ghg565

This problem is from a computer at a freinds work. She works at a realty office and got infected with some sort of malware/virus. I told her I would try to fix it up for her since she is fairly computer illiterate. At first I could not run any .exe files as windows would ask me what program I would like to use to open the file. I managed to install malwarebytes using the runas command and the quick scan cleaned up some registry and system file issues and that symptom is gone. The malware/virus changed all her security center settings to unmonitored. I was able to turn windows firewall back on and change the malware monitoring to say that I would monitor it myself (Not sure how she wants to deal with that yet but I will certainly recommend Malwarebytes Pro). However security center is still telling me that the automatic updates are not turned on. If I go to control panel and look there they appear to be on? I am fairly sure some other issues are still present but I have not messed with it too much and would like an expert to take a look at my dds logs to tell me what my next step(s) should be. I also included the mbam log file in case this is any use. Thanks for any help! After re-registering half a dozen .dll's Windows update seems to be working again and security center has no more issues. I have been on the computer for a good hour and a half (several reboots) since the initial malwarebytes scan and fix, and have encountered no other issues so I am assuming it is clean. If I run into any other problems I will be back for further advice but for now I seem to be ok (unless someone looks at the posted log files and notices something I need to take care of). dds.txt attach.txt mbam-log-2012-04-01 (12-50-51).txt

Thanks again for all the help! Glad to have a clean bill of health.

Hello, Sorry I forgot to add the computers current behavior. Haven't had any issues since my DSS scan. All seems well at the moment. No issues with browser redirecting, task manager is back, I am able to run any scans, av programs without issue. Thx again, and let me know what else needs to be done.

Here is the ComboFix log: ComboFix 11-12-08.01 - Owner 12/08/2011 16:40:11.1.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1013.446 [GMT -7:00] Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\docume~1\Owner\LOCALS~1\Temp\SASA.tmp c:\docume~1\Owner\LOCALS~1\Temp\SASB.tmp c:\documents and settings\All Users\Application Data\TEMP c:\documents and settings\All Users\Application Data\TEMP\{89A43E80-AC6C-4DA8-9800-F4B30ED577C0}\PostBuild.exe c:\documents and settings\Owner\Local Settings\Temp\SASA.tmp c:\documents and settings\Owner\Local Settings\Temp\SASB.tmp c:\documents and settings\Owner\WINDOWS c:\windows\CSC\d6 c:\windows\EventSystem.log J:\albkpq3.exe . . ((((((((((((((((((((((((( Files Created from 2011-11-08 to 2011-12-08 ))))))))))))))))))))))))))))))) . . 2011-12-07 15:19 . 2011-12-07 15:19 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes 2011-12-07 14:40 . 2011-12-07 14:40 100864 ----a-w- C:\fgwyyfod.sys 2011-12-07 05:01 . 2011-12-07 05:01 -------- d-----w- c:\documents and settings\Owner\Application Data\Malwarebytes 2011-12-07 04:58 . 2010-04-29 22:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-12-07 04:58 . 2011-12-07 19:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2011-12-07 04:58 . 2011-12-07 04:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2011-12-07 04:58 . 2010-04-29 22:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-12-07 04:41 . 2011-12-07 04:41 -------- d-----w- c:\program files\Trend Micro 2011-12-07 04:33 . 2011-12-07 04:33 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Western Digital 2011-12-07 01:03 . 2011-12-07 01:03 -------- d-sh--w- c:\documents and settings\Administrator\IECompatCache 2011-12-07 00:59 . 2011-12-07 00:59 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE 2011-12-07 00:47 . 2011-12-07 22:26 -------- d-----w- c:\documents and settings\Administrator\Application Data\CallingID 2011-12-07 00:46 . 2011-12-07 00:46 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Google 2011-11-21 01:59 . 2011-11-21 01:59 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache 2011-11-09 15:10 . 2011-11-09 15:10 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-12-08 19:52 . 2004-08-03 23:07 187776 ----a-w- c:\windows\system32\drivers\acpi.sys 2011-12-07 04:33 . 2011-08-13 15:29 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-12-07 04:28 . 2009-10-03 00:05 222080 ------w- c:\windows\system32\MpSigStub.exe 2011-10-10 14:22 . 2007-09-25 20:46 692736 ----a-w- c:\windows\system32\inetcomm.dll 2011-09-28 07:06 . 2007-09-25 22:34 599040 ----a-w- c:\windows\system32\crypt32.dll 2011-09-26 18:41 . 2008-07-30 02:59 611328 ----a-w- c:\windows\system32\uiautomationcore.dll 2011-09-26 18:41 . 2007-09-25 22:35 220160 ----a-w- c:\windows\system32\oleacc.dll 2011-09-26 18:41 . 2007-09-25 22:35 20480 ----a-w- c:\windows\system32\oleaccrc.dll 2007-10-10 02:06 . 2007-10-10 02:06 51422520 ----a-w- c:\program files\iTunes743Setup.exe 2007-10-09 05:46 . 2007-10-09 05:46 13411824 ----a-w- c:\program files\Google_Earth_BZXD.exe . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-07-01 150040] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-07-01 170520] "Persistence"="c:\windows\system32\igfxpers.exe" [2008-07-01 141848] "MDS_Menu"="c:\program files\Olympus\ib\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264] . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE] @="" . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2011-03-30 04:59 937920 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2011-09-07 22:58 37296 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon] 2011-09-27 14:22 59240 ----a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] 2007-03-12 19:49 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDtoiPodConverter_upgrade] 2007-10-12 10:15 817664 ----a-w- c:\program files\E-Zsoft\DVDtoiPodConverter\DVDtoiPodConverter.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] 2011-10-10 01:06 421736 ----a-w- c:\program files\iTunes\iTunesHelper.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] 2008-04-14 00:12 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] 2007-03-10 00:53 153136 ----a-w- c:\program files\Common Files\Ahead\Lib\NeroCheck.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Olympus ib] 2010-02-05 05:47 93376 ------w- c:\program files\Olympus\ib\olycamdetect.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OnlineBackupScheduler] 2010-10-16 18:06 594760 ----a-w- c:\program files\Online Backup\OnlineBackup.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2011-07-06 01:36 421888 ----a-w- c:\program files\QuickTime\QTTask.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp] 2006-05-26 14:58 282624 ----a-w- c:\windows\sttray.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] 2010-09-22 03:17 202256 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG] 2006-10-19 03:05 204288 ------w- c:\program files\Windows Media Player\wmpnscfg.exe . [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "YahooAUService"=2 (0x2) "gusvc"=3 (0x3) "gupdatem"=3 (0x3) "gupdate"=2 (0x2) "CIDLinkAdvisorService"=2 (0x2) "CaCCProvSP"=3 (0x3) . [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Java\\jdk1.5.0_14\\jre\\bin\\java.exe"= "c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"= "c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= . R1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.SYS --> c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [?] R2 !SASCORE;SAS Core Service;"c:\program files\SUPERAntiSpyware\SASCORE.EXE" --> c:\program files\SUPERAntiSpyware\SASCORE.EXE [?] S3 OlyCamComm;OLYMPUS USB Communication Device;c:\windows\system32\drivers\OlyCamComm.sys [8/29/2010 10:30 AM 21648] S4 CIDLinkAdvisorService;CIDLinkAdvisorService;"c:\program files\CallingID\CallingIDLinkAdvisor2.0\LinkAdvisor\CIDLinkAdvisorService.exe" --> c:\program files\CallingID\CallingIDLinkAdvisor2.0\LinkAdvisor\CIDLinkAdvisorService.exe [?] S4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/31/2010 3:09 PM 135664] S4 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [1/31/2010 3:09 PM 135664] . --- Other Services/Drivers In Memory --- . *Deregistered* - SASDIFSV . Contents of the 'Scheduled Tasks' folder . 2011-11-29 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-02 00:57] . 2011-12-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2495073255-414440772-572454927-1005Core.job - c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-12-08 05:54] . 2011-12-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2495073255-414440772-572454927-1005UA.job - c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-12-08 05:54] . 2011-12-08 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-2495073255-414440772-572454927-1005.job - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 10:02] . 2011-12-08 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2495073255-414440772-572454927-1005.job - c:\program files\Real\RealUpgrade\realupgrade.exe [2010-06-03 10:02] . . ------- Supplementary Scan ------- . uInternet Settings,ProxyOverride = *.local IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 Trusted Zone: aol.com\free TCP: DhcpNameServer = 208.180.42.100 66.76.175.100 208.180.42.68 DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.2.0/GarminAxControl.CAB . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) SafeBoot-26179755.sys MSConfigStartUp-AdobeUpdater - c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe MSConfigStartUp-cctray - c:\program files\CA\CA Internet Security Suite\cctray\cctray.exe MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe MSConfigStartUp-YKNNWfXiCRNj - c:\documents and settings\All Users\Application Data\YKNNWfXiCRNj.exe AddRemove-{CDB98E2F-7B2A-42C2-B718-F1F6B31586DF} - c:\program files\CallingID\CallingIDLinkAdvisor2.0\CIDLinkAdvisor.exe . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2011-12-08 16:47 Windows 5.1.2600 Service Pack 3 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (Administrator) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,f2,c5,74,66,f1,d2,b7,4e,89,1d,21,\ "6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,f2,c5,74,66,f1,d2,b7,4e,89,1d,21,\ . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'winlogon.exe'(664) c:\program files\SUPERAntiSpyware\SASWINLO.DLL c:\windows\system32\WININET.dll . Completion time: 2011-12-08 16:50:04 ComboFix-quarantined-files.txt 2011-12-08 23:50 . Pre-Run: 123,338,936,320 bytes free Post-Run: 126,038,106,112 bytes free . WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons UnsupportedDebug="do not select this" /debug multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect . - - End Of File - - 374E51FBA79F45010616D0AFEE34D147 Thank you again for helping.

This is what I got when I submitted the file: 1 VT Community user(s) with a total of 1 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware. File name: fgwyyfod.sys Submission date: 2011-12-08 22:59:08 (UTC) Current status: finished Result: 0/ 43 (0.0%) AhnLab-V3 2011.12.08.02 2011.12.08 - AntiVir 7.11.19.30 2011.12.08 - Antiy-AVL 2.0.3.7 2011.12.08 - Avast 6.0.1289.0 2011.12.08 - AVG 10.0.0.1190 2011.12.08 - BitDefender 7.2 2011.12.09 - ByteHero 1.0.0.1 2011.12.07 - CAT-QuickHeal 12.00 2011.12.08 - ClamAV 0.97.3.0 2011.12.09 - Commtouch 5.3.2.6 2011.12.08 - Comodo 10887 2011.12.08 - DrWeb 5.0.2.03300 2011.12.08 - Emsisoft 5.1.0.11 2011.12.08 - eSafe 7.0.17.0 2011.12.08 - eTrust-Vet 37.0.9614 2011.12.08 - F-Prot 4.6.5.141 2011.11.29 - F-Secure 9.0.16440.0 2011.12.08 - Fortinet 4.3.388.0 2011.12.08 - GData 22 2011.12.08 - Ikarus T3.1.1.109.0 2011.12.08 - Jiangmin 13.0.900 2011.12.08 - K7AntiVirus 9.119.5619 2011.12.07 - Kaspersky 9.0.0.837 2011.12.08 - McAfee 5.400.0.1158 2011.12.08 - McAfee-GW-Edition 2010.1E 2011.12.08 - Microsoft 1.7903 2011.12.08 - NOD32 6691 2011.12.07 - Norman 6.07.13 2011.12.07 - nProtect 2011-12-08.02 2011.12.08 - Panda 10.0.3.5 2011.12.08 - PCTools 8.0.0.5 2011.12.08 - Prevx 3.0 2011.12.09 - Rising 23.87.03.02 2011.12.08 - Sophos 4.71.0 2011.12.08 - SUPERAntiSpyware 4.40.0.1006 2011.12.08 - Symantec 20111.2.0.82 2011.12.08 - TheHacker 6.7.0.1.353 2011.12.07 - TrendMicro 9.500.0.1008 2011.12.08 - TrendMicro-HouseCall 9.500.0.1008 2011.12.08 - VBA32 3.12.16.4 2011.12.08 - VIPRE 11221 2011.12.08 - ViRobot 2011.12.8.4815 2011.12.08 - VirusBuster 14.1.106.0 2011.12.08 - Additional informationShow all MD5 : 577c37fbeb973390e61b654d0ac1bebd SHA1 : d63afbc87838239d816942e81db56cbe237ad1d1 SHA256: 49c9df7fb2200e3e20aedb8f8a69aa28bf858adfbc3ae286957d2479832abb8b ssdeep: 1536:PhQy2GDoTNx3l7mhrKB3rJ1ucBZsKV5phBuj2pCNsiDjyRHnMcs+Zg5rcS5yZBT:5ABl1u sVf6Nui2nMcsYgJcS5yT File size : 100864 bytes First seen: 2011-07-17 05:09:05 Last seen : 2011-12-08 22:59:08 TrID: Win32 Executable Generic (58.4%) Clipper DOS Executable (13.8%) Generic Win/DOS Executable (13.7%) DOS Executable Generic (13.7%) VXD Driver (0.2%) sigcheck: publisher....: GMER copyright....: Copyright © GMER 2003-2009 product......: GMER description..: GMER Driver http://www.gmer.net original name: gmer.sys internal name: gmer.sys file version.: 1, 0, 15, 4918 built by: WinDDK comments.....: n/a signers......: - signing date.: - verified.....: Unsigned PEInfo: PE structure information [[ basic data ]] entrypointaddress: 0x16005 timedatestamp....: 0x4E21F298 (Sat Jul 16 20:20:40 2011) machinetype......: 0x14c (I386) [[ 7 section(s) ]] name, viradd, virsiz, rawdsiz, ntropy, md5 .text, 0x480, 0xEA2C, 0xEA80, 6.45, a0ffd8d7e67fda16d045b3b9c0142509 .rwtext, 0xEF00, 0x51, 0x80, 1.71, c00d6d7ba9be2d7a526fdd7311b1247f .rdata, 0xEF80, 0x2FBC, 0x3000, 5.14, d5bbf44c1f811f2d9f8454ba69b8c008 .data, 0x11F80, 0x4044, 0x4080, 0.34, 74ff1bbfb8e0ed1825669d220a13bc03 INIT, 0x16000, 0xAA8, 0xB00, 5.43, 619c6618a9e220cb810a7c9a63a55a26 .rsrc, 0x16B00, 0x370, 0x380, 3.35, c0c6d76b43cfd61d2ad6fb7fc4b40a16 .reloc, 0x16E80, 0x1B1A, 0x1B80, 6.44, 278d1556f5baf102668f4df3707ad15b [[ 2 import(s) ]] ntoskrnl.exe: ExFreePoolWithTag, ExAllocatePool, ZwReadFile, ZwQueryInformationFile, ZwOpenFile, memcpy, KeQuerySystemTime, PsLookupProcessByProcessId, ObfDereferenceObject, ObReferenceObjectByHandle, KeDetachProcess, KeAttachProcess, MmIsAddressValid, memset, ZwSetInformationFile, RtlInitUnicodeString, ObOpenObjectByPointer, IofCompleteRequest, IoDeleteDevice, IoDeleteSymbolicLink, RtlUnicodeStringToAnsiString, PsTerminateSystemThread, PsCreateSystemThread, KeInitializeEvent, wcsstr, IoCreateSymbolicLink, IoCreateDevice, PsGetVersion, strrchr, KeGetCurrentThread, KeBugCheckEx, IoFreeIrp, _wcsnicmp, IoAllocateIrp, IoGetBaseFileSystemDeviceObject, ZwWriteFile, ZwCreateFile, strncmp, IoGetCurrentProcess, strncpy, _vsnprintf, PsGetCurrentProcessId, _snprintf, RtlTimeToTimeFields, ExSystemTimeToLocalTime, _stricmp, ZwQuerySystemInformation, _strnicmp, RtlCopyUnicodeString, ZwQueryValueKey, ZwOpenKey, ZwSetValueKey, _snwprintf, ZwClose, MmUnlockPages, MmProbeAndLockPages, IoAllocateMdl, ZwEnumerateKey, PsLookupThreadByThreadId, RtlAnsiStringToUnicodeString, RtlInitAnsiString, _strupr, _strlwr, KeDelayExecutionThread, RtlVolumeDeviceToDosName, ObfReferenceObject, IoGetDeviceObjectPointer, wcschr, wcsncmp, KeInsertQueueDpc, KeSetTargetProcessorDpc, KeInitializeDpc, KeNumberProcessors, MmMapLockedPagesSpecifyCache, KeServiceDescriptorTable, _wcsicmp, wcsrchr, strchr, strstr, wcsncpy, IoCreateNotificationEvent, ZwQuerySection, RtlInitString, ZwRequestWaitReplyPort, ZwConnectPort, MmMapLockedPages, MmGetSystemRoutineAddress, ObReferenceObjectByName, IoDriverObjectType, ZwDeleteFile, KeTickCount, NtClose, IofCallDriver, RtlCompareUnicodeString, IoBuildSynchronousFsdRequest, _alldiv, RtlEqualUnicodeString, ZwQueryDirectoryObject, ZwOpenDirectoryObject, ZwQuerySymbolicLinkObject, ZwOpenSymbolicLinkObject, IoGetDeviceInterfaces, KeBugCheck, KeSetEvent, KeWaitForSingleObject, IoFreeMdl, KeClearEvent, RtlUnwind HAL.dll: KfLowerIrql, KeGetCurrentIrql, KfRaiseIrql ExifTool: file metadata CharacterSet: Unicode CodeSize: 62976 CompanyName: GMER EntryPoint: 0x16005 FileDescription: GMER Driver http://www.gmer.net FileFlagsMask: 0x003f FileOS: Windows NT 32-bit FileSize: 98 kB FileSubtype: 7 FileType: Win32 EXE FileVersion: 1, 0, 15, 4918 built by: WinDDK FileVersionNumber: 1.0.15.4918 ImageVersion: 6.0 InitializedDataSize: 36736 InternalName: gmer.sys LanguageCode: English (U.S.) LegalCopyright: Copyright © GMER 2003-2009 LinkerVersion: 8.0 MIMEType: application/octet-stream MachineType: Intel 386 or later, and compatibles OSVersion: 6.0 ObjectFileType: Driver OriginalFilename: gmer.sys PEType: PE32 ProductName: GMER ProductVersion: 1, 0, 15, 4918 ProductVersionNumber: 1.0.15.4918 Subsystem: Native SubsystemVersion: 5.1 TimeStamp: 2011:07:16 22:20:40+02:00 UninitializedDataSize: 0 Hope this helps you out. Thank you for your help.

Hello, I have a Windows XP sp3 computer that seems to be infected with some malware. I have tried to remove it by myself and the issues keep comming back. I am having occasional browser redirecting from google results using chrome, my task manager keeps getting disabled, and I am getting a generic host process for win32 services error each time I reboot(which may be unrelated but I figure it is best to fix any malware issue before taking on any other problems). According to my event viewer the generic win32 error is from the DNS Client service terminating unexpectedly. I have tried running DDS but my computer freezes after it runs for about 2 mins. I haven't been able to find either of the log files that it creates so I am not sure what I need to post for you? Please let me know and I will post any needed info asap. I tried running a full scan with Malwarebytes in safe mode w/networking and some issues were found and fixed, but the symptoms came back on the next reboot. Next I treid renaming the mbam.exe and using unhide.exe before running but no issues were found and my problems persist. Any help is much appreciated! Hello Again, I have done some more work on this computer and have gotten it to finish a DDS scan for which I have attached the created log files. I also have gotten rid of any symptoms that I was experiencing before and had mentioned in my previous post. This was accomplished using TDSS Killer and the Malwarebytes scan. I am all to aware that this doesn't mean that the malware is completely gone and I would appreciate an experts opinion on whether further action is necessary. I also have a Gmer log file which I have attached even though it may not be of any help (sorry if this is not helpful but I am trying to expedite the process as best I can.) Thanks again for any help! GmerLog.txt attach.txt dds.txt . DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.5.0_14 Run by Owner at 15:10:37 on 2011-12-08 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1013.572 [GMT -7:00] . . ============== Running Processes =============== . C:\WINDOWS\system32\svchost.exe -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\igfxsrvc.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\SUPERAntiSpyware\SASCORE.EXE . ============== Pseudo HJT Report =============== . uInternet Settings,ProxyOverride = *.local uURLSearchHooks: H - No File BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.5.0_14\bin\ssv.dll {fbf2401b-7447-4727-be5d-c19b2075ca84} TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File TB: {10134636-E7AF-4AC5-A1DC-C7C44BB97D81} - No File TB: {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No File uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [sUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe uRun: [Google Update] "c:\documents and settings\owner\local settings\application data\google\update\GoogleUpdate.exe" /c mRun: [igfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [MDS_Menu] "c:\program files\olympus\ib\muitransfer\muistartmenu.exe" "c:\program files\olympus\ib" updatewithcreateonce "software\olympus\ib\1.0" dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0014-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_14\bin\ssv.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL Trusted Zone: aol.com\free DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.2.0/GarminAxControl.CAB DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/7/3/e7345c16-80aa-4488-ae10-9ac6be844f99/OGAControl.cab DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_14-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_07-windows-i586.cab DPF: {CAFEEFAC-0015-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_14-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_14-windows-i586.cab Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL Notify: igfxcui - igfxdev.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL . ============= SERVICES / DRIVERS =============== . R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\SASDIFSV.SYS [2010-2-17 12880] R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67664] R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCORE.EXE [2010-6-29 116608] S3 OlyCamComm;OLYMPUS USB Communication Device;c:\windows\system32\drivers\OlyCamComm.sys [2010-8-29 21648] S4 CIDLinkAdvisorService;CIDLinkAdvisorService;"c:\program files\callingid\callingidlinkadvisor2.0\linkadvisor\cidlinkadvisorservice.exe" --> c:\program files\callingid\callingidlinkadvisor2.0\linkadvisor\CIDLinkAdvisorService.exe [?] S4 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-1-31 135664] S4 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-1-31 135664] . =============== Created Last 30 ================ . 2011-12-07 22:00:24 -------- d-----w- c:\documents and settings\owner\application data\SUPERAntiSpyware.com 2011-12-07 22:00:24 -------- d-----w- c:\documents and settings\all users\application data\SUPERAntiSpyware.com 2011-12-07 22:00:15 -------- d-----w- c:\program files\SUPERAntiSpyware 2011-12-07 14:40:53 100864 ----a-w- C:\fgwyyfod.sys 2011-12-07 05:01:49 -------- d-----w- c:\documents and settings\owner\application data\Malwarebytes 2011-12-07 04:58:24 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-12-07 04:58:23 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-12-07 04:58:23 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2011-12-07 04:58:23 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes 2011-12-07 04:41:50 -------- d-----w- c:\program files\Trend Micro 2011-12-07 04:33:56 -------- d-----w- c:\documents and settings\owner\local settings\application data\Western Digital 2011-11-09 14:30:21 -------- d-----w- c:\windows\pss . ==================== Find3M ==================== . 2011-12-08 19:52:08 187776 ----a-w- c:\windows\system32\drivers\acpi.sys 2011-12-07 04:33:43 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2011-12-07 04:28:13 222080 ------w- c:\windows\system32\MpSigStub.exe 2011-10-10 14:22:41 692736 ----a-w- c:\windows\system32\inetcomm.dll 2011-09-28 07:06:50 599040 ----a-w- c:\windows\system32\crypt32.dll 2011-09-26 18:41:20 611328 ----a-w- c:\windows\system32\uiautomationcore.dll 2011-09-26 18:41:20 220160 ----a-w- c:\windows\system32\oleacc.dll 2011-09-26 18:41:14 20480 ----a-w- c:\windows\system32\oleaccrc.dll 2007-10-10 02:06:18 51422520 ----a-w- c:\program files\iTunes743Setup.exe 2007-10-09 05:46:14 13411824 ----a-w- c:\program files\Google_Earth_BZXD.exe . ============= FINISH: 15:11:04.45 ===============