View Full Version : click.giftload
Found click.giftload on my spybot and also ran Malwarebytes anti malware to scan, both found and removed it, yet it still pops up every time i turn on the computer, my explorer.exe messes up upon booting and fails to load, also redirecting from google when i google at all
here is my DDS:
.
DDS (Ver_11-03-05.01) - NTFSx86
Run by Wut at 22:37:41.93 on Sat 04/02/2011
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_24
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3325.2315 [GMT -5:00]
.
AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
svchost.exe
svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\McAfee Security Scan\2.1.121\SSScheduler.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CSHelper.exe
C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpCtr.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\Wut\My Documents\Downloads\dds.scr
.
============== Pseudo HJT Report ===============
.
uInternet Settings,ProxyOverride = *.local
BHO: AC-Pro: {0fb6a909-6086-458f-bd92-1f8ee10042a0} - c:\program files\autocompletepro\AutocompletePro.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\askbardis\bar\bin\askBar.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Search Toolbar: {9d425283-d487-4337-bab6-ab8354a81457} - c:\program files\search toolbar\SearchToolbar.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll
TB: DAEMON Tools Toolbar: {32099aac-c132-4136-9e9a-4e364a424e17} - c:\program files\daemon tools toolbar\DTToolbar.dll
TB: Search Toolbar: {9d425283-d487-4337-bab6-ab8354a81457} - c:\program files\search toolbar\SearchToolbar.dll
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [ContentTransferWMDetector.exe] c:\program files\sony\content transfer\ContentTransferWMDetector.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [ATICustomerCare] "c:\program files\ati\aticustomercare\ATICustomerCare.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [LogMeIn Hamachi Ui] "c:\program files\logmein hamachi\hamachi-2-ui.exe" --auto-start
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\2.1.121\SSScheduler.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://www.systemrequirementslab.com/srl_bin/sysreqlab_srl.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\docume~1\wut\applic~1\mozilla\firefox\profiles\znpdqnqv.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.joystiq.com/
FF - plugin: c:\documents and settings\all users\application data\nexonus\ngm\npNxGameUS.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npArtistScope42.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npArtistScopeDRM11.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npijjiautoinstallpluginff.dll
FF - plugin: c:\program files\pando networks\media booster\npPandoWebPlugin.dll
FF - plugin: c:\windows\system32\npOGPPlugin.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
FF - Ext: AutocompletePro - Your handy search suggestions tool: support@predictad.com - c:\program files\autocompletepro\support@predictad.com
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff
.
============= SERVICES / DRIVERS ===============
.
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-5-28 11608]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-5-28 135336]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-5-28 269480]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-5-28 61960]
R2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [2011-2-19 22504]
R2 CSHelper;CopySafe Helper Service;c:\windows\system32\CSHelper.exe [2010-7-21 266240]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\logmein hamachi\hamachi-2.exe [2011-3-28 1242504]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2009-4-16 1684736]
S3 cpuz132;cpuz132;\??\c:\docume~1\jdawg\locals~1\temp\cpuz132\cpuz132_x32.sys --> c:\docume~1\jdawg\locals~1\temp\cpuz132\cpuz132_x32.sys [?]
S3 EagleXNt;EagleXNt;\??\c:\windows\system32\drivers\eaglexnt.sys --> c:\windows\system32\drivers\EagleXNt.sys [?]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\2.1.121\McCHSvc.exe [2010-9-3 227232]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 vtany;vtany;\??\c:\windows\vtany.sys --> c:\windows\vtany.sys [?]
S3 xhunter1;xhunter1;\??\c:\windows\xhunter1.sys --> c:\windows\xhunter1.sys [?]
.
=============== Created Last 30 ================
.
2011-04-01 00:14:52 -------- d-----w- c:\program files\iPod
2011-04-01 00:14:50 -------- d-----w- c:\program files\iTunes
2011-04-01 00:09:41 -------- d-----w- c:\program files\Bonjour
2011-03-30 18:56:32 83249512 ----a-w- c:\program files\common files\windows live\.cache\wlc18.tmp
2011-03-30 00:22:20 -------- d-----w- c:\documents and settings\wut\.thumbnails
2011-03-30 00:21:42 -------- d-----w- c:\documents and settings\wut\.gimp-2.6
2011-03-30 00:21:38 -------- d-----w- c:\documents and settings\wut\.gegl-0.0
2011-03-29 21:59:57 26176 ---ha-w- c:\windows\system32\hamachi.sys
2011-03-29 21:59:53 -------- d-----w- c:\program files\LogMeIn Hamachi
2011-03-27 07:17:55 -------- d-----w- c:\documents and settings\wut\Tracing
2011-03-25 20:20:46 -------- d-----w- C:\Minecraft
2011-03-25 20:10:03 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-03-24 02:21:22 66520 ----a-w- c:\program files\mozilla firefox\plugins\npnul32.dll
2011-03-24 02:21:22 25048 ----a-w- c:\program files\mozilla firefox\components\browserdirprovider.dll
2011-03-24 02:21:22 140248 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
2011-03-24 02:21:21 492504 ----a-w- c:\program files\mozilla firefox\sqlite3.dll
2011-03-24 02:21:21 1018328 ----a-w- c:\program files\mozilla firefox\js3250.dll
2011-03-19 03:34:18 -------- d-----w- c:\docume~1\wut\applic~1\.minecraft
2011-03-14 12:17:16 -------- d-----w- c:\docume~1\alluse~1\applic~1\McAfee Security Scan
2011-03-14 12:17:13 -------- d-----w- c:\program files\McAfee Security Scan
2011-03-12 03:53:35 -------- d-----w- c:\docume~1\wut\locals~1\applic~1\LogMeIn Hamachi
2011-03-11 00:06:42 -------- d-----w- c:\docume~1\wut\locals~1\applic~1\ATI
2011-03-10 23:59:38 -------- d-----w- C:\ATI
2011-03-10 23:12:52 -------- d-----w- c:\program files\ATI Technologies
2011-03-10 23:12:41 -------- d-----w- C:\AMD
2011-03-06 05:56:23 -------- d-----w- c:\documents and settings\wut\world
2011-03-06 01:41:23 -------- d-----w- c:\docume~1\wut\locals~1\applic~1\Adobe
.
==================== Find3M ====================
.
2011-03-25 20:09:54 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-03-11 00:04:35 0 ----a-w- c:\windows\ativpsrm.bin
2011-02-09 13:53:52 270848 ----a-w- c:\windows\system32\sbe.dll
2011-02-09 13:53:52 186880 ----a-w- c:\windows\system32\encdec.dll
2011-02-02 07:58:35 2067456 ----a-w- c:\windows\system32\mstscax.dll
2011-01-30 06:01:39 219128 -c--a-w- c:\windows\system32\PnkBstrB.xtr
2011-01-30 06:01:39 219128 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-01-27 11:57:06 677888 ----a-w- c:\windows\system32\mstsc.exe
2011-01-26 23:05:56 17252352 ----a-w- c:\windows\system32\atioglxx.dll
2011-01-26 23:01:00 57344 ----a-w- c:\windows\system32\aticalrt.dll
2011-01-26 23:00:54 53248 ----a-w- c:\windows\system32\aticalcl.dll
2011-01-26 22:59:36 4636672 ----a-w- c:\windows\system32\aticaldd.dll
2011-01-26 22:52:46 462848 ----a-w- c:\windows\system32\ATIDEMGX.dll
2011-01-26 22:51:42 302080 ----a-w- c:\windows\system32\ati2dvag.dll
2011-01-26 22:42:00 4029824 ----a-w- c:\windows\system32\ati3duag.dll
2011-01-26 22:41:32 311296 ----a-w- c:\windows\system32\atiiiexx.dll
2011-01-26 22:35:04 1112576 ----a-w- c:\windows\system32\ativvamv.dll
2011-01-26 22:32:12 212992 ----a-w- c:\windows\system32\atipdlxx.dll
2011-01-26 22:31:58 155648 ----a-w- c:\windows\system32\Oemdspif.dll
2011-01-26 22:31:50 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe
2011-01-26 22:31:42 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2011-01-26 22:31:28 188416 ----a-w- c:\windows\system32\ati2evxx.dll
2011-01-26 22:30:08 638976 ----a-w- c:\windows\system32\ati2evxx.exe
2011-01-26 22:28:44 53248 ----a-w- c:\windows\system32\ATIDDC.DLL
2011-01-26 22:27:50 143360 ----a-w- c:\windows\system32\atiapfxx.exe
2011-01-26 22:27:06 2673280 ----a-w- c:\windows\system32\ativvaxx.dll
2011-01-26 22:23:50 651264 ----a-w- c:\windows\system32\atikvmag.dll
2011-01-26 22:21:32 196608 ----a-w- c:\windows\system32\atiadlxx.dll
2011-01-26 22:21:30 483328 ----a-w- c:\windows\system32\atiok3x2.dll
2011-01-26 22:21:08 17408 ----a-w- c:\windows\system32\atitvo32.dll
2011-01-26 22:15:12 847872 ----a-w- c:\windows\system32\ati2cqag.dll
2011-01-26 22:12:58 64512 ----a-w- c:\windows\system32\atimpc32.dll
2011-01-26 22:12:58 64512 ----a-w- c:\windows\system32\amdpcom32.dll
2011-01-21 14:42:25 439808 ----a-w- c:\windows\system32\shimgvw.dll
2011-01-07 14:09:31 290048 ----a-w- c:\windows\system32\atmfd.dll
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: WDC_WD3200AAKS-00L9A0 rev.01.03E01 -> Harddisk0\DR0 -> \Device\Ide\IdePort2 P2T0L0-10
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8AE33439]<<
_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x8ae397d0]; MOV EAX, [0x8ae3984c]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
1 ntkrnlpa!IofCallDriver[0x804EF1A6] -> \Device\Harddisk0\DR0[0x8AE67AB8]
3 CLASSPNP[0xB8108FD7] -> ntkrnlpa!IofCallDriver[0x804EF1A6] -> \Device\00000071[0x8AE72948]
5 ACPI[0xB7E66620] -> ntkrnlpa!IofCallDriver[0x804EF1A6] -> [0x8AEB5B00]
\Driver\atapi[0x8AEC7330] -> IRP_MJ_CREATE -> 0x8AE33439
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
detected disk devices:
\Device\Ide\IdeDeviceP2T0L0-10 -> \??\IDE#DiskWDC_WD3200AAKS-00L9A0___________________01.03E01#5&1a04b4bb&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
detected hooks:
\Driver\atapi DriverStartIo -> 0x8AE3327F
user & kernel MBR OK
Warning: possible TDL3 rootkit infection !
.
============= FINISH: 22:38:55.54 ===============
Blottedisk
2011-04-04, 02:20
Hi Neohart,
Welcome to Safer Networking. My name is Blottedisk and I will be helping you with your malware issues.
Please subscribe to this topic, if you haven't already. You can subscribe by clicking the Thread Tools box to the top right of your topic title and then choosing Suscribe to this Thread (then choose Instant Notification by email). If the button says Unsuscribe from this Thread, then you are already subscribed.
Please avoid installing/uninstalling or updating any programs and attempting any unsupervised fixes or scans. This can make helping you impossible.
The forum is busy and we need to have replies as soon as possible. If I haven't had a reply after 3 days I will bump the topic and if you do not reply by the following day after that then the thread will be locked due to inactivity. However, if you will be away, let us know and we will be sure to keep the thread open.
Unfortunately your machine appears to have been infected by the TDSS rootkit/backdoor infection. These kind of malwares are very dangerous. Backdoor Trojans provide a means of accessing a computer system that bypasses security mechanisms and steal sensitive information like passwords, personal and financial data which they send back to the hacker. Rootkits can hook into the Windows 32-bit kernel, and patch several APIs to hide new registry keys and files they install. Remote attackers use backdoor Trojans and rootkits as part of an exploit to to gain unauthorized access to a computer and take control of it without your knowledge.
If you use your computer for sensitive purposes such as internet banking then I recommend you take the following steps immediately:
Use another, uninfected computer to change all your internet passwords, especially ones with financial implications such as banks,
paypal, ebay, etc. You should also change the passwords for any other site you use.
Call your bank(s), credit card company or any other institution which may be affected and advise them that your login/password or
credit card information may have been stolen and ask what steps to take with regard to your account.
Consider what other private information could possibly have been taken from your computer and take appropriate steps
Please read the following for more information:
How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud? (http://www.dslreports.com/faq/10451 )
What Should I Do If I've Become A Victim Of Identity Theft? (http://www.usdoj.gov/criminal/fraud/websites/idtheft.html#whatifvictim )
Identity Theft Victims Guide - What to do (http://www.privacyrights.org/fs/fs17a.htm )
Although the TDSS infection can be identified and removed, your PC has likely been compromised and there is no way to be sure the computer can ever be trusted again. It is dangerous and incorrect to assume that if this type of malware has been removed the computer is now secure. In some instances an infection may have caused so much damage to your system that it cannot be completely cleaned or repaired. The malware may leave so many remnants behind that security tools cannot find them. Many experts in the security community believe that once infected with this type of malware, the best course of action is to wipe the drive clean, reformat and reinstall the OS. Please read:
When should I re-format? How should I reinstall? (http://www.dslreports.com/faq/10063 )
Where to draw the line? When to recommend a format and reinstall? (http://miekiemoes.blogspot.com/2008/06/malware-removal-where-to-draw-line.html )
Note: Attempting to reinstall Windows (repair install) without first wiping the entire hard drive with a repartition/reformat will not remove the infection. The reinstall will only overwrite the Windows files. Any malware on the system causing problems will still be there afterwards and a Repair will NOT help.
Should you have any questions, please feel free to ask. Please let me know what you have decided to do in your next post. If you decide you want to try and clean your PC then please continue with the following instructions:
Step 1 | Please open SpyBot S&D
Check for problems.
When the scan completes, right click on the results list, select "Copy results to clipboard".
Paste (Ctrl+V) those results in your next reply.
Step 2 | Please download aswMBR (http://public.avast.com/~gmerek/aswMBR.exe ) to your desktop.
Double click the aswMBR icon to run it.
Vista and Windows 7 users right click the icon and choose "Run as administrator".
Click the Scan button to start scan.
When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.
http://i1190.photobucket.com/albums/z454/Blottedisk/aswMBRscan-1.png (http://i1190.photobucket.com/albums/z454/Blottedisk/aswMBRscan.png )
Click the image to enlarge it
Step 3 | Please download GMER from one of the following locations and save it to your desktop:
Main Mirror (http://gmer.net/download.php ) - This version will download a randomly named file (Recommended)
Zipped Mirror (http://gmer.net/gmer.zip ) - This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
--------------------------------------------------------------------
Disconnect from the Internet and close all running programs.
Temporarily disable any real-time active protection (http://forums.whatthetech.com/index.php?showtopic=96260 ) so your security programs will not conflict with gmer's driver.
Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
http://img.photobucket.com/albums/v666/sUBs/gmer_zip.gif
GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
Make sure all options are checked except:
IAT/EAT
Drives/Partition other than Systemdrive, which is typically C:\
Show All (This is important, so do not miss it.)
http://i582.photobucket.com/albums/ss269/Cat_Byte/GMER/gmer_th.gif (http://i582.photobucket.com/albums/ss269/Cat_Byte/GMER/gmer_screen2-1.gif )
Click the image to enlarge it
Now click the Scan button. If you see a rootkit warning window, click OK.
When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
Click the Copy button and paste the results into your next reply.
Exit GMER and re-enable all active protection when done.
-- If you encounter any problems, try running GMER in Safe Mode (http://www.computerhope.com/issues/chsafe.htm ).
Thank you for replying, i will try and do what i can to fix the issue before having to reformat the computer, here are the logs you asked for...
Click.GiftLoad: [SBI $89783858] User settings (Registry value, fixed)
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\featurecontrol\FEATURE_BROWSER_EMULATION\svchost.exe
--- Spybot - Search & Destroy version: 1.6.2 (build: 20090126) ---
2009-01-26 blindman.exe (1.0.0.8)
2009-01-26 SDFiles.exe (1.6.1.7)
2009-01-26 SDMain.exe (1.0.0.6)
2009-01-26 SDShred.exe (1.0.2.5)
2009-01-26 SDUpdate.exe (1.6.0.12)
2009-01-26 SpybotSD.exe (1.6.2.46)
2009-03-05 TeaTimer.exe (1.6.6.32)
2010-05-18 unins000.exe (51.49.0.0)
2009-01-26 Update.exe (1.6.0.7)
2009-11-04 advcheck.dll (1.6.5.20)
2007-04-02 aports.dll (2.1.0.0)
2008-06-14 DelZip179.dll (1.79.11.1)
2009-01-26 SDHelper.dll (1.6.2.14)
2008-06-19 sqlite3.dll
2009-01-26 Tools.dll (2.1.6.10)
2009-01-16 UninsSrv.dll (1.0.0.0)
2011-03-18 Includes\Adware.sbi (*)
2011-03-22 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2010-12-14 Includes\Dialer.sbi (*)
2011-03-08 Includes\DialerC.sbi (*)
2011-02-24 Includes\HeavyDuty.sbi (*)
2011-03-29 Includes\Hijackers.sbi (*)
2011-03-29 Includes\HijackersC.sbi (*)
2010-09-15 Includes\iPhone.sbi (*)
2010-12-14 Includes\Keyloggers.sbi (*)
2011-03-08 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2011-03-29 Includes\Malware.sbi (*)
2011-03-29 Includes\MalwareC.sbi (*)
2011-02-24 Includes\PUPS.sbi (*)
2011-03-15 Includes\PUPSC.sbi (*)
2010-01-25 Includes\Revision.sbi (*)
2009-01-13 Includes\Security.sbi (*)
2011-03-08 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2011-02-24 Includes\Spyware.sbi (*)
2011-03-15 Includes\SpywareC.sbi (*)
2010-03-08 Includes\Tracks.uti
2010-12-28 Includes\Trojans.sbi (*)
2011-03-25 Includes\TrojansC-02.sbi (*)
2011-03-29 Includes\TrojansC-03.sbi (*)
2011-03-08 Includes\TrojansC-04.sbi (*)
2011-03-29 Includes\TrojansC-05.sbi (*)
2011-03-08 Includes\TrojansC.sbi (*)
2008-03-04 Plugins\Chai.dll
2008-03-05 Plugins\Fennel.dll
2008-02-26 Plugins\Mate.dll
2007-12-24 Plugins\TCPIPAddress.dll
--------------------------------------------------------------------------
aswMBR version 0.9.4 Copyright(c) 2011 AVAST Software
Run date: 2011-04-03 20:34:07
-----------------------------
20:34:07.218 OS Version: Windows 5.1.2600 Service Pack 3
20:34:07.218 Number of processors: 2 586 0x170A
20:34:07.218 ComputerName: JORDAN UserName: Wut
20:34:08.984 Initialize success
20:34:15.812 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdePort2
20:34:15.812 Disk 0 Vendor: WDC_WD3200AAKS-00L9A0 01.03E01 Size: 305245MB BusType: 3
20:34:15.812 Device \Device\Ide\IdeDeviceP2T0L0-10 -> \??\IDE#DiskWDC_WD3200AAKS-00L9A0___________________01.03E01#5&1a04b4bb&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} not found
20:34:15.812 Device \Driver\atapi -> DriverStartIo 8ae3227f
20:34:15.812 Disk 0 MBR read error
20:34:15.812 Disk 0 MBR scan
20:34:15.812 MBR BIOS signature not found 0
20:34:15.812 Disk 0 scanning sectors +625121280
20:34:15.812 Disk 0 scanning C:\WINDOWS\system32\drivers
20:34:22.453 Service scanning
20:34:23.312 Disk 0 trace - called modules:
20:34:23.312 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8ae32439]<<
20:34:23.312 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8aebbab8]
20:34:23.312 3 CLASSPNP.SYS[b8108fd7] -> nt!IofCallDriver -> \Device\00000071[0x8aec2318]
20:34:23.312 5 ACPI.sys[b7e66620] -> nt!IofCallDriver -> [0x8aec0b00]
20:34:23.328 \Driver\atapi[0x8aeb3e20] -> IRP_MJ_CREATE -> 0x8ae32439
20:34:23.328 Scan finished successfully
aswMBR version 0.9.4 Copyright(c) 2011 AVAST Software
Run date: 2011-04-03 20:34:07
-----------------------------
20:34:07.218 OS Version: Windows 5.1.2600 Service Pack 3
20:34:07.218 Number of processors: 2 586 0x170A
20:34:07.218 ComputerName: JORDAN UserName: Wut
20:34:08.984 Initialize success
20:34:15.812 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdePort2
20:34:15.812 Disk 0 Vendor: WDC_WD3200AAKS-00L9A0 01.03E01 Size: 305245MB BusType: 3
20:34:15.812 Device \Device\Ide\IdeDeviceP2T0L0-10 -> \??\IDE#DiskWDC_WD3200AAKS-00L9A0___________________01.03E01#5&1a04b4bb&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} not found
20:34:15.812 Device \Driver\atapi -> DriverStartIo 8ae3227f
20:34:15.812 Disk 0 MBR read error
20:34:15.812 Disk 0 MBR scan
20:34:15.812 MBR BIOS signature not found 0
20:34:15.812 Disk 0 scanning sectors +625121280
20:34:15.812 Disk 0 scanning C:\WINDOWS\system32\drivers
20:34:22.453 Service scanning
20:34:23.312 Disk 0 trace - called modules:
20:34:23.312 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8ae32439]<<
20:34:23.312 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8aebbab8]
20:34:23.312 3 CLASSPNP.SYS[b8108fd7] -> nt!IofCallDriver -> \Device\00000071[0x8aec2318]
20:34:23.312 5 ACPI.sys[b7e66620] -> nt!IofCallDriver -> [0x8aec0b00]
20:34:23.328 \Driver\atapi[0x8aeb3e20] -> IRP_MJ_CREATE -> 0x8ae32439
20:34:23.328 Scan finished successfully
--------------------------------------------------------------------------
GMER 1.0.15.15570 - http://www.gmer.net
Rootkit scan 2011-04-03 22:32:48
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdePort2 WDC_WD3200AAKS-00L9A0 rev.01.03E01
Running: xqi7dr33.exe; Driver: C:\DOCUME~1\Wut\LOCALS~1\Temp\uxtdypob.sys
---- System - GMER 1.0.15 ----
SSDT 9816F5D6 ZwCreateKey
SSDT 9816F5CC ZwCreateThread
SSDT 9816F5DB ZwDeleteKey
SSDT 9816F5E5 ZwDeleteValueKey
SSDT sprl.sys ZwEnumerateKey [0xB7EC5CA4]
SSDT sprl.sys ZwEnumerateValueKey [0xB7EC6032]
SSDT 9816F5EA ZwLoadKey
SSDT sprl.sys ZwOpenKey [0xB7EA70C0]
SSDT 9816F5B8 ZwOpenProcess
SSDT 9816F5BD ZwOpenThread
SSDT sprl.sys ZwQueryKey [0xB7EC610A]
SSDT sprl.sys ZwQueryValueKey [0xB7EC5F8A]
SSDT 9816F5F4 ZwReplaceKey
SSDT 9816F5EF ZwRestoreKey
SSDT 9816F5E0 ZwSetValueKey
INT 0x63 ? 8AF89BF8
INT 0x63 ? 8AF89BF8
INT 0x63 ? 8AC9DBF8
INT 0x63 ? 8AC9DBF8
INT 0x63 ? 8AF89BF8
INT 0x74 ? 8AC9DBF8
INT 0x94 ? 8AF89BF8
INT 0x94 ? 8AF89BF8
INT 0x94 ? 8AF89BF8
INT 0x94 ? 8AF89BF8
INT 0x94 ? 8AC9DBF8
INT 0x94 ? 8AF89BF8
INT 0xB4 ? 8AC9DBF8
---- Kernel code sections - GMER 1.0.15 ----
.text ntkrnlpa.exe!ZwCallbackReturn + 2D6C 80504608 4 Bytes JMP 509816F5
? sprl.sys The system cannot find the file specified. !
.text C:\WINDOWS\system32\DRIVERS\ati2mtag.sys section is writeable [0xB70D4000, 0x29C9F0, 0xE8000020]
.text USBPORT.SYS!DllUnload B704E934 5 Bytes JMP 8AC9D1D8
.text allgpgio.SYS B6FDB386 35 Bytes [00, 00, 00, 00, 00, 00, 20, ...]
.text allgpgio.SYS B6FDB3AA 24 Bytes [00, 00, 00, 00, 00, 00, 00, ...]
.text allgpgio.SYS B6FDB3C4 3 Bytes [00, 70, 02] {ADD [EAX+0x2], DH}
.text allgpgio.SYS B6FDB3C9 1 Byte [30]
.text allgpgio.SYS B6FDB3C9 11 Bytes [30, 00, 00, 00, 5C, 02, 00, ...] {XOR [EAX], AL; ADD [EAX], AL; POP ESP; ADD AL, [EAX]; ADD [EAX], AL; ADD [EAX], AL}
.text ...
---- User code sections - GMER 1.0.15 ----
.text C:\WINDOWS\System32\svchost.exe[1340] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00D3000A
.text C:\WINDOWS\System32\svchost.exe[1340] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00D4000A
.text C:\WINDOWS\System32\svchost.exe[1340] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00D2000C
.text C:\WINDOWS\System32\svchost.exe[1340] ole32.dll!CoCreateInstance 774FF1C4 5 Bytes JMP 00EA000A
.text C:\WINDOWS\Explorer.EXE[1476] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00D7000A
.text C:\WINDOWS\Explorer.EXE[1476] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00FB000A
.text C:\WINDOWS\Explorer.EXE[1476] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00D6000C
---- Devices - GMER 1.0.15 ----
Device \FileSystem\Ntfs \Ntfs 8AF881F8
Device \Driver\usbuhci \Device\USBPDO-0 8AC9A1F8
Device \Driver\dmio \Device\DmControl\DmIoDaemon 8AF1A1F8
Device \Driver\dmio \Device\DmControl\DmConfig 8AF1A1F8
Device \Driver\dmio \Device\DmControl\DmPnP 8AF1A1F8
Device \Driver\dmio \Device\DmControl\DmInfo 8AF1A1F8
Device \Driver\usbuhci \Device\USBPDO-1 8AC9A1F8
Device \Driver\usbuhci \Device\USBPDO-2 8AC9A1F8
Device \Driver\usbehci \Device\USBPDO-3 8AC631F8
Device \Driver\usbuhci \Device\USBPDO-4 8AC9A1F8
Device \Driver\NetBT \Device\NetBT_Tcpip_{5CC729B7-33E1-427C-A244-D448CF12E0C5} 8A2801F8
Device \Driver\usbuhci \Device\USBPDO-5 8AC9A1F8
Device \Driver\PCI_PNP1840 \Device\00000049 sprl.sys
Device \Driver\usbuhci \Device\USBPDO-6 8AC9A1F8
Device \Driver\Ftdisk \Device\HarddiskVolume1 8AF8A1F8
Device \Driver\usbehci \Device\USBPDO-7 8AC631F8
Device \Driver\Cdrom \Device\CdRom0 8AC551F8
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort0 8AE3D27F
Device \Driver\atapi \Device\Ide\IdePort0 [B7DFBB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP0T0L0-3 8AE3D27F
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 [B7DFBB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort1 8AE3D27F
Device \Driver\atapi \Device\Ide\IdePort1 [B7DFBB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort2 8AE3D27F
Device \Driver\atapi \Device\Ide\IdePort2 [B7DFBB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort3 8AE3D27F
Device \Driver\atapi \Device\Ide\IdePort3 [B7DFBB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort4 8AE3D27F
Device \Driver\atapi \Device\Ide\IdePort4 [B7DFBB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort5 8AE3D27F
Device \Driver\atapi \Device\Ide\IdePort5 [B7DFBB40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\Cdrom \Device\CdRom1 8AC551F8
Device \Driver\NetBT \Device\NetBT_Tcpip_{8A2FAEC1-E7D6-4AF2-A954-18DE8C48542D} 8A2801F8
Device \Driver\NetBT \Device\NetBt_Wins_Export 8A2801F8
Device \Driver\NetBT \Device\NetbiosSmb 8A2801F8
Device \Driver\sptd \Device\2710701840 sprl.sys
Device \Driver\usbuhci \Device\USBFDO-0 8AC9A1F8
Device \Driver\usbuhci \Device\USBFDO-1 8AC9A1F8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 8A26D1F8
Device \Driver\usbuhci \Device\USBFDO-2 8AC9A1F8
Device \FileSystem\MRxSmb \Device\LanmanRedirector 8A26D1F8
Device \Driver\usbehci \Device\USBFDO-3 8AC631F8
Device \Driver\usbuhci \Device\USBFDO-4 8AC9A1F8
Device \Driver\Ftdisk \Device\FtControl 8AF8A1F8
Device \Driver\usbuhci \Device\USBFDO-5 8AC9A1F8
Device \Driver\usbuhci \Device\USBFDO-6 8AC9A1F8
Device \Driver\usbehci \Device\USBFDO-7 8AC631F8
Device \Driver\allgpgio \Device\Scsi\allgpgio1 8ABFC1F8
Device \Driver\allgpgio \Device\Scsi\allgpgio1Port6Path0Target0Lun0 8ABFC1F8
Device \FileSystem\Cdfs \Cdfs 8AB671F8
Device \Device\Ide\IdeDeviceP2T0L0-10 -> \??\IDE#DiskWDC_WD3200AAKS-00L9A0___________________01.03E01#5&1a04b4bb&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xC9 0x32 0xB7 0x85 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x84 0xCF 0x0F 0xFA ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xBA 0x71 0x78 0x95 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xC9 0x32 0xB7 0x85 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x84 0xCF 0x0F 0xFA ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xBA 0x71 0x78 0x95 ...
---- Files - GMER 1.0.15 ----
File C:\Program Files\Steam\steamapps\common\left 4 dead\left4dead\sound\player\tank\fall\Tank_death_BodyFall_01.wav 0 bytes
---- EOF - GMER 1.0.15 ----
There is all 3 things you asked for.
Blottedisk
2011-04-04, 18:54
Hi Neohart,
Thanks for the logs. If you would like to try and clean the machine, then please download TDSSKiller from one of the following mirrors and save it in your desktop:
This is THE Mirror (http://support.kaspersky.com/downloads/utils/tdsskiller.zip )
Extract its contents to your desktop.
Once extracted, open the TDSSKiller folder and doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
If an infected file is detected, the default action will be Cure, click on Continue.
http://i466.photobucket.com/albums/rr21/JSntgRvr/TDSSKillerMal-1.png
If a suspicious file is detected, the default action will be Skip, click on Continue.
http://i466.photobucket.com/albums/rr21/JSntgRvr/TDSSKillerSuspicious-1.png
It may ask you to reboot the computer to complete the process. Click on Reboot Now.
http://i466.photobucket.com/albums/rr21/JSntgRvr/TDSSKillerCompleted.png
If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.
Hello thank you for replying, here is the logs you have asked for.
2011/04/04 18:01:51.0296 2804 TDSS rootkit removing tool 2.4.21.0 Mar 10 2011 12:26:28
2011/04/04 18:01:51.0421 2804 ================================================================================
2011/04/04 18:01:51.0421 2804 SystemInfo:
2011/04/04 18:01:51.0421 2804
2011/04/04 18:01:51.0421 2804 OS Version: 5.1.2600 ServicePack: 3.0
2011/04/04 18:01:51.0421 2804 Product type: Workstation
2011/04/04 18:01:51.0421 2804 ComputerName: JORDAN
2011/04/04 18:01:51.0421 2804 UserName: Wut
2011/04/04 18:01:51.0421 2804 Windows directory: C:\WINDOWS
2011/04/04 18:01:51.0421 2804 System windows directory: C:\WINDOWS
2011/04/04 18:01:51.0421 2804 Processor architecture: Intel x86
2011/04/04 18:01:51.0421 2804 Number of processors: 2
2011/04/04 18:01:51.0421 2804 Page size: 0x1000
2011/04/04 18:01:51.0421 2804 Boot type: Normal boot
2011/04/04 18:01:51.0421 2804 ================================================================================
2011/04/04 18:01:51.0937 2804 Initialize success
2011/04/04 18:02:16.0687 1332 ================================================================================
2011/04/04 18:02:16.0687 1332 Scan started
2011/04/04 18:02:16.0687 1332 Mode: Manual;
2011/04/04 18:02:16.0687 1332 ================================================================================
2011/04/04 18:02:17.0406 1332 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/04/04 18:02:17.0437 1332 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
2011/04/04 18:02:17.0500 1332 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/04/04 18:02:17.0546 1332 AFD (4d43e74f2a1239d53929b82600f1971c) C:\WINDOWS\System32\drivers\afd.sys
2011/04/04 18:02:17.0640 1332 Ambfilt (f6af59d6eee5e1c304f7f73706ad11d8) C:\WINDOWS\system32\drivers\Ambfilt.sys
2011/04/04 18:02:17.0750 1332 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2011/04/04 18:02:17.0812 1332 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/04/04 18:02:17.0828 1332 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/04/04 18:02:18.0046 1332 ati2mtag (c2b6f2161abd498d2b453050ffc81812) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys
2011/04/04 18:02:18.0125 1332 AtiHdmiService (dc6957811ff95f2dd3004361b20d8d3f) C:\WINDOWS\system32\drivers\AtiHdmi.sys
2011/04/04 18:02:18.0140 1332 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/04/04 18:02:18.0203 1332 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/04/04 18:02:18.0312 1332 avgio (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Program Files\Avira\AntiVir Desktop\avgio.sys
2011/04/04 18:02:18.0328 1332 avgntflt (47b879406246ffdced59e18d331a0e7d) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
2011/04/04 18:02:18.0359 1332 avipbb (5fedef54757b34fb611b9ec8fb399364) C:\WINDOWS\system32\DRIVERS\avipbb.sys
2011/04/04 18:02:18.0390 1332 BANTExt (5d7be7b19e827125e016325334e58ff1) C:\WINDOWS\System32\Drivers\BANTExt.sys
2011/04/04 18:02:18.0437 1332 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/04/04 18:02:18.0468 1332 BVRPMPR5 (248dfa5762dde38dfddbbd44149e9d7a) C:\WINDOWS\system32\drivers\BVRPMPR5.SYS
2011/04/04 18:02:18.0515 1332 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/04/04 18:02:18.0546 1332 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2011/04/04 18:02:18.0609 1332 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/04/04 18:02:18.0609 1332 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/04/04 18:02:18.0625 1332 Cdrom (4b0a100eaf5c49ef3cca8c641431eacc) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/04/04 18:02:18.0890 1332 cpuz135 (6bada94085b6709694f8327c211d12e1) C:\WINDOWS\system32\drivers\cpuz135_x32.sys
2011/04/04 18:02:18.0937 1332 Disk (47b6aaec570f2c11d8bad80a064d8ed1) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/04/04 18:02:19.0000 1332 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
2011/04/04 18:02:19.0046 1332 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
2011/04/04 18:02:19.0078 1332 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/04/04 18:02:19.0125 1332 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/04/04 18:02:19.0156 1332 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/04/04 18:02:19.0187 1332 e1express (8942419786970adb32b05bb7950aee72) C:\WINDOWS\system32\DRIVERS\e1e5132.sys
2011/04/04 18:02:19.0281 1332 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/04/04 18:02:19.0296 1332 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
2011/04/04 18:02:19.0343 1332 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
2011/04/04 18:02:19.0359 1332 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
2011/04/04 18:02:19.0390 1332 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
2011/04/04 18:02:19.0406 1332 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/04/04 18:02:19.0421 1332 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/04/04 18:02:19.0468 1332 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
2011/04/04 18:02:19.0484 1332 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/04/04 18:02:19.0515 1332 hamachi (833051c6c6c42117191935f734cfbd97) C:\WINDOWS\system32\DRIVERS\hamachi.sys
2011/04/04 18:02:19.0546 1332 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2011/04/04 18:02:19.0562 1332 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/04/04 18:02:19.0625 1332 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/04/04 18:02:19.0703 1332 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/04/04 18:02:19.0718 1332 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/04/04 18:02:19.0859 1332 IntcAzAudAddService (f9bb9063a6557098dbaf7396e026c922) C:\WINDOWS\system32\drivers\RtkHDAud.sys
2011/04/04 18:02:19.0937 1332 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/04/04 18:02:19.0953 1332 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
2011/04/04 18:02:20.0000 1332 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/04/04 18:02:20.0015 1332 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/04/04 18:02:20.0046 1332 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/04/04 18:02:20.0062 1332 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/04/04 18:02:20.0109 1332 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/04/04 18:02:20.0125 1332 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/04/04 18:02:20.0140 1332 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/04/04 18:02:20.0140 1332 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2011/04/04 18:02:20.0187 1332 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/04/04 18:02:20.0218 1332 KSecDD (c6ebf1d6ad71df30db49b8d3287e1368) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/04/04 18:02:20.0250 1332 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/04/04 18:02:20.0281 1332 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
2011/04/04 18:02:20.0328 1332 Monfilt (9fa7207d1b1adead88ae8eed9cdbbaa5) C:\WINDOWS\system32\drivers\Monfilt.sys
2011/04/04 18:02:20.0375 1332 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/04/04 18:02:20.0390 1332 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/04/04 18:02:20.0406 1332 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/04/04 18:02:20.0421 1332 MRxDAV (0a25b866933d126d1e831fd025a278c2) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/04/04 18:02:20.0484 1332 MRxSmb (d09b9f0b9960dd41e73127b7814c115f) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/04/04 18:02:20.0515 1332 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/04/04 18:02:20.0546 1332 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/04/04 18:02:20.0593 1332 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/04/04 18:02:20.0625 1332 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/04/04 18:02:20.0671 1332 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/04/04 18:02:20.0718 1332 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
2011/04/04 18:02:20.0750 1332 Mup (6546fe6639499fa4bef180bdf08266a1) C:\WINDOWS\system32\drivers\Mup.sys
2011/04/04 18:02:20.0828 1332 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2011/04/04 18:02:20.0875 1332 NAL (d02734423b59b3ac14cdfe91e9665ff0) C:\WINDOWS\system32\Drivers\iqvw32.sys
2011/04/04 18:02:20.0890 1332 NDIS (b5b1080d35974c0e718d64280761bcd5) C:\WINDOWS\system32\drivers\NDIS.sys
2011/04/04 18:02:20.0921 1332 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
2011/04/04 18:02:20.0953 1332 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/04/04 18:02:21.0000 1332 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/04/04 18:02:21.0015 1332 NdisWan (b053a8411045fd0664b389a090cb2bbc) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/04/04 18:02:21.0031 1332 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/04/04 18:02:21.0046 1332 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/04/04 18:02:21.0078 1332 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/04/04 18:02:21.0156 1332 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2011/04/04 18:02:21.0156 1332 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/04/04 18:02:21.0234 1332 Ntfs (a0857c97770034fd2af17dc4014b5abd) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/04/04 18:02:21.0312 1332 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/04/04 18:02:21.0390 1332 nv (2b298519edbfcf451d43e0f1e8f1006d) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
2011/04/04 18:02:21.0515 1332 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/04/04 18:02:21.0515 1332 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/04/04 18:02:21.0546 1332 ohci1394 (23f68c5580883a7640bf961704aa10a0) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2011/04/04 18:02:21.0578 1332 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys
2011/04/04 18:02:21.0593 1332 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/04/04 18:02:21.0625 1332 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/04/04 18:02:21.0625 1332 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/04/04 18:02:21.0640 1332 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/04/04 18:02:21.0671 1332 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
2011/04/04 18:02:21.0781 1332 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/04/04 18:02:21.0796 1332 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/04/04 18:02:21.0812 1332 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/04/04 18:02:21.0843 1332 QCDonner (fddd1aeb9f81ef1e6e48ae1edc2a97d6) C:\WINDOWS\system32\DRIVERS\OVCD.sys
2011/04/04 18:02:21.0890 1332 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/04/04 18:02:21.0921 1332 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/04/04 18:02:21.0937 1332 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/04/04 18:02:21.0937 1332 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/04/04 18:02:21.0953 1332 Rdbss (9629383f70db691cb6aa5bbd828cd9a9) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/04/04 18:02:21.0968 1332 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/04/04 18:02:22.0000 1332 rdpdr (3a99642ed25a2fad5b0ba55f09ba2f93) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2011/04/04 18:02:22.0046 1332 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/04/04 18:02:22.0093 1332 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/04/04 18:02:22.0171 1332 rspndr (743d7d59767073a617b1dcc6c546f234) C:\WINDOWS\system32\DRIVERS\rspndr.sys
2011/04/04 18:02:22.0218 1332 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/04/04 18:02:22.0234 1332 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
2011/04/04 18:02:22.0250 1332 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
2011/04/04 18:02:22.0281 1332 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/04/04 18:02:22.0359 1332 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
2011/04/04 18:02:22.0421 1332 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/04/04 18:02:22.0468 1332 sptd (d15da1ba189770d93eea2d7e18f95af9) C:\WINDOWS\system32\Drivers\sptd.sys
2011/04/04 18:02:22.0468 1332 Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: d15da1ba189770d93eea2d7e18f95af9
2011/04/04 18:02:22.0468 1332 sptd - detected Locked file (1)
2011/04/04 18:02:22.0500 1332 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/04/04 18:02:22.0546 1332 Srv (0f6aefad3641a657e18081f52d0c15af) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/04/04 18:02:22.0609 1332 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
2011/04/04 18:02:22.0640 1332 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
2011/04/04 18:02:22.0656 1332 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/04/04 18:02:22.0687 1332 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/04/04 18:02:22.0781 1332 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/04/04 18:02:22.0812 1332 Tcpip (367de8e5f638c091f49273144274f629) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/04/04 18:02:22.0859 1332 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/04/04 18:02:22.0875 1332 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/04/04 18:02:22.0890 1332 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/04/04 18:02:22.0921 1332 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/04/04 18:02:22.0984 1332 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/04/04 18:02:23.0046 1332 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
2011/04/04 18:02:23.0109 1332 usbbus (adb68aa60ef991ce2e217223fa20b4ff) C:\WINDOWS\system32\DRIVERS\lgusbbus.sys
2011/04/04 18:02:23.0156 1332 usbccgp (c18d6c74953621346df6b0a11f80c1cc) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/04/04 18:02:23.0203 1332 UsbDiag (d4a6201dd361f019e44483645b490e4e) C:\WINDOWS\system32\DRIVERS\lgusbdiag.sys
2011/04/04 18:02:23.0218 1332 usbehci (152ee0baa614388273a0b9ae9c9fd5a0) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/04/04 18:02:23.0218 1332 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/04/04 18:02:23.0250 1332 USBModem (a2b99411e10287f327a9820d260e7fe4) C:\WINDOWS\system32\DRIVERS\lgusbmodem.sys
2011/04/04 18:02:23.0296 1332 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/04/04 18:02:23.0296 1332 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/04/04 18:02:23.0328 1332 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/04/04 18:02:23.0406 1332 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/04/04 18:02:23.0421 1332 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/04/04 18:02:23.0453 1332 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/04/04 18:02:23.0500 1332 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/04/04 18:02:23.0578 1332 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2011/04/04 18:02:23.0640 1332 \HardDisk0 - detected Rootkit.Win32.TDSS.tdl4 (0)
2011/04/04 18:02:23.0640 1332 ================================================================================
2011/04/04 18:02:23.0640 1332 Scan finished
2011/04/04 18:02:23.0640 1332 ================================================================================
2011/04/04 18:02:23.0656 1464 Detected object count: 2
2011/04/04 18:03:00.0015 1464 Locked file(sptd) - User select action: Skip
2011/04/04 18:03:00.0687 1464 \HardDisk0 (Rootkit.Win32.TDSS.tdl4) - will be cured after reboot
2011/04/04 18:03:00.0687 1464 \HardDisk0 - ok
2011/04/04 18:03:00.0687 1464 Rootkit.Win32.TDSS.tdl4(\HardDisk0) - User select action: Cure
2011/04/04 18:03:13.0718 2792 Deinitialize success
Blottedisk
2011-04-05, 01:53
Hi Neohart,
Well done. We took care of the "heavy" part of the infection. But there's still more to be done.
Please visit the following and have a look how you can disable your security software.
How to disable your security programs (http://forums.whatthetech.com/index.php?showtopic=96260 )
After disabling your security programs, download Combofix from any of the links below and save it to your desktop.
Link 1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe )
Link 2 (http://www.forospyware.com/sUBs/ComboFix.exe )
--------------------------------------------------------------------
Double click on Combofix.exe & follow the prompts.
When finished, it will produce a report for you.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
http://img.photobucket.com/albums/v706/ried7/RcAuto1.gif
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
http://img.photobucket.com/albums/v706/ried7/whatnext.png
Click on Yes, to continue scanning for malware.
When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply.
If you need help, see this link:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix (http://www.bleepingcomputer.com/combofix/how-to-use-combofix )
I ran Combo fix, here is the log you asked for.
ComboFix 11-04-04.01 - Wut 04/04/2011 19:23:34.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3325.2804 [GMT -5:00]
Running from: c:\documents and settings\Wut\My Documents\Downloads\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\asdasd\Local Settings\Temporary Internet Files\cookies.sqlite
c:\documents and settings\JDAWG\Local Settings\Temporary Internet Files\ijjistarter_verinfo.dat
C:\Install.exe
c:\program files\AutocompletePro
c:\program files\AutocompletePro\AcRemoteUpdate.exe
c:\program files\AutocompletePro\AutocompletePro.dll
c:\program files\AutocompletePro\InstTracker.exe
c:\program files\AutocompletePro\support@predictad.com\defaults\preferences\predictad.js
c:\program files\AutocompletePro\support@predictad.com\install.rdf
c:\program files\AutocompletePro\TaskScheduler.dll
c:\program files\AutocompletePro\unins000.dat
c:\program files\AutocompletePro\unins000.exe
c:\program files\Search Toolbar
c:\program files\Search Toolbar\icon.ico
c:\program files\Search Toolbar\SearchToolbar.dll
c:\program files\Search Toolbar\SearchToolbarUninstall.exe
c:\program files\Search Toolbar\SearchToolbarUpdater.exe
c:\program files\WhiteSmoke
.
.
((((((((((((((((((((((((( Files Created from 2011-03-05 to 2011-04-05 )))))))))))))))))))))))))))))))
.
.
2011-04-03 19:06 . 2011-04-03 19:06 -------- d-----w- c:\documents and settings\Wut\Application Data\wargaming.net
2011-04-03 18:57 . 2011-04-03 18:57 -------- d-----w- C:\Games
2011-04-01 00:14 . 2011-04-01 00:14 -------- d-----w- c:\program files\iPod
2011-04-01 00:14 . 2011-04-01 00:15 -------- d-----w- c:\program files\iTunes
2011-04-01 00:09 . 2011-04-01 00:09 -------- d-----w- c:\program files\Bonjour
2011-03-30 18:56 . 2011-03-30 18:56 83249512 ----a-w- c:\program files\Common Files\Windows Live\.cache\wlc18.tmp
2011-03-30 04:07 . 2011-03-30 04:07 -------- d-----w- c:\documents and settings\Name
2011-03-30 00:22 . 2011-03-30 00:22 -------- d-----w- c:\documents and settings\Wut\.thumbnails
2011-03-30 00:21 . 2011-03-30 00:22 -------- d-----w- c:\documents and settings\Wut\.gimp-2.6
2011-03-30 00:21 . 2011-03-30 00:21 -------- d-----w- c:\documents and settings\Wut\.gegl-0.0
2011-03-29 21:59 . 2009-03-18 22:35 26176 ---ha-w- c:\windows\system32\hamachi.sys
2011-03-29 21:59 . 2011-03-29 21:59 -------- d-----w- c:\program files\LogMeIn Hamachi
2011-03-28 21:24 . 2011-03-28 21:24 -------- d-----w- c:\documents and settings\JDAWG\Local Settings\Application Data\ATI
2011-03-28 21:24 . 2011-03-28 21:24 -------- d-----w- c:\documents and settings\JDAWG\Application Data\ATI
2011-03-28 21:24 . 2011-03-28 21:24 -------- d-----w- c:\documents and settings\JDAWG\Local Settings\Application Data\LogMeIn Hamachi
2011-03-28 07:26 . 2011-03-28 07:26 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2011-03-27 07:17 . 2011-04-04 23:04 -------- d-----w- c:\documents and settings\Wut\Tracing
2011-03-26 23:04 . 2011-03-26 23:04 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2011-03-26 22:25 . 2011-03-26 22:25 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2011-03-25 20:20 . 2011-04-02 00:08 -------- d-----w- C:\Minecraft
2011-03-25 20:10 . 2011-03-25 20:09 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-03-24 02:21 . 2011-03-19 23:27 66520 ----a-w- c:\program files\Mozilla Firefox\plugins\npnul32.dll
2011-03-24 02:21 . 2011-03-19 23:27 25048 ----a-w- c:\program files\Mozilla Firefox\components\browserdirprovider.dll
2011-03-24 02:21 . 2011-03-19 23:27 140248 ----a-w- c:\program files\Mozilla Firefox\components\brwsrcmp.dll
2011-03-24 02:21 . 2011-03-19 23:27 492504 ----a-w- c:\program files\Mozilla Firefox\sqlite3.dll
2011-03-24 02:21 . 2011-03-19 23:27 1018328 ----a-w- c:\program files\Mozilla Firefox\js3250.dll
2011-03-19 03:34 . 2011-03-22 10:12 -------- d-----w- c:\documents and settings\Wut\Application Data\.minecraft
2011-03-14 12:17 . 2011-03-14 12:17 -------- d-----w- c:\program files\Common Files\Java
2011-03-14 12:17 . 2011-03-14 12:17 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
2011-03-14 12:17 . 2011-03-14 12:17 -------- d-----w- c:\program files\McAfee Security Scan
2011-03-12 03:53 . 2011-04-05 00:29 -------- d-----w- c:\documents and settings\Wut\Local Settings\Application Data\LogMeIn Hamachi
2011-03-12 03:53 . 2011-04-04 23:04 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\LogMeIn Hamachi
2011-03-11 00:06 . 2011-03-11 00:06 -------- d-----w- c:\documents and settings\Wut\Local Settings\Application Data\ATI
2011-03-11 00:06 . 2011-03-11 00:06 -------- d-----w- c:\documents and settings\Wut\Application Data\ATI
2011-03-11 00:06 . 2011-03-11 00:06 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI
2011-03-10 23:59 . 2011-03-10 23:59 -------- d-----w- C:\ATI
2011-03-10 23:12 . 2011-03-11 00:04 -------- d-----w- c:\program files\ATI Technologies
2011-03-10 23:12 . 2011-03-10 23:12 -------- d-----w- C:\AMD
2011-03-06 05:56 . 2011-03-17 05:16 -------- d-----w- c:\documents and settings\Wut\world
2011-03-06 01:41 . 2011-03-06 01:41 -------- d-----w- c:\documents and settings\Wut\Local Settings\Application Data\Adobe
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-25 20:09 . 2010-06-17 00:01 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-03-25 20:09 . 2010-05-28 19:05 137656 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-02-09 13:53 . 2008-04-14 12:00 270848 ----a-w- c:\windows\system32\sbe.dll
2011-02-09 13:53 . 2008-04-14 12:00 186880 ----a-w- c:\windows\system32\encdec.dll
2011-02-02 07:58 . 2009-04-16 17:38 2067456 ----a-w- c:\windows\system32\mstscax.dll
2011-01-30 06:01 . 2009-11-14 05:33 219128 -c--a-w- c:\windows\system32\PnkBstrB.xtr
2011-01-30 06:01 . 2009-11-14 05:31 219128 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-01-30 05:58 . 2009-11-14 05:31 138592 -c--a-w- c:\windows\system32\drivers\PnkBstrK.sys
2011-01-27 11:57 . 2009-04-16 17:38 677888 ----a-w- c:\windows\system32\mstsc.exe
2011-01-21 14:42 . 2008-04-14 12:00 439808 ----a-w- c:\windows\system32\shimgvw.dll
2011-01-19 23:47 . 2011-02-19 22:36 22504 ----a-w- c:\windows\system32\drivers\cpuz135_x32.sys
2011-01-07 14:09 . 2008-05-27 17:29 290048 ----a-w- c:\windows\system32\atmfd.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-03-09 26100520]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2009-02-04 18085888]
"ContentTransferWMDetector.exe"="c:\program files\Sony\Content Transfer\ContentTransferWMDetector.exe" [2008-07-11 423200]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-03 281768]
"ATICustomerCare"="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-05-04 311296]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"LogMeIn Hamachi Ui"="c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe" [2011-03-28 1910152]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-03-07 421160]
.
c:\documents and settings\asdasd\Start Menu\Programs\Startup\
KETV NewsWatch 7 Instant Alert.lnk - c:\program files\KETV NewsWatch 7 Instant Alert\liveonline_3749389.exe [2010-9-1 458752]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.1.121\SSScheduler.exe [2010-9-3 255536]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.0.1-to-3.0.2-enUS-Win-Update-downloader.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\Steam\\steamapps\\scfan7\\team fortress 2\\hl2.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.1.0.9767-to-3.1.1.9806-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\Program Files\\Steam\\steamapps\\scfan7\\half-life 2 deathmatch\\hl2.exe"=
"c:\\Program Files\\Steam\\steamapps\\scfan7\\source sdk base\\hl2.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.1.2.9901-to-3.1.3.9947-enUS-downloader.exe"=
"c:\\Program Files\\Sony\\Station\\LaunchPad\\LaunchPad.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Documents and Settings\\JDAWG\\Local Settings\\Apps\\2.0\\5J46AAC4.3TC\\KPYW8TN6.M89\\gwab..tion_978e0ac48d518eb4_0001.0026_6a5a2d1791a3e63a\\Gwabs.Deploy.exe"=
"c:\\Program Files\\Black Isle\\BGII - SoA\\BGMain.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\Starcraft\\StarCraft.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.1.3.9947-to-3.2.0.10192-enUS-downloader.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\ijjigame\\PLauncher.exe"=
"c:\\WINDOWS\\Downloaded Program Files\\PurpleBean.exe"=
"c:\\ijji\\ENGLISH\\Gunz\\Gunz.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.0.10192-to-3.2.0.10314-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.0.10314-to-3.2.2.10482-enUS-downloader.exe"=
"c:\\Documents and Settings\\JDAWG\\Application Data\\RayV\\Viewer\\RayV.dll"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.2.10482-to-3.2.2.10505-enUS-downloader.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Steam\\steamapps\\scfan7\\insurgency\\hl2.exe"=
"c:\\Program Files\\Steam\\steam.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Steam\\appcache\\stats\\UserGameStats_33010020_13140.bin"=
"c:\\Program Files\\Steam\\appcache\\stats\\UserGameStats_33010020_12900.bin"=
"c:\\Program Files\\Steam\\appcache\\stats\\UserGameStats_33010020_4000.bin"=
"c:\\Program Files\\Steam\\appcache\\stats\\UserGameStats_33010020_590.bin"=
"c:\\Program Files\\Steam\\appcache\\stats\\UserGameStats_33010020_500.bin"=
"c:\\Program Files\\Steam\\appcache\\stats\\UserGameStats_33010020_440.bin"=
"c:\\Program Files\\Steam\\appcache\\stats\\UserGameStats_33010020_400.bin"=
"c:\\Program Files\\Steam\\steamapps\\common\\mass effect\\Binaries\\MassEffect.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\mass effect\\docs\\EA Help\\Electronic_Arts_Technical_Support.htm"=
"c:\\Program Files\\Steam\\steamapps\\common\\stalker shadow of chernobyl\\bin\\XR_3DA.exe"=
"c:\\Program Files\\Steam\\steamapps\\scfan7\\source sdk base 2007\\hl2.exe"=
"c:\\Program Files\\ijji\\ijji REACTOR\\REACTOR.exe"=
"c:\\WINDOWS\\Downloaded Program Files\\ijjiOptimizer.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\r.u.s.e. beta\\Ruse.exe"=
"c:\\Documents and Settings\\JDAWG\\My Documents\\Downloads\\StarCraft_2_Beta_enUS (2).exe"=
"c:\\Program Files\\StarCraft II Beta\\StarCraft II.exe"=
"c:\\Program Files\\Steam\\steamapps\\scfan7\\zombie panic! source\\hl2.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\StarCraft II Beta\\Versions\\Base15976\\SC2.exe"=
"c:\\Program Files\\StarCraft II Beta\\Versions\\Base16036\\SC2.exe"=
"c:\\Program Files\\Steam\\steamapps\\scfan7\\sourcesdk\\bin\\SDKLauncher.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\nexon\Combat Arms\CombatArms.exe"= c:\nexon\Combat Arms\CombatArms.exe:*Enabled:CombatArms.exe
"c:\\Nexon\\Combat Arms\\NMService.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\alien swarm\\srcds.exe"=
"c:\\Program Files\\StarCraft II\\StarCraft II.exe"=
"c:\\Program Files\\StarCraft II\\Versions\\Base15405\\SC2.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\call of duty 4\\iw3sp.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\call of duty 4\\iw3mp.exe"=
"c:\\Program Files\\StarCraft II\\Versions\\Base16605\\SC2.exe"=
"c:\\Program Files\\World of Warcraft\\Blizzard Downloader.exe"=
"c:\\Program Files\\StarCraft II\\Versions\\Base16755\\SC2.exe"=
"c:\\Program Files\\Steam\\steamapps\\scfan7\\synergy\\hl2.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\beat hazard demo\\BeatHazardDemo.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\plants vs zombies\\PlantsVsZombies.exe"=
"c:\\Program Files\\Steam\\steamapps\\scfan7\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\StarCraft II\\Versions\\Base16939\\SC2.exe"=
"c:\\Program Files\\Steam\\steamapps\\scfan7\\eternal-silence\\hl2.exe"=
"c:\\Program Files\\OGPlanet\\Zone4\\Zone4_NA.exe"=
"c:\\Nexon\\Combat Arms\\Engine.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\torchlight\\Torchlight.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\audiosurf\\engine\\QuestViewer.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\alien swarm\\swarm.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\alien swarm\\bin\\SDKLauncher.exe"=
"c:\\Program Files\\Steam\\steamapps\\neohart\\team fortress 2\\hl2.exe"=
"c:\\Documents and Settings\\Wut\\Application Data\\Macromedia\\Flash Player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=
"c:\\WINDOWS\\system32\\java.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\StarCraft II\\Versions\\Base18092\\SC2.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"57570:TCP"= 57570:TCP:Pando Media Booster
"57570:UDP"= 57570:UDP:Pando Media Booster
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [6/19/2009 5:58 AM 721904]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [5/28/2010 2:05 PM 135336]
R2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [2/19/2011 5:36 PM 22504]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [3/28/2011 3:41 PM 1242504]
S2 CSHelper;CopySafe Helper Service;c:\windows\system32\CSHelper.exe [7/21/2010 9:59 PM 266240]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [4/16/2009 3:15 PM 1684736]
S3 EagleXNt;EagleXNt;\??\c:\windows\system32\drivers\EagleXNt.sys --> c:\windows\system32\drivers\EagleXNt.sys [?]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.1.121\McCHSvc.exe [9/3/2010 1:45 AM 227232]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 vtany;vtany;\??\c:\windows\vtany.sys --> c:\windows\vtany.sys [?]
S3 xhunter1;xhunter1;\??\c:\windows\xhunter1.sys --> c:\windows\xhunter1.sys [?]
.
Contents of the 'Scheduled Tasks' folder
.
2011-03-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 16:50]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\documents and settings\Wut\Application Data\Mozilla\Firefox\Profiles\znpdqnqv.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.joystiq.com/
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\AskBarDis\bar\bin\askBar.dll
Toolbar-{3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\AskBarDis\bar\bin\askBar.dll
AddRemove-Ask Toolbar_is1 - c:\program files\AskBarDis\unins000.exe
AddRemove-AutocompletePro2_is1 - c:\program files\AutocompletePro\unins000.exe
AddRemove-DAEMON Tools Toolbar - c:\program files\DAEMON Tools Toolbar\uninst.exe
AddRemove-Inform 7 - c:\program files\Inform 7\Uninstall.exe
AddRemove-LimeWire - c:\program files\LimeWire\uninstall.exe
AddRemove-RayV - c:\program files\RayV\RayV\uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-04 19:29
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(852)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
.
Completion time: 2011-04-04 19:31:07
ComboFix-quarantined-files.txt 2011-04-05 00:31
.
Pre-Run: 87,201,587,200 bytes free
Post-Run: 89,206,763,520 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
[spybotsd]
timeout.old=30
.
- - End Of File - - B799449A2B5E1A05DED1DE3C0E382B3C
Blottedisk
2011-04-05, 02:47
Hi Neohart,
You are using peer-to-peer programs, specifically BitTorrent. These are what we call an optional removal. However, anytime you are running any type of peer-to-peer application, you are more prone to infection by malware, and this is probably how you became infected in the first place. The choice to remove them is entirely up to you, but I would strongly recommend that you do. If you do not want to, please at least refrain from using any peer-to-peer programs for the remainder of my fix.
Please go to the following site to scan a file: Virus Total (http://forums.whatthetech.com/redirect.php?url=http%3A%2F%2Fwww.virustotal.com )
Click on Browse, and upload the following file for analysis:
c:\Documents and Settings\JDAWG\Local Settings\Apps\2.0\5J46AAC4.3TC\KPYW8TN6.M89\gwab..tion_978e0ac48d518eb4_0001.0026_6a5a2d1791a3e63a\Gwabs.Deploy.exe
Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.
If it says already scanned -- click "reanalyze now"
Please post the results in your next reply.
Thank you for the reply, Yes I do have those programs but none of them were being used during any of this process, Here is the logs you have asked for.
I did not see a area to get a full log so i Coped and pasted what was important.
File name:
Gwabs.Deploy.exe
Submission date:
2011-04-05 00:52:45 (UTC)
Current status:
queued queued analysing finished
Result:
0/ 41 (0.0%)
Antivirus Version Last Update Result
AhnLab-V3 2011.04.05.00 2011.04.04 -
AntiVir 7.11.5.186 2011.04.04 -
Antiy-AVL 2.0.3.7 2011.04.04 -
Avast 4.8.1351.0 2011.04.04 -
Avast5 5.0.677.0 2011.04.04 -
AVG 10.0.0.1190 2011.04.04 -
BitDefender 7.2 2011.04.05 -
CAT-QuickHeal 11.00 2011.04.03 -
ClamAV 0.97.0.0 2011.04.04 -
Commtouch 5.2.11.5 2011.03.24 -
Comodo 8223 2011.04.05 -
DrWeb 5.0.2.03300 2011.04.05 -
Emsisoft 5.1.0.5 2011.04.04 -
eTrust-Vet 36.1.8253 2011.04.04 -
F-Prot 4.6.2.117 2011.04.04 -
F-Secure 9.0.16440.0 2011.04.02 -
Fortinet 4.2.254.0 2011.04.05 -
GData 22 2011.04.05 -
Ikarus T3.1.1.103.0 2011.04.05 -
Jiangmin 13.0.900 2011.03.31 -
K7AntiVirus 9.96.4290 2011.04.04 -
Kaspersky 7.0.0.125 2011.04.05 -
McAfee 5.400.0.1158 2011.04.05 -
McAfee-GW-Edition 2010.1C 2011.04.04 -
Microsoft 1.6702 2011.04.04 -
NOD32 6015 2011.04.04 -
Norman 6.07.07 2011.04.04 -
Panda 10.0.3.5 2011.04.04 -
PCTools 7.0.3.5 2011.04.04 -
Prevx 3.0 2011.04.05 -
Rising 23.51.05.05 2011.04.02 -
Sophos 4.64.0 2011.04.04 -
SUPERAntiSpyware 4.40.0.1006 2011.04.05 -
Symantec 20101.3.2.89 2011.04.05 -
TheHacker 6.7.0.1.167 2011.04.05 -
TrendMicro 9.200.0.1012 2011.04.04 -
TrendMicro-HouseCall 9.200.0.1012 2011.04.05 -
VBA32 3.12.14.3 2011.04.04 -
VIPRE 8921 2011.04.04 -
ViRobot 2011.4.4.4392 2011.04.04 -
VirusBuster 13.6.287.0 2011.04.04 -
Blottedisk
2011-04-05, 05:04
Ok, please do the following:
Step 1 | ComboFix - CFScript
WARNING !
This script is for THIS user and computer ONLY!
Using this tool incorrectly could damage your Operating System... preventing it from starting again!
You will not have Internet access when you execute ComboFix. All open windows will need to be closed!
Please open Notepad and copy/paste all the text below... into the window:
DDS::
uInternet Settings,ProxyOverride = *.local
Save it to your desktop as CFScript.txt
Please disable any Antivirus or Firewall you have active, as shown in this topic (http://www.bleepingcomputer.com/forums/topic114351.html). Please close all open application windows.
Drag the CFScript.txt (icon) into the ComboFix.exe icon... as seen in the image below:
http://i526.photobucket.com/albums/cc345/MPKwings/ComboFixScriptDrag.gif
This will cause ComboFix to run again.
Do Not use your keyboard or mouse click anywhere in the ComboFix window, as this may cause the program to stall or crash.
Do Not touch your computer when ComboFix is running!
When finished... Notepad will open ... ComboFix will produce a log file called "log.txt".
Please copy/paste the contents of log.txt... in your next reply.
** Enable your Antivirus and Firewall, before connecting to the Internet again! **
Step 2 | Please download Malwarebytes' Anti-Malware (http://www.malwarebytes.org/mbam.php) to your desktop.
Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Hello, Thank you the quick reply, I did as you said and ran that scan. I already have Malwarebytes' Anti-Malware on my computer, I updated and did a quick scan, here are the logs you asked for.
ComboFix 11-04-04.01 - Wut 04/04/2011 22:09:31.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3325.2738 [GMT -5:00]
Running from: c:\documents and settings\Wut\My Documents\Downloads\ComboFix.exe
Command switches used :: c:\documents and settings\Wut\Desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
((((((((((((((((((((((((( Files Created from 2011-03-05 to 2011-04-05 )))))))))))))))))))))))))))))))
.
.
2011-04-03 19:06 . 2011-04-03 19:06 -------- d-----w- c:\documents and settings\Wut\Application Data\wargaming.net
2011-04-03 18:57 . 2011-04-03 18:57 -------- d-----w- C:\Games
2011-04-01 00:14 . 2011-04-01 00:14 -------- d-----w- c:\program files\iPod
2011-04-01 00:14 . 2011-04-01 00:15 -------- d-----w- c:\program files\iTunes
2011-04-01 00:09 . 2011-04-01 00:09 -------- d-----w- c:\program files\Bonjour
2011-03-30 18:56 . 2011-03-30 18:56 83249512 ----a-w- c:\program files\Common Files\Windows Live\.cache\wlc18.tmp
2011-03-30 04:07 . 2011-03-30 04:07 -------- d-----w- c:\documents and settings\Name
2011-03-30 00:22 . 2011-03-30 00:22 -------- d-----w- c:\documents and settings\Wut\.thumbnails
2011-03-30 00:21 . 2011-03-30 00:22 -------- d-----w- c:\documents and settings\Wut\.gimp-2.6
2011-03-30 00:21 . 2011-03-30 00:21 -------- d-----w- c:\documents and settings\Wut\.gegl-0.0
2011-03-29 21:59 . 2009-03-18 22:35 26176 ---ha-w- c:\windows\system32\hamachi.sys
2011-03-29 21:59 . 2011-03-29 21:59 -------- d-----w- c:\program files\LogMeIn Hamachi
2011-03-28 21:24 . 2011-03-28 21:24 -------- d-----w- c:\documents and settings\JDAWG\Local Settings\Application Data\ATI
2011-03-28 21:24 . 2011-03-28 21:24 -------- d-----w- c:\documents and settings\JDAWG\Application Data\ATI
2011-03-28 21:24 . 2011-03-28 21:24 -------- d-----w- c:\documents and settings\JDAWG\Local Settings\Application Data\LogMeIn Hamachi
2011-03-28 07:26 . 2011-03-28 07:26 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2011-03-27 07:17 . 2011-04-04 23:04 -------- d-----w- c:\documents and settings\Wut\Tracing
2011-03-26 23:04 . 2011-03-26 23:04 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2011-03-26 22:25 . 2011-03-26 22:25 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2011-03-25 20:20 . 2011-04-02 00:08 -------- d-----w- C:\Minecraft
2011-03-25 20:10 . 2011-03-25 20:09 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-03-24 02:21 . 2011-03-19 23:27 66520 ----a-w- c:\program files\Mozilla Firefox\plugins\npnul32.dll
2011-03-24 02:21 . 2011-03-19 23:27 25048 ----a-w- c:\program files\Mozilla Firefox\components\browserdirprovider.dll
2011-03-24 02:21 . 2011-03-19 23:27 140248 ----a-w- c:\program files\Mozilla Firefox\components\brwsrcmp.dll
2011-03-24 02:21 . 2011-03-19 23:27 492504 ----a-w- c:\program files\Mozilla Firefox\sqlite3.dll
2011-03-24 02:21 . 2011-03-19 23:27 1018328 ----a-w- c:\program files\Mozilla Firefox\js3250.dll
2011-03-19 03:34 . 2011-03-22 10:12 -------- d-----w- c:\documents and settings\Wut\Application Data\.minecraft
2011-03-14 12:17 . 2011-03-14 12:17 -------- d-----w- c:\program files\Common Files\Java
2011-03-14 12:17 . 2011-03-14 12:17 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee Security Scan
2011-03-14 12:17 . 2011-03-14 12:17 -------- d-----w- c:\program files\McAfee Security Scan
2011-03-12 03:53 . 2011-04-05 03:13 -------- d-----w- c:\documents and settings\Wut\Local Settings\Application Data\LogMeIn Hamachi
2011-03-12 03:53 . 2011-04-04 23:04 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\LogMeIn Hamachi
2011-03-11 00:06 . 2011-03-11 00:06 -------- d-----w- c:\documents and settings\Wut\Local Settings\Application Data\ATI
2011-03-11 00:06 . 2011-03-11 00:06 -------- d-----w- c:\documents and settings\Wut\Application Data\ATI
2011-03-11 00:06 . 2011-03-11 00:06 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI
2011-03-10 23:59 . 2011-03-10 23:59 -------- d-----w- C:\ATI
2011-03-10 23:12 . 2011-03-11 00:04 -------- d-----w- c:\program files\ATI Technologies
2011-03-10 23:12 . 2011-03-10 23:12 -------- d-----w- C:\AMD
2011-03-06 05:56 . 2011-03-17 05:16 -------- d-----w- c:\documents and settings\Wut\world
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-25 20:09 . 2010-06-17 00:01 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-03-25 20:09 . 2010-05-28 19:05 137656 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-02-09 13:53 . 2008-04-14 12:00 270848 ----a-w- c:\windows\system32\sbe.dll
2011-02-09 13:53 . 2008-04-14 12:00 186880 ----a-w- c:\windows\system32\encdec.dll
2011-02-02 07:58 . 2009-04-16 17:38 2067456 ----a-w- c:\windows\system32\mstscax.dll
2011-01-30 06:01 . 2009-11-14 05:33 219128 -c--a-w- c:\windows\system32\PnkBstrB.xtr
2011-01-30 06:01 . 2009-11-14 05:31 219128 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-01-30 05:58 . 2009-11-14 05:31 138592 -c--a-w- c:\windows\system32\drivers\PnkBstrK.sys
2011-01-27 11:57 . 2009-04-16 17:38 677888 ----a-w- c:\windows\system32\mstsc.exe
2011-01-21 14:42 . 2008-04-14 12:00 439808 ----a-w- c:\windows\system32\shimgvw.dll
2011-01-19 23:47 . 2011-02-19 22:36 22504 ----a-w- c:\windows\system32\drivers\cpuz135_x32.sys
2011-01-07 14:09 . 2008-05-27 17:29 290048 ----a-w- c:\windows\system32\atmfd.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-03-09 26100520]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2009-02-04 18085888]
"ContentTransferWMDetector.exe"="c:\program files\Sony\Content Transfer\ContentTransferWMDetector.exe" [2008-07-11 423200]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-03 281768]
"ATICustomerCare"="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-05-04 311296]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"LogMeIn Hamachi Ui"="c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe" [2011-03-28 1910152]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-03-07 421160]
.
c:\documents and settings\asdasd\Start Menu\Programs\Startup\
KETV NewsWatch 7 Instant Alert.lnk - c:\program files\KETV NewsWatch 7 Instant Alert\liveonline_3749389.exe [2010-9-1 458752]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.1.121\SSScheduler.exe [2010-9-3 255536]
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.0.1-to-3.0.2-enUS-Win-Update-downloader.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\Steam\\steamapps\\scfan7\\team fortress 2\\hl2.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.1.0.9767-to-3.1.1.9806-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\Program Files\\Steam\\steamapps\\scfan7\\half-life 2 deathmatch\\hl2.exe"=
"c:\\Program Files\\Steam\\steamapps\\scfan7\\source sdk base\\hl2.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.1.2.9901-to-3.1.3.9947-enUS-downloader.exe"=
"c:\\Program Files\\Sony\\Station\\LaunchPad\\LaunchPad.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Documents and Settings\\JDAWG\\Local Settings\\Apps\\2.0\\5J46AAC4.3TC\\KPYW8TN6.M89\\gwab..tion_978e0ac48d518eb4_0001.0026_6a5a2d1791a3e63a\\Gwabs.Deploy.exe"=
"c:\\Program Files\\Black Isle\\BGII - SoA\\BGMain.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
"c:\\Program Files\\Starcraft\\StarCraft.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.1.3.9947-to-3.2.0.10192-enUS-downloader.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\ijjigame\\PLauncher.exe"=
"c:\\WINDOWS\\Downloaded Program Files\\PurpleBean.exe"=
"c:\\ijji\\ENGLISH\\Gunz\\Gunz.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.0.10192-to-3.2.0.10314-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.0.10314-to-3.2.2.10482-enUS-downloader.exe"=
"c:\\Documents and Settings\\JDAWG\\Application Data\\RayV\\Viewer\\RayV.dll"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.2.10482-to-3.2.2.10505-enUS-downloader.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Steam\\steamapps\\scfan7\\insurgency\\hl2.exe"=
"c:\\Program Files\\Steam\\steam.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Steam\\appcache\\stats\\UserGameStats_33010020_13140.bin"=
"c:\\Program Files\\Steam\\appcache\\stats\\UserGameStats_33010020_12900.bin"=
"c:\\Program Files\\Steam\\appcache\\stats\\UserGameStats_33010020_4000.bin"=
"c:\\Program Files\\Steam\\appcache\\stats\\UserGameStats_33010020_590.bin"=
"c:\\Program Files\\Steam\\appcache\\stats\\UserGameStats_33010020_500.bin"=
"c:\\Program Files\\Steam\\appcache\\stats\\UserGameStats_33010020_440.bin"=
"c:\\Program Files\\Steam\\appcache\\stats\\UserGameStats_33010020_400.bin"=
"c:\\Program Files\\Steam\\steamapps\\common\\mass effect\\Binaries\\MassEffect.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\mass effect\\docs\\EA Help\\Electronic_Arts_Technical_Support.htm"=
"c:\\Program Files\\Steam\\steamapps\\common\\stalker shadow of chernobyl\\bin\\XR_3DA.exe"=
"c:\\Program Files\\Steam\\steamapps\\scfan7\\source sdk base 2007\\hl2.exe"=
"c:\\Program Files\\ijji\\ijji REACTOR\\REACTOR.exe"=
"c:\\WINDOWS\\Downloaded Program Files\\ijjiOptimizer.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\r.u.s.e. beta\\Ruse.exe"=
"c:\\Documents and Settings\\JDAWG\\My Documents\\Downloads\\StarCraft_2_Beta_enUS (2).exe"=
"c:\\Program Files\\StarCraft II Beta\\StarCraft II.exe"=
"c:\\Program Files\\Steam\\steamapps\\scfan7\\zombie panic! source\\hl2.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\StarCraft II Beta\\Versions\\Base15976\\SC2.exe"=
"c:\\Program Files\\StarCraft II Beta\\Versions\\Base16036\\SC2.exe"=
"c:\\Program Files\\Steam\\steamapps\\scfan7\\sourcesdk\\bin\\SDKLauncher.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\nexon\Combat Arms\CombatArms.exe"= c:\nexon\Combat Arms\CombatArms.exe:*Enabled:CombatArms.exe
"c:\\Nexon\\Combat Arms\\NMService.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\alien swarm\\srcds.exe"=
"c:\\Program Files\\StarCraft II\\StarCraft II.exe"=
"c:\\Program Files\\StarCraft II\\Versions\\Base15405\\SC2.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\call of duty 4\\iw3sp.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\call of duty 4\\iw3mp.exe"=
"c:\\Program Files\\StarCraft II\\Versions\\Base16605\\SC2.exe"=
"c:\\Program Files\\World of Warcraft\\Blizzard Downloader.exe"=
"c:\\Program Files\\StarCraft II\\Versions\\Base16755\\SC2.exe"=
"c:\\Program Files\\Steam\\steamapps\\scfan7\\synergy\\hl2.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\beat hazard demo\\BeatHazardDemo.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\plants vs zombies\\PlantsVsZombies.exe"=
"c:\\Program Files\\Steam\\steamapps\\scfan7\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\StarCraft II\\Versions\\Base16939\\SC2.exe"=
"c:\\Program Files\\Steam\\steamapps\\scfan7\\eternal-silence\\hl2.exe"=
"c:\\Program Files\\OGPlanet\\Zone4\\Zone4_NA.exe"=
"c:\\Nexon\\Combat Arms\\Engine.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\torchlight\\Torchlight.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\audiosurf\\engine\\QuestViewer.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\alien swarm\\swarm.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\alien swarm\\bin\\SDKLauncher.exe"=
"c:\\Program Files\\Steam\\steamapps\\neohart\\team fortress 2\\hl2.exe"=
"c:\\Documents and Settings\\Wut\\Application Data\\Macromedia\\Flash Player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=
"c:\\WINDOWS\\system32\\java.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\StarCraft II\\Versions\\Base18092\\SC2.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"57570:TCP"= 57570:TCP:Pando Media Booster
"57570:UDP"= 57570:UDP:Pando Media Booster
.
R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [6/19/2009 5:58 AM 721904]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [5/28/2010 2:05 PM 135336]
R2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [2/19/2011 5:36 PM 22504]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [3/28/2011 3:41 PM 1242504]
S2 CSHelper;CopySafe Helper Service;c:\windows\system32\CSHelper.exe [7/21/2010 9:59 PM 266240]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [4/16/2009 3:15 PM 1684736]
S3 EagleXNt;EagleXNt;\??\c:\windows\system32\drivers\EagleXNt.sys --> c:\windows\system32\drivers\EagleXNt.sys [?]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.1.121\McCHSvc.exe [9/3/2010 1:45 AM 227232]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 vtany;vtany;\??\c:\windows\vtany.sys --> c:\windows\vtany.sys [?]
S3 xhunter1;xhunter1;\??\c:\windows\xhunter1.sys --> c:\windows\xhunter1.sys [?]
.
Contents of the 'Scheduled Tasks' folder
.
2011-03-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 16:50]
.
.
------- Supplementary Scan -------
.
FF - ProfilePath - c:\documents and settings\Wut\Application Data\Mozilla\Firefox\Profiles\znpdqnqv.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.joystiq.com/
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-04-04 22:13
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(852)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
.
- - - - - - - > 'explorer.exe'(2224)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2011-04-04 22:14:39
ComboFix-quarantined-files.txt 2011-04-05 03:14
ComboFix2.txt 2011-04-05 00:31
.
Pre-Run: 89,212,981,248 bytes free
Post-Run: 89,195,134,976 bytes free
.
- - End Of File - - 79EBBED9F581D95B8B924AB339C3628D
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Database version: 6272
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
4/4/2011 10:18:26 PM
mbam-log-2011-04-04 (22-18-26).txt
Scan type: Quick scan
Objects scanned: 193145
Time elapsed: 1 minute(s), 50 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
Blottedisk
2011-04-05, 05:25
Hi Neohart,
Your logs look ok. How's the machine working/behaving?
Please do the following:
Step 1 | Please download CCleaner (freeware) (http://www.majorgeeks.com/download4191.html)
Run the installer.
Once installed, run CCleaner click the Windows [tab]
The following should be selected by default, if not, please select:
http://i210.photobucket.com/albums/bb164/jedi_030/CCleanerA.png
Next: click Options (in the left panel) and click the Advanced button.
Uncheck: "Only delete files in Windows Temp folders older than 24 hours."
Go back to Cleaner (in the left panel) and click the Run Cleaner button (bottom right). Then exit CCleaner.
Step 2 | Let's perform an ESET Online Scan
Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here (http://www.bleepingcomputer.com/forums/topic114351.html).
Please go here (http://www.eset.com/onlinescan/) then click on: http://i280.photobucket.com/albums/kk173/Dakeyras_album2/EOLS1.gif
Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
Select the option YES, I accept the Terms of Use then click on: http://i280.photobucket.com/albums/kk173/Dakeyras_album2/EOLS2.gif
When prompted allow the Add-On/Active X to install.
Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
Now click on Advanced Settings and select the following:
Scan for potentially unwanted applications
Scan for potentially unsafe applications
Enable Anti-Stealth Technology
Now click on: http://i280.photobucket.com/albums/kk173/Dakeyras_album2/EOLS3.gif
The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
When completed the Online Scan will begin automatically.
Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
When completed make sure you first copy the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic.
Now click on: http://i280.photobucket.com/albums/kk173/Dakeyras_album2/EOLS4.gif (Selecting Uninstall application on close if you so wish)
The computer is running alot better then it has been lately, no more redirecting from google, no more random tabs opened when online
Did both of the things you asked and the scanner found 2 results, Here is the log.
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6425
# api_version=3.0.2
# EOSSerial=237a1a26a9145f428928f17d340e7169
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2011-04-05 05:01:28
# local_time=2011-04-05 12:01:28 (-0600, Central Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=1797 16775141 100 93 771693 37564285 112462 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=184703
# found=2
# cleaned=0
# scan_time=5190
C:\Documents and Settings\asdasd\Application Data\Mozilla\Firefox\Profiles\iixp04bw.default\prefs.js Win32/Agent.RQD.Gen trojan (unable to clean) 00000000000000000000000000000000 I
C:\Program Files\GamersFirst\War Rock\System\WarRock.exe a variant of Win32/Packed.Themida application (unable to clean) 00000000000000000000000000000000 I
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6425
# api_version=3.0.2
# EOSSerial=237a1a26a9145f428928f17d340e7169
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2011-04-06 02:26:00
# local_time=2011-04-05 09:26:00 (-0600, Central Daylight Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=1797 16775125 100 93 840078 37632670 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=365222
# found=2
# cleaned=0
# scan_time=13878
C:\Documents and Settings\asdasd\Application Data\Mozilla\Firefox\Profiles\iixp04bw.default\prefs.js Win32/Agent.RQD.Gen trojan (unable to clean) 00000000000000000000000000000000 I
C:\Program Files\GamersFirst\War Rock\System\WarRock.exe a variant of Win32/Packed.Themida application (unable to clean) 00000000000000000000000000000000 I
Blottedisk
2011-04-06, 05:27
Hi Neohart,
Glad to hear that :bigthumb:
We are almost done.
Do you recognize this file/game?
C:\Program Files\GamersFirst\War Rock\System\WarRock.exe
ESET is detecting a threat in that executable.
Please go to the following site to scan a file: http://wepawet.iseclab.org
Click on Browse, and upload the following file for analysis:
C:\Documents and Settings\asdasd\Application Data\Mozilla\Firefox\Profiles\iixp04bw.default\prefs.js
Then click Submit for analysis. Allow the file to be scanned, and when finished please copy and paste the link to the results page.
Ya and i removed that game/file from my computer, here is the report from that website
Analysis report for file 7039a380f920b248f17fc2d3abae0575
Sample Overview
File prefs.js
MD5 7039a380f920b248f17fc2d3abae0575
Analysis Started 2011-04-05 21:03:32
Report Generated 2011-04-05 21:03:38
Jsand version 1.3.2
Detection results
Detector Result
Jsand 1.3.2 benign
Exploits
No exploits were identified.
Deobfuscation results
Evals
No evals.
Writes
No writes.
Network Activity
Requests
URL
file://prefs.js
ActiveX controls
No objects/controls.
Shellcode and Malware
No shellcode was identified.
No additional malware was retrieved.
I ran spybot today and noticed the click.giftload was back on the computer
Blottedisk
2011-04-08, 14:42
Hi Neohart,
If you remove that entry with Spybot, does it appear again?
Please run DDS and post a new log. Don't include attach.txt
This time no it did not, Here is the DDS,
.
DDS (Ver_11-03-05.01) - NTFSx86
Run by Wut at 13:29:39.03 on Fri 04/08/2011
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_24
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3325.2572 [GMT -5:00]
.
AV: AntiVir Desktop *Enabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
svchost.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CSHelper.exe
C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\McAfee Security Scan\2.1.121\SSScheduler.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\Wut\My Documents\Downloads\dds(2).scr
.
============== Pseudo HJT Report ===============
.
BHO: AC-Pro: {0fb6a909-6086-458f-bd92-1f8ee10042a0} - c:\program files\autocompletepro\AutocompletePro.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: DAEMON Tools Toolbar: {32099aac-c132-4136-9e9a-4e364a424e17} - c:\program files\daemon tools toolbar\DTToolbar.dll
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [ContentTransferWMDetector.exe] c:\program files\sony\content transfer\ContentTransferWMDetector.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [ATICustomerCare] "c:\program files\ati\aticustomercare\ATICustomerCare.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [LogMeIn Hamachi Ui] "c:\program files\logmein hamachi\hamachi-2-ui.exe" --auto-start
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\2.1.121\SSScheduler.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://www.systemrequirementslab.com/srl_bin/sysreqlab_srl.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\docume~1\wut\applic~1\mozilla\firefox\profiles\znpdqnqv.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.joystiq.com/
FF - plugin: c:\documents and settings\all users\application data\nexonus\ngm\npNxGameUS.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npArtistScope42.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npArtistScopeDRM11.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npijjiautoinstallpluginff.dll
FF - plugin: c:\program files\pando networks\media booster\npPandoWebPlugin.dll
FF - plugin: c:\windows\system32\npOGPPlugin.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff
.
============= SERVICES / DRIVERS ===============
.
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-5-28 11608]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-5-28 135336]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-5-28 269480]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-5-28 61960]
R2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [2011-2-19 22504]
R2 CSHelper;CopySafe Helper Service;c:\windows\system32\CSHelper.exe [2010-7-21 266240]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\logmein hamachi\hamachi-2.exe [2011-3-28 1242504]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2009-4-16 1684736]
S3 cpuz132;cpuz132;\??\c:\docume~1\jdawg\locals~1\temp\cpuz132\cpuz132_x32.sys --> c:\docume~1\jdawg\locals~1\temp\cpuz132\cpuz132_x32.sys [?]
S3 EagleXNt;EagleXNt;\??\c:\windows\system32\drivers\eaglexnt.sys --> c:\windows\system32\drivers\EagleXNt.sys [?]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\2.1.121\McCHSvc.exe [2010-9-3 227232]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 vtany;vtany;\??\c:\windows\vtany.sys --> c:\windows\vtany.sys [?]
S3 xhunter1;xhunter1;\??\c:\windows\xhunter1.sys --> c:\windows\xhunter1.sys [?]
.
=============== Created Last 30 ================
.
2011-04-05 03:29:16 -------- d-----w- c:\program files\CCleaner
2011-04-05 03:08:38 -------- d-----w- C:\ComboFix
2011-04-05 00:16:47 -------- d-sha-r- C:\cmdcons
2011-04-05 00:10:32 98816 ----a-w- c:\windows\sed.exe
2011-04-05 00:10:32 89088 ----a-w- c:\windows\MBR.exe
2011-04-05 00:10:32 256512 ----a-w- c:\windows\PEV.exe
2011-04-05 00:10:32 161792 ----a-w- c:\windows\SWREG.exe
2011-04-03 19:06:17 -------- d-----w- c:\docume~1\wut\applic~1\wargaming.net
2011-04-03 18:57:15 -------- d-----w- C:\Games
2011-04-01 00:14:52 -------- d-----w- c:\program files\iPod
2011-04-01 00:14:50 -------- d-----w- c:\program files\iTunes
2011-04-01 00:09:41 -------- d-----w- c:\program files\Bonjour
2011-03-30 18:56:32 83249512 ----a-w- c:\program files\common files\windows live\.cache\wlc18.tmp
2011-03-30 00:22:20 -------- d-----w- c:\documents and settings\wut\.thumbnails
2011-03-30 00:21:42 -------- d-----w- c:\documents and settings\wut\.gimp-2.6
2011-03-30 00:21:38 -------- d-----w- c:\documents and settings\wut\.gegl-0.0
2011-03-29 21:59:57 26176 ---ha-w- c:\windows\system32\hamachi.sys
2011-03-29 21:59:53 -------- d-----w- c:\program files\LogMeIn Hamachi
2011-03-27 07:17:55 -------- d-----w- c:\documents and settings\wut\Tracing
2011-03-25 20:20:46 -------- d-----w- C:\Minecraft
2011-03-25 20:10:03 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-03-24 02:21:22 66520 ----a-w- c:\program files\mozilla firefox\plugins\npnul32.dll
2011-03-24 02:21:22 25048 ----a-w- c:\program files\mozilla firefox\components\browserdirprovider.dll
2011-03-24 02:21:22 140248 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
2011-03-24 02:21:21 492504 ----a-w- c:\program files\mozilla firefox\sqlite3.dll
2011-03-24 02:21:21 1018328 ----a-w- c:\program files\mozilla firefox\js3250.dll
2011-03-19 03:34:18 -------- d-----w- c:\docume~1\wut\applic~1\.minecraft
2011-03-14 12:17:16 -------- d-----w- c:\docume~1\alluse~1\applic~1\McAfee Security Scan
2011-03-14 12:17:13 -------- d-----w- c:\program files\McAfee Security Scan
2011-03-12 03:53:35 -------- d-----w- c:\docume~1\wut\locals~1\applic~1\LogMeIn Hamachi
2011-03-11 00:06:42 -------- d-----w- c:\docume~1\wut\locals~1\applic~1\ATI
2011-03-10 23:59:38 -------- d-----w- C:\ATI
2011-03-10 23:12:52 -------- d-----w- c:\program files\ATI Technologies
2011-03-10 23:12:41 -------- d-----w- C:\AMD
.
==================== Find3M ====================
.
2011-03-25 20:09:54 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-03-11 00:04:35 0 ----a-w- c:\windows\ativpsrm.bin
2011-02-09 13:53:52 270848 ----a-w- c:\windows\system32\sbe.dll
2011-02-09 13:53:52 186880 ----a-w- c:\windows\system32\encdec.dll
2011-02-02 07:58:35 2067456 ----a-w- c:\windows\system32\mstscax.dll
2011-01-30 06:01:39 219128 -c--a-w- c:\windows\system32\PnkBstrB.xtr
2011-01-30 06:01:39 219128 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-01-27 11:57:06 677888 ----a-w- c:\windows\system32\mstsc.exe
2011-01-26 23:05:56 17252352 ----a-w- c:\windows\system32\atioglxx.dll
2011-01-26 23:01:00 57344 ----a-w- c:\windows\system32\aticalrt.dll
2011-01-26 23:00:54 53248 ----a-w- c:\windows\system32\aticalcl.dll
2011-01-26 22:59:36 4636672 ----a-w- c:\windows\system32\aticaldd.dll
2011-01-26 22:52:46 462848 ----a-w- c:\windows\system32\ATIDEMGX.dll
2011-01-26 22:51:42 302080 ----a-w- c:\windows\system32\ati2dvag.dll
2011-01-26 22:42:00 4029824 ----a-w- c:\windows\system32\ati3duag.dll
2011-01-26 22:41:32 311296 ----a-w- c:\windows\system32\atiiiexx.dll
2011-01-26 22:35:04 1112576 ----a-w- c:\windows\system32\ativvamv.dll
2011-01-26 22:32:12 212992 ----a-w- c:\windows\system32\atipdlxx.dll
2011-01-26 22:31:58 155648 ----a-w- c:\windows\system32\Oemdspif.dll
2011-01-26 22:31:50 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe
2011-01-26 22:31:42 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2011-01-26 22:31:28 188416 ----a-w- c:\windows\system32\ati2evxx.dll
2011-01-26 22:30:08 638976 ----a-w- c:\windows\system32\ati2evxx.exe
2011-01-26 22:28:44 53248 ----a-w- c:\windows\system32\ATIDDC.DLL
2011-01-26 22:27:50 143360 ----a-w- c:\windows\system32\atiapfxx.exe
2011-01-26 22:27:06 2673280 ----a-w- c:\windows\system32\ativvaxx.dll
2011-01-26 22:23:50 651264 ----a-w- c:\windows\system32\atikvmag.dll
2011-01-26 22:21:32 196608 ----a-w- c:\windows\system32\atiadlxx.dll
2011-01-26 22:21:30 483328 ----a-w- c:\windows\system32\atiok3x2.dll
2011-01-26 22:21:08 17408 ----a-w- c:\windows\system32\atitvo32.dll
2011-01-26 22:15:12 847872 ----a-w- c:\windows\system32\ati2cqag.dll
2011-01-26 22:12:58 64512 ----a-w- c:\windows\system32\atimpc32.dll
2011-01-26 22:12:58 64512 ----a-w- c:\windows\system32\amdpcom32.dll
2011-01-21 14:42:25 439808 ----a-w- c:\windows\system32\shimgvw.dll
.
============= FINISH: 13:29:48.40 ===============
Blottedisk
2011-04-09, 01:21
Hi Neohart,
Please go to the following site to scan some files: Virus Total (http://forums.whatthetech.com/redirect.php?url=http%3A%2F%2Fwww.virustotal.com )
Click on Browse, and upload the following files for analysis:
c:\windows\system32\npOGPPlugin.dll
c:\windows\ativpsrm.bin
c:\documents and settings\all users\application data\nexonus\ngm\npNxGameUS.dll
Then click Submit. Allow the files to be scanned, and then please copy and paste the results here for me to see.
If it says already scanned -- click "reanalyze now"
Please post the results in your next reply.
Hello, Thank you for replying here is the scans.
File name:
npOGPPlugin.dll
Submission date:
2011-04-09 21:05:15 (UTC)
Current status:
queued (#15) queued (#15) analysing finished
Result:
0/ 41 (0.0%)
c:\windows\ativpsrm.bin I could not get it to scan, does not look like there is a file?
File name:
npNxGameUS.dll
Submission date:
2011-04-09 21:11:00 (UTC)
Current status:
queued (#4) queued analysing finished
Result:
0/ 42 (0.0%)
Blottedisk
2011-04-10, 02:32
Hi Neohart,
Please do the following:
ComboFix - CFScript
WARNING !
This script is for THIS user and computer ONLY!
Using this tool incorrectly could damage your Operating System... preventing it from starting again!
You will not have Internet access when you execute ComboFix. All open windows will need to be closed!
Please open Notepad and copy/paste all the text below... into the window:
File::
C:\Documents and Settings\asdasd\Application Data\Mozilla\Firefox\Profiles\iixp04bw.default\prefs.js
Folder::
C:\Program Files\GamersFirst
Save it to your desktop as CFScript.txt
Please disable any Antivirus or Firewall you have active, as shown in this topic (http://www.bleepingcomputer.com/forums/topic114351.html). Please close all open application windows.
Drag the CFScript.txt (icon) into the ComboFix.exe icon... as seen in the image below:
http://i526.photobucket.com/albums/cc345/MPKwings/ComboFixScriptDrag.gif
This will cause ComboFix to run again.
Do Not use your keyboard or mouse click anywhere in the ComboFix window, as this may cause the program to stall or crash.
Do Not touch your computer when ComboFix is running!
When finished... Notepad will open ... ComboFix will produce a log file called "log.txt".
Please copy/paste the contents of log.txt... in your next reply.
** Enable your Antivirus and Firewall, before connecting to the Internet again! **
Blottedisk
2011-04-15, 22:43
Hi Neohart,
Are you still there?
Blottedisk
2011-05-10, 14:20
Due to the lack of feedback, this Topic is closed. If you need this topic reopened for continuations of existing problems, please request this by sending me a PM with the address of the thread. This applies only to the original topic starter. Everyone else please read the guidelines to request assistance (http://forums.spybot.info/showthread.php?t=288) and begin a New Topic.