What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Can't get into anything

55 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
About a week ago I booted up my computer and went online but I kept getting a box that came up wanting me to do a scan. I would close the box out but it would reappear again a little later. It was getting late so I shut the computer down. When I booted up my computer the other day I couldn't get into anything, even when I tried booting up in safe mode. Any time I click on something I get this message " This file does not have a program associated with it for performing this action. Create an association in the folder options control panel." I'm not sure what that means and I'm not sure what to do. I can't get online. I'm using another computer to write this. I tried putting Ccleaner, Internet Explorer and Firefox on a jump drive from another computer and tried installing them from the jump drive onto my computer so I could try to get online but I still end up getting that same error message when I try to go into the one's I just installed. I think my computer is probably pretty messed up. Do you think you can help me? I would really appreciate any help. Thanks!
Post #2
Hello Nick23 and :welcome:

My name is JonTom

  • Malware Logs can sometimes take a lot of time to research and interpret.
  • Please be patient while I try to assist with your problem. If at any time you do not understand what is required, please ask for further explanation.
  • Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
  • Read every reply you receive carefully and thoroughly before carrying out the instructions. You may also find it helpful to print out the instructions you receive, as in some instances you may have to disconnect your computer from the Internet.
  • PLEASE NOTE: If you do not reply after 5 days your thread will be closed.
Apologies for the delay in responding - the forums are very busy.

It sounds as though you are having some major problems with the infected machine.

I'm using another computer to write this

If you are unable to connect to the net with the infected machine you will need to copy the required tools to a flash drive and transfer them to the infected system. Lets try the following to begin with:

If the machine you use to download the tools runs on XP, please run the following tool first to reduce the chance of cross-infection.

  • Please download Flash Disinfector


    • Click here to download Flash Disinfector and save the file (called Flash_Disinfector.exe) to your desktop.
    • Double click on the Flash_Disinfector.exe icon to run the program and follow any prompts that may appear.
    • The program may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so if prompted.
    • Wait until Flash disinfector has finished scanning and then exit the program.
    • Reboot your computer.

    If it runs on Vista/Win 7, use this one:

  • AutoRun Eater


    • Download Autorun Eater and save it to your desktop.
    • Plug all of your removable storage devices into the machine (USB sticks etc) and run the tool.

    Once you have run the appropriate tool above, download the following tools and transfer them to the infected machine:

  • Please perform the following scan


    • Please download DDS from here and save it to your desktop.
    • Disable any script blocking protection (How to Disable your Security Programs)
    • Double click on the DDS icon to run the tool (may take up to 3 minutes to run).
    • When done, DDS.txt will open.
    • After a few moments, attach.txt will open in a second window.
    • Save both reports to your desktop.
    • Please post the contents of the DDS.txt and Attach.txt logs in your next reply.

  • Please scan your system with GMER


    [external image: Posted Image]
    Download GMER Rootkit Scanner from here or here.
    • Extract the contents of the zipped file to desktop.
    • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent.
    • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
    • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and post it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOTKIT" entries

Please post the DDS logs and the GMER log in your next reply. If you encounter any problems with the scans, or if you receive the "This file does not have a program associated with it" message again, just come back and let me know.
Post #3
Thank you so much!!! I'm sorry, I guess I should have told you I have Windows XP. I thought it said I was running Windows XP in my profile and it showed up by my name. Any way, sorry about that. Thanks again so much for your help! I will go ahead and try what you posted. I'm a little confused though….. I know I will need to use another computer to get that first item in your post, the Flash Disinfector, put it on a flash drive and transfer it to my infected computer and hopefully be able to run it from there. But, should I also put the others (dds & gmer) on the flash drive and transfer those to my infected computer and then run them? I guess I'll just try the Flash Disinfector first and see if I can get online after that, if not then do you think it would be alright to put those others (dds & gmer) on the flash drive and transfer those to my infected computer and run them that way? Thanks so much again!
Post #4
Hello Nick23

Any way, sorry about that

No need to apologies at all :)

I'm a little confused though….. I know I will need to use another computer to get that first item in your post, the Flash Disinfector, put it on a flash drive and transfer it to my infected computer and hopefully be able to run it from there.
But, should I also put the others (dds & gmer) on the flash drive and transfer those to my infected computer and then run them?

Sorry if my instructions were confusing. Flash disinfector is to be run on the uninfected machine. Download flash disinfector using the machine you have to use to connect to the Internet (the uninfected machine). Once you have downloaded it, run flash disinfector on the uninfected machine and follow the prompts you receive (you will be asked to insert a removable device which will be the flash drive you are going to use to transfer the required tools to the infected machine).

Once flash disinfector has been run on the flash drive, download DDS and GMER to the desktop of the uninfected machine and copy them to the flash drive. Once there, take the flash drive to the infected machine and transfer DDS and GMER ot the desktop of the infected machine and see if they will run.

Save the logs that are produced, copy them back to the flash drive then take the drive back to the uninfected machine to post back here.

If you run into any problems just let me know :)
Post #5
Ooooh, oooookay! I got ya now! So sorry about that. I'm not to great with computers, as if you couldn't tell. But, I understand now. I will do that and post back. Thank you!
Post #6 last edited
oooooooo, wait. I just thought of something. I already put the flash drive in the uninfected computer to put the flash disinfector on. Duh! The flash disinfector was to make sure there isn't any viruses or anything on before its put in to the uninfected computer. Oooops! I hope I didn't transfer anything to the uninfected computer. Nothing from the infected computer was put onto the flash drive but its the same flash drive I used to put Firefox and internet explorer on(from the uninfected computer) so I could try and put it on my infected computer so I could try to see if I could get online. But it was in the infected computer before I put it in the uninfected computer to put that program on. Do you think the uninfected computer will be alright?
Post #7
Hello Nick23

Do you think the uninfected computer will be alright?

Let me know if the uninfected system has any problems and we can deal with it later.

For the time being, please make sure that flash disinfector is saved to the desktop of the uninfected machine, double click on it to run, follow the prompts, then download the required tools and transfer them across to the machine that needs cleaning.

Let me know how it goes in your next reply :)
Post #8
Ok, I did the scans. I was surprised I was able to get them to run. I had some problems but was able to get them to run. I'm assuming that I should run that Flash Disinfector before every time I want to put the flash drive in the uninfected computer - once its been in the infected computer??? I hope the reports turned out alright. I couldn't get the dds to run at first but then I went under "run as" and was able to get it to run. Then on the gmer scan, once it was finished I had a hard time trying to save it. I kept getting error messages that kept coming up - The first one was Windows - Delayed Write Failed - Windows was unable to save all the data for the file \Device\HarddiskVolume1\Documents and Settings\All users\Application Data\AVGIO\IDS\log. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere. I had to click on OK or I couldn't do anything but once I did then this next error came up - avgrsx.exe-corrupt file - The file or directory \Documents and settings\All Users\Application Data\AGEIO\log is corrupt and unreadable. Please fun the chkdsk utility. I had to click on OK to be able to do anything else but as soon as I did this next message came up - avgrsx.exe - corrupt file - The file or directory \Documents and settings\All Users\Application Data\AGEIO\log\avgrs.log.4 is corrupt and unreadable. Please run the chkdsk utility. When I clicked OK I got another error message - avgtsx.exe - corrupt file - The file or directory \Documents and settings\All Users\Application Data\AGEIO\log\avgrs.log.8 is corrupt and unreadable. Please run the chkdsk utility. I tried just clicking on SAVE to save the gmer scan log but then everything froze and the little circle kept spinning around. I left it go for over an hour but it was still froze. I was going to try and shut it down and figured I'd pull the flash drive out and when I pulled the flash drive out then the save box came up so I was able to save it. I think. Well, I'm on the uninfected computer and I just opened the flash drive and I guess it didn't or wasn't able to save the gmer file. I looked when I was on the infected computer and it said it was on the flash drive but when I open it in the uninfected computer it isn't there. I had to open the dds logs in the uninfected computer to be able to post them here, that isn't going to transfer any viruses or anything to the uninfected computer is it? I did the Flash Disinfector before I put the flash drive in the uninfected computer. Here are the dds logs……… This is the first log, the dds log - . DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 8.0.6001.18702 Run by [removed] at 19:33:16 on 2011-09-05 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.503.177 [GMT -4:00] . AV: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF} . ============== Running Processes =============== . C:\PROGRA~1\AVG\AVG10\avgchsvx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE svchost.exe C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\AVG\AVG10\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Kodak\AiO\Center\EKAiOHostService.exe C:\WINDOWS\system32\lxctcoms.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe C:\Program Files\AVG\AVG10\avgnsx.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKAiO2MUI.exe C:\PROGRA~1\AVG\AVG10\avgrsx.exe C:\Program Files\AVG\AVG10\avgcsrvx.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://google.atcomet.com/b/ uInternet Settings,ProxyOverride = uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll mURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll mWinlogon: SFCDisable=-99 (0xffffff9d) BHO: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - c:\program files\lexmark toolbar\toolband.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll BHO: {7c5c0f58-e061-457d-9033-77307f5ed00c} - No File BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg10\toolbar\IEToolbar.dll BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: {7c5c0f58-e061-457d-9033-77307f5ed00c} - No File TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll TB: Lexmark Toolbar: {1017a80c-6f09-4548-a84d-edd6ac9525f0} - c:\program files\lexmark toolbar\toolband.dll TB: {724d43a0-0d85-11d4-9908-00400523e39a} - No File TB: {0C8413C1-FAD1-446C-8584-BE50576F863E} - No File TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg10\toolbar\IEToolbar.dll TB: {9D425283-D487-4337-BAB6-AB8354A81457} - No File TB: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No File uRun: [AnalogClock] c:\program files\windows7\analog clock\AnalogClock.exe uRun: [TransBar] c:\program files\windows7\transbar\TransBar.exe /s uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [SpeedBitVideoAccelerator] c:\program files\speedbit video accelerator\VideoAccelerator.exe uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe uRun: [RocketDock] "c:\program files\rocketdock\RocketDock.exe" mRun: [KRun] c:\program files\windows7\runme\RunMe.exe mRun: [Viena Explorer] "c:\program files\windows7\vienna explorer\Vienna Explorer.exe" mRun: [Visual Task Tips] "c:\program files\windows7\visualtasktips\VisualTaskTips.exe" mRun: [AGRSMMSG] AGRSMMSG.exe mRun: [KBD] c:\hp\kbd\KBD.EXE mRun: [igfxtray] c:\windows\system32\igfxtray.exe mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe mRun: [igfxpers] c:\windows\system32\igfxpers.exe mRun: [RTHDCPL] RTHDCPL.EXE mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k mRun: [lxctmon.exe] "c:\program files\lexmark 5400 series\lxctmon.exe" mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe mRun: [LXCTCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\LXCTtime.dll,_RunDLLEntry@16 mRun: [Conime] %windir%\system32\conime.exe mRun: [EKAIO2StatusMonitor] c:\windows\system32\spool\drivers\w32x86\3\EKAiO2MUI.exe mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\documents and settings\nick\my documents\malwarebytes' anti-malware\malwarebytes' anti-malware\malwarebytes' anti-malware\mbam.exe" /runcleanupscript dRunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 dRunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\launch whitesmoke translator.lnk - c:\documents and settings\nick\my documents\programs\WSTrayDictMode.exe uPolicies-explorer: NoDesktopCleanupWizard = 1 (0x1) uPolicies-explorer: NoWindowsUpdate = 1 (0x1) mPolicies-explorer: NoResolveTrack = 1 (0x1) IE: &Search IE: Customize Menu - file://c:\program files\siber systems\ai roboform\RoboFormComCustomizeIEMenu.html IE: Fill Forms - file://c:\program files\siber systems\ai roboform\RoboFormComFillForms.html IE: RoboForm Toolbar - file://c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html IE: Save Forms - file://c:\program files\siber systems\ai roboform\RoboFormComSavePass.html IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - c:\program files\siber systems\ai roboform\RoboFormComFillForms.html IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - c:\program files\siber systems\ai roboform\RoboFormComSavePass.html IE: {724d43aa-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} DPF: {2EDF75C0-5ABD-49f9-BAB6-220476A32034} - hxxp://intel-drv-cdn.systemrequirementslab.com/multi/bin/sysreqlab_srlx.cab DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.0.cab DPF: {49232000-16E4-426C-A231-62846947304B} - hxxps://wimpro2.cce.hp.com/ChatEntry/downloads/sysinfo.cab DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} - hxxps://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab TCP: DhcpNameServer = 192.168.1.1 [removed] TCP: Interfaces\{5151C364-CB4B-4880-AF34-CD417E6F752A} : DhcpNameServer = 192.168.1.1 [removed] Handler: avgsecuritytoolbar - {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - c:\program files\avg\avg10\toolbar\IEToolbar.dll Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll Notify: igfxcui - igfxdev.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll Hosts: 127.0.0.1 www.spywareinfo.com Hosts: 91.212.127.227 antiviraprof-2009.microsoft.com Hosts: 91.212.127.227 antiviraprof2009.com Hosts: 91.212.127.227 www.antiviraprof2009.com Hosts: 78.159.110.45 www.google.com . Note: multiple HOSTS entries found. Please refer to Attach.txt . ================= FIREFOX =================== . FF - ProfilePath - c:\documents and settings\nick\application data\mozilla\firefox\profiles\4zniteye.default\ FF - prefs.js: browser.search.selectedEngine - AVG Secure Search FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ FF - prefs.js: keyword.URL - hxxp://search.avg.com/route/?d=4e02abbf&v=7.005.030.004&i=23&tp=ab&iy=&ychte=us&lng=en-US&q= FF - prefs.js: network.proxy.http - 127.0.0.1 FF - prefs.js: network.proxy.http_port - 5555 FF - prefs.js: network.proxy.type - 0 FF - component: c:\documents and settings\nick\application data\mozilla\firefox\profiles\4zniteye.default\extensions\{b042753d-f57e-4e8e-a01b-7379a6d4cefb}\components\IBitCometExtension.dll FF - component: c:\program files\crawler\firefox\components\xcomm.dll FF - component: c:\program files\crawler\firefox\components\xshared.dll FF - component: c:\program files\crawler\firefox\components\xsupport.dll FF - component: c:\program files\crawler\firefox\components\xwsg.dll . ============= SERVICES / DRIVERS =============== . R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2011-2-22 22992] R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-3-16 32592] R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-1-7 248656] R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-3-1 34896] R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-4-5 297168] R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [2011-4-18 7398752] R2 avgwd;AVG WatchDog;c:\program files\avg\avg10\avgwdsvc.exe [2011-2-8 269520] R2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files\kodak\aio\center\EKAiOHostService.exe [2011-4-11 375296] R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2011-4-14 134480] R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2011-2-10 24144] R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2011-2-10 27216] R3 xcpip;TCP/IP Protocol Driver;c:\windows\system32\drivers\xcpip.sys –> c:\windows\system32\drivers\xcpip.sys [?] R3 xpsec;IPSEC driver;c:\windows\system32\drivers\xpsec.sys –> c:\windows\system32\drivers\xpsec.sys [?] S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg10\toolbar\ToolbarBroker.exe [2011-5-17 1025352] . =============== Created Last 30 ================ . . ==================== Find3M ==================== . 2011-07-06 23:52:42 41272 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-07-06 23:52:42 22712 —-a-w- c:\windows\system32\drivers\mbam.sys . ============= FINISH: 19:34:53.92 =============== *** And this is the other dds log named "attach" - . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2011-08-26.01) . Microsoft Windows XP Professional Boot Device: \Device\HarddiskVolume1 Install Date: 8/11/2009 10:48:21 AM System Uptime: 9/5/2011 7:17:15 PM (0 hours ago) . Motherboard: ASUSTeK Computer INC. | | Goldfish3 Processor: Intel® Pentium® 4 CPU 3.06GHz | CPU 1 | 3065/133mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 186 GiB total, 125.587 GiB free. D: is CDROM () E: is CDROM () F: is Removable G: is Removable H: is Removable I: is Removable J: is Removable . ==== Disabled Device Manager Items ============= . Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: Realtek RTL8139 Family PCI Fast Ethernet NIC Device ID: PCI\VEN_10EC&DEV_8139&SUBSYS_2A0B103C&REV_10\4&23C0B1C&0&10F0 Manufacturer: Realtek Name: Realtek RTL8139 Family PCI Fast Ethernet NIC PNP Device ID: PCI\VEN_10EC&DEV_8139&SUBSYS_2A0B103C&REV_10\4&23C0B1C&0&10F0 Service: rtl8139 . Class GUID: Description: Multimedia Audio Controller Device ID: PCI\VEN_13F6&DEV_0111&SUBSYS_011113F6&REV_10\4&23C0B1C&0&18F0 Manufacturer: Name: Multimedia Audio Controller PNP Device ID: PCI\VEN_13F6&DEV_0111&SUBSYS_011113F6&REV_10\4&23C0B1C&0&18F0 Service: . Class GUID: {4D36E97B-E325-11CE-BFC1-08002BE10318} Description: SCSI/RAID Host Controller Device ID: ACPI\PNPA000\4&5D18F2DF&0 Manufacturer: (Standard mass storage controllers) Name: SCSI/RAID Host Controller PNP Device ID: ACPI\PNPA000\4&5D18F2DF&0 Service: a32qluax . Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: MAC Bridge Miniport Device ID: ROOT\MS_BRIDGEMP\0000 Manufacturer: Microsoft Name: MAC Bridge Miniport PNP Device ID: ROOT\MS_BRIDGEMP\0000 Service: BridgeMP . Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: Hamachi Network Interface Device ID: ROOT\NET\0000 Manufacturer: LogMeIn, Inc. Name: Hamachi Network Interface PNP Device ID: ROOT\NET\0000 Service: hamachi . ==== System Restore Points =================== . RP311: 6/8/2011 5:53:32 PM - System Checkpoint RP312: 6/10/2011 9:55:54 PM - System Checkpoint RP313: 6/14/2011 4:41:56 PM - System Checkpoint RP314: 6/18/2011 5:33:45 AM - System Checkpoint RP315: 6/18/2011 8:00:17 PM - Software Distribution Service 3.0 RP316: 6/20/2011 8:28:15 AM - System Checkpoint RP317: 6/25/2011 8:59:09 PM - System Checkpoint RP318: 6/29/2011 2:06:32 AM - Software Distribution Service 3.0 RP319: 7/8/2011 5:10:01 PM - System Checkpoint RP320: 7/10/2011 12:32:11 AM - System Checkpoint RP321: 7/11/2011 8:14:55 AM - System Checkpoint RP322: 7/13/2011 7:24:31 PM - System Checkpoint RP323: 7/13/2011 8:00:17 PM - Software Distribution Service 3.0 RP324: 7/19/2011 4:51:55 AM - System Checkpoint RP325: 7/29/2011 10:33:46 PM - System Checkpoint RP326: 7/31/2011 11:56:30 PM - System Checkpoint RP327: 8/2/2011 12:11:26 AM - System Checkpoint RP328: 8/7/2011 7:20:54 AM - System Checkpoint RP329: 8/9/2011 5:52:47 AM - System Checkpoint RP330: 9/5/2011 1:40:00 AM - System Checkpoint . ==== Hosts File Hijack ====================== . Hosts: 127.0.0.1 www.spywareinfo.com Hosts: 91.212.127.227 antiviraprof-2009.microsoft.com Hosts: 91.212.127.227 antiviraprof2009.com Hosts: 91.212.127.227 www.antiviraprof2009.com Hosts: 78.159.110.45 www.google.com Hosts: 78.159.110.45 www.google.de Hosts: 78.159.110.45 www.google.fr Hosts: 78.159.110.45 www.google.co.uk Hosts: 78.159.110.45 www.google.com.br Hosts: 78.159.110.45 www.google.it Hosts: 78.159.110.45 www.google.es Hosts: 78.159.110.45 www.google.co.jp Hosts: 78.159.110.45 www.google.com.mx Hosts: 78.159.110.45 www.google.ca Hosts: 78.159.110.45 www.google.com.au Hosts: 78.159.110.45 www.google.nl Hosts: 78.159.110.45 www.google.co.za Hosts: 78.159.110.45 www.google.be Hosts: 78.159.110.45 www.google.gr Hosts: 78.159.110.45 www.google.at Hosts: 78.159.110.45 www.google.se Hosts: 78.159.110.45 www.google.ch Hosts: 78.159.110.45 www.google.pt Hosts: 78.159.110.45 www.google.dk Hosts: 78.159.110.45 www.google.fi Hosts: 78.159.110.45 www.google.ie Hosts: 78.159.110.45 www.google.no Hosts: 78.159.110.45 search.yahoo.com Hosts: 78.159.110.45 us.search.yahoo.com Hosts: 78.159.110.45 uk.search.yahoo.com . ==== Installed Programs ====================== . 2007 Microsoft Office Suite Service Pack 2 (SP2) Adobe AIR Adobe Flash Player 10 Plugin Adobe Reader 9.3 aioscnnr Apple Application Support Apple Mobile Device Support Apple Software Update Ask Toolbar AVG 2011 BitComet 1.27 BlackBerry Desktop Software 4.1 Bonjour Business Contact Manager for Outlook 2007 CCleaner center Cheetah DVD Burner Defraggler Enhanced Multimedia Keyboard Solution essentials Google Toolbar for Internet Explorer Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hotfix for Windows XP (KB2158563) Hotfix for Windows XP (KB2443685) Hotfix for Windows XP (KB915865) Hotfix for Windows XP (KB954550-v5) Hotfix for Windows XP (KB976098-v2) Hotfix for Windows XP (KB979306) Hotfix for Windows XP (KB981793) HP Product Detection IL Download Manager Intel® Graphics Media Accelerator Driver iTunes Java Auto Updater Java™ 6 Update 18 Kodak AIO Printer KODAK AiO Software Lexmark 5400 Series Lexmark Toolbar Malwarebytes' Anti-Malware version 1.51.1.1800 Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft Expression Web Microsoft Expression Web MUI (English) Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Software Update for Web Folders (English) 12 Microsoft SQL Server 2005 Microsoft SQL Server 2005 Express Edition (MSSMLBIZ) Microsoft SQL Server Native Client Microsoft SQL Server Setup Support Files (English) Microsoft SQL Server VSS Writer Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Mozilla Firefox 5.0 (x86 en-US) MpcStar 5.0 MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MSXML 6.0 Parser MSXML4 Parser neroxml ocr OpenOffice.org 3.2 PreReq QuickTime Realtek AC'97 Audio Realtek High Definition Audio Driver RocketDock 1.3.5 Sawer Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473) Security Update for Windows Internet Explorer 7 (KB938127-v2) Security Update for Windows Internet Explorer 7 (KB972260) Security Update for Windows Media Player (KB2378111) Security Update for Windows Media Player (KB954155) Security Update for Windows Media Player (KB968816) Security Update for Windows Media Player (KB975558) Security Update for Windows Media Player (KB978695) Security Update for Windows XP (KB2079403) Security Update for Windows XP (KB2115168) Security Update for Windows XP (KB2121546) Security Update for Windows XP (KB2160329) Security Update for Windows XP (KB2229593) Security Update for Windows XP (KB2259922) Security Update for Windows XP (KB2279986) Security Update for Windows XP (KB2286198) Security Update for Windows XP (KB2296011) Security Update for Windows XP (KB2296199) Security Update for Windows XP (KB2347290) Security Update for Windows XP (KB2360937) Security Update for Windows XP (KB2387149) Security Update for Windows XP (KB2393802) Security Update for Windows XP (KB2412687) Security Update for Windows XP (KB2419632) Security Update for Windows XP (KB2423089) Security Update for Windows XP (KB2436673) Security Update for Windows XP (KB2440591) Security Update for Windows XP (KB2443105) Security Update for Windows XP (KB2476490) Security Update for Windows XP (KB2476687) Security Update for Windows XP (KB2478960) Security Update for Windows XP (KB2478971) Security Update for Windows XP (KB2479628) Security Update for Windows XP (KB2479943) Security Update for Windows XP (KB2481109) Security Update for Windows XP (KB2483185) Security Update for Windows XP (KB2485376) Security Update for Windows XP (KB2485663) Security Update for Windows XP (KB2503658) Security Update for Windows XP (KB2503665) Security Update for Windows XP (KB2506212) Security Update for Windows XP (KB2506223) Security Update for Windows XP (KB2507618) Security Update for Windows XP (KB2507938) Security Update for Windows XP (KB2508272) Security Update for Windows XP (KB2508429) Security Update for Windows XP (KB2509553) Security Update for Windows XP (KB2510581) Security Update for Windows XP (KB2511455) Security Update for Windows XP (KB2524375) Security Update for Windows XP (KB2535512) Security Update for Windows XP (KB2536276) Security Update for Windows XP (KB2544893) Security Update for Windows XP (KB2555917) Security Update for Windows XP (KB923789) Security Update for Windows XP (KB956844) Security Update for Windows XP (KB958869) Security Update for Windows XP (KB969059) Security Update for Windows XP (KB969947) Security Update for Windows XP (KB970430) Security Update for Windows XP (KB971468) Security Update for Windows XP (KB971486) Security Update for Windows XP (KB971961) Security Update for Windows XP (KB972270) Security Update for Windows XP (KB973525) Security Update for Windows XP (KB973904) Security Update for Windows XP (KB974112) Security Update for Windows XP (KB974318) Security Update for Windows XP (KB974392) Security Update for Windows XP (KB974571) Security Update for Windows XP (KB975025) Security Update for Windows XP (KB975467) Security Update for Windows XP (KB975560) Security Update for Windows XP (KB975561) Security Update for Windows XP (KB975562) Security Update for Windows XP (KB975713) Security Update for Windows XP (KB977165) Security Update for Windows XP (KB977816) Security Update for Windows XP (KB977914) Security Update for Windows XP (KB978037) Security Update for Windows XP (KB978251) Security Update for Windows XP (KB978262) Security Update for Windows XP (KB978338) Security Update for Windows XP (KB978542) Security Update for Windows XP (KB978601) Security Update for Windows XP (KB978706) Security Update for Windows XP (KB979309) Security Update for Windows XP (KB979482) Security Update for Windows XP (KB979559) Security Update for Windows XP (KB979683) Security Update for Windows XP (KB979687) Security Update for Windows XP (KB980195) Security Update for Windows XP (KB980218) Security Update for Windows XP (KB980232) Security Update for Windows XP (KB980436) Security Update for Windows XP (KB981322) Security Update for Windows XP (KB981349) Security Update for Windows XP (KB981852) Security Update for Windows XP (KB981957) Security Update for Windows XP (KB981997) Security Update for Windows XP (KB982132) Security Update for Windows XP (KB982214) Security Update for Windows XP (KB982665) Security Update for Windows XP (KB982802) SpeedBit Video Accelerator System Requirements Lab Toxic Biohazard Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Windows Internet Explorer 7 (KB980182) Update for Windows XP (KB2141007) Update for Windows XP (KB2345886) Update for Windows XP (KB2467659) Update for Windows XP (KB2541763) Update for Windows XP (KB955759) Update for Windows XP (KB971029) Update for Windows XP (KB971737) Update for Windows XP (KB973687) WebFldrs XP Whitesmoke Translator Windows Genuine Advantage Notifications (KB905474) . ==== Event Viewer Messages From Past Week ======== . 9/5/2011 7:20:39 PM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751) 8/29/2011 12:11:50 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E} 8/29/2011 12:10:02 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 8/29/2011 12:06:01 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Avgldx86 Avgmfx86 Fips intelppm sptd 8/29/2011 12:05:48 AM, error: Workstation [5728] - Could not load any transport. 8/29/2011 12:03:52 AM, error: sptd [4] - Driver detected an internal error in its data structures for . . ==== End Of File =========================== I will try again to see if I can get the gmer scan log saved on to the flash drive.(hope it works) Thanks so much again for all your help!!!!!
Post #9
Hello Nick23

Great job getting DDS to run! Very well done indeed :thumbup:

I'm assuming that I should run that Flash Disinfector before every time I want to put the flash drive in the uninfected computer

No need, it only needs to be run once.

I will try again to see if I can get the gmer scan log saved on to the flash drive

Don't panic if GMER is giving you trouble. Lets see if we can get one of the following tools to complete instead:

  • aswMBR


    • Download aswMBR.exe to your desktop.
    • Double click the aswMBR.exe to run it.
    • Click the "Scan" button to start scan.

    [external image: Posted Image]

    • On completion of the scan click save log, save it to your desktop and post in your next reply.

    [external image: Posted Image]


    If you are unable to save the log from this tool, try this one instead:

  • Rootkit Unhooker


    • Please Download Rootkit Unhooker and Save it to your desktop.
    • Now double-click on RKUnhookerLE.exe to run it.
    • Click the Report tab, then click Scan.
    • Check (Tick) Drivers, Stealth. Uncheck the rest, then Click OK.
    • Wait till the scanner has finished and then click File, Save Report.
    • Save the report somewhere where you can find it. Click Close.

    Copy the entire contents of the report and paste it in your next reply here.

    Note: You may get the following warning, just click OK and continue.

    "Rootkit Unhooker has detected a parasite inside itself!
    It is recommended to remove parasite, okay?"

    If you are able to save the GMER log please post it in your next reply. If not, please post either the aswMBR or Rootkit Unhooker log :)
Post #10
I think this is the GMER scan log that you need, if its right let me now what to do next. Do you still want me to try to get the aswMBR to work or am i fine now that i got GMER to scan? I also wanted to let you know that i was messing around trying to get into some of my programs and i happened to try and right click on a program and click "run as" and it seems to work on some programs, i am actually sending you this on the infected computer. Just thought i would let you now in case that could help in the future. Thanks again for helping me with all this, i seem to have such bad luck with computers.

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-09-06 03:53:11
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-17 ST3200822AS rev.3.02
Running: gmer.exe; Driver: C:\DOCUME~1\Nick\LOCALS~1\Temp\awryaaod.sys


—- System - GMER 1.0.15 —-

SSDT spfc.sys ZwCreateKey [0xF83C00E0]
SSDT spfc.sys ZwEnumerateKey [0xF83D8DA4]
SSDT spfc.sys ZwEnumerateValueKey [0xF83D9132]
SSDT spfc.sys ZwOpenKey [0xF83C00C0]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwOpenProcess [0xF597E738]
SSDT spfc.sys ZwQueryKey [0xF83D920A]
SSDT spfc.sys ZwQueryValueKey [0xF83D908A]
SSDT spfc.sys ZwSetValueKey [0xF83D929C]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateProcess [0xF597E7DC]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwTerminateThread [0xF597E878]
SSDT \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. ) ZwWriteVirtualMemory [0xF597E914]

INT 0x62 ? 83189BF8
INT 0x63 ? 83189BF8
INT 0x63 ? 83189BF8
INT 0x63 ? 82E8FBF8
INT 0x63 ? 83189BF8
INT 0x82 ? 83189BF8
INT 0x83 ? 82E8FBF8
INT 0xA4 ? 82E8FBF8
INT 0xB4 ? 82E8FBF8

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!ZwCallbackReturn + 27D8 80502010 4 Bytes JMP A2AD15AC
? spfc.sys The system cannot find the file specified. !
.text USBPORT.SYS!DllUnload F80288AC 5 Bytes JMP 82E8F1D8
? system32\drivers\xpsec.sys The system cannot find the path specified. !
? system32\drivers\xcpip.sys The system cannot find the path specified. !

—- Devices - GMER 1.0.15 —-

Device \FileSystem\Ntfs \Ntfs 831871F8

AttachedDevice \FileSystem\Ntfs \Ntfs AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )

Device \FileSystem\Fastfat \FatCdrom 82DCA500

AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device \Driver\usbuhci \Device\USBPDO-0 82FF31F8
Device \Driver\usbuhci \Device\USBPDO-1 82FF31F8
Device \Driver\dmio \Device\DmControl\DmIoDaemon 8318A1F8
Device \Driver\dmio \Device\DmControl\DmConfig 8318A1F8
Device \Driver\dmio \Device\DmControl\DmPnP 8318A1F8
Device \Driver\dmio \Device\DmControl\DmInfo 8318A1F8
Device \Driver\usbuhci \Device\USBPDO-2 82FF31F8
Device \Driver\usbuhci \Device\USBPDO-3 82FF31F8
Device \Driver\usbehci \Device\USBPDO-4 82FDC1F8

AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device \Driver\Ftdisk \Device\HarddiskVolume1 8318B1F8
Device \Driver\Cdrom \Device\CdRom0 82FBF1F8
Device \Driver\atapi \Device\Ide\IdePort0 [F8314B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdePort1 [F8314B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-4 [F8314B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdePort2 [F8314B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdePort3 [F8314B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-c [F8314B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-17 [F8314B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\Cdrom \Device\CdRom1 82FBF1F8
Device \Driver\NetBT \Device\NetBt_Wins_Export 82BD41F8
Device \Driver\NetBT \Device\NetbiosSmb 82BD41F8
Device \Driver\usbstor \Device\00000086 82B9F1F8
Device \Driver\usbstor \Device\00000087 82B9F1F8

AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device \Driver\usbuhci \Device\USBFDO-0 82FF31F8
Device \Driver\usbuhci \Device\USBFDO-1 82FF31F8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 82B971F8
Device \Driver\usbuhci \Device\USBFDO-2 82FF31F8
Device \FileSystem\MRxSmb \Device\LanmanRedirector 82B971F8
Device \Driver\usbuhci \Device\USBFDO-3 82FF31F8
Device \Driver\usbehci \Device\USBFDO-4 82FDC1F8
Device \Driver\Ftdisk \Device\FtControl 8318B1F8
Device \FileSystem\Fastfat \Fat 82DCA500

AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat AVGIDSFilter.Sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )

Device \FileSystem\Cdfs \Cdfs 82E11500

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x35 0x0A 0xDE 0x47 …
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x71 0x6B 0x6A 0xF8 …
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x1E 0x02 0x6F 0x15 …
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0x4A 0x42 0xD6 0x13 …
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42@khjeh 0x4A 0x42 0xD6 0x13 …
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43@khjeh 0x4A 0x42 0xD6 0x13 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x35 0x0A 0xDE 0x47 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x71 0x6B 0x6A 0xF8 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x1E 0x02 0x6F 0x15 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0x4A 0x42 0xD6 0x13 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42@khjeh 0x4A 0x42 0xD6 0x13 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43@khjeh 0x4A 0x42 0xD6 0x13 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x35 0x0A 0xDE 0x47 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x71 0x6B 0x6A 0xF8 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x1E 0x02 0x6F 0x15 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0x4A 0x42 0xD6 0x13 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42@khjeh 0x4A 0x42 0xD6 0x13 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43@khjeh 0x4A 0x42 0xD6 0x13 …
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x35 0x0A 0xDE 0x47 …
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools\
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x71 0x6B 0x6A 0xF8 …
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x1E 0x02 0x6F 0x15 …
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0x4A 0x42 0xD6 0x13 …
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42@khjeh 0x4A 0x42 0xD6 0x13 …
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43@khjeh 0x4A 0x42 0xD6 0x13 …

—- Disk sectors - GMER 1.0.15 —-

Disk \Device\Harddisk0\DR0 sector 00: rootkit-like behavior
Disk \Device\Harddisk0\DR0 malicious Win32:MBRoot code @ sector 390700803
Disk \Device\Harddisk0\DR0 PE file @ sector 390700825
Disk \Device\Harddisk0\DR0 MBRoot/Sinowal@MBR code has been found <– ROOTKIT !!!

—- Files - GMER 1.0.15 —-

File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\gs_palm_06.BH3 3530 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\gs_dead_01.BH3 2431 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\gs_dead_02.BH3 2431 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\gs_dead_03.BH3 2431 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\gs_dead_04.BH3 2431 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\gs_leafy2_01.BH3 3256 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\gs_leafy2_02.BH3 3256 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\gs_leafy2_03.BH3 3256 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\gs_leafy_01.BH3 4078 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\gs_leafy_02.BH3 3527 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\gs_leafy_03.BH3 4078 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\gs_leafy_04.BH3 3527 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\gs_leafy_05.BH3 3527 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\gs_palm_01.BH3 3530 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\gs_palm_02.BH3 3530 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\gs_palm_03.BH3 3530 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\gs_palm_04.BH3 3530 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\gs_palm_05.BH3 3748 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\gs_palm_07.BH3 3920 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\gs_palm_08.BH3 3874 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\gs_palm_09.BH3 3874 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\savannah_lowend_tree_01.BH3 599 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\savannah_lowend_tree_02.BH3 645 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\savannah_lowend_tree_03.BH3 553 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\savannah_lowend_tree_04.BH3 507 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\savannah_lowend_tree_05.BH3 507 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\savannah_lowend_tree_06.BH3 507 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\savannah_low_trees.tga 122102 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\savannah_tree_01.BH3 4224 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\savannah_tree_02.BH3 4132 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\savannah_tree_03.BH3 4132 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\savannah_tree_04.BH3 3328 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\savannah_tree_05.BH3 3650 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\savannah_tree_06.BH3 3650 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\savannah_tree_07.BH3 3650 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\savannah_tree_08.BH3 3328 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\Tree_T_Bark.tga 65702 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\Tree_T_Bark2.tga 65683 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\tree_t_bottom_a.tga 110459 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\tree_t_bottom_b.tga 69919 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\Tree_T_Middle_A.tga 118609 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\tree_t_middle_b.tga 140777 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\Tree_T_Shadows.tga 29555 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\african_savannah\astrees\tree_t_top_a.tga 255853 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctic1.tga 2327978 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctic2.tga 2334784 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctic3.tga 2271195 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctic4.tga 2288674 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees 0 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\tree_a_11.bh3 4143 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\arctic_lowend_tree_01.BH3 553 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\arctic_lowend_tree_02.BH3 553 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\arctic_lowend_tree_03.BH3 553 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\arctic_lowend_tree_04.BH3 553 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\arctic_lowend_tree_05.BH3 553 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\arctic_lowend_tree_06.BH3 553 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\arctic_low_trees.tga 147168 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\tree_a_00.bh3 3471 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\tree_a_01.bh3 3467 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\tree_a_02.bh3 3609 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\tree_a_03.bh3 3467 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\tree_a_04.bh3 3925 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\tree_a_05.bh3 3925 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\tree_a_06.bh3 3517 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\tree_a_07.bh3 3517 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\tree_a_10.bh3 4143 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\tree_a_12.bh3 4143 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\tree_a_13.bh3 4143 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\tree_a_14.bh3 3735 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\tree_a_15.bh3 4143 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\tree_a_16.bh3 4551 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\tree_a_17.bh3 4143 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\tree_a_20.bh3 3821 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\tree_a_21.bh3 3099 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\tree_a_22.bh3 3821 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\tree_a_23.bh3 3821 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\tree_a_24.bh3 3821 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\tree_a_25.bh3 4401 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\tree_a_26.bh3 3821 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\tree_a_27.bh3 3241 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\tree_a_bark.tga 64760 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\tree_a_bottom_a.tga 178628 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\tree_a_bottom_b.tga 178624 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\tree_a_middle_a.tga 177435 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\tree_a_middle_b.tga 176708 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\tree_a_middle_c.tga 187312 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\tree_a_shadows.tga 24412 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\arctictrees\tree_a_top_a.tga 162460 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\coastal.tga 262686 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\arctic\ocean_floor_5.tga 1036839 bytes
File C:\Program Files\Microsoft Games\Rise of Nations\terrain art\tilesets\common\common_doobers 0 bytes

—- EOF - GMER 1.0.15 —-

Attachments:

Post #11
Hello Nick23

Thank you for the GMER log :)

Do you still want me to try to get the aswMBR to work or am i fine now that i got GMER to scan?

There is no need to run those tools now, GMER tells us everything we need to know.

Please work your way through the following steps. If you encounter any problems or are not sure what to do just stop and ask.

  • P2P Programs:


    • P2P programs are a major source of Malware infections.
    • From your log I see you have BitComet 1.27. We do not pass judgment on file-sharing, however we must inform you that engaging in this activity and having this kind of software installed on your system will always make you more susceptible to Malware infections.
    • The use of P2P programs may be contributing to your current situation, and you would certainly be doing yourself a favour by removing them.
    • If you wish to keep the program(s), please do not use them until your computer is cleaned.
    • Information regarding the risk of using these programs can be found from here and here.
    • It is strongly recommend that you uninstall any P2P programs you have on your system.
    • To do this, Click on "Start" then on "Control Panel" and then on "Add or remove programs".
    • A list of currently installed programs will be displayed.
    • Find the "BitComet 1.27" program, click on it once and then click on the "Remove" button.
    • If you are prompted to re-boot your computer to complete the uninstall please do so.


      PLEASE NOTE:
    • Even if you are using a P2P program that is deemed safe, it is only the program that is safe. Any files that you receive using a "safe" P2P program may be infected with Malware. The malware writers use P2P file-sharing as a major conduit to spread infected files.

  • Toolbars


    • I can see that you have Ask Toolbar installed.
    • We recommend that you uninstall this toolbar from your machine.
    • To do this, Click on "Start" then on "Control Panel" and then on "Add or remove programs".
    • A list of currently installed programs will be displayed.
    • Find the "Ask Toolbar" program, click on it once and then click on the "Remove" button.
    • If you are prompted to re-boot your computer to complete the uninstall please do so.

  • Please un-install Whitesmoke Translator


    • Click on "Start" then on "Control Panel" and then on "Add or remove programs".
    • Click on "remove a program". A list of currently installed programs will be displayed.
    • Find the "Whitesmoke Translator" program, click on it once and then click on the "uninstall" button.
    • If you are prompted to re-boot your computer to complete the uninstall please do so.

  • TDSS Killer


    • Please read carefully and follow these steps.
    • Download TDSSKiller and save it to your Desktop.
    • Extract its contents to your desktop.
    • Once extracted, open the TDSSKiller folder and double click on TDSSKiller.exe to run the application, then on Start Scan.
    • If an infected file is detected, the default action will be Cure, click on Continue.
    • If a suspicious file is detected, the default action will be Skip, click on Continue.
    • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
    • If no reboot is required, click on Report. A log file should appear. Please copy and paste the contents of that file here.
    • If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

    Please post the TDSSKiller log in your next reply :)
Post #12
I have already tried getting into the control panel to delete some programs but when i click on the add remove programs icon that same message comes up that wont let me get into it.
Post #13
o and i also tried uninstalling whitesmoke a number of times before but when i tried to remove it from the control panel it wouldn't let me i forget what it told me i guess I'll have to wait until i can get in there again so i can let you now what it says
Post #15
The TDSSkiller worked and ran here is the log, hope it works. 2011/09/07 15:54:18.0062 3100 TDSS rootkit removing tool 2.5.19.0 Sep 6 2011 19:23:56 2011/09/07 15:54:18.0718 3100 ================================================================================ 2011/09/07 15:54:18.0718 3100 SystemInfo: 2011/09/07 15:54:18.0718 3100 2011/09/07 15:54:18.0718 3100 OS Version: 5.1.2600 ServicePack: 3.0 2011/09/07 15:54:18.0718 3100 Product type: Workstation 2011/09/07 15:54:18.0718 3100 ComputerName: XPWINDOWS7 2011/09/07 15:54:18.0718 3100 UserName: Nick 2011/09/07 15:54:18.0718 3100 Windows directory: C:\WINDOWS 2011/09/07 15:54:18.0718 3100 System windows directory: C:\WINDOWS 2011/09/07 15:54:18.0718 3100 Processor architecture: Intel x86 2011/09/07 15:54:18.0718 3100 Number of processors: 1 2011/09/07 15:54:18.0718 3100 Page size: 0x1000 2011/09/07 15:54:18.0718 3100 Boot type: Normal boot 2011/09/07 15:54:18.0718 3100 ================================================================================ 2011/09/07 15:54:22.0578 3100 Initialize success 2011/09/07 15:54:29.0875 3912 ================================================================================ 2011/09/07 15:54:29.0875 3912 Scan started 2011/09/07 15:54:29.0875 3912 Mode: Manual; 2011/09/07 15:54:29.0875 3912 ================================================================================ 2011/09/07 15:54:31.0859 3912 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys 2011/09/07 15:54:32.0156 3912 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys 2011/09/07 15:54:32.0765 3912 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys 2011/09/07 15:54:33.0093 3912 AFD (355556d9e580915118cd7ef736653a89) C:\WINDOWS\System32\drivers\afd.sys 2011/09/07 15:54:33.0906 3912 AgereSoftModem (593aefc67283d409f34cc1245d00a509) C:\WINDOWS\system32\DRIVERS\AGRSM.sys 2011/09/07 15:54:36.0140 3912 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys 2011/09/07 15:54:37.0125 3912 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys 2011/09/07 15:54:37.0531 3912 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys 2011/09/07 15:54:37.0937 3912 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys 2011/09/07 15:54:38.0234 3912 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys 2011/09/07 15:54:38.0750 3912 AVGIDSDriver (c403e7f715bb0a851a9dfae16ec4ae42) C:\WINDOWS\system32\DRIVERS\AVGIDSDriver.Sys 2011/09/07 15:54:39.0031 3912 AVGIDSEH (1af676db3f3d4cc709cfab2571cf5fc3) C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys 2011/09/07 15:54:39.0328 3912 AVGIDSFilter (4c51e233c87f9ec7598551de554bc99d) C:\WINDOWS\system32\DRIVERS\AVGIDSFilter.Sys 2011/09/07 15:54:39.0703 3912 AVGIDSShim (c3fc426e54f55c1cc3219e415b88e10c) C:\WINDOWS\system32\DRIVERS\AVGIDSShim.Sys 2011/09/07 15:54:40.0000 3912 Avgldx86 (4e796d3d2c3182b13b3e3b5a2ad4ef0a) C:\WINDOWS\system32\DRIVERS\avgldx86.sys 2011/09/07 15:54:40.0328 3912 Avgmfx86 (5639de66b37d02bd22df4cf3155fba60) C:\WINDOWS\system32\DRIVERS\avgmfx86.sys 2011/09/07 15:54:40.0656 3912 Avgrkx86 (d1baf652eda0ae70896276a1fb32c2d4) C:\WINDOWS\system32\DRIVERS\avgrkx86.sys 2011/09/07 15:54:41.0031 3912 Avgtdix (aaf0ebcad95f2164cffb544e00392498) C:\WINDOWS\system32\DRIVERS\avgtdix.sys 2011/09/07 15:54:41.0406 3912 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys 2011/09/07 15:54:41.0843 3912 Bridge (f934d1b230f84e1d19dd00ac5a7a83ed) C:\WINDOWS\system32\DRIVERS\bridge.sys 2011/09/07 15:54:42.0015 3912 BridgeMP (f934d1b230f84e1d19dd00ac5a7a83ed) C:\WINDOWS\system32\DRIVERS\bridge.sys 2011/09/07 15:54:42.0343 3912 BVRPMPR5 (a0b1aeb65397adcae5a199bd152c107d) C:\WINDOWS\system32\drivers\BVRPMPR5.SYS 2011/09/07 15:54:42.0812 3912 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys 2011/09/07 15:54:43.0375 3912 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys 2011/09/07 15:54:43.0875 3912 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys 2011/09/07 15:54:44.0125 3912 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys 2011/09/07 15:54:45.0562 3912 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys 2011/09/07 15:54:46.0296 3912 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys 2011/09/07 15:54:47.0109 3912 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys 2011/09/07 15:54:47.0484 3912 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys 2011/09/07 15:54:47.0765 3912 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys 2011/09/07 15:54:48.0312 3912 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys 2011/09/07 15:54:48.0593 3912 es1371 (a55dd7d8ced5d2624a9ee2dda7be0319) C:\WINDOWS\system32\drivers\es1371mp.sys 2011/09/07 15:54:49.0062 3912 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys 2011/09/07 15:54:49.0328 3912 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys 2011/09/07 15:54:49.0546 3912 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys 2011/09/07 15:54:49.0781 3912 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys 2011/09/07 15:54:50.0234 3912 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys 2011/09/07 15:54:50.0531 3912 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys 2011/09/07 15:54:50.0796 3912 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys 2011/09/07 15:54:51.0218 3912 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys 2011/09/07 15:54:51.0468 3912 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys 2011/09/07 15:54:51.0750 3912 hamachi (833051c6c6c42117191935f734cfbd97) C:\WINDOWS\system32\DRIVERS\hamachi.sys 2011/09/07 15:54:52.0187 3912 HDAudBus (3fcc124b6e08ee0e9351f717dd136939) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 2011/09/07 15:54:52.0484 3912 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys 2011/09/07 15:54:53.0156 3912 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys 2011/09/07 15:54:53.0875 3912 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys 2011/09/07 15:54:54.0765 3912 ialm (81efe1c5542afb2570758f39ae3b1151) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys 2011/09/07 15:54:55.0578 3912 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys 2011/09/07 15:54:57.0843 3912 IntcAzAudAddService (d934b46d095285d8e3ee21f739bb4ad0) C:\WINDOWS\system32\drivers\RtkHDAud.sys 2011/09/07 15:55:00.0031 3912 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys 2011/09/07 15:55:00.0328 3912 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys 2011/09/07 15:55:00.0562 3912 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys 2011/09/07 15:55:00.0875 3912 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 2011/09/07 15:55:01.0156 3912 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys 2011/09/07 15:55:01.0421 3912 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys 2011/09/07 15:55:01.0781 3912 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys 2011/09/07 15:55:02.0031 3912 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys 2011/09/07 15:55:02.0359 3912 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys 2011/09/07 15:55:02.0625 3912 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys 2011/09/07 15:55:02.0906 3912 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys 2011/09/07 15:55:03.0234 3912 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys 2011/09/07 15:55:03.0593 3912 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys 2011/09/07 15:55:04.0375 3912 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys 2011/09/07 15:55:04.0671 3912 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys 2011/09/07 15:55:04.0953 3912 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys 2011/09/07 15:55:05.0187 3912 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys 2011/09/07 15:55:05.0437 3912 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys 2011/09/07 15:55:05.0890 3912 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys 2011/09/07 15:55:06.0265 3912 MRxSmb (0dc719e9b15e902346e87e9dcd5751fa) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 2011/09/07 15:55:06.0734 3912 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys 2011/09/07 15:55:07.0015 3912 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys 2011/09/07 15:55:07.0218 3912 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys 2011/09/07 15:55:07.0437 3912 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys 2011/09/07 15:55:07.0687 3912 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys 2011/09/07 15:55:07.0968 3912 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys 2011/09/07 15:55:08.0312 3912 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys 2011/09/07 15:55:08.0562 3912 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys 2011/09/07 15:55:08.0796 3912 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys 2011/09/07 15:55:09.0031 3912 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys 2011/09/07 15:55:09.0328 3912 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys 2011/09/07 15:55:09.0671 3912 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys 2011/09/07 15:55:09.0984 3912 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys 2011/09/07 15:55:10.0328 3912 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys 2011/09/07 15:55:10.0562 3912 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys 2011/09/07 15:55:11.0000 3912 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys 2011/09/07 15:55:11.0437 3912 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys 2011/09/07 15:55:11.0687 3912 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 2011/09/07 15:55:11.0968 3912 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 2011/09/07 15:55:12.0234 3912 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys 2011/09/07 15:55:12.0515 3912 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys 2011/09/07 15:55:12.0765 3912 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys 2011/09/07 15:55:13.0031 3912 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys 2011/09/07 15:55:13.0265 3912 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys 2011/09/07 15:55:13.0718 3912 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\drivers\PCIIde.sys 2011/09/07 15:55:14.0000 3912 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys 2011/09/07 15:55:15.0468 3912 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys 2011/09/07 15:55:15.0750 3912 Ps2 (390c204ced3785609ab24e9c52054a84) C:\WINDOWS\system32\DRIVERS\PS2.sys 2011/09/07 15:55:16.0062 3912 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys 2011/09/07 15:55:17.0390 3912 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys 2011/09/07 15:55:17.0671 3912 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 2011/09/07 15:55:17.0906 3912 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys 2011/09/07 15:55:18.0171 3912 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys 2011/09/07 15:55:18.0500 3912 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys 2011/09/07 15:55:18.0843 3912 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 2011/09/07 15:55:19.0171 3912 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys 2011/09/07 15:55:19.0562 3912 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys 2011/09/07 15:55:19.0859 3912 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys 2011/09/07 15:55:20.0125 3912 RimSerPort (b177927edfb8fb8da62ee1dfbcefde54) C:\WINDOWS\system32\DRIVERS\RimSerial.sys 2011/09/07 15:55:20.0703 3912 ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS\system32\Drivers\RootMdm.sys 2011/09/07 15:55:21.0015 3912 rtl8139 (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS 2011/09/07 15:55:21.0281 3912 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys 2011/09/07 15:55:21.0578 3912 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\drivers\Serial.sys 2011/09/07 15:55:21.0843 3912 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys 2011/09/07 15:55:22.0562 3912 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys 2011/09/07 15:55:23.0015 3912 sptd (cdddec541bc3c96f91ecb48759673505) C:\WINDOWS\system32\Drivers\sptd.sys 2011/09/07 15:55:23.0031 3912 Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: cdddec541bc3c96f91ecb48759673505 2011/09/07 15:55:23.0046 3912 sptd - detected LockedFile.Multi.Generic (1) 2011/09/07 15:55:23.0453 3912 sp_rsdrv2 (8831252bcf05fcfb5abd116a22e552d8) C:\WINDOWS\system32\drivers\sp_rsdrv2.sys 2011/09/07 15:55:23.0765 3912 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys 2011/09/07 15:55:24.0296 3912 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys 2011/09/07 15:55:24.0640 3912 StillCam (a9573045baa16eab9b1085205b82f1ed) C:\WINDOWS\system32\DRIVERS\serscan.sys 2011/09/07 15:55:24.0937 3912 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys 2011/09/07 15:55:25.0343 3912 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys 2011/09/07 15:55:26.0484 3912 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys 2011/09/07 15:55:26.0906 3912 Tcpip (163096f2d0d3fab77cb577bcfbee59ce) C:\WINDOWS\system32\DRIVERS\tcpip.sys 2011/09/07 15:55:27.0234 3912 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys 2011/09/07 15:55:27.0484 3912 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys 2011/09/07 15:55:27.0734 3912 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys 2011/09/07 15:55:28.0281 3912 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys 2011/09/07 15:55:28.0812 3912 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys 2011/09/07 15:55:29.0218 3912 USBAAPL (5c2bdc152bbab34f36473deaf7713f22) C:\WINDOWS\system32\Drivers\usbaapl.sys 2011/09/07 15:55:29.0500 3912 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys 2011/09/07 15:55:29.0781 3912 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys 2011/09/07 15:55:30.0062 3912 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys 2011/09/07 15:55:30.0328 3912 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys 2011/09/07 15:55:30.0609 3912 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys 2011/09/07 15:55:30.0890 3912 usbstor (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 2011/09/07 15:55:31.0156 3912 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys 2011/09/07 15:55:31.0437 3912 VClone (1cdaa48cb2f7744b8d25650e050766a5) C:\WINDOWS\system32\DRIVERS\VClone.sys 2011/09/07 15:55:31.0718 3912 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys 2011/09/07 15:55:32.0171 3912 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys 2011/09/07 15:55:32.0453 3912 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys 2011/09/07 15:55:32.0906 3912 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys 2011/09/07 15:55:33.0312 3912 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys 2011/09/07 15:55:33.0593 3912 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys 2011/09/07 15:55:33.0906 3912 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys 2011/09/07 15:55:34.0203 3912 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys 2011/09/07 15:55:34.0703 3912 MBR (0x1B8) (a85844a0d2ae290fb601360a641e5962) \Device\Harddisk0\DR0 2011/09/07 15:55:34.0703 3912 \Device\Harddisk0\DR0 - detected Backdoor.Win32.Sinowal.knf (0) 2011/09/07 15:55:34.0718 3912 Boot (0x1200) (17156945071a2f354bd517b7b622be2d) \Device\Harddisk0\DR0\Partition0 2011/09/07 15:55:34.0734 3912 ================================================================================ 2011/09/07 15:55:34.0734 3912 Scan finished 2011/09/07 15:55:34.0734 3912 ================================================================================ 2011/09/07 15:55:34.0765 3900 Detected object count: 2 2011/09/07 15:55:34.0765 3900 Actual detected object count: 2 2011/09/07 15:56:16.0984 3900 LockedFile.Multi.Generic(sptd) - User select action: Skip 2011/09/07 15:56:17.0140 3900 \Device\Harddisk0\DR0 (Backdoor.Win32.Sinowal.knf) - will be cured after reboot 2011/09/07 15:56:17.0140 3900 \Device\Harddisk0\DR0 - ok 2011/09/07 15:56:17.0140 3900 Backdoor.Win32.Sinowal.knf(\Device\Harddisk0\DR0) - User select action: Cure

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI