What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

how to get rid of ping.exe virus [Solved]

15 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi :)

I had a virus show up the other say. It came with the "security alert" thing. That stopped, but the ping.exe thing continues.

I need to transfer some image files from the infected computer to my new computer (family photos mostly) but don't want the new computer to be infected as well. I plan to reinstall windows on the old computer once I get the photos out.

What can I do and how should I do it?

Thank you in advance for any help.

Here is the gmer results, which did find a rootkit.


************************************************************

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-12-29 18:35:36
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 WDC_WD400EB-00CPF0 rev.06.04G06
Running: gmer.exe; Driver: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\kxlyyaow.sys


—- System - GMER 1.0.15 —-

SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwAddBootEntry [0xEE7BACAE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwAdjustPrivilegesToken [0xEEFB75FA]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwClose [0xEE7D79A5]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwConnectPort [0xEEFB8D32]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateEvent [0xEE7BCB34]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateEventPair [0xEE7BCB8C]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateFile [0xEEFB81DA]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateIoCompletion [0xEE7BCCA2]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateKey [0xEE7D7359]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateMutant [0xEE7BCA8A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateNamedPipeFile [0xEEFB71E8]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreatePort [0xEEFB9036]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateSection [0xEE7BCBDC]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateSemaphore [0xEE7BCADE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateThread [0xEEFB7B86]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateTimer [0xEE7BCC50]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwCreateWaitablePort [0xEEFB90CC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDebugActiveProcess [0xEEFBAA84]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDeleteBootEntry [0xEE7BACD2]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDeleteKey [0xEE7D806B]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDeleteValueKey [0xEE7D8321]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwDeviceIoControlFile [0xEEFB865C]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDuplicateObject [0xEE7BD3D4]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwEnumerateKey [0xEE7D7ED6]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwEnumerateValueKey [0xEE7D7D41]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwFsControlFile [0xEEFB846A]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwLoadDriver [0xEE7BAADA]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwLoadKey [0xEEFB6446]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwLoadKey2 [0xEEFB6458]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwMapViewOfSection [0xEEFBB2DE]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwModifyBootEntry [0xEE7BACF6]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwNotifyChangeKey [0xEE7BD548]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwNotifyChangeMultipleKeys [0xEE7BB7F8]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenEvent [0xEE7BCB64]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenEventPair [0xEE7BCBB4]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwOpenFile [0xEEFB7F80]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenIoCompletion [0xEE7BCCCC]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenKey [0xEE7D76B5]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenMutant [0xEE7BCAB6]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenProcess [0xEE7BD20C]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenSection [0xEE7BCC1C]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenSemaphore [0xEE7BCB0C]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenThread [0xEE7BD2F0]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenTimer [0xEE7BCC7A]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwQueryKey [0xEE7D7BBC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQueryMultipleValueKey [0xEEFB6CDC]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwQueryObject [0xEE7BB6BE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQuerySection [0xEEFBB618]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwQueryValueKey [0xEE7D7A0E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwQueueApcThread [0xEEFBAF0A]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwRenameKey [0xEE80B22E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwReplaceKey [0xEEFB5E80]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwReplyPort [0xEEFB9796]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwReplyWaitReceivePort [0xEE7BD57E]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwReplyWaitReceivePortEx [0xEE7BD142]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwRequestWaitReplyPort [0xEEFBA81E]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwRestoreKey [0xEE7D69CC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwResumeThread [0xEEFBBB32]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSaveKey [0xEEFB5E18]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSecureConnectPort [0xEEFB8A78]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetBootEntryOrder [0xEE7BAD1A]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetBootOptions [0xEE7BAD3E]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSetContextThread [0xEEFB7DA2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSetInformationToken [0xEEFBA0BE]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSetSecurityObject [0xEEFBAD14]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetSystemInformation [0xEE7BAB34]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetValueKey [0xEE7D8172]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwShutdownSystem [0xEE7BAC44]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSuspendProcess [0xEEFBB85A]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwSuspendThread [0xEEFBB994]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSystemDebugControl [0xEE7BAC56]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwTerminateProcess [0xEEFB79D2]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwTerminateThread [0xEEFB7932]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwUnmapViewOfSection [0xEEFBB4BC]
SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) ZwWriteVirtualMemory [0xEEFB7ABC]

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateProcessEx [0xEE817BAE]
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) FsRtlCheckLockForReadAccess
Code \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab) IoIsOperationSynchronous

—- Kernel code sections - GMER 1.0.15 —-

.text ntoskrnl.exe!_abnormal_termination + D8 804E2734 16 Bytes [34, CB, 7B, EE, 8C, CB, 7B, …] {XOR AL, 0xcb; JNP 0xfffffffffffffff2; MOV EBX, CS; JNP 0xfffffffffffffff6; FIADD DWORD [ECX-0x335d1105]; JNP 0xfffffffffffffffe}
.text ntoskrnl.exe!_abnormal_termination + 1D0 804E282C 12 Bytes [DA, AA, 7B, EE, 46, 64, FB, …]
.text ntoskrnl.exe!_abnormal_termination + 214 804E2870 16 Bytes [64, CB, 7B, EE, B4, CB, 7B, …]
.text ntoskrnl.exe!_abnormal_termination + 2D1 804E292D 3 Bytes [6C, FB, EE] {INSB ; STI ; OUT DX, AL }
.text ntoskrnl.exe!_abnormal_termination + 34C 804E29A8 20 Bytes [2E, B2, 80, EE, 80, 5E, FB, …]
.text …
.text ntoskrnl.exe!IoIsOperationSynchronous 804E875A 5 Bytes JMP EEFAA3C8 \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)
.text ntoskrnl.exe!FsRtlCheckLockForReadAccess 80503289 5 Bytes JMP EEFA9FEC \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)
PAGE ntoskrnl.exe!ZwCreateProcessEx 80582016 7 Bytes JMP EE817BB2 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
.text PCIIDEX.SYS!PciIdeXSetBusData + B2A F8AA145E 3 Bytes [EF, 0D, 82]
.text PCIIDEX.SYS!PciIdeXSetBusData + D72 F8AA16A6 4 Bytes JMP 82439AC4
.text PCIIDEX.SYS!PciIdeXDebugPrint + 24 F8AA16DE 3 Bytes [EF, 0D, 82]
.text PCIIDEX.SYS!PciIdeXDebugPrint + 173 F8AA182D 4 Bytes JMP 82439AC4
.text PCIIDEX.SYS!PciIdeXDebugPrint + 1A8 F8AA1862 4 Bytes JMP 82439AC4
PAGE PCIIDEX.SYS!PciIdeXDebugPrint + 7CC F8AA1E86 3 Bytes [EF, 0D, 82]
PAGE PCIIDEX.SYS!PciIdeXDebugPrint + 19B9 F8AA3073 3 Bytes [EF, 0D, 82]
PAGE …
PAGE PCIIDEX.SYS!PciIdeXInitialize + 289 F8AA4C65 3 Bytes [EF, 0D, 82]
.text atapi.sys F8766E49 4 Bytes JMP 821A9D9C
.text atapi.sys F876709D 4 Bytes JMP 821A9D9C
.text atapi.sys F876753F 4 Bytes JMP 821A9D9C
.text atapi.sys F87676CD 4 Bytes JMP 821A9D9C
.text atapi.sys F876779D 4 Bytes JMP 821A9D9C
.text …
.text CLASSPNP.SYS!ClassReleaseRemoveLock + 198 F88605C8 4 Bytes JMP 820F5DC4
.text CLASSPNP.SYS!ClassCompleteRequest + D F8860C6C 4 Bytes JMP 82044794
.text CLASSPNP.SYS!ClassCompleteRequest + 3FE F886105D 4 Bytes JMP 820F5DC4
.text CLASSPNP.SYS!ClassSendSrbSynchronous + EE F8861210 4 Bytes JMP 820F5DC4
.text CLASSPNP.SYS!ClassDeviceControl + BD F8861627 4 Bytes JMP 82044794
.text CLASSPNP.SYS!ClassDeviceControl + 2B4 F886181E 4 Bytes JMP 820F5DC4
.text CLASSPNP.SYS!ClassReleaseQueue + EA F88625DD 4 Bytes JMP 820F5DC4
.text CLASSPNP.SYS!ClassReleaseChildLock + 66 F8862C36 4 Bytes JMP 820F5DC4
.text CLASSPNP.SYS!ClassSendIrpSynchronous + 3A F8862E01 4 Bytes JMP 820F5DC4
.text CLASSPNP.SYS!ClassGetDriverExtension + 15E F88633A8 4 Bytes JMP 820F5DC4
.text CLASSPNP.SYS!ClassFindModePage + 5AD F8863DC5 4 Bytes JMP 820F5DC4
.text CLASSPNP.SYS!ClassFindModePage + 7D4 F8863FEC 4 Bytes JMP 821AF3A4
.text CLASSPNP.SYS!ClassFindModePage + 90E F8864126 4 Bytes JMP 82359C34
.text CLASSPNP.SYS!ClassFindModePage + 938 F8864150 4 Bytes JMP 820F5DC4
.text CLASSPNP.SYS!ClassFindModePage + A7D F8864295 4 Bytes JMP 821AF3A4
.text …
.text CLASSPNP.SYS!ClassInternalIoControl + 87 F886504A 4 Bytes JMP 820F5DC4
.text CLASSPNP.SYS!ClassGetVpb + 167 F886524B 4 Bytes JMP 820F5DC4
.text CLASSPNP.SYS!ClassSendStartUnit + C9 F88654C1 4 Bytes JMP 820F5DC4
.text CLASSPNP.SYS!ClassSendSrbAsynchronous + 10D F8865610 4 Bytes JMP 820F5DC4
.text CLASSPNP.SYS!ClassWmiFireEvent + 3A9 F8865ABA 4 Bytes JMP 820F5DC4
.text CLASSPNP.SYS!ClassWmiFireEvent + 807 F8865F18 4 Bytes JMP 820F5DC4
.text CLASSPNP.SYS!ClassIoCompleteAssociated + 18B F8866551 4 Bytes JMP 821AF3A4
PAGE CLASSPNP.SYS!ClassDebugPrint + 5B1 F8866BB3 4 Bytes JMP 820F5DC4
PAGE CLASSPNP.SYS!ClassDebugPrint + 7CD F8866DCF 4 Bytes JMP 820F5DC4
PAGE CLASSPNP.SYS!ClassInvalidateBusRelations + 203 F88672C0 4 Bytes JMP 820F5DC4
PAGE CLASSPNP.SYS!ClassInitialize + 6C0 F8867A7E 4 Bytes JMP 820F5DC4
? system32\drivers\06665795.sys The system cannot find the path specified. !

—- User code sections - GMER 1.0.15 —-

.text C:\WINDOWS\System32\svchost.exe[1444] ntdll.dll!NtProtectVirtualMemory 7C90DEB6 5 Bytes JMP 0105000A
.text C:\WINDOWS\System32\svchost.exe[1444] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 0106000A
.text C:\WINDOWS\System32\svchost.exe[1444] ntdll.dll!KiUserExceptionDispatcher 7C90EAEC 5 Bytes JMP 0103000C
.text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[2008] kernel32.dll!SetUnhandledExceptionFilter 7C84480D 4 Bytes [C2, 04, 00, 90] {RET 0x4; NOP }

—- Devices - GMER 1.0.15 —-

Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/AVAST Software)

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\Ip kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\Tcp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)

Device \Driver\58906790 \Device\KLMD14092011_206080 06665795.sys

AttachedDevice \Driver\Tcpip \Device\Udp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\RawIp kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)

—- Modules - GMER 1.0.15 —-

Module (noname) (*** hidden *** ) EEE95000-EEEAF000 (106496 bytes)

—- EOF - GMER 1.0.15 —-
Post #2
Hi Selene,

:welcome:

My name is NoodleTech. I would be glad to assist you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • Please be aware that removing malware is not without risk and while unrecoverable damage to systems is rare, it can happen and may require a re-format and re-install of your operating system. Because of this it is a good idea to back-up anything important saved on your computer.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Do not delete anything unless instructed to.
  • DO NOT use tools such as ComboFix without supervision.
  • Please continue to review my answers until I tell you your machine appears to be clean. Absence of symptoms does not mean that everything is clean.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.
  • Failure to respond within 3 days will result in this topic being closed - If you need more time to complete the steps required, please let me know.
===================================================

Let's try and get your computer cleaned up before you transfer any files over. I will need you to run several scans.

===================================================

Please download DDS by sUBs from one of the following links and save it to your desktop.
    • DDS.scr
    • DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments,  attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scrolling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.
===================================================

Please download aswMBR.exe and save it to your desktop. 

Double click aswMBR.exe to start the tool. (Vista/Windows 7 users - right click to run as administrator)

Click Scan
  • Upon completion of the scan, click Save log and save it to your desktop, and post that log in your next reply for review.
  • Note - do NOT attempt any Fix yet.
  • You will also notice another file created on the desktop named MBR.dat.
  • Right click that file and select Send To>Compressed (zipped) file.
  • Attach that zipped file in your next reply as well.
===================================================

Please download TDSSKiller.zip
  • Extract it to your desktop
  • Double click TDSSKiller.exe
  • Press Start Scan.
    • If Malicious objects are found, DO NOT cure them.
    • Choose Skip then click on Continue.
  • Copy and paste the log in your next reply
    • A copy of the log will be saved automatically to the root of the drive (typically C:\)
===================================================

In your next post, please include the following:
  • DDS log
  • aswMBR log
  • TDSSKiller log
Post #3
. DDS (Ver_2011-06-23.01) - NTFSx86 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_26 Run by [removed] at 14:12:11 on 2011-12-30 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.503.136 [GMT -5:00] . . ============== Running Processes =============== . C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\Program Files\Alwil Software\Avast5\AvastSvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe C:\Program Files\BitTorrent\BitTorrent.exe C:\Program Files\Logitech\Logitech Vid\vid.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\WINDOWS\System32\ping.exe . ============== Pseudo HJT Report =============== . uSearch Page = hxxp://www.google.com uSearch Bar = hxxp://www.google.com/ie_rsearch.html uStart Page = hxxp://www.google.com/ uDefault_Page_URL = hxxp://www.google.com uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uSearchURL,(Default) = hxxp://www.google.com/keyword/%s mSearchAssistant = hxxp://www.google.com/ie_rsearch.html mWinlogon: SfcDisable=-99 (0xffffff9d) BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky anti-virus 2011\ievkbd.dll BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll BHO: Dictionary.com Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: FilterBHO Class: {e33cf602-d945-461a-83f0-819f76a199f8} - c:\program files\kaspersky lab\kaspersky anti-virus 2011\klwtbbho.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: Dictionary.com Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll uRun: [BitTorrent] "c:\program files\bittorrent\BitTorrent.exe" uRun: [Logitech Vid] "c:\program files\logitech\logitech vid\vid.exe" -bootmode uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [SoundMan] SOUNDMAN.EXE mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k mRun: [LogitechQuickCamRibbon] "c:\program files\logitech\logitech webcam software\LWS.exe" /hide mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [Microsoft Works Update Detection] c:\program files\common files\microsoft shared\works shared\WkUFind.exe mRun: [] mRun: [ApnUpdater] "c:\program files\ask.com\updater\Updater.exe" mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe" mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray dRunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N StartupFolder: c:\docume~1\alluse~1.win\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\2.0.181\SSScheduler.exe uPolicies-explorer: NoResolveTrack = 1 (0x1) uPolicies-explorer: NoSMMyPictures = 1 (0x1) uPolicies-explorer: NoSMConfigurePrograms = 1 (0x1) uPolicies-explorer: MemCheckBoxInRunDlg = 1 (0x1) uPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-explorer: MemCheckBoxInRunDlg = 1 (0x1) mPolicies-explorer: StartMenuFavorites = 0 (0x0) mPolicies-explorer: Start_ShowHelp = 0 (0x0) mPolicies-explorer: Start_ShowMyComputer = 1 (0x1) mPolicies-explorer: Start_ShowMyDocs = 1 (0x1) mPolicies-explorer: Start_ShowMyMusic = 0 (0x0) mPolicies-explorer: Start_ShowRun = 1 (0x1) mPolicies-explorer: Start_ShowSearch = 0 (0x0) dPolicies-explorer: NoSMHelp = 1 (0x1) dPolicies-explorer: ForceClassicControlPanel = 1 (0x1) dPolicies-explorer: NoResolveTrack = 1 (0x1) dPolicies-explorer: NoSMMyPictures = 1 (0x1) dPolicies-explorer: NoSMConfigurePrograms = 1 (0x1) dPolicies-explorer: MemCheckBoxInRunDlg = 1 (0x1) dPolicies-explorer: NoActiveDesktop = 1 (0x1) IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {4248FE82-7FCB-46AC-B270-339F08212110} - {4248FE82-7FCB-46AC-B270-339F08212110} - c:\program files\kaspersky lab\kaspersky anti-virus 2011\klwtbbho.dll IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - c:\program files\kaspersky lab\kaspersky anti-virus 2011\klwtbbho.dll LSP: mswsock.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab TCP: DhcpNameServer = 192.168.254.254 TCP: Interfaces\{588835AE-6DCB-41DF-A67F-9C05130E338A} : DhcpNameServer = 192.168.254.254 Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll Notify: igfxcui - igfxsrvc.dll Notify: klogon - c:\windows\system32\klogon.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll . ================= FIREFOX =================== . FF - ProfilePath - c:\documents and settings\administrator\application data\mozilla\firefox\profiles\lus9p8yq.default\ FF - component: c:\documents and settings\administrator\application data\mozilla\firefox\profiles\lus9p8yq.default\extensions\{c2f863cd-0429-48c7-bb54-db756a951760}\components\MailUtil.dll FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll FF - plugin: c:\program files\google\update\1.3.21.79\npGoogleUpdate3.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\microsoft silverlight\4.0.60831.0\npctrlui.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll FF - plugin: c:\program files\mozilla firefox\plugins\npdnupdater2.dll . —- FIREFOX POLICIES —- FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false FF - user.js: browser.sessionstore.resume_from_crash - false . ============= SERVICES / DRIVERS =============== . R0 KL1;kl1;c:\windows\system32\drivers\kl1.sys [2010-6-9 132184] R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-12-25 340048] R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2011-12-25 165584] R1 kl2;kl2;c:\windows\system32\drivers\kl2.sys [2010-6-9 11352] R1 KLIF;Kaspersky Lab Driver;c:\windows\system32\drivers\klif.sys [2011-12-25 475736] R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2011-12-25 40384] R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-12-26 652872] R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2011-12-25 40384] R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2011-12-25 40384] R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2010-5-7 32856] R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [2009-11-2 19472] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-12-26 20464] S2 aswFsBlk;aswFsBlk;aswFsBlk.sys –> aswFsBlk.sys [?] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-6-19 135664] S3 AVP;Kaspersky Anti-Virus Service;c:\program files\kaspersky lab\kaspersky anti-virus 2011\avp.exe [2010-11-2 365336] S3 cpudrv;cpudrv;c:\program files\systemrequirementslab\cpudrv.sys [2009-12-18 11336] S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-6-19 135664] S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-12-30 40776] S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\2.0.181\McCHSvc.exe [2010-1-15 227232] . =============== Created Last 30 ================ . 2011-12-30 17:19:16 40776 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-12-29 23:49:56 ——– d-s—w- C:\ComboFix 2011-12-26 11:23:38 ——– d—–w- c:\documents and settings\administrator\application data\Malwarebytes 2011-12-26 11:22:48 ——– d—–w- c:\documents and settings\all users.windows\application data\Malwarebytes 2011-12-26 11:22:42 20464 —-a-w- c:\windows\system32\drivers\mbam.sys 2011-12-26 11:22:40 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware 2011-12-26 01:15:13 150200 —-a-w- c:\program files\mozilla firefox\extensions\linkfilter@kaspersky.ru_bak\components\kavlinkfilter.dll 2011-12-26 01:14:29 115369 —-a-w- c:\windows\system32\drivers\klin.dat 2011-12-26 01:14:28 97961 —-a-w- c:\windows\system32\drivers\klick.dat 2011-12-26 01:11:32 ——– d—–w- c:\program files\Kaspersky Lab 2011-12-26 01:11:32 ——– d—–w- c:\documents and settings\all users.windows\application data\Kaspersky Lab 2011-12-26 00:56:58 340048 —-a-w- c:\windows\system32\drivers\aswSnx.sys 2011-12-26 00:56:19 38848 —-a-w- c:\windows\avastSS.scr 2011-12-25 02:04:31 ——– d—–w- c:\documents and settings\all users.windows\application data\Kaspersky Lab Setup Files 2011-12-25 00:56:31 ——– d—–w- c:\documents and settings\all users.windows\application data\Alwil Software 2011-12-17 23:46:14 159744 —-a-w- c:\program files\mozilla firefox\plugins\npqtplugin7.dll 2011-12-17 23:46:14 159744 —-a-w- c:\program files\mozilla firefox\plugins\npqtplugin6.dll 2011-12-17 23:46:14 159744 —-a-w- c:\program files\mozilla firefox\plugins\npqtplugin5.dll 2011-12-17 23:46:14 159744 —-a-w- c:\program files\mozilla firefox\plugins\npqtplugin4.dll 2011-12-17 23:46:14 159744 —-a-w- c:\program files\mozilla firefox\plugins\npqtplugin3.dll 2011-12-17 23:46:14 159744 —-a-w- c:\program files\mozilla firefox\plugins\npqtplugin2.dll 2011-12-17 23:46:14 159744 —-a-w- c:\program files\mozilla firefox\plugins\npqtplugin.dll 2011-12-17 23:46:14 159744 —-a-w- c:\program files\internet explorer\plugins\npqtplugin7.dll 2011-12-17 23:42:05 ——– d—–w- c:\documents and settings\administrator\local settings\application data\Apple 2011-12-17 23:40:45 ——– d—–w- c:\documents and settings\administrator\local settings\application data\Apple Computer 2011-12-07 04:30:15 ——– d–h–w- c:\windows\PIF . ==================== Find3M ==================== . 2011-12-17 04:16:52 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-10-24 19:29:02 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx 2011-10-24 19:29:02 69632 —-a-w- c:\windows\system32\QuickTime.qts . ============= FINISH: 14:15:54.28 ===============

Attachments:

Post #4
aswMBR version 0.9.9.1124 Copyright© 2011 AVAST Software Run date: 2011-12-30 14:24:33 —————————– 14:24:33.718 OS Version: Windows 5.1.2600 Service Pack 2 14:24:33.718 Number of processors: 1 586 0x209 14:24:33.781 ComputerName: EXPERIENCE UserName: 14:24:37.609 Initialize success 14:25:00.843 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 14:25:00.843 Disk 0 Vendor: WDC_WD400EB-00CPF0 06.04G06 Size: 38166MB BusType: 3 14:25:01.046 Disk 0 MBR read successfully 14:25:01.046 Disk 0 MBR scan 14:25:01.046 Disk 0 Windows XP default MBR code 14:25:01.046 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 38162 MB offset 63 14:25:01.109 Disk 0 scanning sectors +78156225 14:25:01.296 Disk 0 scanning C:\WINDOWS\system32\drivers 14:25:36.843 Service scanning 14:25:40.593 Service KL1 C:\WINDOWS\system32\DRIVERS\kl1.sys **LOCKED** 5 14:25:40.640 Service kl2 C:\WINDOWS\system32\DRIVERS\kl2.sys **LOCKED** 5 14:25:40.718 Service klim5 C:\WINDOWS\system32\DRIVERS\klim5.sys **LOCKED** 5 14:25:40.765 Service klmouflt C:\WINDOWS\system32\DRIVERS\klmouflt.sys **LOCKED** 5 14:25:42.375 Modules scanning 14:25:58.828 Module: C:\WINDOWS\System32\drivers\afd.sys **SUSPICIOUS** 14:26:22.703 Disk 0 trace - called modules: 14:26:22.734 ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x82822f10]<< 14:26:22.750 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x82fcf030] 14:26:22.765 3 CLASSPNP.SYS[f886105b] -> nt!IofCallDriver -> [0x82fdcb10] 14:26:22.765 \Driver\00004916[0x8294f5b8] -> IRP_MJ_CREATE -> 0x82822f10 14:26:22.781 Scan finished successfully 14:27:06.906 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Administrator\My Documents\MBR.dat" 14:27:06.937 The log file has been saved successfully to "C:\Documents and Settings\Administrator\My Documents\aswMBR.txt" 14:28:21.546 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\MBR.dat" 14:28:21.546 The log file has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\aswMBR.txt" aswMBR version 0.9.9.1124 Copyright© 2011 AVAST Software Run date: 2011-12-30 14:24:33 —————————– 14:24:33.718 OS Version: Windows 5.1.2600 Service Pack 2 14:24:33.718 Number of processors: 1 586 0x209 14:24:33.781 ComputerName: EXPERIENCE UserName: 14:24:37.609 Initialize success 14:25:00.843 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 14:25:00.843 Disk 0 Vendor: WDC_WD400EB-00CPF0 06.04G06 Size: 38166MB BusType: 3 14:25:01.046 Disk 0 MBR read successfully 14:25:01.046 Disk 0 MBR scan 14:25:01.046 Disk 0 Windows XP default MBR code 14:25:01.046 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 38162 MB offset 63 14:25:01.109 Disk 0 scanning sectors +78156225 14:25:01.296 Disk 0 scanning C:\WINDOWS\system32\drivers 14:25:36.843 Service scanning 14:25:40.593 Service KL1 C:\WINDOWS\system32\DRIVERS\kl1.sys **LOCKED** 5 14:25:40.640 Service kl2 C:\WINDOWS\system32\DRIVERS\kl2.sys **LOCKED** 5 14:25:40.718 Service klim5 C:\WINDOWS\system32\DRIVERS\klim5.sys **LOCKED** 5 14:25:40.765 Service klmouflt C:\WINDOWS\system32\DRIVERS\klmouflt.sys **LOCKED** 5 14:25:42.375 Modules scanning 14:25:58.828 Module: C:\WINDOWS\System32\drivers\afd.sys **SUSPICIOUS** 14:26:22.703 Disk 0 trace - called modules: 14:26:22.734 ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x82822f10]<< 14:26:22.750 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x82fcf030] 14:26:22.765 3 CLASSPNP.SYS[f886105b] -> nt!IofCallDriver -> [0x82fdcb10] 14:26:22.765 \Driver\00004916[0x8294f5b8] -> IRP_MJ_CREATE -> 0x82822f10 14:26:22.781 Scan finished successfully 14:27:06.906 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Administrator\My Documents\MBR.dat" 14:27:06.937 The log file has been saved successfully to "C:\Documents and Settings\Administrator\My Documents\aswMBR.txt" 14:28:21.546 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\MBR.dat" 14:28:21.546 The log file has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\aswMBR.txt" 14:30:01.234 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\MBR.dat" 14:30:01.234 The log file has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\aswMBR.txt"

Attachments:

Post #5
14:36:41.0375 1772 TDSS rootkit removing tool 2.6.25.0 Dec 23 2011 14:51:16 14:36:43.0390 1772 ============================================================ 14:36:43.0390 1772 Current date / time: 2011/12/30 14:36:43.0390 14:36:43.0390 1772 SystemInfo: 14:36:43.0390 1772 14:36:43.0390 1772 OS Version: 5.1.2600 ServicePack: 2.0 14:36:43.0390 1772 Product type: Workstation 14:36:43.0390 1772 ComputerName: EXPERIENCE 14:36:43.0406 1772 UserName: Administrator 14:36:43.0406 1772 Windows directory: C:\WINDOWS 14:36:43.0406 1772 System windows directory: C:\WINDOWS 14:36:43.0406 1772 Processor architecture: Intel x86 14:36:43.0406 1772 Number of processors: 1 14:36:43.0406 1772 Page size: 0x1000 14:36:43.0406 1772 Boot type: Normal boot 14:36:43.0406 1772 ============================================================ 14:36:47.0250 1772 Initialize success 14:36:51.0093 0816 ============================================================ 14:36:51.0093 0816 Scan started 14:36:51.0093 0816 Mode: Manual; 14:36:51.0093 0816 ============================================================ 14:36:52.0906 0816 Aavmker4 (8d488938e2f7048906f1fbd3af394887) C:\WINDOWS\system32\drivers\Aavmker4.sys 14:36:52.0921 0816 Aavmker4 - ok 14:36:53.0234 0816 Abiosdsk - ok 14:36:53.0546 0816 abp480n5 - ok 14:36:54.0062 0816 ACPI (a10c7534f7223f4a73a948967d00e69b) C:\WINDOWS\system32\DRIVERS\ACPI.sys 14:36:54.0140 0816 ACPI - ok 14:36:54.0515 0816 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys 14:36:54.0515 0816 ACPIEC - ok 14:36:54.0843 0816 adpu160m - ok 14:36:55.0359 0816 aec (1ee7b434ba961ef845de136224c30fec) C:\WINDOWS\system32\drivers\aec.sys 14:36:55.0421 0816 aec - ok 14:36:56.0671 0816 AFD (81319e909d88a06b80522b4cbf018ca7) C:\WINDOWS\System32\drivers\afd.sys 14:36:56.0828 0816 AFD - ok 14:36:57.0281 0816 Aha154x - ok 14:36:57.0578 0816 aic78u2 - ok 14:36:57.0859 0816 aic78xx - ok 14:37:00.0000 0816 ALCXWDM (dd8520280304b6145a6be31008748c7c) C:\WINDOWS\system32\drivers\ALCXWDM.SYS 14:37:01.0937 0816 ALCXWDM - ok 14:37:02.0296 0816 AliIde - ok 14:37:02.0734 0816 amsint - ok 14:37:03.0031 0816 asc - ok 14:37:03.0312 0816 asc3350p - ok 14:37:03.0609 0816 asc3550 - ok 14:37:03.0656 0816 aswFsBlk - ok 14:37:04.0171 0816 aswMon2 (7d880c76a285a41284d862e2d798ec0d) C:\WINDOWS\system32\drivers\aswMon2.sys 14:37:04.0218 0816 aswMon2 - ok 14:37:04.0578 0816 aswRdr (69823954bbd461a73d69774928c9737e) C:\WINDOWS\system32\drivers\aswRdr.sys 14:37:04.0593 0816 aswRdr - ok 14:37:05.0218 0816 aswSnx (81f10376af5f0f466f03cb2c5321b7ed) C:\WINDOWS\system32\drivers\aswSnx.sys 14:37:05.0359 0816 aswSnx - ok 14:37:05.0796 0816 aswSP (7ecc2776638b04553f9a85bd684c3abf) C:\WINDOWS\system32\drivers\aswSP.sys 14:37:05.0859 0816 aswSP - ok 14:37:06.0421 0816 aswTdi (095ed820a926aa8189180b305e1bcfc9) C:\WINDOWS\system32\drivers\aswTdi.sys 14:37:06.0437 0816 aswTdi - ok 14:37:06.0796 0816 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys 14:37:06.0812 0816 AsyncMac - ok 14:37:07.0359 0816 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys 14:37:07.0375 0816 atapi - ok 14:37:07.0703 0816 Atdisk - ok 14:37:08.0046 0816 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys 14:37:08.0078 0816 Atmarpc - ok 14:37:08.0625 0816 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys 14:37:08.0625 0816 audstub - ok 14:37:09.0062 0816 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys 14:37:09.0078 0816 cbidf2k - ok 14:37:09.0562 0816 CCDECODE (6163ed60b684bab19d3352ab22fc48b2) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys 14:37:09.0578 0816 CCDECODE - ok 14:37:09.0890 0816 cd20xrnt - ok 14:37:10.0218 0816 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys 14:37:10.0234 0816 Cdaudio - ok 14:37:11.0234 0816 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys 14:37:11.0265 0816 Cdfs - ok 14:37:11.0828 0816 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys 14:37:11.0843 0816 Cdrom - ok 14:37:12.0171 0816 Changer - ok 14:37:12.0468 0816 CmdIde - ok 14:37:12.0906 0816 Cpqarray - ok 14:37:13.0015 0816 cpudrv (d01f685f8b4598d144b0cce9ff95d8d5) C:\Program Files\SystemRequirementsLab\cpudrv.sys 14:37:13.0031 0816 cpudrv - ok 14:37:13.0359 0816 dac2w2k - ok 14:37:13.0703 0816 dac960nt - ok 14:37:14.0234 0816 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys 14:37:14.0250 0816 Disk - ok 14:37:15.0125 0816 dmboot (c0fbb516e06e243f0cf31f597e7ebf7d) C:\WINDOWS\system32\drivers\dmboot.sys 14:37:15.0546 0816 dmboot - ok 14:37:15.0984 0816 dmio (f5e7b358a732d09f4bcf2824b88b9e28) C:\WINDOWS\system32\drivers\dmio.sys 14:37:16.0187 0816 dmio - ok 14:37:16.0593 0816 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys 14:37:16.0609 0816 dmload - ok 14:37:17.0000 0816 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys 14:37:17.0015 0816 DMusic - ok 14:37:17.0500 0816 dpti2o - ok 14:37:17.0812 0816 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys 14:37:17.0812 0816 drmkaud - ok 14:37:18.0234 0816 E100B (ac9cf17ee2ae003c98eb4f5336c38058) C:\WINDOWS\system32\DRIVERS\e100b325.sys 14:37:18.0296 0816 E100B - ok 14:37:18.0890 0816 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys 14:37:18.0984 0816 Fastfat - ok 14:37:19.0359 0816 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\DRIVERS\fdc.sys 14:37:19.0375 0816 Fdc - ok 14:37:19.0906 0816 Fips (e153ab8a11de5452bcf5ac7652dbf3ed) C:\WINDOWS\system32\drivers\Fips.sys 14:37:19.0921 0816 Fips - ok 14:37:20.0296 0816 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\DRIVERS\flpydisk.sys 14:37:20.0312 0816 Flpydisk - ok 14:37:20.0906 0816 FltMgr (5a85cd3d07273e3f6fe72ee9c6431632) C:\WINDOWS\system32\DRIVERS\fltMgr.sys 14:37:20.0953 0816 FltMgr - ok 14:37:21.0312 0816 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys 14:37:21.0343 0816 Fs_Rec - ok 14:37:21.0921 0816 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys 14:37:21.0968 0816 Ftdisk - ok 14:37:22.0359 0816 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys 14:37:22.0375 0816 Gpc - ok 14:37:22.0906 0816 hidusb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys 14:37:22.0921 0816 hidusb - ok 14:37:23.0250 0816 hpn - ok 14:37:23.0593 0816 HPZid412 (d03d10f7ded688fecf50f8fbf1ea9b8a) C:\WINDOWS\system32\DRIVERS\HPZid412.sys 14:37:23.0625 0816 HPZid412 - ok 14:37:24.0156 0816 HPZipr12 (89f41658929393487b6b7d13c8528ce3) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys 14:37:24.0171 0816 HPZipr12 - ok 14:37:24.0546 0816 HPZius12 (abcb05ccdbf03000354b9553820e39f8) C:\WINDOWS\system32\DRIVERS\HPZius12.sys 14:37:24.0562 0816 HPZius12 - ok 14:37:25.0187 0816 HTTP (909d110c9634b0f1487eaaea837317d9) C:\WINDOWS\system32\Drivers\HTTP.sys 14:37:25.0296 0816 HTTP - ok 14:37:25.0984 0816 i2omgmt - ok 14:37:26.0453 0816 i2omp - ok 14:37:26.0812 0816 i8042prt (5502b58eef7486ee6f93f3f164dcb808) C:\WINDOWS\system32\DRIVERS\i8042prt.sys 14:37:26.0828 0816 i8042prt - ok 14:37:27.0390 0816 ialm (1406d6ef4436aee970efe13193123965) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys 14:37:27.0437 0816 ialm - ok 14:37:27.0828 0816 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys 14:37:27.0859 0816 Imapi - ok 14:37:28.0375 0816 ini910u - ok 14:37:28.0703 0816 IntelIde (2d722b2b54ab55b2fa475eb58d7b2aad) C:\WINDOWS\system32\DRIVERS\intelide.sys 14:37:28.0718 0816 IntelIde - ok 14:37:29.0140 0816 intelppm (279fb78702454dff2bb445f238c048d2) C:\WINDOWS\system32\DRIVERS\intelppm.sys 14:37:29.0156 0816 intelppm - ok 14:37:29.0718 0816 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys 14:37:29.0765 0816 Ip6Fw - ok 14:37:30.0171 0816 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 14:37:30.0187 0816 IpFilterDriver - ok 14:37:30.0703 0816 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys 14:37:30.0734 0816 IpInIp - ok 14:37:31.0140 0816 IpNat (d58ecd3b3969a670e68588f1640920b6) C:\WINDOWS\system32\DRIVERS\ipnat.sys 14:37:31.0203 0816 IpNat - ok 14:37:31.0734 0816 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys 14:37:31.0765 0816 IPSec - ok 14:37:32.0218 0816 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys 14:37:32.0250 0816 IRENUM - ok 14:37:32.0812 0816 isapnp (e504f706ccb699c2596e9a3da1596e87) C:\WINDOWS\system32\DRIVERS\isapnp.sys 14:37:32.0937 0816 isapnp - ok 14:37:33.0562 0816 Kbdclass (ebdee8a2ee5393890a1acee971c4c246) C:\WINDOWS\system32\DRIVERS\kbdclass.sys 14:37:33.0625 0816 Kbdclass - ok 14:37:34.0296 0816 kbdhid (e182fa8e49e8ee41b4adc53093f3c7e6) C:\WINDOWS\system32\DRIVERS\kbdhid.sys 14:37:34.0328 0816 kbdhid - ok 14:37:34.0828 0816 KL1 (94d67d49bd9503bb1d838405d80f2058) C:\WINDOWS\system32\DRIVERS\kl1.sys 14:37:35.0078 0816 KL1 - ok 14:37:35.0468 0816 kl2 (713576569667ac9e0f8556076004a96b) C:\WINDOWS\system32\DRIVERS\kl2.sys 14:37:35.0484 0816 kl2 - ok 14:37:36.0156 0816 KLIF (44ec6b3dbe167c7fa818f9918d2cbf22) C:\WINDOWS\system32\DRIVERS\klif.sys 14:37:36.0343 0816 KLIF - ok 14:37:36.0734 0816 klim5 (8d6e11bfa9927978d25b1b8029554f07) C:\WINDOWS\system32\DRIVERS\klim5.sys 14:37:36.0750 0816 klim5 - ok 14:37:37.0265 0816 klmouflt (3959530f69e19da56f1f24f2c89f1e2c) C:\WINDOWS\system32\DRIVERS\klmouflt.sys 14:37:37.0281 0816 klmouflt - ok 14:37:37.0718 0816 kmixer (8531438246ce9474e41ee1599904c0c7) C:\WINDOWS\system32\drivers\kmixer.sys 14:37:37.0781 0816 kmixer - ok 14:37:38.0312 0816 KSecDD (1be7cc2535d760ae4d481576eb789f24) C:\WINDOWS\system32\drivers\KSecDD.sys 14:37:38.0359 0816 KSecDD - ok 14:37:38.0687 0816 lbrtfdc - ok 14:37:39.0046 0816 LVPr2Mon (1a7db7a00a4b0d8da24cd691a4547291) C:\WINDOWS\system32\DRIVERS\LVPr2Mon.sys 14:37:39.0062 0816 LVPr2Mon - ok 14:37:39.0593 0816 MBAMProtector (b7ca8cc3f978201856b6ab82f40953c3) C:\WINDOWS\system32\drivers\mbam.sys 14:37:39.0609 0816 MBAMProtector - ok 14:37:39.0984 0816 MBAMSwissArmy (0db7527db188c7d967a37bb51bbf3963) C:\WINDOWS\system32\drivers\mbamswissarmy.sys 14:37:40.0000 0816 MBAMSwissArmy - ok 14:37:40.0703 0816 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys 14:37:40.0796 0816 mnmdd - ok 14:37:41.0281 0816 Modem (6fc6f9d7acc36dca9b914565a3aeda05) C:\WINDOWS\system32\drivers\Modem.sys 14:37:41.0312 0816 Modem - ok 14:37:41.0875 0816 Mouclass (34e1f0031153e491910e12551400192c) C:\WINDOWS\system32\DRIVERS\mouclass.sys 14:37:41.0890 0816 Mouclass - ok 14:37:42.0250 0816 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys 14:37:42.0265 0816 mouhid - ok 14:37:42.0796 0816 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys 14:37:42.0812 0816 MountMgr - ok 14:37:43.0140 0816 mraid35x - ok 14:37:43.0671 0816 MRxDAV (46edcc8f2db2f322c24f48785cb46366) C:\WINDOWS\system32\DRIVERS\mrxdav.sys 14:37:43.0750 0816 MRxDAV - ok 14:37:44.0312 0816 MRxSmb (7412ce77c6fd823f8889b4df420c680b) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 14:37:44.0484 0816 MRxSmb - ok 14:37:45.0015 0816 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys 14:37:45.0046 0816 Msfs - ok 14:37:45.0421 0816 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys 14:37:45.0421 0816 MSKSSRV - ok 14:37:45.0953 0816 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys 14:37:45.0968 0816 MSPCLOCK - ok 14:37:46.0328 0816 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys 14:37:46.0343 0816 MSPQM - ok 14:37:46.0687 0816 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys 14:37:46.0703 0816 mssmbios - ok 14:37:47.0234 0816 MSTEE (bf13612142995096ab084f2db7f40f77) C:\WINDOWS\system32\drivers\MSTEE.sys 14:37:47.0250 0816 MSTEE - ok 14:37:47.0656 0816 Mup (f66b6b1cddee6ca87cefc016eb7a0d8e) C:\WINDOWS\system32\drivers\Mup.sys 14:37:47.0703 0816 Mup - ok 14:37:48.0281 0816 NABTSFEC (5c8dc6429c43dc6177c1fa5b76290d1a) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys 14:37:48.0312 0816 NABTSFEC - ok 14:37:48.0687 0816 NAL (481daa2cba98521a4e40f75518c06330) C:\WINDOWS\system32\Drivers\iqvw32.sys 14:37:48.0718 0816 NAL - ok 14:37:49.0359 0816 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys 14:37:49.0437 0816 NDIS - ok 14:37:49.0812 0816 NdisIP (520ce427a8b298f54112857bcf6bde15) C:\WINDOWS\system32\DRIVERS\NdisIP.sys 14:37:49.0828 0816 NdisIP - ok 14:37:50.0375 0816 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys 14:37:50.0390 0816 NdisTapi - ok 14:37:50.0734 0816 Ndisuio (8d3ce6b579cde8d37acc690b67dc2106) C:\WINDOWS\system32\DRIVERS\ndisuio.sys 14:37:50.0750 0816 Ndisuio - ok 14:37:51.0312 0816 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys 14:37:51.0359 0816 NdisWan - ok 14:37:51.0734 0816 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys 14:37:51.0750 0816 NDProxy - ok 14:37:52.0265 0816 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys 14:37:52.0281 0816 NetBIOS - ok 14:37:52.0734 0816 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys 14:37:52.0796 0816 NetBT - ok 14:37:53.0390 0816 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys 14:37:53.0406 0816 Npfs - ok 14:37:54.0046 0816 Ntfs (05ab81909514bfd69cbb1f2c147cf6b9) C:\WINDOWS\system32\drivers\Ntfs.sys 14:37:54.0406 0816 Ntfs - ok 14:37:54.0781 0816 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys 14:37:54.0796 0816 Null - ok 14:37:55.0156 0816 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 14:37:55.0171 0816 NwlnkFlt - ok 14:37:56.0093 0816 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 14:37:56.0171 0816 NwlnkFwd - ok 14:37:56.0750 0816 Parport (29744eb4ce659dfe3b4122deb45bc478) C:\WINDOWS\system32\DRIVERS\parport.sys 14:37:56.0796 0816 Parport - ok 14:37:57.0156 0816 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys 14:37:57.0171 0816 PartMgr - ok 14:37:57.0687 0816 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys 14:37:57.0703 0816 ParVdm - ok 14:37:58.0078 0816 PCI (8086d9979234b603ad5bc2f5d890b234) C:\WINDOWS\system32\DRIVERS\pci.sys 14:37:58.0109 0816 PCI - ok 14:37:58.0468 0816 PCIDump - ok 14:37:58.0937 0816 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\drivers\PCIIde.sys 14:37:58.0953 0816 PCIIde - ok 14:37:59.0421 0816 Pcmcia (82a087207decec8456fbe8537947d579) C:\WINDOWS\system32\drivers\Pcmcia.sys 14:37:59.0468 0816 Pcmcia - ok 14:37:59.0968 0816 PDCOMP - ok 14:38:00.0265 0816 PDFRAME - ok 14:38:00.0562 0816 PDRELI - ok 14:38:00.0968 0816 PDRFRAME - ok 14:38:01.0265 0816 perc2 - ok 14:38:01.0546 0816 perc2hib - ok 14:38:03.0203 0816 PID_PEPI (dd184d9adfe2a8a21741dbdfe9e22f5c) C:\WINDOWS\system32\DRIVERS\LV302V32.SYS 14:38:04.0406 0816 PID_PEPI - ok 14:38:04.0828 0816 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys 14:38:04.0859 0816 PptpMiniport - ok 14:38:05.0421 0816 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys 14:38:05.0453 0816 PSched - ok 14:38:06.0234 0816 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys 14:38:06.0250 0816 Ptilink - ok 14:38:06.0750 0816 ql1080 - ok 14:38:07.0031 0816 Ql10wnt - ok 14:38:07.0312 0816 ql12160 - ok 14:38:07.0750 0816 ql1240 - ok 14:38:08.0031 0816 ql1280 - ok 14:38:08.0359 0816 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys 14:38:08.0375 0816 RasAcd - ok 14:38:08.0890 0816 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 14:38:08.0921 0816 Rasl2tp - ok 14:38:09.0328 0816 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys 14:38:09.0343 0816 RasPppoe - ok 14:38:09.0875 0816 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys 14:38:09.0890 0816 Raspti - ok 14:38:10.0328 0816 Rdbss (ed375ce745c42a14f10753f7022ecd6a) C:\WINDOWS\system32\DRIVERS\rdbss.sys 14:38:10.0406 0816 Rdbss - ok 14:38:10.0953 0816 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 14:38:10.0968 0816 RDPCDD - ok 14:38:11.0406 0816 rdpdr (a2cae2c60bc37e0751ef9dda7ceaf4ad) C:\WINDOWS\system32\DRIVERS\rdpdr.sys 14:38:11.0484 0816 rdpdr - ok 14:38:12.0078 0816 RDPWD (047bea21274c8a4a233674a76c958c2c) C:\WINDOWS\system32\drivers\RDPWD.sys 14:38:12.0156 0816 RDPWD - ok 14:38:12.0546 0816 redbook (b31b4588e4086d8d84adbf9845c2402b) C:\WINDOWS\system32\DRIVERS\redbook.sys 14:38:12.0578 0816 redbook - ok 14:38:13.0234 0816 Secdrv (d26e26ea516450af9d072635c60387f4) C:\WINDOWS\system32\DRIVERS\secdrv.sys 14:38:13.0250 0816 Secdrv - ok 14:38:13.0640 0816 serenum (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS\system32\DRIVERS\serenum.sys 14:38:13.0656 0816 serenum - ok 14:38:14.0281 0816 Serial (cd9404d115a00d249f70a371b46d5a26) C:\WINDOWS\system32\DRIVERS\serial.sys 14:38:14.0312 0816 Serial - ok 14:38:14.0671 0816 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys 14:38:14.0687 0816 Sfloppy - ok 14:38:15.0015 0816 Simbad - ok 14:38:15.0484 0816 SLIP (5caeed86821fa2c6139e32e9e05ccdc9) C:\WINDOWS\system32\DRIVERS\SLIP.sys 14:38:15.0500 0816 SLIP - ok 14:38:15.0812 0816 Sparrow - ok 14:38:16.0125 0816 splitter (9bb1dd670cb7505a90fc4e61d4aa8227) C:\WINDOWS\system32\drivers\splitter.sys 14:38:16.0140 0816 splitter - ok 14:38:16.0812 0816 Srv (5230953c21c811b5fc1ff31ae2b48097) C:\WINDOWS\system32\DRIVERS\srv.sys 14:38:16.0953 0816 Srv - ok 14:38:17.0500 0816 streamip (284c57df5dc7abca656bc2b96a667afb) C:\WINDOWS\system32\DRIVERS\StreamIP.sys 14:38:17.0515 0816 streamip - ok 14:38:17.0875 0816 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys 14:38:17.0890 0816 swenum - ok 14:38:18.0265 0816 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys 14:38:18.0296 0816 swmidi - ok 14:38:18.0781 0816 symc810 - ok 14:38:19.0062 0816 symc8xx - ok 14:38:19.0375 0816 sym_hi - ok 14:38:19.0734 0816 sym_u3 - ok 14:38:20.0078 0816 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys 14:38:20.0109 0816 sysaudio - ok 14:38:20.0718 0816 Tcpip (744e57c99232201ae98c49168b918f48) C:\WINDOWS\system32\DRIVERS\tcpip.sys 14:38:20.0859 0816 Tcpip - ok 14:38:21.0250 0816 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys 14:38:21.0265 0816 TDPIPE - ok 14:38:21.0750 0816 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys 14:38:21.0781 0816 TDTCP - ok 14:38:22.0156 0816 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys 14:38:22.0187 0816 TermDD - ok 14:38:22.0546 0816 TosIde - ok 14:38:22.0953 0816 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys 14:38:23.0000 0816 Udfs - ok 14:38:23.0312 0816 ultra - ok 14:38:23.0718 0816 Update (aff2e5045961bbc0a602bb6f95eb1345) C:\WINDOWS\system32\DRIVERS\update.sys 14:38:23.0796 0816 Update - ok 14:38:24.0203 0816 usbaudio (45a0d14b26c35497ad93bce7e15c9941) C:\WINDOWS\system32\drivers\usbaudio.sys 14:38:24.0234 0816 usbaudio - ok 14:38:24.0640 0816 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys 14:38:24.0687 0816 usbccgp - ok 14:38:25.0046 0816 usbehci (15e993ba2f6946b2bfbbfcd30398621e) C:\WINDOWS\system32\DRIVERS\usbehci.sys 14:38:25.0062 0816 usbehci - ok 14:38:25.0437 0816 usbhub (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys 14:38:25.0468 0816 usbhub - ok 14:38:25.0859 0816 usbprint (a42369b7cd8886cd7c70f33da6fcbcf5) C:\WINDOWS\system32\DRIVERS\usbprint.sys 14:38:25.0890 0816 usbprint - ok 14:38:26.0265 0816 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys 14:38:26.0281 0816 usbscan - ok 14:38:26.0703 0816 USBSTOR (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 14:38:26.0718 0816 USBSTOR - ok 14:38:27.0093 0816 usbuhci (f8fd1400092e23c8f2f31406ef06167b) C:\WINDOWS\system32\DRIVERS\usbuhci.sys 14:38:27.0125 0816 usbuhci - ok 14:38:27.0500 0816 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys 14:38:27.0515 0816 VgaSave - ok 14:38:27.0906 0816 ViaIde - ok 14:38:28.0234 0816 VolSnap (ee4660083deba849ff6c485d944b379b) C:\WINDOWS\system32\drivers\VolSnap.sys 14:38:28.0265 0816 VolSnap - ok 14:38:28.0703 0816 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys 14:38:28.0718 0816 Wanarp - ok 14:38:29.0062 0816 WDICA - ok 14:38:29.0437 0816 wdmaud (0bfa8203b8148fb4e54bc212c41ce497) C:\WINDOWS\system32\drivers\wdmaud.sys 14:38:29.0484 0816 wdmaud - ok 14:38:30.0000 0816 WSTCODEC (d5842484f05e12121c511aa93f6439ec) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS 14:38:30.0015 0816 WSTCODEC - ok 14:38:30.0390 0816 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys 14:38:30.0421 0816 WudfPf - ok 14:38:30.0921 0816 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys 14:38:30.0968 0816 WudfRd - ok 14:38:31.0421 0816 {6080A529-897E-4629-A488-ABA0C29B635E} (fd1f4e9cf06c71c8d73a24acf18d8296) C:\WINDOWS\system32\drivers\ialmsbw.sys 14:38:31.0468 0816 {6080A529-897E-4629-A488-ABA0C29B635E} - ok 14:38:31.0906 0816 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91} (d4d7331d33d1fa73e588e5ce0d90a4c1) C:\WINDOWS\system32\drivers\ialmkchw.sys 14:38:31.0937 0816 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91} - ok 14:38:31.0984 0816 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0 14:38:32.0296 0816 \Device\Harddisk0\DR0 - ok 14:38:32.0328 0816 MBR (0x1B8) (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk1\DR2 14:38:32.0390 0816 \Device\Harddisk1\DR2 - ok 14:38:32.0390 0816 Boot (0x1200) (df7dffd7c490f03b79a2ee11c16cc741) \Device\Harddisk0\DR0\Partition0 14:38:32.0390 0816 \Device\Harddisk0\DR0\Partition0 - ok 14:38:32.0406 0816 Boot (0x1200) (073ba3bf3e9d53aa3387460a12cd9f99) \Device\Harddisk1\DR2\Partition0 14:38:32.0406 0816 \Device\Harddisk1\DR2\Partition0 - ok 14:38:32.0421 0816 ============================================================ 14:38:32.0421 0816 Scan finished 14:38:32.0421 0816 ============================================================ 14:38:32.0453 0740 Detected object count: 0 14:38:32.0453 0740 Actual detected object count: 0
Post #6
Hi Selene,

Next, Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT- Save ComboFix.exe to your Desktop

====================================================


Disable your AntiVirus and AntiSpyware applications as they will interfere with our tools and the removal. If you are unsure how to do this, please refer to our sticky topic How to disable your security applications

====================================================


Double click on ComboFix.exe & follow the prompts.


  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:


[external image: Posted Image]


Click on Yes, to continue scanning for malware.


When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply for further review.
Post #7
Hi again :) Thanks for so much help. The ComboFix ran and everything was fine, the log was created. But when I tried to get back online to post the log here, I found I can't connect to the internet with that computer. It says something like cannot connect and then when I try repair, it says it can't repair the connection because my IP address needs to be renewed … and to talk to a network administrator. It's not a networked computer. And just now, I tried to get on IE and it says "Internet Explorer cannot download, unspecified error." So, what would be my next step?
Post #8
Hi Selene, Is there any way you could transfer that log over to a computer that has internet connectivity and post it? That would offer insight into what might have caused the connection problem. Also include c:\qoobox\combofix-quarantined-files.txt in your post.
Post #9
It's below. . But won't that possibly transfer the virus to the new computer?

ComboFix 11-12-30.02 - Administrator 12/30/2011 18:38:48.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.503.323 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\autorun.inf
c:\windows\$NtUninstallKB46664$\1737347525\@
c:\windows\$NtUninstallKB46664$\1737347525\bckfg.tmp
c:\windows\$NtUninstallKB46664$\1737347525\cfg.ini
c:\windows\$NtUninstallKB46664$\1737347525\Desktop.ini
c:\windows\$NtUninstallKB46664$\1737347525\keywords
c:\windows\$NtUninstallKB46664$\1737347525\kwrd.dll
c:\windows\$NtUninstallKB46664$\1737347525\L\nkwhionm
c:\windows\$NtUninstallKB46664$\1737347525\lsflt7.ver
c:\windows\$NtUninstallKB46664$\1737347525\U\00000001.@
c:\windows\$NtUninstallKB46664$\1737347525\U\00000002.@
c:\windows\$NtUninstallKB46664$\1737347525\U\00000004.@
c:\windows\$NtUninstallKB46664$\1737347525\U\80000000.@
c:\windows\$NtUninstallKB46664$\1737347525\U\80000004.@
c:\windows\$NtUninstallKB46664$\1737347525\U\80000032.@
c:\windows\$NtUninstallKB46664$\1360364155 . . . . Failed to delete
.
c:\windows\system32\srsvc.dll . . . is infected!!
.
.
((((((((((((((((((((((((( Files Created from 2011-11-28 to 2011-12-31 )))))))))))))))))))))))))))))))
.
.
2011-12-31 00:19 . 2011-12-31 00:19 ——– d—–w- c:\windows\system32\oobe
2011-12-31 00:19 . 2011-12-31 00:19 ——– d—–w- c:\windows\srchasst
2011-12-31 00:18 . 2011-12-31 00:19 ——– d—–w- c:\windows\pchealth
2011-12-31 00:18 . 2011-12-31 00:18 ——– d—–w- c:\program files\microsoft frontpage
2011-12-30 17:19 . 2011-12-30 17:19 40776 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-12-26 17:04 . 2011-12-26 17:04 ——– d—–w- c:\documents and settings\Administrator\Application Data\Apple Computer
2011-12-26 11:23 . 2011-12-26 11:23 ——– d—–w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2011-12-26 11:22 . 2011-12-26 11:22 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2011-12-26 11:22 . 2011-12-10 20:24 20464 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-12-26 11:22 . 2011-12-30 00:04 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-12-26 01:15 . 2010-10-06 01:27 150200 —-a-w- c:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak\components\kavlinkfilter.dll
2011-12-26 01:14 . 2011-12-26 02:05 115369 —-a-w- c:\windows\system32\drivers\klin.dat
2011-12-26 01:14 . 2011-12-26 02:05 97961 —-a-w- c:\windows\system32\drivers\klick.dat
2011-12-26 01:11 . 2011-12-26 17:07 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Kaspersky Lab
2011-12-26 01:11 . 2011-12-26 01:11 ——– d—–w- c:\program files\Kaspersky Lab
2011-12-26 00:57 . 2010-09-07 15:47 17744 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2011-12-26 00:57 . 2010-09-07 15:52 165584 —-a-w- c:\windows\system32\drivers\aswSP.sys
2011-12-26 00:56 . 2010-09-07 15:53 340048 —-a-w- c:\windows\system32\drivers\aswSnx.sys
2011-12-26 00:56 . 2010-09-07 15:47 23376 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2011-12-26 00:56 . 2010-09-07 15:52 46672 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2011-12-26 00:56 . 2010-09-07 15:47 100176 —-a-w- c:\windows\system32\drivers\aswmon2.sys
2011-12-26 00:56 . 2010-09-07 15:47 94544 —-a-w- c:\windows\system32\drivers\aswmon.sys
2011-12-26 00:56 . 2010-09-07 15:46 28880 —-a-w- c:\windows\system32\drivers\aavmker4.sys
2011-12-26 00:56 . 2010-09-07 16:12 38848 —-a-w- c:\windows\avastSS.scr
2011-12-26 00:56 . 2010-09-07 16:11 167592 —-a-w- c:\windows\system32\aswBoot.exe
2011-12-25 02:04 . 2011-12-25 02:04 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Kaspersky Lab Setup Files
2011-12-25 01:43 . 2011-12-26 00:55 ——– d—–w- c:\program files\Alwil Software
2011-12-25 00:56 . 2011-12-26 00:38 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Alwil Software
2011-12-23 20:59 . 2011-12-23 20:59 ——– d—–w- c:\documents and settings\NetworkService.NT AUTHORITY\Local Settings\Application Data\Apple
2011-12-17 23:46 . 2011-12-17 23:46 159744 —-a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin7.dll
2011-12-17 23:46 . 2011-12-17 23:46 159744 —-a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin6.dll
2011-12-17 23:46 . 2011-12-17 23:46 159744 —-a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin5.dll
2011-12-17 23:46 . 2011-12-17 23:46 159744 —-a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin4.dll
2011-12-17 23:46 . 2011-12-17 23:46 159744 —-a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin3.dll
2011-12-17 23:46 . 2011-12-17 23:46 159744 —-a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin2.dll
2011-12-17 23:46 . 2011-12-17 23:46 159744 —-a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin.dll
2011-12-17 23:46 . 2011-12-17 23:46 159744 —-a-w- c:\program files\Internet Explorer\PLUGINS\npqtplugin7.dll
2011-12-17 23:44 . 2011-12-17 23:44 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Apple Computer
2011-12-17 23:43 . 2011-12-17 23:43 ——– d—–w- c:\program files\Common Files\Apple
2011-12-17 23:42 . 2011-12-17 23:42 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Apple
2011-12-17 23:41 . 2011-12-17 23:41 ——– d—–w- c:\program files\Apple Software Update
2011-12-17 23:41 . 2011-12-17 23:41 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Apple
2011-12-17 23:40 . 2011-12-17 23:40 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Apple Computer
2011-12-07 04:30 . 2011-12-07 04:30 ——– d–h–w- c:\windows\PIF
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-17 04:16 . 2011-06-27 19:42 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-24 19:29 . 2011-10-24 19:29 94208 —-a-w- c:\windows\system32\QuickTimeVR.qtx
2011-10-24 19:29 . 2011-10-24 19:29 69632 —-a-w- c:\windows\system32\QuickTime.qts
2011-11-26 09:00 . 2011-04-05 06:44 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
——- Sigcheck ——-
Note: Unsigned files aren't necessarily malware.
.
.
[-] 2008-04-14 . 3805DF0AC4296A34BA4BF93B346CC378 . 171008 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\srsvc.dll
.
[-] 2008-04-14 . F92E1076C42FCD6DB3D72D8CFE9816D5 . 13824 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\9866fb57abdc0ea2f5d4e132d055ba4e\wscntfy.exe
.
c:\windows\System32\drivers\beep.sys … is missing !!
c:\windows\System32\srsvc.dll … is missing !!
c:\windows\System32\wscntfy.exe … is missing !!
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitTorrent"="c:\program files\BitTorrent\BitTorrent.exe" [2011-05-13 400760]
"Logitech Vid"="c:\program files\Logitech\Logitech Vid\vid.exe" [2009-07-16 5458704]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2003-04-06 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2003-04-06 114688]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 577536]
"LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-10-14 2793304]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2002-07-25 28672]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-24 460872]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2009-03-08 128512]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"MemCheckBoxInRunDlg"= 1 (0x1)
"StartMenuFavorites"= 0 (0x0)
"Start_ShowHelp"= 0 (0x0)
"Start_ShowMyComputer"= 1 (0x1)
"Start_ShowMyDocs"= 1 (0x1)
"Start_ShowMyMusic"= 0 (0x0)
"Start_ShowRun"= 1 (0x1)
"Start_ShowSearch"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\BitTorrent\\BitTorrent.exe"=
"c:\\Program Files\\Logitech\\Logitech Vid\\Vid.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"123:UDP"= 123:UDP:SNTP
.
R2 aswFsBlk;aswFsBlk;aswFsBlk.sys [x]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-06-20 135664]
R3 cpudrv;cpudrv;c:\program files\SystemRequirementsLab\cpudrv.sys [2009-12-18 11336]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-06-20 135664]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-12-30 40776]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [2010-06-09 11352]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-12-24 652872]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2010-05-07 32856]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-11-03 19472]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-12-10 20464]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
NETSVCS REQUIRES REPAIRS - current entries shown
6to4
AppMgmt
AudioSrv
Browser
CryptSvc
DMServer
DHCP
EventSystem
FastUserSwitchingCompatibility
HidServ
Ias
Iprip
Irmon
LanmanServer
LanmanWorkstation
Netman
Nla
Ntmssvc
NWCWorkstation
Nwsapagent
Rasauto
Rasman
Remoteaccess
Schedule
Seclogon
SENS
Sharedaccess
Tapisrv
Themes
TrkWks
W32Time
WZCSVC
Wmi
WmdmPmSp
winmgmt
xmlprov
BITS
wuauserv
ShellHWDetection
WmdmPmSN
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-12-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 22:57]
.
2011-12-31 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-06-20 03:03]
.
2011-12-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-06-20 03:03]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\lus9p8yq.default\
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false
FF - user.js: browser.sessionstore.resume_from_crash - false
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\Ask.com\GenericAskToolbar.dll
Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\Ask.com\GenericAskToolbar.dll
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\Ask.com\GenericAskToolbar.dll
HKLM-Run-ApnUpdater - c:\program files\Ask.com\Updater\Updater.exe
AddRemove-eMule - c:\program files\eMule\Uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-30 19:20
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-725345543-1085031214-1801674531-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,15,b7,da,ae,7e,e5,4b,45,ba,02,8b,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,15,b7,da,ae,7e,e5,4b,45,ba,02,8b,\
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(3260)
c:\windows\system32\WININET.dll
c:\windows\TEMP\logishrd\LVPrcInj01.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\windows\SOUNDMAN.EXE
c:\program files\Common Files\Logishrd\LQCVFX\COCIManager.exe
.
**************************************************************************
.
Completion time: 2011-12-30 19:36:16 - machine was rebooted
ComboFix-quarantined-files.txt 2011-12-31 00:36
.
Pre-Run: 1,313,972,224 bytes free
Post-Run: 3,422,908,416 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /noexecute=optin
.
- - End Of File - - 03DC3ECD57F900F4B1C3C52448E4C182
Post #10 last edited
Hi Selene,

Sorry for the late reply. I've been researching the connectivity issue. I'll be back with you soon with a fix.

But won't that possibly transfer the virus to the new computer?

Possible, but unlikely because this infection typically does not spread via removable drives and ComboFix took care of the bulk it.

Happy new years :woot:!
Post #11 last edited
Hi Selene,

What we will need to do next is install Windows XP Service Pack 3. It can be downloaded here. Download it on the clean computer, then copy it over to the infected one and install it. If you are really paranoid about infection spreading via the flash drive, you can burn it onto a CD.

Another alternative would be to run Flash Disinfector which disinfects your flash drive and prevents it from being infected in the future. You MUST be running Windows XP on the computer with which you are planning to run Flash Disinfector (in your case, the clean computer). If you are running other versions of Windows (7, Vista, etc), you will need to download Panda USB Vaccine instead.

Download Flash_Disinfector.exe by sUBs from HERE and save it to your desktop.
  • Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
  • The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
  • Wait until it has finished scanning and then exit the program.
  • Reboot your computer when done.
Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder…it will help protect your drives from future infection.

Let me know when you have finished installing Service Pack 3.
Post #12
Hi and Happy New Year :). I have a quick question. Can I just transfer my photos from the old (infected) computer to my new one and then reinstall windows on the old one? Would I infect the new computer that way at this point? I'm not trying to be paranoid … just less reckless than I usually am lol.
Post #13
Hi Selene, Yes, you can do that. Reinstalling Windows would probably be the easiest thing to do. It would most likely not infect your new computer. I am assuming that you will be using an external hard drive to transfer the photos? I would recommend you run Flash Disinfector or Panda USB Vaccine (depending on what version of Windows is running on the new computer) and vaccinate the external drive prior to plugging it into the infected computer just to be safe.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI