Results 1 to 10 of 44

Thread: malware took other my computer

Hybrid View

Previous Post Previous Post   Next Post Next Post
  1. #1
    Guest
    Join Date
    May 2011
    Posts
    57

    Default malware took other my computer

    svchost.exe takes 100%
    random advertising windows open
    I am being redirected to crazy websites
    and the computer is slow and the processor is working 100%
    and I have a message Generic Hort Process for Win32 Services has encountered a problem and needs to close. we are sorry for the inconvenience.
    I applied tdsskiller.exe (in run as mode, so no log) and he find nothing.
    spybot finds click.giftload but can't erase it.
    malwarebyte finds nothing.
    I have a dds log and a defogger log.
    I already disable tea-timer. the computer is not stable since 2 days ago. I can't use him safely. I have to restart him every 15 mn because he starts flickering (the desktop), to much process going on!!!
    please help me
    the dds log
    .
    DDS (Ver_11-03-05.01) - NTFSx86
    Run by NICOU at 22:21:45,48 on 2011-04-29
    Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_22
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2046.1482 [GMT -3:00]
    .
    AV: McAfee VirusScan Enterprise *Enabled/Updated* {918A2B0B-2C60-4016-A4AB-E868DEABF7F0}
    .
    ============== Running Processes ===============
    .
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\McAfee\Common Framework\UdaterUI.exe
    C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
    C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\McAfee\Common Framework\McTray.exe
    svchost.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\M-Audio MA_CMIDI\MA_CMIDI_Inst.exe
    C:\Program Files\McAfee\Common Framework\FrameworkService.exe
    C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
    C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
    C:\WINDOWS\system32\HPZipm12.exe
    F:\Programmes\Alcohol 52\StarWind\StarWindServiceAE.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\WINDOWS\system32\wuauclt.exe
    C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\NICOU\Desktop\dds.scr
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.bigseekpro.com/anyvideo2dvd/{72451267-22A7-4C23-9DCE-A7E772A37893}
    mStart Page = hxxp://www.bigseekpro.com/anyvideo2dvd/{72451267-22A7-4C23-9DCE-A7E772A37893}
    uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_CA&c=Q106&bd=pavilion&pf=laptop
    uInternet Settings,ProxyOverride = *.local
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
    BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan enterprise\scriptcl.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    BHO: SMTTB2009 Class: {fcbccb87-9224-4b8d-b117-f56d924beb18} - c:\program files\any video to dvd db toolbar\tbcore3.dll
    TB: {C4069E3A-68F1-403E-B40E-20066696354B} - No File
    TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
    mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
    mRun: [ShStatEXE] "c:\program files\mcafee\virusscan enterprise\SHSTAT.EXE" /STANDALONE
    mRun: [McAfeeUpdaterUI] "c:\program files\mcafee\common framework\UdaterUI.exe" /StartedFromRunKey
    mRun: [hpWirelessAssistant] c:\program files\hpq\hp wireless assistant\HP Wireless Assistant.exe
    mRun: [eabconfg.cpl] c:\program files\hpq\quick launch buttons\EabServr.exe /Start
    mRun: [ATIPTA] "c:\program files\ati technologies\ati control panel\atiptaxx.exe"
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
    dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
    Notify: AtiExtEvent - Ati2evxx.dll
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - c:\docume~1\nicou\applic~1\mozilla\firefox\profiles\mtc5e0vx.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/
    FF - prefs.js: keyword.URL - hxxp://www.bigseekpro.com/search/toolbar/anyvideo2dvd/{5BC4B17D-66A1-4F00-BE33-AF17ECDA68F1}?q=
    FF - plugin: c:\documents and settings\nicou\application data\mozilla\firefox\profiles\mtc5e0vx.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
    .
    ============= SERVICES / DRIVERS ===============
    .
    R1 mferkdk;VSCore mferkdk;c:\program files\mcafee\virusscan enterprise\mferkdk.sys [2008-1-24 31816]
    R2 McAfeeFramework;McAfee Framework Service;c:\program files\mcafee\common framework\FrameworkService.exe [2011-4-2 103744]
    R2 McShield;McAfee McShield;c:\program files\mcafee\virusscan enterprise\Mcshield.exe [2008-1-24 144704]
    R2 McTaskManager;McAfee Task Manager;c:\program files\mcafee\virusscan enterprise\VsTskMgr.exe [2008-1-24 54608]
    R2 StarWindServiceAE;StarWind AE Service;f:\programmes\alcohol 52\starwind\StarWindServiceAE.exe [2009-12-23 370688]
    R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [2005-8-22 231424]
    R3 mfeavfk;McAfee Inc.;c:\windows\system32\drivers\mfeavfk.sys [2011-4-2 72936]
    R3 mfebopk;McAfee Inc.;c:\windows\system32\drivers\mfebopk.sys [2011-4-2 33960]
    R3 mfehidk;McAfee Inc.;c:\windows\system32\drivers\mfehidk.sys [2011-4-2 171400]
    S2 Cubase32;Cubase32;c:\windows\system32\drivers\Cubase32.sys [2011-4-11 11808]
    S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2011-4-5 13192]
    S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2011-4-5 8456]
    S3 RDID1044;Roland SP-606;c:\windows\system32\drivers\rdwm1044.sys [2011-4-11 161422]
    .
    =============== Created Last 30 ================
    .
    2011-04-29 23:45:13 -------- d-sha-r- C:\cmdcons
    2011-04-29 23:41:53 98816 ----a-w- c:\windows\sed.exe
    2011-04-29 23:41:53 89088 ----a-w- c:\windows\MBR.exe
    2011-04-29 23:41:53 256512 ----a-w- c:\windows\PEV.exe
    2011-04-29 23:41:53 161792 ----a-w- c:\windows\SWREG.exe
    2011-04-29 20:28:09 0 ----a-w- c:\documents and settings\nicou\ntuser.tmp
    2011-04-29 01:26:11 -------- d-----w- c:\program files\Spybot - Search & Destroy
    2011-04-29 01:26:11 -------- d-----w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
    2011-04-28 20:20:08 -------- d-----w- c:\program files\CCleaner
    2011-04-28 03:21:56 0 ----a-w- c:\windows\Xgihetiy.bin
    2011-04-28 03:20:39 157184 --sha-r- c:\windows\system32\MsPMSPU.dll
    2011-04-28 03:20:39 157184 --sha-r- c:\windows\system32\dispexv.dll
    2011-04-28 03:20:39 157184 --sha-r- c:\windows\system32\confmspl.dll
    2011-04-21 06:22:57 -------- d-----w- c:\docume~1\nicou\applic~1\Toolbar4
    2011-04-21 06:22:53 -------- d-----w- c:\docume~1\nicou\locals~1\applic~1\Somoto
    2011-04-21 06:22:48 -------- d-----w- c:\program files\Any Video To DVD DB Toolbar
    2011-04-12 17:32:59 -------- d-sh--w- c:\documents and settings\nicou\IECompatCache
    2011-04-12 04:49:18 -------- d-----w- c:\docume~1\nicou\applic~1\OpenOffice.org
    2011-04-12 04:43:50 -------- d-----w- c:\program files\OpenOffice.org 3
    2011-04-11 18:51:08 38401 ----a-r- c:\windows\system32\RdCi1044.dll
    2011-04-11 18:51:07 81920 ----a-r- c:\windows\system32\rdas1044.dll
    2011-04-11 18:51:07 161422 ----a-r- c:\windows\system32\drivers\rdwm1044.sys
    2011-04-11 18:51:06 57344 ----a-r- c:\windows\system32\RDCP1044.CPL
    2011-04-11 18:51:06 229376 ----a-r- c:\windows\system32\RDDP1044.DAT
    2011-04-11 18:51:05 51644 ----a-r- c:\windows\system32\rddv1044.dll
    2011-04-11 18:09:54 60032 ----a-w- c:\windows\system32\drivers\USBAUDIO.sys
    2011-04-11 18:09:54 60032 ----a-w- c:\windows\system32\dllcache\usbaudio.sys
    2011-04-11 18:08:30 85504 ----a-w- c:\windows\system32\ma_cmidn.dll
    2011-04-11 18:08:29 7282 ----a-w- c:\windows\system32\MA_CMIDI.VXD
    2011-04-11 18:08:29 21888 ----a-w- c:\windows\system32\drivers\ma_cmidi.sys
    2011-04-11 18:08:29 17920 ----a-w- c:\windows\system32\MA_CMIDI.DLL
    2011-04-11 18:08:29 14176 ----a-w- c:\windows\system32\MA_CMIDI.DRV
    2011-04-11 18:08:10 -------- d-----w- c:\program files\M-Audio MA_CMIDI
    2011-04-11 09:00:56 -------- d-----w- c:\program files\D16 Group
    2011-04-11 08:51:41 -------- d-----w- c:\program files\Solid State Logic
    2011-04-11 08:16:48 765952 ----a-w- c:\windows\system32\msvcp71d.dll
    2011-04-11 08:16:48 544768 ----a-w- c:\windows\system32\msvcr71d.dll
    2011-04-11 08:16:44 -------- d-----w- c:\program files\Nomad Factory
    2011-04-11 07:42:37 129024 ----a-w- c:\windows\UNWISE.EXE
    2011-04-11 07:35:09 24576 ----a-w- c:\windows\system32\wavlbsys.dll
    2011-04-11 07:35:09 11808 ----a-w- c:\windows\system32\drivers\Cubase32.sys
    2011-04-11 05:23:45 -------- d-----w- c:\docume~1\nicou\applic~1\Blue Cat Audio
    2011-04-11 04:08:03 -------- d-----w- c:\docume~1\nicou\applic~1\Daichi
    2011-04-11 00:29:07 -------- d-----w- c:\program files\FXpansion
    2011-04-11 00:29:07 -------- d-----w- c:\docume~1\nicou\applic~1\FXpansion
    2011-04-10 21:36:12 2240 ----a-w- c:\windows\LENDIG.sys
    2011-04-10 20:45:07 -------- d-----w- c:\docume~1\nicou\locals~1\applic~1\Identities
    2011-04-10 08:19:44 -------- d-sh--w- c:\documents and settings\nicou\PrivacIE
    2011-04-10 07:32:20 691551 ----a-w- c:\program files\uninstall information\{abaf1232-6213-4062-9d52-04e04a730cea}\unins000.exe
    2011-04-10 07:28:47 691551 ----a-w- c:\program files\uninstall information\{842c6afc-7856-4fd9-99af-8900554acaa2}\unins000.exe
    2011-04-10 06:50:29 -------- d-----w- c:\docume~1\nicou\applic~1\Smartelectronix
    2011-04-10 04:02:20 -------- d-----w- c:\program files\GForce
    2011-04-10 00:55:01 1025 ----a-w- c:\windows\system32\sysprs7.dll
    2011-04-10 00:55:01 1025 ----a-w- c:\windows\system32\clauth2.dll
    2011-04-10 00:55:01 1025 ----a-w- c:\windows\system32\clauth1.dll
    2011-04-10 00:54:55 -------- d-----w- c:\docume~1\nicou\locals~1\applic~1\Native Instruments
    2011-04-10 00:43:49 -------- d-----w- c:\docume~1\alluse~1\applic~1\IK Multimedia
    2011-04-08 05:51:33 319487 ----a-w- c:\windows\LOOP.exe
    2011-04-08 05:37:13 -------- d-----w- c:\program files\common files\KORG
    2011-04-08 05:28:06 233472 ----a-w- c:\windows\system32\REX Shared Library.dll
    2011-04-08 05:28:06 -------- d-----w- c:\program files\common files\iZotope
    2011-04-08 04:22:27 393216 ----a-w- c:\windows\system32\NI_IRC_1_2.dll
    2011-04-08 04:22:12 61440 ----a-w- c:\windows\system32\NI_DFD_1_5.dll
    2011-04-08 04:22:12 1870336 ----a-w- c:\windows\system32\bconvert.dll
    2011-04-08 04:22:11 -------- d-----w- c:\program files\Native Instruments
    2011-04-08 04:22:11 -------- d-----w- c:\program files\common files\Native Instruments
    2011-04-08 04:06:08 86016 ----a-w- c:\windows\unvise32.exe
    2011-04-08 03:20:08 151552 ----a-w- c:\windows\system32\FDlg.dll
    2011-04-08 01:41:58 665424 ----a-w- c:\windows\system32\wmv8dmoe.dll
    2011-04-08 01:41:58 566272 ----a-w- c:\windows\system32\wmvdmoe.dll
    2011-04-08 01:41:58 438608 ----a-w- c:\windows\system32\wmv8dmod.dll
    2011-04-08 01:41:58 285184 ----a-w- c:\windows\system32\wmidx2.ocx
    2011-04-08 01:41:58 1683792 ----a-w- c:\windows\system32\wmvcore2.dll
    2011-04-08 01:34:10 1294336 ----a-w- c:\windows\system32\vorbis.acm
    2011-04-07 00:07:58 -------- d-----w- C:\QUARANTINE
    2011-04-06 22:39:52 -------- d-----w- c:\docume~1\nicou\locals~1\applic~1\Microsoft Help
    2011-04-06 22:07:29 436792 ----a-w- c:\windows\system32\drivers\sptd.sys
    2011-04-06 21:46:46 -------- d-----w- c:\docume~1\nicou\applic~1\NetMedia Providers
    2011-04-06 21:46:43 -------- d-----w- c:\docume~1\nicou\locals~1\applic~1\Sony
    2011-04-06 21:36:12 33340 ------w- c:\windows\system32\dbmsqlgc.dll
    2011-04-06 21:36:12 24576 ------w- c:\windows\system32\dbmsgnet.dll
    2011-04-06 21:35:32 -------- d-----w- c:\program files\Microsoft SQL Server
    2011-04-06 21:12:06 -------- d-----w- c:\docume~1\nicou\locals~1\applic~1\Installer2184
    2011-04-06 20:57:05 -------- d-----w- c:\docume~1\nicou\locals~1\applic~1\Installer376
    2011-04-06 20:54:31 -------- d-----w- c:\program files\VideoLAN
    2011-04-06 20:35:11 -------- d-----w- c:\program files\common files\Control Panels
    2011-04-06 20:31:13 -------- d-----w- c:\docume~1\alluse~1\applic~1\ALM
    2011-04-06 20:30:38 2463976 ----a-w- c:\windows\system32\NPSWF32.dll
    2011-04-06 20:30:38 190696 ----a-w- c:\windows\system32\NPSWF32_FlashUtil.exe
    2011-04-06 20:18:24 -------- d-----w- c:\program files\Bonjour
    2011-04-06 20:07:52 -------- d-----w- c:\program files\common files\Macrovision Shared
    2011-04-06 19:49:57 23376 ----a-w- c:\windows\system32\dopdfmn7.dll
    2011-04-06 19:49:57 20304 ----a-w- c:\windows\system32\dopdfmi7.dll
    2011-04-06 19:22:25 -------- d-----w- c:\docume~1\nicou\applic~1\Serif
    2011-04-06 18:41:46 -------- d-----w- c:\docume~1\nicou\applic~1\Softland
    2011-04-06 18:34:59 119568 ----a-w- c:\windows\system32\VB6FR.DLL
    2011-04-06 18:34:58 -------- d-----w- c:\docume~1\nicou\applic~1\FreeVideoConverter
    2011-04-05 06:19:02 86408 ----a-w- c:\windows\system32\setupempdrv03.exe
    2011-04-05 06:19:02 8456 ----a-w- c:\windows\system32\EuGdiDrv.sys
    2011-04-05 06:19:02 2340992 ----a-w- c:\windows\system32\BootMan.exe
    2011-04-05 06:19:02 18048 ----a-w- c:\windows\system32\EuEpmGdi.dll
    2011-04-05 06:19:01 13192 ----a-w- c:\windows\system32\epmntdrv.sys
    2011-04-05 06:10:35 -------- d-----w- c:\program files\EASEUS
    2011-04-05 03:59:14 -------- d-----w- c:\docume~1\nicou\applic~1\QuickScan
    2011-04-04 23:03:44 -------- d-----w- c:\windows\system32\LogFiles
    2011-04-04 23:03:42 -------- d-----w- c:\docume~1\nicou\applic~1\Malwarebytes
    2011-04-04 23:03:22 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-04-04 23:03:22 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
    2011-04-04 23:03:19 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-04-04 23:03:19 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-04-04 21:13:56 -------- d-----w- C:\bin
    2011-04-04 21:00:50 -------- d-----w- c:\program files\common files\Hewlett-Packard
    2011-04-04 20:59:43 94208 ----a-w- c:\windows\system32\HPZipt12.dll
    2011-04-04 20:59:43 57344 ----a-w- c:\windows\system32\HPZisn12.dll
    2011-04-04 20:59:43 204800 ----a-w- c:\windows\system32\HPZipr12.dll
    2011-04-04 20:59:42 69632 ----a-w- c:\windows\system32\HPZipm12.exe
    2011-04-04 20:59:42 65536 ----a-w- c:\windows\system32\HPZinw12.exe
    2011-04-04 20:59:42 278584 ----a-w- c:\windows\system32\HPZidr12.dll
    2011-04-04 20:56:23 16496 ----a-r- c:\windows\system32\drivers\HPZipr12.sys
    2011-04-04 20:56:18 49664 ----a-r- c:\windows\system32\drivers\HPZid412.sys
    2011-04-04 20:55:47 77824 ----a-r- c:\windows\system32\HPZIDS01.dll
    2011-04-04 20:55:42 74240 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\hpzpp054.dll
    2011-04-04 20:55:40 38400 ----a-w- c:\windows\system32\hpz3l054.dll
    2011-04-04 20:53:12 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
    2011-04-04 20:53:12 25856 ----a-w- c:\windows\system32\dllcache\usbprint.sys
    2011-04-04 20:52:53 827392 ----a-r- c:\windows\system32\hpotiop2.dll
    2011-04-04 20:52:53 254026 ----a-r- c:\windows\system32\hpovst09.dll
    2011-04-04 20:52:52 659456 ----a-r- c:\windows\system32\hpowiax2.dll
    2011-04-04 20:52:49 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
    2011-04-04 20:52:49 15104 ----a-w- c:\windows\system32\dllcache\usbscan.sys
    2011-04-04 20:50:17 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
    2011-04-04 20:50:17 32128 ----a-w- c:\windows\system32\dllcache\usbccgp.sys
    2011-04-04 06:01:53 -------- d-----w- c:\windows\pss
    2011-04-04 05:41:20 -------- d-----w- c:\docume~1\nicou\locals~1\applic~1\Temp
    2011-04-03 21:26:45 -------- d-sh--w- c:\documents and settings\nicou\IETldCache
    2011-04-03 20:06:39 7680 ------w- c:\windows\system32\dllcache\iecompat.dll
    2011-04-03 20:06:22 -------- d-----w- c:\windows\ie8updates
    2011-04-03 20:05:45 12800 ------w- c:\windows\system32\dllcache\xpshims.dll
    2011-04-03 20:05:44 743424 ------w- c:\windows\system32\dllcache\iedvtool.dll
    2011-04-03 20:05:44 602112 ------w- c:\windows\system32\dllcache\msfeeds.dll
    2011-04-03 20:05:44 55296 ------w- c:\windows\system32\dllcache\msfeedsbs.dll
    2011-04-03 20:05:44 247808 ------w- c:\windows\system32\dllcache\ieproxy.dll
    2011-04-03 20:05:44 1991680 ------w- c:\windows\system32\dllcache\iertutil.dll
    2011-04-03 20:05:44 11080704 ------w- c:\windows\system32\dllcache\ieframe.dll
    2011-04-03 20:04:24 -------- dc-h--w- c:\windows\ie8
    2011-04-03 04:36:19 -------- d-----w- c:\docume~1\nicou\applic~1\VSRevoGroup
    2011-04-03 03:23:05 -------- d-----w- c:\program files\VS Revo Group
    2011-04-03 03:07:51 -------- d-----w- c:\windows\system32\scripting
    2011-04-03 03:07:51 -------- d-----w- c:\windows\l2schemas
    2011-04-03 03:07:50 -------- d-----w- c:\windows\system32\en
    2011-04-03 03:07:50 -------- d-----w- c:\windows\system32\bits
    2011-04-03 03:04:04 -------- d-----w- c:\windows\network diagnostic
    2011-04-03 03:01:00 -------- d-----w- c:\windows\EHome
    2011-04-03 02:41:55 -------- d-----w- c:\windows\ServicePackFiles
    2011-04-03 02:40:48 -------- d-----w- c:\program files\MSXML 4.0
    2011-04-03 02:37:57 685056 ------w- c:\windows\system32\drivers\hsfcxts2.sys
    2011-04-03 02:29:27 272128 ------w- c:\windows\system32\dllcache\bthport.sys
    2011-04-03 02:29:26 272128 ------w- c:\windows\system32\drivers\bthport.sys
    2011-04-03 02:29:15 357248 ------w- c:\windows\system32\dllcache\srv.sys
    2011-04-03 02:29:00 455680 ------w- c:\windows\system32\dllcache\mrxsmb.sys
    2011-04-03 02:28:56 471552 ------w- c:\windows\system32\dllcache\aclayers.dll
    2011-04-03 02:28:49 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe
    2011-04-03 02:27:31 81920 ------w- c:\windows\system32\dllcache\fontsub.dll
    2011-04-03 02:27:30 119808 ------w- c:\windows\system32\dllcache\t2embed.dll
    2011-04-03 02:27:24 3558912 ------w- c:\windows\system32\dllcache\moviemk.exe
    2011-04-03 02:27:16 153088 ------w- c:\windows\system32\dllcache\triedit.dll
    2011-04-03 02:25:41 331776 ------w- c:\windows\system32\dllcache\msadce.dll
    2011-04-03 02:25:39 1172480 ------w- c:\windows\system32\dllcache\msxml3.dll
    2011-04-03 02:24:41 2066432 ------w- c:\windows\system32\dllcache\mstscax.dll
    2011-04-03 02:24:16 337408 ------w- c:\windows\system32\dllcache\netapi32.dll
    2011-04-03 02:23:25 5120 ----a-w- c:\windows\system32\xpsp4res.dll
    2011-04-03 02:23:24 218112 ------w- c:\windows\system32\dllcache\wordpad.exe
    2011-04-03 02:22:36 -------- d-----w- c:\windows\system32\PreInstall
    2011-04-03 02:11:39 -------- d-----w- c:\windows\system32\SoftwareDistribution
    2011-04-03 00:00:59 72936 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
    2011-04-03 00:00:59 64232 ----a-w- c:\windows\system32\drivers\mfeapfk.sys
    2011-04-03 00:00:59 52104 ----a-w- c:\windows\system32\drivers\mfetdik.sys
    2011-04-03 00:00:59 33960 ----a-w- c:\windows\system32\drivers\mfebopk.sys
    2011-04-03 00:00:59 171400 ----a-w- c:\windows\system32\drivers\mfehidk.sys
    2011-04-03 00:00:42 -------- d-----w- c:\program files\McAfee
    2011-04-03 00:00:42 -------- d-----w- c:\program files\common files\McAfee
    2011-04-02 23:51:42 73728 ----a-w- c:\windows\system32\javacpl.cpl
    2011-04-02 23:51:41 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2011-04-02 21:08:39 -------- d-----w- c:\docume~1\nicou\locals~1\applic~1\Adobe
    2011-04-02 09:24:56 -------- d-----w- c:\docume~1\nicou\locals~1\applic~1\PCHealth
    2011-04-02 08:21:23 954368 ------w- c:\windows\system32\dllcache\mfc40.dll
    2011-04-02 08:21:22 974848 ------w- c:\windows\system32\dllcache\mfc42.dll
    2011-04-02 08:21:22 953856 ------w- c:\windows\system32\dllcache\mfc40u.dll
    2011-04-02 08:21:03 617472 ------w- c:\windows\system32\dllcache\comctl32.dll
    2011-04-02 08:20:25 40960 ------w- c:\windows\system32\dllcache\ndproxy.sys
    2011-04-02 08:17:55 726528 ----a-w- c:\windows\system32\dllcache\jscript.dll
    2011-04-02 08:17:53 45568 ------w- c:\windows\system32\dllcache\wab.exe
    2011-04-02 06:01:01 -------- d-----w- c:\docume~1\nicou\locals~1\applic~1\Mozilla
    2011-04-02 05:57:05 -------- d-sh--w- c:\documents and settings\nicou\UserData
    2011-04-02 05:03:25 47104 ----a-w- c:\windows\system32\WACntlPnl.cpl
    2011-04-02 05:01:59 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys
    2011-04-02 05:01:59 12160 ----a-w- c:\windows\system32\dllcache\mouhid.sys
    2011-04-02 05:01:53 10368 ----a-w- c:\windows\system32\drivers\hidusb.sys
    2011-04-02 03:49:14 1495552 ----a-w- c:\windows\system32\epoPGPsdk.dll
    2011-04-02 03:49:14 -------- d-----w- c:\program files\common files\Cisco Systems
    2011-04-02 03:42:19 26368 ----a-w- c:\windows\system32\dllcache\usbstor.sys
    .
    ==================== Find3M ====================
    .
    2011-04-28 21:20:24 372736 ----a-w- c:\windows\eqoyafisequpal.dl
    2011-02-09 13:53:52 270848 ----a-w- c:\windows\system32\sbe.dll
    2011-02-09 13:53:52 186880 ----a-w- c:\windows\system32\encdec.dll
    2011-02-02 07:58:35 2067456 ----a-w- c:\windows\system32\mstscax.dll
    .
    =================== ROOTKIT ====================
    .
    Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
    Windows 5.1.2600 Disk: ST9120824A rev.3.05 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
    .
    device: opened successfully
    user: MBR read successfully
    .
    Disk trace:
    called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x89D7B730]<<
    _asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x89d81a10]; MOV EAX, [0x89d81a8c]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
    1 ntkrnlpa!IofCallDriver[0x804EE130] -> \Device\Harddisk0\DR0[0x89DD6AB8]
    3 CLASSPNP[0xF74E7FD7] -> ntkrnlpa!IofCallDriver[0x804EE130] -> \Device\00000075[0x89E059E8]
    5 ACPI[0xF735E620] -> ntkrnlpa!IofCallDriver[0x804EE130] -> [0x89DC3940]
    \Driver\atapi[0x89E11AE8] -> IRP_MJ_CREATE -> 0x89D7B730
    error: Read A device attached to the system is not functioning.
    kernel: MBR read successfully
    _asm { XOR DI, DI; MOV SI, 0x200; MOV SS, DI; MOV SP, 0x7a00; MOV BX, 0x7a0; MOV CX, SI; MOV DS, BX; MOV ES, BX; REP MOVSB ; JMP FAR 0x7a0:0x7a; }
    detected disk devices:
    detected hooks:
    \Driver\atapi DriverStartIo -> 0x89D7B57B
    user & kernel MBR OK
    Warning: possible TDL3 rootkit infection !
    .
    ============= FINISH: 22:23:58,34 ===============

    spybot log

    Click.GiftLoad: [SBI $89783858] User settings (Registry value, nothing done)
    HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\featurecontrol\FEATURE_BROWSER_EMULATION\svchost.exe


    --- Spybot - Search & Destroy version: 1.6.2 (build: 20090126) ---

    2009-01-26 blindman.exe (1.0.0.8)
    2009-01-26 SDFiles.exe (1.6.1.7)
    2009-01-26 SDMain.exe (1.0.0.6)
    2009-01-26 SDShred.exe (1.0.2.5)
    2009-01-26 SDUpdate.exe (1.6.0.12)
    2009-01-26 SpybotSD.exe (1.6.2.46)
    2009-03-05 TeaTimer.exe (1.6.6.32)
    2011-04-28 unins000.exe (51.49.0.0)
    2009-01-26 Update.exe (1.6.0.7)
    2009-11-04 advcheck.dll (1.6.5.20)
    2007-04-02 aports.dll (2.1.0.0)
    2008-06-14 DelZip179.dll (1.79.11.1)
    2009-01-26 SDHelper.dll (1.6.2.14)
    2008-06-19 sqlite3.dll
    2009-01-26 Tools.dll (2.1.6.10)
    2009-01-16 UninsSrv.dll (1.0.0.0)
    2011-03-18 Includes\Adware.sbi (*)
    2011-03-22 Includes\AdwareC.sbi (*)
    2010-08-13 Includes\Cookies.sbi (*)
    2010-12-14 Includes\Dialer.sbi (*)
    2011-03-08 Includes\DialerC.sbi (*)
    2011-02-24 Includes\HeavyDuty.sbi (*)
    2011-03-29 Includes\Hijackers.sbi (*)
    2011-03-29 Includes\HijackersC.sbi (*)
    2010-09-15 Includes\iPhone.sbi (*)
    2010-12-14 Includes\Keyloggers.sbi (*)
    2011-03-08 Includes\KeyloggersC.sbi (*)
    2004-11-29 Includes\LSP.sbi (*)
    2011-04-05 Includes\Malware.sbi (*)
    2011-04-26 Includes\MalwareC.sbi (*)
    2011-02-24 Includes\PUPS.sbi (*)
    2011-03-15 Includes\PUPSC.sbi (*)
    2010-01-25 Includes\Revision.sbi (*)
    2009-01-13 Includes\Security.sbi (*)
    2011-03-08 Includes\SecurityC.sbi (*)
    2008-06-03 Includes\Spybots.sbi (*)
    2008-06-03 Includes\SpybotsC.sbi (*)
    2011-02-24 Includes\Spyware.sbi (*)
    2011-03-15 Includes\SpywareC.sbi (*)
    2010-03-08 Includes\Tracks.uti
    2010-12-28 Includes\Trojans.sbi (*)
    2011-04-26 Includes\TrojansC-02.sbi (*)
    2011-04-26 Includes\TrojansC-03.sbi (*)
    2011-04-18 Includes\TrojansC-04.sbi (*)
    2011-04-26 Includes\TrojansC-05.sbi (*)
    2011-03-08 Includes\TrojansC.sbi (*)
    2008-03-04 Plugins\Chai.dll
    2008-03-05 Plugins\Fennel.dll
    2008-02-26 Plugins\Mate.dll
    2007-12-24 Plugins\TCPIPAddress.dll

  2. #2
    Security Expert ken545's Avatar
    Join Date
    Nov 2005
    Location
    Florida's SpaceCoast
    Posts
    15,208

    Default




    Please read Before You Post
    While best efforts are made to assist in removing infections safely, unexpected stuff can happen. It is advisable that you back up your important data before starting any clean up procedure. Neither Safer Networking Forums nor the Analyst providing the advice may be held responsible for any loss.

    Until we deem your system clean I am going to ask you not to install or uninstall any software or hardware except for the programs we may run.


    Your infected with a nasty Rootkit


    Download aswMBR.exe ( 511KB ) to your desktop.

    Double click the aswMBR.exe to run it

    Click the "Scan" button to start scan


    On completion of the scan click save log, save it to your desktop and post in your next reply
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012-2013-2014

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.

  3. #3
    Guest
    Join Date
    May 2011
    Posts
    57

    Default

    Thank You Ken545, here is the log

    aswMBR version 0.9.5.256 Copyright(c) 2011 AVAST Software
    Run date: 2011-05-06 16:16:55
    -----------------------------
    16:16:55.453 OS Version: Windows 5.1.2600 Service Pack 3
    16:16:55.453 Number of processors: 1 586 0x2402
    16:16:55.453 ComputerName: MOHICAN UserName: NICOU
    16:16:56.125 Initialize success
    16:16:57.593 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
    16:16:57.609 Disk 0 Vendor: ST9120824A 3.05 Size: 114473MB BusType: 3
    16:16:57.609 Device \Driver\atapi -> DriverStartIo 89d7b57b
    16:16:59.609 Disk 0 MBR read successfully
    16:16:59.609 Disk 0 MBR scan
    16:16:59.609 Disk 0 TDL4@MBR code has been found
    16:16:59.609 Disk 0 MBR hidden
    16:16:59.609 Disk 0 MBR [TDL4] **ROOTKIT**
    16:16:59.625 Disk 0 trace - called modules:
    16:16:59.625 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x89d7b730]<<
    16:16:59.625 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x89dd6ab8]
    16:16:59.625 3 CLASSPNP.SYS[f74e7fd7] -> nt!IofCallDriver -> \Device\00000075[0x89de25d0]
    16:16:59.640 5 ACPI.sys[f735e620] -> nt!IofCallDriver -> [0x89dc3940]
    16:16:59.640 \Driver\atapi[0x89e11ae8] -> IRP_MJ_CREATE -> 0x89d7b730
    16:16:59.640 Scan finished successfully
    16:17:07.953 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\NICOU\Desktop\MBR.dat"
    16:17:07.968 The log file has been saved successfully to "C:\Documents and Settings\NICOU\Desktop\aswMBR.txt"




    do you think you can solve the problem?

  4. #4
    Security Expert ken545's Avatar
    Join Date
    Nov 2005
    Location
    Florida's SpaceCoast
    Posts
    15,208

    Default

    Hi,

    You most likely have more malware present but let remove the Rootkit first

    Re-Run aswMBR

    Click Scan

    On completion of the scan

    Click the Fix for TDL4




    Save the log as before and post in your next reply


    After your computer boots back up , run DDS again and post a new log also
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012-2013-2014

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.

  5. #5
    Guest
    Join Date
    May 2011
    Posts
    57

    Default

    So I ran the program as you said and at the fix step the computer got stuck for a while. so restarted and scanned again this time nothing showed up, I guess the fix worked
    her ethe log of the program after the restart

    aswMBR version 0.9.5.256 Copyright(c) 2011 AVAST Software
    Run date: 2011-05-06 23:30:25
    -----------------------------
    23:30:25.921 OS Version: Windows 5.1.2600 Service Pack 3
    23:30:25.921 Number of processors: 1 586 0x2402
    23:30:25.921 ComputerName: MOHICAN UserName: NICOU
    23:30:26.812 Initialize success
    23:30:29.281 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
    23:30:29.500 Disk 0 Vendor: ST9120824A 3.05 Size: 114473MB BusType: 3
    23:30:31.500 Disk 0 MBR read successfully
    23:30:31.500 Disk 0 MBR scan
    23:30:31.500 Disk 0 unknown MBR code
    23:30:33.500 Disk 0 scanning sectors +234436545
    23:30:33.531 Disk 0 scanning C:\WINDOWS\system32\drivers
    23:30:40.109 Service scanning
    23:30:41.406 Disk 0 trace - called modules:
    23:30:41.421 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
    23:30:41.421 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x89db9ab8]
    23:30:41.437 3 CLASSPNP.SYS[f74e7fd7] -> nt!IofCallDriver -> \Device\00000075[0x89e673b8]
    23:30:41.437 5 ACPI.sys[f735e620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x89e66940]
    23:30:41.437 Scan finished successfully
    23:31:24.500 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\NICOU\Desktop\MBR.dat"
    23:31:24.515 The log file has been saved successfully to "C:\Documents and Settings\NICOU\Desktop\aswMBR2.txt"

  6. #6
    Security Expert ken545's Avatar
    Join Date
    Nov 2005
    Location
    Florida's SpaceCoast
    Posts
    15,208

    Default

    Hi,

    Please read through what I post as it will speed up the cleaning process


    After your computer boots back up , run DDS again and post a new log also



    Please download ATF Cleaner by Atribune to your desktop.
    • Double-click ATF-Cleaner.exe to run the program.
    • Under Main choose: Select All
    • Click the Empty Selected button.
    Your system may start up slower after running ATF Cleaner, this is expected but will be back to normal after the first or second boot up
    Please note: If you use online banking or are registered online with any other organizations, ensure you have memorized password and other personal information as removing cookies will temporarily disable the auto-login facility.






    Please download Malwarebytes from Here or Here

    • Double-click mbam-setup.exe and follow the prompts to install the program.
    • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    • If an update is found, it will download and install the latest version.
    • Once the program has loaded, select Perform quick scan, then click Scan.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Be sure that everything is checked, and click Remove Selected .
    • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
    • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
    Post the report please



    1. Post a New DDS log
    2. Post the log from Malwarebytes
    3. Let me know how your computer is behaving as far as redirects
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012-2013-2014

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •