – File not found
SRV - (PnkBstrA) – File not found
SRV - (Steam Client Service) – C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (AMD External Events Utility) – C:\Windows\System32\atiesrxx.exe (AMD)

========== Driver Services (SafeList) ==========

DRV - (NTIOLib_1_0_8) – C:\Program Files\MSI\MSIWDev\NTIOLib.sys (MSI)
DRV - (amdkmdag) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (amdkmdap) – C:\Windows\System32\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV - (AtiHDAudioService) – C:\Windows\System32\drivers\AtihdLH3.sys (Advanced Micro Devices)
DRV - (MSI_MSIBIOS_010507) – C:\Program Files\MSI\MSIWDev\msibios32_100507.sys (Your Corporation)
DRV - (tap0901t) TAP-Win32 Adapter V9 (Tunngle) – C:\Windows\System32\drivers\tap0901t.sys (Tunngle.net)
DRV - (Point32) – C:\Windows\System32\drivers\point32k.sys (Microsoft Corporation)
DRV - (mcdbus) – C:\Windows\System32\drivers\mcdbus.sys (MagicISO, Inc.)
DRV - (RTL8169) – C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "www.google.co.uk"
FF - prefs.js..network.proxy.type: 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF - HKCU\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF - HKLM\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011/03/04 20:59:20 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011/03/04 20:59:20 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox 4.0 Beta 12\components [2011/07/06 17:19:58 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox 4.0 Beta 12\plugins [2011/07/04 07:02:44 | 000,000,000 | —D | M]
FF - HKCU\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011/03/04 20:59:20 | 000,000,000 | —D | M]
FF - HKCU\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011/03/04 20:59:20 | 000,000,000 | —D | M]
FF - HKCU\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox 4.0 Beta 12\components [2011/07/06 17:19:58 | 000,000,000 | —D | M]
FF - HKCU\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox 4.0 Beta 12\plugins [2011/07/04 07:02:44 | 000,000,000 | —D | M]

[2011/02/27 02:46:59 | 000,000,000 | —D | M] (No name found) – C:\Users\Shane\AppData\Roaming\Mozilla\Extensions
[2008/07/15 22:13:53 | 000,000,000 | —D | M] (No name found) – C:\Users\Shane\AppData\Roaming\Mozilla\Extensions\[removed]
[2011/07/09 21:09:30 | 000,000,000 | —D | M] (No name found) – C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\p7aaa99j.default\extensions
[2010/10/23 20:15:49 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\p7aaa99j.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/06/20 14:52:17 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\p7aaa99j.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010/10/07 23:44:07 | 000,000,000 | —D | M] (New Tab Homepage) – C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\p7aaa99j.default\extensions\{66E978CD-981F-47DF-AC42-E3CF417C1467}
[2009/09/24 20:07:37 | 000,000,000 | —D | M] (20-20 3D Viewer) – C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\p7aaa99j.default\extensions\[removed]
[2011/05/12 18:56:47 | 000,000,000 | —D | M] (No name found) – C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\qohvf8o3.default\extensions
[2011/07/04 07:02:49 | 000,000,000 | —D | M] (EPUBReader) – C:\Users\Shane\AppData\Roaming\Mozilla\Firefox\Profiles\qohvf8o3.default\extensions\{5384767E-00D9-40E9-B72F-9CC39D655D6F}
[2011/01/31 14:24:00 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/06/20 14:51:23 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/10/14 19:22:00 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010/12/26 21:14:14 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
File not found (No name found) –
[2011/07/04 07:02:44 | 000,000,000 | —D | M] (Java Console) – C:\PROGRAM FILES\MOZILLA FIREFOX 4.0 BETA 12\EXTENSIONS\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
() (No name found) – C:\USERS\SHANE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QOHVF8O3.DEFAULT\EXTENSIONS\{66E978CD-981F-47DF-AC42-E3CF417C1467}.XPI
() (No name found) – C:\USERS\SHANE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QOHVF8O3.DEFAULT\EXTENSIONS\[removed]
[2011/02/28 01:29:10 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2010/10/22 19:08:15 | 000,001,538 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2010/10/22 19:08:15 | 000,000,947 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2010/10/22 19:08:15 | 000,000,769 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2010/10/22 19:08:15 | 000,001,135 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2011/07/09 21:09:32 | 000,000,098 | —- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (DivX Plus Web Player HTML5 ) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (Tracker Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - File not found
O3 - HKLM\..\Toolbar: (Tracker Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - File not found
O4 - HKLM..\Run: [ATICustomerCare] C:\Program Files\ATI\ATICustomerCare\ATICustomerCare.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Steam] C:\Program Files\Steam\Steam.exe (Valve Corporation)
O4 - Startup: C:\Users\Shane\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
O4 - Startup: C:\Users\Shane\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: com ([www.msi] http in Trusted sites)
O15 - HKCU\..Trusted Domains: com.tw ([asia.msi] http in Trusted sites)
O15 - HKCU\..Trusted Domains: com.tw ([global.msi] http in Trusted sites)
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} http://liveupdate.msi.com.tw/autobios/LOnl…CAB/install.cab (WebSDev Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img22.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img22.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 22:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2006/11/02 21:00:00 | 000,000,043 | R— | M] () - D:\autorun.inf – [ UDF ]
O32 - AutoRun File - [2007/07/01 07:22:48 | 000,000,000 | —D | M] - F:\AutoRunSource – [ CDFS ]
O32 - AutoRun File - [2007/06/28 19:06:56 | 000,011,478 | R— | M] () - F:\Autorun.ico – [ CDFS ]
O32 - AutoRun File - [2007/06/28 19:06:56 | 002,256,896 | R— | M] (Longtion) - F:\autorun.exe – [ CDFS ]
O32 - AutoRun File - [2007/07/01 07:20:09 | 000,000,047 | R— | M] () - F:\autorun.inf – [ CDFS ]
O32 - AutoRun File - [2007/07/01 07:20:10 | 000,462,809 | R— | M] () - F:\autorun.tgt – [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O35 - HKCU\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKCU\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/07/10 17:39:33 | 000,000,000 | —D | C] – C:\Users\Shane\Desktop\10th july
[2011/07/09 21:09:27 | 000,000,000 | —D | C] – C:\_OTL
[2011/07/07 18:10:39 | 000,000,000 | —D | C] – C:\Windows\temp
[2011/07/07 18:10:39 | 000,000,000 | —D | C] – C:\Users\Shane\AppData\Local\temp
[2011/07/07 18:10:16 | 000,000,000 | -HSD | C] – C:\$RECYCLE.BIN
[2011/07/07 17:57:44 | 000,000,000 | —D | C] – C:\Users\Shane\Desktop\RK_Quarantine
[2011/07/07 17:53:34 | 004,135,577 | R— | C] (Swearware) – C:\Users\Shane\Desktop\ComboFix.exe
[2011/07/05 21:27:11 | 001,925,512 | —- | C] (AVAST Software) – C:\Users\Shane\Desktop\aswMBR.exe
[2011/07/05 07:32:42 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Users\Shane\Desktop\HiJackThis.exe
[2011/07/05 07:32:00 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Users\Shane\Desktop\OTL.exe
[2011/07/05 07:31:44 | 000,000,000 | —D | C] – C:\Users\Shane\What the tech
[2011/07/05 06:28:45 | 000,518,144 | —- | C] (SteelWerX) – C:\Windows\SWREG.exe
[2011/07/05 06:28:45 | 000,406,528 | —- | C] (SteelWerX) – C:\Windows\SWSC.exe
[2011/07/05 06:28:45 | 000,212,480 | —- | C] (SteelWerX) – C:\Windows\SWXCACLS.exe
[2011/07/05 06:28:45 | 000,060,416 | —- | C] (NirSoft) – C:\Windows\NIRCMD.exe
[2011/07/05 06:28:40 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2011/07/05 06:28:37 | 000,000,000 | —D | C] – C:\Qoobox
[2011/07/04 18:00:18 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Recuva
[2011/07/04 18:00:17 | 000,000,000 | —D | C] – C:\Program Files\Recuva
[2011/07/04 18:00:13 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2011/07/02 06:26:41 | 000,000,000 | —D | C] – C:\NBRT

========== Files - Modified Within 30 Days ==========

[2011/07/10 23:51:03 | 000,679,146 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/07/10 23:51:03 | 000,129,508 | —- | M] () – C:\Windows\System32\perfc009.dat
[2011/07/10 23:46:39 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/07/10 23:46:17 | 268,435,456 | -HS- | M] () – C:\Windows\System32\temppf.sys
[2011/07/09 21:09:32 | 000,000,098 | —- | M] () – C:\Windows\System32\drivers\etc\Hosts
[2011/07/07 20:01:45 | 000,054,016 | —- | M] () – C:\Windows\System32\drivers\tbmlyorq.sys
[2011/07/07 19:32:15 | 000,000,906 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/07/07 17:53:44 | 004,135,577 | R— | M] (Swearware) – C:\Users\Shane\Desktop\ComboFix.exe
[2011/07/06 22:04:12 | 000,070,144 | —- | M] () – C:\Users\Shane\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/07/06 17:44:43 | 000,001,356 | —- | M] () – C:\Users\Shane\AppData\Local\d3d9caps.dat
[2011/07/05 21:27:17 | 001,925,512 | —- | M] (AVAST Software) – C:\Users\Shane\Desktop\aswMBR.exe
[2011/07/05 21:08:59 | 000,000,000 | —- | M] () – C:\Users\Shane\defogger_reenable
[2011/07/05 07:34:13 | 000,625,664 | —- | M] () – C:\Users\Shane\Desktop\dds.scr
[2011/07/05 07:32:42 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Users\Shane\Desktop\HiJackThis.exe
[2011/07/05 07:32:00 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Users\Shane\Desktop\OTL.exe
[2011/07/04 18:00:18 | 000,001,634 | —- | M] () – C:\Users\Public\Desktop\Recuva.lnk
[2011/07/04 18:00:14 | 000,001,971 | —- | M] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2011/07/04 18:00:14 | 000,001,955 | —- | M] () – C:\Users\Shane\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/07/04 17:59:32 | 000,000,878 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/06/26 07:45:56 | 000,256,000 | —- | M] () – C:\Windows\PEV.exe

========== Files Created - No Company Name ==========

[2011/07/07 20:01:45 | 000,054,016 | —- | C] () – C:\Windows\System32\drivers\tbmlyorq.sys
[2011/07/07 19:32:15 | 000,000,906 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/07/05 21:08:59 | 000,000,000 | —- | C] () – C:\Users\Shane\defogger_reenable
[2011/07/05 07:34:13 | 000,625,664 | —- | C] () – C:\Users\Shane\Desktop\dds.scr
[2011/07/05 06:28:45 | 000,256,000 | —- | C] () – C:\Windows\PEV.exe
[2011/07/05 06:28:45 | 000,208,896 | —- | C] () – C:\Windows\MBR.exe
[2011/07/05 06:28:45 | 000,098,816 | —- | C] () – C:\Windows\sed.exe
[2011/07/05 06:28:45 | 000,080,412 | —- | C] () – C:\Windows\grep.exe
[2011/07/05 06:28:45 | 000,068,096 | —- | C] () – C:\Windows\zip.exe
[2011/07/04 18:00:18 | 000,001,634 | —- | C] () – C:\Users\Public\Desktop\Recuva.lnk
[2011/07/04 18:00:14 | 000,001,971 | —- | C] () – C:\Users\Public\Desktop\Google Chrome.lnk
[2011/07/04 18:00:14 | 000,001,955 | —- | C] () – C:\Users\Shane\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/07/04 17:59:32 | 000,000,878 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/07/03 22:05:15 | 268,435,456 | -HS- | C] () – C:\Windows\System32\temppf.sys
[2011/04/19 23:19:22 | 000,175,616 | —- | C] () – C:\Windows\System32\unrar.dll
[2011/04/19 23:19:21 | 000,631,808 | —- | C] () – C:\Windows\System32\xvidcore.dll
[2011/04/19 23:19:21 | 000,243,200 | —- | C] () – C:\Windows\System32\xvidvfw.dll
[2011/04/19 23:19:21 | 000,000,038 | —- | C] () – C:\Windows\avisplitter.ini
[2011/04/19 23:19:20 | 000,080,896 | —- | C] () – C:\Windows\System32\ff_vfw.dll
[2011/03/15 22:07:21 | 000,000,000 | —- | C] () – C:\Windows\System32\Access.dat
[2011/03/02 20:20:30 | 000,000,223 | —- | C] () – C:\Users\Shane\AppData\Roaming\burnaware.ini
[2011/02/27 22:05:33 | 000,138,056 | —- | C] () – C:\Users\Shane\AppData\Roaming\PnkBstrK.sys
[2011/02/27 22:04:56 | 002,434,856 | —- | C] () – C:\Windows\System32\pbsvc_bc2.exe
[2011/02/27 09:38:36 | 000,070,144 | —- | C] () – C:\Users\Shane\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/02/27 02:35:57 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2011/02/27 02:03:00 | 000,001,356 | —- | C] () – C:\Users\Shane\AppData\Local\d3d9caps.dat
[2011/01/26 23:11:58 | 000,023,040 | —- | C] () – C:\Windows\System32\atitmpxx.dll
[2010/12/21 03:27:20 | 000,003,113 | —- | C] () – C:\Windows\System32\atipblag.dat
[2010/12/17 17:00:44 | 000,227,587 | —- | C] () – C:\Windows\System32\atiicdxx.dat
[2010/11/28 13:01:35 | 000,000,178 | —- | C] () – C:\Users\Shane\AppData\Roaming\default.rss
[2010/04/21 01:27:01 | 000,030,498 | -HS- | C] () – C:\Users\Shane\AppData\Local\J50Ev7evclyS4
[2009/08/06 23:55:36 | 001,871,758 | —- | C] () – C:\Users\Shane\AppData\Roaming\NMM-MetaData.db
[2009/08/04 22:59:28 | 000,000,036 | —- | C] () – C:\Users\Shane\AppData\Local\housecall.guid.cache
[2008/01/23 21:52:53 | 000,000,134 | —- | C] () – C:\Users\Shane\AppData\Roaming\AVSDVDPlayer.m3u
[2006/11/02 13:57:28 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 13:47:37 | 000,257,720 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 13:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 11:33:01 | 000,679,146 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 11:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 11:33:01 | 000,129,508 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 11:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 11:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 09:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 09:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 08:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 08:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2006/11/02 08:22:43 | 000,099,999 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2006/11/02 08:22:43 | 000,018,271 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin

< End of report >

OTL FIX LOG

All processes killed
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
Registry key HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d4027c7f-154a-4066-a1ad-4243d8127440}\ not found.
Registry key HKEY_CLASSES_ROOT\Tracker Toolbar not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users
->Temp folder emptied: 0 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: Shane
->Temp folder emptied: 45013832 bytes
->Temporary Internet Files folder emptied: 43217492 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 43320982 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 456 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 89375 bytes

Total Files Cleaned = 126.00 mb

OTL by OldTimer - Version 3.2.26.0 log created on 07102011_223756

MBAM SCAN

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Database version: 7068

Windows 6.0.6000 (Safe Mode)
Internet Explorer 7.0.6000.16982

11/07/2011 00:09:16
mbam-log-2011-07-11 (00-09-16).txt

Scan type: Quick scan
Objects scanned: 154827
Time elapsed: 2 minute(s), 2 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Satchfan

Post #17July 11, 2011, 10:14 AM UTC last edited July 11, 2011, 10:40 AM UTC

the damage was done at the last cocktail bar - v. tasty Mohitos. Can't blame her - a Mohito is my favourite too.

had to look that one up but it sounds good.

If there's still a problem with the MBR would a format fix it though?

Yes but I hope it won’t come to that

===================================================

re-Run aswMBR
click Scan
on completion of the scan click the Fix button

🖼Click to load external image (Posted Image)

Save the log as before and post in your next reply

===================================================

Run OTL

Double click on the icon to run it.

Copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services :OTL [2011/07/07 20:01:45 | 000,054,016 | —- | C] () – C:\Windows\System32\drivers\tbmlyorq.sys [2010/04/21 01:27:01 | 000,030,498 | -HS- | C] () – C:\Users\Shane\AppData\Local\J50Ev7evclyS4 :Commands [purity] [emptytemp] [Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log (don't check the boxes beside LOP Check or Purity this time)

===================================================

I’d like you to check your system files:• click on Start, All Programs. Accessories, then right click on Command Prompt and click on Run as administrator
• type in sfc /scannow in the command window and press Enter. (note the space between the c and the /)
• if any files require replacing SFC will replace them. You may be asked to insert your Windows Vista Disk for this process to continue. This can be done with a borrowed Windows Vista disk if you don't have one.
• be patient because the scan may take some time.
• allow the scan to run and when completed, reboot the system.
Satchfan

dawooksta

Post #18July 12, 2011, 11:00 PM UTC

Hi Satchfan Had to take a night off last night, but I'm back for the fight. I ran aswMBR but the "fix" button was greyed out and couldn't be pressed. Here's the log : aswMBR version 0.9.7.705 Copyright© 2011 AVAST Software Run date: 2011-07-12 18:25:37 —————————– 18:25:37.049 OS Version: Windows 6.0.6000 18:25:37.049 Number of processors: 2 586 0xF0D 18:25:37.049 ComputerName: SHANE-PC UserName: Shane 18:25:40.075 Initialize success 18:26:29.556 AVAST engine defs: 11071201 18:28:51.365 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 18:28:51.368 Disk 0 Vendor: Intel___ 1.0. Size: 953875MB BusType: 8 18:28:51.379 Disk 0 MBR read successfully 18:28:51.382 Disk 0 MBR scan 18:28:51.397 Disk 0 Windows VISTA default MBR code 18:28:51.405 Disk 0 scanning sectors +1953533952 18:28:51.439 Disk 0 scanning C:\Windows\system32\drivers 18:29:00.945 Service scanning 18:29:01.293 Service fdc C:\Windows\system32\DRIVERS\fdc.sys **HIDDEN** 18:29:01.310 Service flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys **HIDDEN** 18:29:01.323 Service i8042prt C:\Windows\system32\DRIVERS\i8042prt.sys **HIDDEN** 18:29:01.992 Disk 0 trace - called modules: 18:29:02.007 ntoskrnl.exe CLASSPNP.SYS disk.sys iastorv.sys hal.dll 18:29:02.398 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x84693030] 18:29:02.405 3 ntoskrnl.exe[81ca80af] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x8421e030] 18:29:05.476 AVAST engine scan C:\Windows 18:33:11.841 File: C:\Windows\System32\config\systemprofile\AppData\Local\amehapuvebuqavi.dll **INFECTED** Win32:MalOb-GC [Cryp] 18:38:17.272 File: C:\Windows\System32\config\systemprofile\AppData\Local\shneri.dll **INFECTED** Win32:MalOb-DT [Cryp] 19:43:41.799 AVAST engine scan C:\Users\Shane 19:43:52.362 File: C:\Users\Shane\AppData\Local\BluetoothHelpInit\Cdcrtmm.dll **INFECTED** Win32:Malware-gen 20:28:49.083 AVAST engine scan C:\ProgramData 20:31:11.980 Scan finished successfully 20:59:06.678 Disk 0 MBR has been saved successfully to "C:\Users\Shane\Desktop\12 July\MBR.dat" 20:59:06.685 The log file has been saved successfully to "C:\Users\Shane\Desktop\12 July\aswMBR.txt" Then OTL…………………………. All processes killed ========== SERVICES/DRIVERS ========== ========== OTL ========== C:\Windows\System32\drivers\tbmlyorq.sys moved successfully. C:\Users\Shane\AppData\Local\J50Ev7evclyS4 moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users ->Temp folder emptied: 0 bytes User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Public ->Temp folder emptied: 0 bytes User: Shane ->Temp folder emptied: 45098340 bytes ->Temporary Internet Files folder emptied: 49528303 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 43345128 bytes ->Google Chrome cache emptied: 0 bytes ->Apple Safari cache emptied: 0 bytes ->Flash cache emptied: 456 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 2242 bytes RecycleBin emptied: 60069 bytes Total Files Cleaned = 132.00 mb OTL by OldTimer - Version 3.2.26.0 log created on 07122011_210504 I followed your directions with the scannow command and received the message "Windows Resource Protection did not find any integrity violations"

Satchfan

Post #19July 13, 2011, 9:08 AM UTC

Hi dawooksta

I ran aswMBR but the "fix" button was greyed out

Did you click the scan button first? If not, please run the aswMBR scan again and when the scan is completed hit the “Fix” button

Run TDSSKiller

Please download TDSSKiller.zip

extract it to your desktop
double click TDSSKiller.exe
press Start Scan
only if Malicious objects are found then ensure Cure is selected
then click Continue > Reboot now
copy and paste the log in your next reply
a copy of the log will be saved automatically to the root of the drive (typically C:\) called TDSSKiller_*** (*** denotes version & date)

Satchfan

dawooksta

Post #20July 14, 2011, 12:32 AM UTC

Hi Satchfan I've just ran a scan with aswMBR again and still don't get the option of pressing "Fix". I see in your screen print image the option of "FixMBR" is greyed out but the "Fix" button is available. Mine is the other way around. I've pressed FixMBR. I ran TDSSKiller. No malicious objects were found though 2011/07/13 23:50:09.0167 0740 TDSS rootkit removing tool 2.5.11.0 Jul 11 2011 16:56:56 2011/07/13 23:50:09.0511 0740 ================================================================================ 2011/07/13 23:50:09.0511 0740 SystemInfo: 2011/07/13 23:50:09.0511 0740 2011/07/13 23:50:09.0526 0740 OS Version: 6.0.6000 ServicePack: 0.0 2011/07/13 23:50:09.0526 0740 Product type: Workstation 2011/07/13 23:50:09.0526 0740 ComputerName: SHANE-PC 2011/07/13 23:50:09.0526 0740 UserName: Shane 2011/07/13 23:50:09.0526 0740 Windows directory: C:\Windows 2011/07/13 23:50:09.0526 0740 System windows directory: C:\Windows 2011/07/13 23:50:09.0526 0740 Processor architecture: Intel x86 2011/07/13 23:50:09.0526 0740 Number of processors: 2 2011/07/13 23:50:09.0526 0740 Page size: 0x1000 2011/07/13 23:50:09.0526 0740 Boot type: Safe boot with network 2011/07/13 23:50:09.0526 0740 ================================================================================ 2011/07/13 23:50:16.0120 0740 !crdlk 2011/07/13 23:50:16.0229 0740 Initialize success 2011/07/13 23:50:21.0823 1832 ================================================================================ 2011/07/13 23:50:21.0823 1832 Scan started 2011/07/13 23:50:21.0823 1832 Mode: Manual; 2011/07/13 23:50:21.0823 1832 ================================================================================ 2011/07/13 23:50:23.0136 1832 ACPI (84fc6df81212d16be5c4f441682feccc) C:\Windows\system32\drivers\acpi.sys 2011/07/13 23:50:23.0245 1832 adp94xx (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys 2011/07/13 23:50:23.0323 1832 adpahci (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys 2011/07/13 23:50:23.0386 1832 adpu160m (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys 2011/07/13 23:50:23.0464 1832 adpu320 (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys 2011/07/13 23:50:23.0557 1832 AFD (5d24caf8efd924a875698ff28384db8b) C:\Windows\system32\drivers\afd.sys 2011/07/13 23:50:23.0620 1832 agp440 (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys 2011/07/13 23:50:23.0682 1832 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys 2011/07/13 23:50:23.0729 1832 aliide (90395b64600ebb4552e26e178c94b2e4) C:\Windows\system32\drivers\aliide.sys 2011/07/13 23:50:23.0807 1832 amdagp (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys 2011/07/13 23:50:23.0854 1832 amdide (0577df1d323fe75a739c787893d300ea) C:\Windows\system32\drivers\amdide.sys 2011/07/13 23:50:23.0901 1832 AmdK7 (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys 2011/07/13 23:50:23.0948 1832 AmdK8 (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\drivers\amdk8.sys 2011/07/13 23:50:24.0151 1832 amdkmdag (d05cf4523e0c04ef82454abfd84fdc1d) C:\Windows\system32\DRIVERS\atikmdag.sys 2011/07/13 23:50:24.0370 1832 amdkmdap (92dc2e0ae49148f83b24d89c737b0c97) C:\Windows\system32\DRIVERS\atikmpag.sys 2011/07/13 23:50:24.0464 1832 arc (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys 2011/07/13 23:50:24.0495 1832 arcsas (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys 2011/07/13 23:50:24.0573 1832 AsyncMac (e86cf7ce67d5de898f27ef884dc357d8) C:\Windows\system32\DRIVERS\asyncmac.sys 2011/07/13 23:50:24.0604 1832 atapi (b35cfcef838382ab6490b321c87edf17) C:\Windows\system32\drivers\atapi.sys 2011/07/13 23:50:24.0698 1832 AtiHDAudioService (0c3c2e9136397e1aaa9033dcae25ced2) C:\Windows\system32\drivers\AtihdLH3.sys 2011/07/13 23:50:24.0792 1832 Beep (ac3dd1708b22761ebd7cbe14dcc3b5d7) C:\Windows\system32\drivers\Beep.sys 2011/07/13 23:50:24.0901 1832 bowser (913cd06fbe9105ce6077e90fd4418561) C:\Windows\system32\DRIVERS\bowser.sys 2011/07/13 23:50:24.0948 1832 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys 2011/07/13 23:50:24.0995 1832 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys 2011/07/13 23:50:25.0042 1832 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys 2011/07/13 23:50:25.0089 1832 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys 2011/07/13 23:50:25.0104 1832 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys 2011/07/13 23:50:25.0151 1832 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys 2011/07/13 23:50:25.0198 1832 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys 2011/07/13 23:50:25.0276 1832 cdfs (6c3a437fc873c6f6a4fc620b6888cb86) C:\Windows\system32\DRIVERS\cdfs.sys 2011/07/13 23:50:25.0339 1832 cdrom (8d1866e61af096ae8b582454f5e4d303) C:\Windows\system32\DRIVERS\cdrom.sys 2011/07/13 23:50:25.0401 1832 circlass (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys 2011/07/13 23:50:25.0464 1832 CLFS (1b84fd0937d3b99af9ba38ddff3daf54) C:\Windows\system32\CLFS.sys 2011/07/13 23:50:25.0604 1832 cmdide (45201046c776ffdaf3fc8a0029c581c8) C:\Windows\system32\drivers\cmdide.sys 2011/07/13 23:50:25.0667 1832 Compbatt (82b8c91d327cfecf76cb58716f7d4997) C:\Windows\system32\drivers\compbatt.sys 2011/07/13 23:50:25.0729 1832 crcdisk (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys 2011/07/13 23:50:25.0792 1832 Crusoe (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys 2011/07/13 23:50:25.0886 1832 DfsC (a7179de59ae269ab70345527894ccd7c) C:\Windows\system32\Drivers\dfsc.sys 2011/07/13 23:50:26.0026 1832 disk (841af4c4d41d3e3b2f244e976b0f7963) C:\Windows\system32\drivers\disk.sys 2011/07/13 23:50:26.0167 1832 drmkaud (ee472cd2c01f6f8e8aa1fa06ffef61b6) C:\Windows\system32\drivers\drmkaud.sys 2011/07/13 23:50:26.0229 1832 DXGKrnl (334988883de69adb27e2cf9f9715bbdb) C:\Windows\System32\drivers\dxgkrnl.sys 2011/07/13 23:50:26.0339 1832 E1G60 (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys 2011/07/13 23:50:26.0417 1832 Ecache (0efc7531b936ee57fdb4e837664c509f) C:\Windows\system32\drivers\ecache.sys 2011/07/13 23:50:26.0495 1832 elxstor (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys 2011/07/13 23:50:26.0573 1832 fastfat (84a317cb0b3954d3768cdcd018dbf670) C:\Windows\system32\drivers\fastfat.sys 2011/07/13 23:50:26.0651 1832 fdc (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys 2011/07/13 23:50:26.0714 1832 FileInfo (65773d6115c037ffd7ef8280ae85eb9d) C:\Windows\system32\drivers\fileinfo.sys 2011/07/13 23:50:26.0761 1832 Filetrace (c226dd0de060745f3e042f58dcf78402) C:\Windows\system32\drivers\filetrace.sys 2011/07/13 23:50:26.0823 1832 flpydisk (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys 2011/07/13 23:50:26.0870 1832 FltMgr (a6a8da7ae4d53394ab22ac3ab6d3f5d3) C:\Windows\system32\drivers\fltmgr.sys 2011/07/13 23:50:26.0901 1832 Fs_Rec (66a078591208baa210c7634b11eb392c) C:\Windows\system32\drivers\Fs_Rec.sys 2011/07/13 23:50:26.0932 1832 gagp30kx (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys 2011/07/13 23:50:26.0995 1832 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys 2011/07/13 23:50:27.0057 1832 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys 2011/07/13 23:50:27.0136 1832 HDAudBus (0db613a7e427b5663563677796fd5258) C:\Windows\system32\DRIVERS\HDAudBus.sys 2011/07/13 23:50:27.0182 1832 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys 2011/07/13 23:50:27.0229 1832 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys 2011/07/13 23:50:27.0339 1832 HidUsb (3c64042b95e583b366ba4e5d2450235e) C:\Windows\system32\DRIVERS\hidusb.sys 2011/07/13 23:50:27.0417 1832 HpCISSs (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys 2011/07/13 23:50:27.0464 1832 HTTP (ea24fe637d974a8a31bc650f478e3533) C:\Windows\system32\drivers\HTTP.sys 2011/07/13 23:50:27.0495 1832 i2omp (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys 2011/07/13 23:50:27.0573 1832 i8042prt (1c9ee072baa3abb460b91d7ee9152660) C:\Windows\system32\DRIVERS\i8042prt.sys 2011/07/13 23:50:27.0604 1832 iaStorV (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys 2011/07/13 23:50:27.0651 1832 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys 2011/07/13 23:50:27.0698 1832 intelide (97469037714070e45194ed318d636401) C:\Windows\system32\drivers\intelide.sys 2011/07/13 23:50:27.0729 1832 intelppm (ce44cc04262f28216dd4341e9e36a16f) C:\Windows\system32\DRIVERS\intelppm.sys 2011/07/13 23:50:27.0776 1832 IpFilterDriver (880c6f86cc3f551b8fea2c11141268c0) C:\Windows\system32\DRIVERS\ipfltdrv.sys 2011/07/13 23:50:27.0886 1832 IPMIDRV (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys 2011/07/13 23:50:27.0901 1832 IPNAT (10077c35845101548037df04fd1a420b) C:\Windows\system32\DRIVERS\ipnat.sys 2011/07/13 23:50:27.0964 1832 IRENUM (a82f328f4792304184642d6d397bb1e3) C:\Windows\system32\drivers\irenum.sys 2011/07/13 23:50:28.0011 1832 isapnp (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys 2011/07/13 23:50:28.0042 1832 iScsiPrt (4dca456d4d5723f8fa9c6760d240b0df) C:\Windows\system32\DRIVERS\msiscsi.sys 2011/07/13 23:50:28.0089 1832 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys 2011/07/13 23:50:28.0120 1832 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys 2011/07/13 23:50:28.0167 1832 kbdclass (b076b2ab806b3f696dab21375389101c) C:\Windows\system32\DRIVERS\kbdclass.sys 2011/07/13 23:50:28.0214 1832 kbdhid (ed61dbc6603f612b7338283edbacbc4b) C:\Windows\system32\DRIVERS\kbdhid.sys 2011/07/13 23:50:28.0276 1832 KSecDD (0a829977b078dea11641fc2af87ceade) C:\Windows\system32\Drivers\ksecdd.sys 2011/07/13 23:50:28.0386 1832 lltdio (fd015b4f95daa2b712f0e372a116fbad) C:\Windows\system32\DRIVERS\lltdio.sys 2011/07/13 23:50:28.0448 1832 LSI_FC (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys 2011/07/13 23:50:28.0495 1832 LSI_SAS (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys 2011/07/13 23:50:28.0526 1832 LSI_SCSI (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys 2011/07/13 23:50:28.0557 1832 luafv (42885bb44b6e065b8575a8dd6c430c52) C:\Windows\system32\drivers\luafv.sys 2011/07/13 23:50:28.0620 1832 mcdbus (8fd868e32459ece2a1bb0169f513d31e) C:\Windows\system32\DRIVERS\mcdbus.sys 2011/07/13 23:50:28.0714 1832 megasas (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys 2011/07/13 23:50:28.0761 1832 Modem (21755967298a46fb6adfec9db6012211) C:\Windows\system32\drivers\modem.sys 2011/07/13 23:50:28.0839 1832 monitor (7446e104a5fe5987ca9e4983fbac4f97) C:\Windows\system32\DRIVERS\monitor.sys 2011/07/13 23:50:28.0886 1832 mouclass (5fba13c1a1841b0885d316ed3589489d) C:\Windows\system32\DRIVERS\mouclass.sys 2011/07/13 23:50:28.0964 1832 mouhid (b569b5c5d3bde545df3a6af512cccdba) C:\Windows\system32\DRIVERS\mouhid.sys 2011/07/13 23:50:29.0057 1832 MountMgr (01f1e5a3e4877c931cbb31613fec16a6) C:\Windows\system32\drivers\mountmgr.sys 2011/07/13 23:50:29.0151 1832 mpio (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys 2011/07/13 23:50:29.0229 1832 mpsdrv (6e7a7f0c1193ee5648443fe2d4b789ec) C:\Windows\system32\drivers\mpsdrv.sys 2011/07/13 23:50:29.0276 1832 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys 2011/07/13 23:50:29.0307 1832 MRxDAV (1d8828b98ee309d65e006f0829e280e5) C:\Windows\system32\drivers\mrxdav.sys 2011/07/13 23:50:29.0354 1832 mrxsmb (8af705ce1bb907932157fab821170f27) C:\Windows\system32\DRIVERS\mrxsmb.sys 2011/07/13 23:50:29.0432 1832 mrxsmb10 (47e13ab23371be3279eef22bbfa2c1be) C:\Windows\system32\DRIVERS\mrxsmb10.sys 2011/07/13 23:50:29.0495 1832 mrxsmb20 (90b3fc7bd6b3d7ee7635debba2187f66) C:\Windows\system32\DRIVERS\mrxsmb20.sys 2011/07/13 23:50:29.0542 1832 msahci (742aed7939e734c36b7e8d6228ce26b7) C:\Windows\system32\drivers\msahci.sys 2011/07/13 23:50:29.0573 1832 msdsm (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys 2011/07/13 23:50:29.0620 1832 Msfs (729eafefd4e7417165f353a18dbe947d) C:\Windows\system32\drivers\Msfs.sys 2011/07/13 23:50:29.0667 1832 msisadrv (5f454a16a5146cd91a176d70f0cfa3ec) C:\Windows\system32\drivers\msisadrv.sys 2011/07/13 23:50:29.0792 1832 MSI_MSIBIOS_010507 (3846c05a66a3f5cd1d33e1a323c1762c) C:\PROGRA~1\MSI\MSIWDev\msibios32_100507.sys 2011/07/13 23:50:29.0823 1832 MSKSSRV (892cedefa7e0ffe7be8da651b651d047) C:\Windows\system32\drivers\MSKSSRV.sys 2011/07/13 23:50:29.0854 1832 MSPCLOCK (ae2cb1da69b2676b4cee2a501af5871c) C:\Windows\system32\drivers\MSPCLOCK.sys 2011/07/13 23:50:29.0886 1832 MSPQM (f910da84fa90c44a3addb7cd874463fd) C:\Windows\system32\drivers\MSPQM.sys 2011/07/13 23:50:29.0932 1832 MsRPC (84571c0ae07647ba38d493f5f0015df7) C:\Windows\system32\drivers\MsRPC.sys 2011/07/13 23:50:29.0979 1832 mssmbios (4385c80ede885e25492d408cad91bd6f) C:\Windows\system32\DRIVERS\mssmbios.sys 2011/07/13 23:50:30.0026 1832 MSTEE (c826dd1373f38afd9ca46ec3c436a14e) C:\Windows\system32\drivers\MSTEE.sys 2011/07/13 23:50:30.0042 1832 Mup (fa7aa70050cf5e2d15de00941e5665e5) C:\Windows\system32\Drivers\mup.sys 2011/07/13 23:50:30.0120 1832 NativeWifiP (6da4a0fc7c0e83df0cb3cfd0a514c3bc) C:\Windows\system32\DRIVERS\nwifi.sys 2011/07/13 23:50:30.0198 1832 NDIS (227c11e1e7cf6ef8afb2a238d209760c) C:\Windows\system32\drivers\ndis.sys 2011/07/13 23:50:30.0261 1832 NdisTapi (81659cdcbd0f9a9e07e6878ad8c78d3f) C:\Windows\system32\DRIVERS\ndistapi.sys 2011/07/13 23:50:30.0307 1832 Ndisuio (5de5ee546bf40838ebe0e01cb629df64) C:\Windows\system32\DRIVERS\ndisuio.sys 2011/07/13 23:50:30.0339 1832 NdisWan (397402adcbb8946223a1950101f6cd94) C:\Windows\system32\DRIVERS\ndiswan.sys 2011/07/13 23:50:30.0401 1832 NDProxy (1b24fa907af283199a81b3bb37e5e526) C:\Windows\system32\drivers\NDProxy.sys 2011/07/13 23:50:30.0417 1832 NetBIOS (356dbb9f98e8dc1028dd3092fceeb877) C:\Windows\system32\DRIVERS\netbios.sys 2011/07/13 23:50:30.0448 1832 netbt (e3a168912e7eefc3bd3b814720d68b41) C:\Windows\system32\DRIVERS\netbt.sys 2011/07/13 23:50:30.0542 1832 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys 2011/07/13 23:50:30.0589 1832 Npfs (4f9832beb9fafd8ceb0e541f1323b26e) C:\Windows\system32\drivers\Npfs.sys 2011/07/13 23:50:30.0636 1832 nsiproxy (b488dfec274de1fc9d653870ef2587be) C:\Windows\system32\drivers\nsiproxy.sys 2011/07/13 23:50:30.0714 1832 Ntfs (37430aa7a66d7a63407adc2c0d05e9f6) C:\Windows\system32\drivers\Ntfs.sys 2011/07/13 23:50:30.0792 1832 NTIOLib_1_0_8 (aa70ed3b0d93c1073260a5043805b6db) C:\PROGRA~1\MSI\MSIWDev\NTIOLib.sys 2011/07/13 23:50:30.0854 1832 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys 2011/07/13 23:50:30.0886 1832 Null (ec5efb3c60f1b624648344a328bce596) C:\Windows\system32\drivers\Null.sys 2011/07/13 23:50:30.0932 1832 nvraid (e69e946f80c1c31c53003bfbf50cbb7c) C:\Windows\system32\drivers\nvraid.sys 2011/07/13 23:50:30.0995 1832 nvstor (9e0ba19a28c498a6d323d065db76dffc) C:\Windows\system32\drivers\nvstor.sys 2011/07/13 23:50:31.0026 1832 nv_agp (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys 2011/07/13 23:50:31.0167 1832 ohci1394 (be32da025a0be1878f0ee8d6d9386cd5) C:\Windows\system32\drivers\ohci1394.sys 2011/07/13 23:50:31.0229 1832 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys 2011/07/13 23:50:31.0276 1832 partmgr (555a5b2c8022983bc7467bc925b222ee) C:\Windows\system32\drivers\partmgr.sys 2011/07/13 23:50:31.0339 1832 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys 2011/07/13 23:50:31.0386 1832 pci (1085d75657807e0e8b32f9e19a1647c3) C:\Windows\system32\drivers\pci.sys 2011/07/13 23:50:31.0448 1832 pciide (caba65e9c41cd2900d4c92d4f825c5f8) C:\Windows\system32\drivers\pciide.sys 2011/07/13 23:50:31.0495 1832 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys 2011/07/13 23:50:31.0557 1832 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys 2011/07/13 23:50:31.0698 1832 Point32 (858d5d8dbe432b358ca2f9d534169ca1) C:\Windows\system32\DRIVERS\point32k.sys 2011/07/13 23:50:31.0776 1832 PptpMiniport (6c359ac71d7b550a0d41f9db4563ce05) C:\Windows\system32\DRIVERS\raspptp.sys 2011/07/13 23:50:31.0839 1832 Processor (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys 2011/07/13 23:50:31.0901 1832 PSched (2c8bae55247c4e09352e870292e4d1ab) C:\Windows\system32\DRIVERS\pacer.sys 2011/07/13 23:50:31.0995 1832 ql2300 (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys 2011/07/13 23:50:32.0073 1832 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys 2011/07/13 23:50:32.0120 1832 QWAVEdrv (d2b3e2b7426dc23e185fbc73c8936c12) C:\Windows\system32\drivers\qwavedrv.sys 2011/07/13 23:50:32.0151 1832 RasAcd (bd7b30f55b3649506dd8b3d38f571d2a) C:\Windows\system32\DRIVERS\rasacd.sys 2011/07/13 23:50:32.0198 1832 Rasl2tp (88587dd843e2059848995b407b67f6cf) C:\Windows\system32\DRIVERS\rasl2tp.sys 2011/07/13 23:50:32.0229 1832 RasPppoe (ccf4e9c6cbbac81437f88cb2ae0b6c96) C:\Windows\system32\DRIVERS\raspppoe.sys 2011/07/13 23:50:32.0276 1832 rdbss (54129c5d9581bbec8bd1ebd3ba813f47) C:\Windows\system32\DRIVERS\rdbss.sys 2011/07/13 23:50:32.0307 1832 RDPCDD (794585276b5d7fca9f3fc15543f9f0b9) C:\Windows\system32\DRIVERS\RDPCDD.sys 2011/07/13 23:50:32.0370 1832 rdpdr (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys 2011/07/13 23:50:32.0417 1832 RDPENCDD (980b56e2e273e19d3a9d72d5c420f008) C:\Windows\system32\drivers\rdpencdd.sys 2011/07/13 23:50:32.0479 1832 RDPWD (8830e790a74a96605faba74f9665bb3c) C:\Windows\system32\drivers\RDPWD.sys 2011/07/13 23:50:32.0542 1832 rspndr (97e939d2128fec5d5a3e6e79b290a2f4) C:\Windows\system32\DRIVERS\rspndr.sys 2011/07/13 23:50:32.0620 1832 RTL8169 (283392af1860ecdb5e0f8ebd7f3d72df) C:\Windows\system32\DRIVERS\Rtlh86.sys 2011/07/13 23:50:32.0667 1832 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys 2011/07/13 23:50:32.0761 1832 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys 2011/07/13 23:50:32.0807 1832 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\DRIVERS\serenum.sys 2011/07/13 23:50:32.0870 1832 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\DRIVERS\serial.sys 2011/07/13 23:50:32.0932 1832 sermouse (450accd77ec5cea720c1cdb9e26b953b) C:\Windows\system32\drivers\sermouse.sys 2011/07/13 23:50:33.0026 1832 sffdisk (103b79418da647736ee95645f305f68a) C:\Windows\system32\drivers\sffdisk.sys 2011/07/13 23:50:33.0089 1832 sffp_mmc (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys 2011/07/13 23:50:33.0136 1832 sffp_sd (9cfa05fcfcb7124e69cfc812b72f9614) C:\Windows\system32\drivers\sffp_sd.sys 2011/07/13 23:50:33.0245 1832 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys 2011/07/13 23:50:33.0339 1832 sisagp (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys 2011/07/13 23:50:33.0417 1832 SiSRaid2 (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys 2011/07/13 23:50:33.0479 1832 SiSRaid4 (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys 2011/07/13 23:50:33.0557 1832 Smb (ac0d90738adb51a6fd12ff00874a2162) C:\Windows\system32\DRIVERS\smb.sys 2011/07/13 23:50:33.0620 1832 spldr (426f9b029aa9162ceccf65369457d046) C:\Windows\system32\drivers\spldr.sys 2011/07/13 23:50:33.0698 1832 srv (038579c35f7cad4a4bbf735dbf83277d) C:\Windows\system32\DRIVERS\srv.sys 2011/07/13 23:50:33.0761 1832 srv2 (6971a757af8cb5e2cbcbb76cc530db6c) C:\Windows\system32\DRIVERS\srv2.sys 2011/07/13 23:50:33.0792 1832 srvnet (9e1a4603b874eebce0298113951abefb) C:\Windows\system32\DRIVERS\srvnet.sys 2011/07/13 23:50:33.0870 1832 swenum (1379bdb336f8158c176a465e30759f57) C:\Windows\system32\DRIVERS\swenum.sys 2011/07/13 23:50:33.0948 1832 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys 2011/07/13 23:50:34.0011 1832 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys 2011/07/13 23:50:34.0057 1832 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys 2011/07/13 23:50:34.0136 1832 tap0901t (b7aee68d2e867cbf69b649b18fcedbbb) C:\Windows\system32\DRIVERS\tap0901t.sys 2011/07/13 23:50:34.0214 1832 Tcpip (4a82fa8f0df67aa354580c3faaf8bde3) C:\Windows\system32\drivers\tcpip.sys 2011/07/13 23:50:34.0307 1832 Tcpip6 (4a82fa8f0df67aa354580c3faaf8bde3) C:\Windows\system32\DRIVERS\tcpip.sys 2011/07/13 23:50:34.0339 1832 tcpipreg (5ce0c4a7b12d0067dad527d72b68c726) C:\Windows\system32\drivers\tcpipreg.sys 2011/07/13 23:50:34.0370 1832 TDPIPE (964248aef49c31fa6a93201a73ffaf50) C:\Windows\system32\drivers\tdpipe.sys 2011/07/13 23:50:34.0417 1832 TDTCP (7d2c1ae1648a60fce4aa0f7982e419d3) C:\Windows\system32\drivers\tdtcp.sys 2011/07/13 23:50:34.0464 1832 tdx (ab4fde8af4a0270a46a001c08cbce1c2) C:\Windows\system32\DRIVERS\tdx.sys 2011/07/13 23:50:34.0495 1832 TermDD (2c549bd9dd091fbfaa0a2a48e82ec2fb) C:\Windows\system32\DRIVERS\termdd.sys 2011/07/13 23:50:34.0573 1832 tssecsrv (29f0eca726f0d51f7e048bdb0b372f29) C:\Windows\system32\DRIVERS\tssecsrv.sys 2011/07/13 23:50:34.0620 1832 tunmp (65e953bc0084d44498b51f59784d2a82) C:\Windows\system32\DRIVERS\tunmp.sys 2011/07/13 23:50:34.0667 1832 tunnel (4a39bda5e0fd30bdf4884f9d33ae6105) C:\Windows\system32\DRIVERS\tunnel.sys 2011/07/13 23:50:34.0714 1832 uagp35 (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys 2011/07/13 23:50:34.0761 1832 udfs (6348da98707ceda8a0dfb05820e17732) C:\Windows\system32\DRIVERS\udfs.sys 2011/07/13 23:50:34.0823 1832 uliagpkx (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys 2011/07/13 23:50:34.0870 1832 uliahci (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys 2011/07/13 23:50:34.0917 1832 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys 2011/07/13 23:50:34.0964 1832 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys 2011/07/13 23:50:34.0995 1832 umbus (3fb78f1d1dd86d87bececd9dffa24dd9) C:\Windows\system32\DRIVERS\umbus.sys 2011/07/13 23:50:35.0042 1832 USBAAPL (d4fb6ecc60a428564ba8768b0e23c0fc) C:\Windows\system32\Drivers\usbaapl.sys 2011/07/13 23:50:35.0089 1832 usbccgp (8bd3ae150d97ba4e633c6c5c51b41ae1) C:\Windows\system32\DRIVERS\usbccgp.sys 2011/07/13 23:50:35.0136 1832 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys 2011/07/13 23:50:35.0182 1832 usbehci (63fe924d8a1113c3ba6750693fbec7d3) C:\Windows\system32\DRIVERS\usbehci.sys 2011/07/13 23:50:35.0198 1832 usbhub (5edec5510592c905e91817707dce62a2) C:\Windows\system32\DRIVERS\usbhub.sys 2011/07/13 23:50:35.0245 1832 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys 2011/07/13 23:50:35.0292 1832 usbprint (b51e52acf758be00ef3a58ea452fe360) C:\Windows\system32\DRIVERS\usbprint.sys 2011/07/13 23:50:35.0339 1832 USBSTOR (7887ce56934e7f104e98c975f47353c5) C:\Windows\system32\DRIVERS\USBSTOR.SYS 2011/07/13 23:50:35.0386 1832 usbuhci (325dbbacb8a36af9988ccf40eac228cc) C:\Windows\system32\DRIVERS\usbuhci.sys 2011/07/13 23:50:35.0479 1832 vga (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys 2011/07/13 23:50:35.0557 1832 VgaSave (17a8f877314e4067f8c8172cc6d9101c) C:\Windows\System32\drivers\vga.sys 2011/07/13 23:50:35.0604 1832 viaagp (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys 2011/07/13 23:50:35.0636 1832 ViaC7 (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys 2011/07/13 23:50:35.0682 1832 viaide (fd2e3175fcada350c7ab4521dca187ec) C:\Windows\system32\drivers\viaide.sys 2011/07/13 23:50:35.0698 1832 volmgr (103e84c95832d0ed93507997cc7b54e8) C:\Windows\system32\drivers\volmgr.sys 2011/07/13 23:50:35.0729 1832 volmgrx (294da8d3f965f6a8db934a83c7b461ff) C:\Windows\system32\drivers\volmgrx.sys 2011/07/13 23:50:35.0807 1832 volsnap (80dc0c9bcb579ed9815001a4d37cbfd5) C:\Windows\system32\drivers\volsnap.sys 2011/07/13 23:50:35.0854 1832 vsmraid (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys 2011/07/13 23:50:35.0932 1832 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys 2011/07/13 23:50:35.0995 1832 Wanarp (6798c1209a53b5a0ded8d437c45145ff) C:\Windows\system32\DRIVERS\wanarp.sys 2011/07/13 23:50:36.0011 1832 Wanarpv6 (6798c1209a53b5a0ded8d437c45145ff) C:\Windows\system32\DRIVERS\wanarp.sys 2011/07/13 23:50:36.0073 1832 Wd (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys 2011/07/13 23:50:36.0151 1832 Wdf01000 (7b5f66e4a2219c7d9daf9e738480e534) C:\Windows\system32\drivers\Wdf01000.sys 2011/07/13 23:50:36.0307 1832 WmiAcpi (701a9f884a294327e9141d73746ee279) C:\Windows\system32\drivers\wmiacpi.sys 2011/07/13 23:50:36.0417 1832 WpdUsb (2d27171b16a577ef14c1273668753485) C:\Windows\system32\DRIVERS\wpdusb.sys 2011/07/13 23:50:36.0511 1832 ws2ifsl (84620aecdcfd2a7a14e6263927d8c0ed) C:\Windows\system32\drivers\ws2ifsl.sys 2011/07/13 23:50:36.0604 1832 WUDFRd (a2aafcc8a204736296d937c7c545b53f) C:\Windows\system32\DRIVERS\WUDFRd.sys 2011/07/13 23:50:36.0667 1832 MBR (0x1B8) (239841e1ae8e4843c0676f3681a7d6be) \Device\Harddisk0\DR0 2011/07/13 23:50:36.0698 1832 Boot (0x1200) (0ff63a5952c0f06dbe95a24347ce4e34) \Device\Harddisk0\DR0\Partition0 2011/07/13 23:50:36.0698 1832 ================================================================================ 2011/07/13 23:50:36.0698 1832 Scan finished 2011/07/13 23:50:36.0698 1832 ================================================================================ 2011/07/13 23:50:36.0729 1624 Detected object count: 0 2011/07/13 23:50:36.0729 1624 Actual detected object count: 0 2011/07/13 23:57:47.0589 0768 Deinitialize success

Satchfan

Post #21July 14, 2011, 6:44 AM UTC

You are right in saying that there is nothing in the TDSSK log Can you send a new aswMBR scan and let me know what problems remain

Satchfan

Post #22July 17, 2011, 3:25 PM UTC

Hello dawooksta It has been several days since I sent my last post with instructions to help with your computer problem.. Please let me know if you are having problems and still need help. Thanks Satchfan

Satchfan

Post #23July 18, 2011, 3:14 PM UTC

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html and start a new topic

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Please help - possible tdss.serv infection

✨ Ask AI

Ask AI