Jump to content

thunnus12

Honorary Members
  • Posts

    23
  • Joined

  • Last visited

Reputation

0 Neutral
  1. As far as I can tell the problem seems to be resolved. Any final checks that you can recommend to be sure we got everything? Thanks so much for your help!!!!!!!
  2. Should I be removing any of these programs that I used to clean the machine?
  3. Yes everything seems fine now except that my Antivirus system tray icon sometimes shows up on startup and sometimes doesn't. When I go into the program it says it's running, but this seems strange that the icon isn't there when it should be. Do you think this is related to infection?
  4. I ran Unhide and it uncovered the start menu items, but it did not produce a log file (even though it said that it did).....?
  5. Thanks Maniac it is running much better, but I still have the "File Restore" icon on the desktop and listed in the Programs folder.....and when I click on the start menu I can't see anything in the right hand menu where you would normally see listed printers, control panel, etc.
  6. I posted the log.txt file from the ESET scan in my last post.....was there something else i should be doing?
  7. Here is all that was in the log.txt file: ESETSmartInstaller@High as CAB hook log: OnlineScanner.ocx - registred OK esets_scanner_update returned -1 esets_gle=12 Shouldn't this have more information? When the scan finished it said it found 3 threats, though they all seemed to be in quarantine folders of other programs......?? THanks again for the continued help!
  8. Hi Maniac, Here is the new ComboFix log: ComboFix 12-11-21.01 - SSmith 11/21/2012 20:25:46.2.4 - x86 Microsoft Windows 7 Enterprise 6.1.7601.1.1252.1.1033.18.2953.1949 [GMT -5:00] Running from: c:\users\SSmith\Saved Games\Desktop\ComboFix.exe Command switches used :: c:\users\SSmith\Saved Games\Desktop\CFScript.txt AV: McAfee VirusScan Enterprise *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637} SP: McAfee VirusScan Enterprise Antispyware Module *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((( Files Created from 2012-10-22 to 2012-11-22 ))))))))))))))))))))))))))))))) . . 2012-11-22 01:30 . 2012-11-22 01:30 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-11-19 15:41 . 2012-07-26 03:39 526952 ----a-w- c:\windows\system32\drivers\Wdf01000.sys 2012-11-19 15:41 . 2012-07-26 03:39 47720 ----a-w- c:\windows\system32\drivers\WdfLdr.sys 2012-11-19 15:41 . 2012-07-26 02:46 9728 ----a-w- c:\windows\system32\Wdfres.dll 2012-11-19 15:41 . 2012-07-26 02:33 66560 ----a-w- c:\windows\system32\drivers\WUDFPf.sys 2012-11-19 15:41 . 2012-07-26 02:32 155136 ----a-w- c:\windows\system32\drivers\WUDFRd.sys 2012-11-19 15:41 . 2012-07-26 03:21 196608 ----a-w- c:\windows\system32\WUDFHost.exe 2012-11-19 15:41 . 2012-07-26 03:20 73216 ----a-w- c:\windows\system32\WUDFSvc.dll 2012-11-19 15:41 . 2012-07-26 03:20 38912 ----a-w- c:\windows\system32\WUDFCoinstaller.dll 2012-11-19 15:41 . 2012-07-26 03:20 172032 ----a-w- c:\windows\system32\WUDFPlatform.dll 2012-11-19 15:41 . 2012-07-26 03:20 613888 ----a-w- c:\windows\system32\WUDFx.dll 2012-11-19 14:53 . 2012-08-22 17:16 712048 ----a-w- c:\windows\system32\drivers\ndis.sys 2012-11-19 14:53 . 2012-02-11 05:43 492032 ----a-w- c:\windows\system32\win32spl.dll 2012-11-19 14:53 . 2012-02-11 05:37 317440 ----a-w- c:\windows\system32\spoolsv.exe 2012-11-19 14:53 . 2012-07-04 19:45 33280 ----a-w- c:\windows\system32\drivers\RNDISMP.sys 2012-11-19 14:51 . 2012-09-14 18:28 2048 ----a-w- c:\windows\system32\tzres.dll 2012-11-19 14:49 . 2012-10-09 17:40 44032 ----a-w- c:\windows\system32\dhcpcsvc6.dll 2012-11-19 14:49 . 2012-10-09 17:40 193536 ----a-w- c:\windows\system32\dhcpcore6.dll 2012-11-19 14:49 . 2012-03-03 05:31 1077248 ----a-w- c:\windows\system32\DWrite.dll 2012-11-19 14:46 . 2012-11-21 20:17 -------- d-----r- c:\users\SSmith\Dropbox 2012-11-19 14:33 . 2012-11-21 20:17 -------- d-----w- c:\users\SSmith\AppData\Roaming\Dropbox 2012-11-17 12:21 . 2012-08-31 17:18 1211760 ----a-w- c:\windows\system32\drivers\ntfs.sys 2012-11-17 12:21 . 2012-10-03 16:58 1293680 ----a-w- c:\windows\system32\drivers\tcpip.sys 2012-11-17 12:21 . 2012-10-03 16:42 156672 ----a-w- c:\windows\system32\ncsi.dll 2012-11-17 12:21 . 2012-08-22 17:16 240496 ----a-w- c:\windows\system32\drivers\netio.sys 2012-11-17 12:21 . 2012-10-03 16:40 499712 ----a-w- c:\windows\system32\iphlpsvc.dll 2012-11-17 12:21 . 2012-10-03 16:42 175104 ----a-w- c:\windows\system32\netcorehc.dll 2012-11-17 12:21 . 2012-08-22 17:16 187760 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS 2012-11-17 12:21 . 2012-10-03 16:42 242176 ----a-w- c:\windows\system32\nlasvc.dll 2012-11-17 12:21 . 2012-10-03 15:21 35328 ----a-w- c:\windows\system32\drivers\tcpipreg.sys 2012-11-17 12:21 . 2012-10-03 16:42 52224 ----a-w- c:\windows\system32\nlaapi.dll 2012-11-17 12:21 . 2012-10-03 16:42 18944 ----a-w- c:\windows\system32\netevent.dll 2012-11-17 12:20 . 2012-06-06 05:05 1019904 ----a-w- c:\program files\Common Files\System\ado\msado15.dll 2012-11-17 12:20 . 2012-06-06 05:03 805376 ----a-w- c:\windows\system32\cdosys.dll 2012-11-17 12:20 . 2012-06-06 05:05 57344 ----a-w- c:\program files\Common Files\System\ado\msador15.dll 2012-11-17 12:20 . 2012-06-06 05:05 352256 ----a-w- c:\program files\Common Files\System\ado\msadomd.dll 2012-11-17 12:20 . 2012-06-06 05:05 143360 ----a-w- c:\program files\Common Files\System\ado\msjro.dll 2012-11-17 12:20 . 2012-06-06 05:05 212992 ----a-w- c:\program files\Common Files\System\msadc\msadco.dll 2012-11-17 12:20 . 2012-06-06 05:05 372736 ----a-w- c:\program files\Common Files\System\ado\msadox.dll 2012-11-17 12:20 . 2012-05-05 07:46 400896 ----a-w- c:\windows\system32\srcore.dll 2012-11-17 12:20 . 2012-07-04 21:14 102912 ----a-w- c:\windows\system32\browser.dll 2012-11-17 12:20 . 2012-07-04 21:14 41984 ----a-w- c:\windows\system32\browcli.dll 2012-11-17 12:20 . 2012-08-10 23:56 542208 ----a-w- c:\windows\system32\kerberos.dll 2012-11-17 12:19 . 2012-08-30 17:12 3968880 ----a-w- c:\windows\system32\ntkrnlpa.exe 2012-11-17 12:19 . 2012-08-30 17:12 3914096 ----a-w- c:\windows\system32\ntoskrnl.exe 2012-11-17 12:19 . 2012-04-26 04:45 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll 2012-11-17 12:19 . 2012-04-26 04:45 58880 ----a-w- c:\windows\system32\rdpwsx.dll 2012-11-17 12:19 . 2012-04-26 04:41 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe 2012-11-17 12:19 . 2012-08-02 16:57 490496 ----a-w- c:\windows\system32\d3d10level9.dll 2012-11-17 12:19 . 2012-04-07 11:26 2342400 ----a-w- c:\windows\system32\msi.dll 2012-11-17 12:19 . 2012-03-17 07:27 56176 ----a-w- c:\windows\system32\drivers\partmgr.sys 2012-11-17 12:19 . 2012-05-14 04:33 769024 ----a-w- c:\windows\system32\localspl.dll 2012-11-17 12:19 . 2012-09-25 22:47 78336 ----a-w- c:\windows\system32\synceng.dll 2012-11-17 12:19 . 2012-05-01 04:44 164352 ----a-w- c:\windows\system32\profsvc.dll 2012-11-17 12:18 . 2012-10-18 17:59 2345984 ----a-w- c:\windows\system32\win32k.sys 2012-11-16 01:35 . 2012-11-17 13:11 -------- d-----w- c:\users\SSmith\AppData\Roaming\System 2012-11-15 17:49 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe 2012-11-15 17:49 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll 2012-11-15 17:49 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll 2012-11-15 17:49 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll 2012-11-15 17:49 . 2012-06-02 22:19 35864 ----a-w- c:\windows\system32\wups.dll 2012-11-15 17:49 . 2012-06-02 22:19 577048 ----a-w- c:\windows\system32\wuapi.dll 2012-11-15 17:49 . 2012-06-02 22:12 88576 ----a-w- c:\windows\system32\wudriver.dll 2012-11-15 17:48 . 2012-06-02 20:19 171904 ----a-w- c:\windows\system32\wuwebv.dll 2012-11-15 17:48 . 2012-06-02 20:12 33792 ----a-w- c:\windows\system32\wuapp.exe 2012-11-14 16:57 . 2012-11-14 16:57 -------- d-----w- c:\windows\MSICacheSigmaPlot 2012-11-14 16:57 . 2012-11-14 16:57 -------- d-----w- c:\program files\SigmaPlot . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 129272 ----a-w- c:\users\SSmith\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 129272 ----a-w- c:\users\SSmith\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 129272 ----a-w- c:\users\SSmith\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2012-11-13 23:32 129272 ----a-w- c:\users\SSmith\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2011-01-25 536668] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-04-12 143640] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-12 176920] "Persistence"="c:\windows\system32\igfxpers.exe" [2011-04-12 178456] "FreeFallProtection"="c:\program files\STMicroelectronics\AccelerometerP11\FF_Protection.exe" [2010-12-17 686704] "Broadcom Wireless Manager UI"="c:\program files\Dell\DW WLAN Card\WLTRAY.exe" [2011-01-18 5955072] "Dell Webcam Central"="c:\program files\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2010-03-12 462993] "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520] "Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232] "Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-12 640376] "McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\udaterui.exe" [2011-01-12 161088] "ShStatEXE"="c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2011-01-12 215360] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008] . c:\users\SSmith\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dropbox.lnk - c:\users\SSmith\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-11-16 29427912] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Dell System Manager.lnk - c:\program files\Dell\Dell System Manager\DCPSysMgr.exe [2011-1-20 1459056] Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2011-9-9 50688] VPN Client.lnk - c:\windows\Installer\{B0BF7057-6869-4E4B-920C-EA2A58DA07F0}\Icon3E5562ED7.ico [2011-9-21 6144] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x] R3 CtAudDrv;Provides advanced audio effects for audio devices.;c:\windows\system32\Drivers\CtAudDrv.sys [x] R3 e1kexpress;Intel® PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k6032.sys [x] R3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x] R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [x] R3 O2MDFRDR;O2MDFRDR;c:\windows\system32\DRIVERS\O2MDFw7.sys [x] R3 O2MDRRDR;O2MDRRDR;c:\windows\system32\DRIVERS\O2MDRw7.sys [x] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x] R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x] R3 tcm;tcm;c:\windows\system32\DRIVERS\tcm.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x] R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [x] S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [x] S0 stdcfltn;Disk Class Filter Driver for Accelerometer;c:\windows\system32\DRIVERS\stdcfltn.sys [x] S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\aestsrv.exe [x] S2 dcpsysmgrsvc;Dell System Manager Service;c:\program files\Dell\Dell System Manager\DCPSysMgrSvc.exe [x] S2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [x] S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [x] S3 Acceler;Accelerometer Service;c:\windows\system32\DRIVERS\Accelern.sys [x] S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [x] S3 cvusbdrv;Dell ControlVault;c:\windows\system32\Drivers\cvusbdrv.sys [x] S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x] S3 MEI;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECI.sys [x] S3 O2SDJRDR;O2SDJRDR;c:\windows\system32\DRIVERS\o2sdjw7.sys [x] . . --- Other Services/Drivers In Memory --- . *Deregistered* - mfeavfk01 . . ------- Supplementary Scan ------- . TCP: DhcpNameServer = 192.168.1.1 . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'Explorer.exe'(3060) c:\users\SSmith\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\IDT\WDM\STacSV.exe c:\windows\System32\WUDFHost.exe c:\program files\Dell\DW WLAN Card\WLTRYSVC.EXE c:\windows\system32\WLANExt.exe c:\windows\system32\conhost.exe c:\program files\Dell\DW WLAN Card\bcmwltry.exe c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe c:\program files\Cisco Systems\VPN Client\cvpnd.exe c:\program files\McAfee\Common Framework\FrameworkService.exe c:\windows\system32\taskhost.exe c:\program files\McAfee\VirusScan Enterprise\VsTskMgr.exe c:\windows\system32\DRIVERS\o2flash.exe c:\program files\Common Files\McAfee\SystemCore\mcshield.exe c:\program files\McAfee\VirusScan Enterprise\mfeann.exe c:\windows\system32\conhost.exe c:\program files\McAfee\Common Framework\naPrdMgr.exe c:\windows\system32\conhost.exe c:\windows\system32\sppsvc.exe . ************************************************************************** . Completion time: 2012-11-21 20:35:39 - machine was rebooted ComboFix-quarantined-files.txt 2012-11-22 01:35 . Pre-Run: 164,825,042,944 bytes free Post-Run: 164,663,828,480 bytes free . - - End Of File - - 75290079FDB3221446C3345B504F61EA
  9. Ok, I left it running for a while and it finally finished/rebooted. I've pasted one log and had to attach the other because the site is saying the post is too long: Malwarebytes Anti-Rootkit 1.1.0.1009 www.malwarebytes.org Database version: v2012.11.21.04 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 9.0.8112.16421 SSmith :: UMJ6DK3R1 [administrator] 11/21/2012 9:58:08 AM mbar-log-2012-11-21 (09-58-08).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken Scan options disabled: PUP | PUM | P2P Objects scanned: 25756 Time elapsed: 18 minute(s), Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 6 C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Bootstrap_0_3_488368128_infected.mbam (Rootkit.Alureon.F.VBR) -> Delete on reboot. [37866662f65e60694ee1b95c3d38103b] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\MBR_0_infected.mbam (Rootkit.Alureon.F.VBR) -> Delete on reboot. [ea39a2c8d1ba85abc08e9e538f12bdb3] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Sector_0_488377168_user.mbam (Forged physical sector) -> Delete on reboot. [6a1c75e931d4886dc4027a69e7c05598] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Sector_0_488388992_user.mbam (Forged physical sector) -> Delete on reboot. [95498601e79a2597ab052c6b5fce0fcb] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Sector_0_488394751_user.mbam (Forged physical sector) -> Delete on reboot. [93c9f766e5c75372a89bc336cef3c6e4] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Sector_0_488397167_user.mbam (Forged physical sector) -> Delete on reboot. [ea39a2c8d1ba85abc08e9e538f12bdb3] (end) system-log.txt
  10. Malwarebytes Anti-Rootkit is doing same as before.....it hangs while scanning (says "Not Responding"), but when i look in the folder a log file is generated.....should I reboot? Should I post the log files anyway? I never get the cleanup screen that i'm supposed to get from the program.....
  11. Hi Maniac- I PM'd the file you requested and i tried to run TDSSKiller again in both normal and safe mode but it still won't run.
  12. Ok, here is ComboFix log: ComboFix 12-11-16.02 - SSmith 11/17/2012 7:39.1.4 - x86 Microsoft Windows 7 Enterprise 6.1.7601.1.1252.1.1033.18.2953.1667 [GMT -5:00] Running from: c:\users\SSmith\Saved Games\Desktop\ComboFix.exe AV: McAfee VirusScan Enterprise *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637} SP: McAfee VirusScan Enterprise Antispyware Module *Disabled/Updated* {3D54B793-665E-3129-9103-206115370C8A} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\Nt9P0Nyob3ae1g c:\programdata\Nt9P0Nyob3ae1g.exe c:\users\SSmith\AppData\Roaming\system\svchost.exe c:\windows\system32\drivers\npf.sys c:\windows\system32\je9sdaj.dll c:\windows\system32\prsgrc.dll c:\windows\system32\ssprs.dll . . ((((((((((((((((((((((((( Files Created from 2012-10-17 to 2012-11-17 ))))))))))))))))))))))))))))))) . . 2012-11-17 13:13 . 2012-11-17 13:13 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-11-16 01:35 . 2012-11-17 13:11 -------- d-----w- c:\users\SSmith\AppData\Roaming\System 2012-11-15 17:49 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe 2012-11-15 17:49 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll 2012-11-15 17:49 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll 2012-11-15 17:49 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll 2012-11-15 17:48 . 2012-06-02 20:19 171904 ----a-w- c:\windows\system32\wuwebv.dll 2012-11-15 17:48 . 2012-06-02 20:12 33792 ----a-w- c:\windows\system32\wuapp.exe 2012-11-14 16:57 . 2012-11-14 16:57 -------- d-----w- c:\windows\MSICacheSigmaPlot 2012-11-14 16:57 . 2012-11-14 16:57 -------- d-----w- c:\program files\SigmaPlot . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2011-01-25 536668] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-04-12 143640] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-12 176920] "Persistence"="c:\windows\system32\igfxpers.exe" [2011-04-12 178456] "FreeFallProtection"="c:\program files\STMicroelectronics\AccelerometerP11\FF_Protection.exe" [2010-12-17 686704] "Broadcom Wireless Manager UI"="c:\program files\Dell\DW WLAN Card\WLTRAY.exe" [2011-01-18 5955072] "Dell Webcam Central"="c:\program files\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2010-03-12 462993] "BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520] "Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232] "Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-12 640376] "McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\udaterui.exe" [2011-01-12 161088] "ShStatEXE"="c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2011-01-12 215360] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Dell System Manager.lnk - c:\program files\Dell\Dell System Manager\DCPSysMgr.exe [2011-1-20 1459056] Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2011-9-9 50688] VPN Client.lnk - c:\windows\Installer\{B0BF7057-6869-4E4B-920C-EA2A58DA07F0}\Icon3E5562ED7.ico [2011-9-21 6144] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x] R3 CtAudDrv;Provides advanced audio effects for audio devices.;c:\windows\system32\Drivers\CtAudDrv.sys [x] R3 e1kexpress;Intel® PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k6032.sys [x] R3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x] R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [x] R3 O2MDFRDR;O2MDFRDR;c:\windows\system32\DRIVERS\O2MDFw7.sys [x] R3 O2MDRRDR;O2MDRRDR;c:\windows\system32\DRIVERS\O2MDRw7.sys [x] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x] R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x] R3 tcm;tcm;c:\windows\system32\DRIVERS\tcm.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x] R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x] R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x] R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [x] S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [x] S0 stdcfltn;Disk Class Filter Driver for Accelerometer;c:\windows\system32\DRIVERS\stdcfltn.sys [x] S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\aestsrv.exe [x] S2 dcpsysmgrsvc;Dell System Manager Service;c:\program files\Dell\Dell System Manager\DCPSysMgrSvc.exe [x] S2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [x] S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [x] S3 Acceler;Accelerometer Service;c:\windows\system32\DRIVERS\Accelern.sys [x] S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [x] S3 cvusbdrv;Dell ControlVault;c:\windows\system32\Drivers\cvusbdrv.sys [x] S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x] S3 MEI;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECI.sys [x] S3 O2SDJRDR;O2SDJRDR;c:\windows\system32\DRIVERS\o2sdjw7.sys [x] . . --- Other Services/Drivers In Memory --- . *Deregistered* - mfeavfk01 . . ------- Supplementary Scan ------- . TCP: DhcpNameServer = 192.168.1.1 . - - - - ORPHANS REMOVED - - - - . HKCU-Run-Nt9P0Nyob3ae1g - c:\programdata\Nt9P0Nyob3ae1g.exe HKCU-Run-Windows Services Host - c:\users\SSmith\AppData\Roaming\System\svchost.exe . . . ************************************************************************** . Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net Windows 6.1.7601 Disk: WDC_WD25 rev.01.0 -> Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 . device: opened successfully user: MBR read successfully kernel: MBR read successfully user != kernel MBR !!! . ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2012-11-17 08:31:22 ComboFix-quarantined-files.txt 2012-11-17 13:31 . Pre-Run: 167,350,099,968 bytes free Post-Run: 168,261,853,184 bytes free . - - End Of File - - 9639BF21A7AB65B85CDE127E6D2EF51B
  13. I can't seem to run TDSSKiller. I downloaded it to the desktop and when I open it I get the "Do you want TDSSKiller to make changes to your computer?" screen, but when I click yes, nothing else happens.
  14. Thanks for your help! Ok, here are the logs. BTW, when I ran Malwarebytes' Anti-Rootkit it hung at the end. I never got a finish screen or reboot request, but when I looked in the folder the log was there saying it was finished and that the detections would delete on reboot, so I rebooted anyway...... Malwarebytes Anti-Rootkit 1.1.0.1009 www.malwarebytes.org Database version: v2012.11.15.08 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 9.0.8112.16421 SSmith :: UMJ6DK3R1 [administrator] 11/15/2012 7:55:52 PM mbar-log-2012-11-15 (19-55-52).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken Scan options disabled: PUP | PUM | P2P Objects scanned: 25696 Time elapsed: 12 minute(s), 45 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 6 C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Bootstrap_0_3_488368128_infected.mbam (Rootkit.Alureon.F.VBR) -> Delete on reboot. [37866662f65e60694ee1b95c3d38103b] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\MBR_0_infected.mbam (Rootkit.Alureon.F.VBR) -> Delete on reboot. [ea39a2c8d1ba85abc08e9e538f12bdb3] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Sector_0_488377168_user.mbam (Forged physical sector) -> Delete on reboot. [15e99e9bcc577b8b1ed81782ba663845] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Sector_0_488388992_user.mbam (Forged physical sector) -> Delete on reboot. [95498601e79a2597ab052c6b5fce0fcb] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Sector_0_488394751_user.mbam (Forged physical sector) -> Delete on reboot. [93c9f766e5c75372a89bc336cef3c6e4] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Sector_0_488397167_user.mbam (Forged physical sector) -> Delete on reboot. [ea39a2c8d1ba85abc08e9e538f12bdb3] (end) DDS (Ver_2012-11-07.01) - NTFS_x86 Internet Explorer: 9.0.8112.16421 Run by SSmith at 20:34:23 on 2012-11-15 Microsoft Windows 7 Enterprise 6.1.7601.1.1252.1.1033.18.2953.1649 [GMT -5:00] . AV: McAfee VirusScan Enterprise *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: McAfee VirusScan Enterprise Antispyware Module *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A} . ============== Running Processes ================ . C:\windows\system32\wininit.exe C:\windows\system32\lsm.exe C:\Program Files\IDT\WDM\STacSV.exe C:\Windows\system32\WUDFHost.exe C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE C:\Program Files\Dell\DW WLAN Card\bcmwltry.exe C:\windows\system32\WLANExt.exe C:\windows\system32\conhost.exe C:\windows\System32\spoolsv.exe C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files\IDT\WDM\aestsrv.exe C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe C:\Program Files\McAfee\Common Framework\FrameworkService.exe C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe C:\windows\system32\mfevtps.exe C:\windows\system32\DRIVERS\o2flash.exe C:\Program Files\McAfee\VirusScan Enterprise\mfeann.exe C:\windows\system32\conhost.exe C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe C:\Program Files\Dell\Dell System Manager\DCPSysMgrSvc.exe C:\Program Files\McAfee\Common Framework\naPrdMgr.exe C:\windows\system32\Dwm.exe C:\windows\Explorer.EXE C:\windows\system32\taskhost.exe C:\windows\system32\wbem\wmiprvse.exe C:\windows\system32\SearchIndexer.exe C:\windows\system32\SearchProtocolHost.exe C:\Program Files\IDT\WDM\sttray.exe C:\Windows\System32\igfxtray.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\STMicroelectronics\AccelerometerP11\FF_Protection.exe C:\Program Files\Dell\DW WLAN Card\WLTRAY.EXE C:\Program Files\Dell Webcam\Dell Webcam Central\WebcamDell2.exe C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe C:\Program Files\McAfee\Common Framework\UdaterUI.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\ProgramData\Nt9P0Nyob3ae1g.exe C:\Program Files\McAfee\Common Framework\McTray.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE C:\windows\system32\NOTEPAD.EXE C:\windows\system32\sppsvc.exe C:\windows\servicing\TrustedInstaller.exe C:\Program Files\Internet Explorer\iexplore.exe C:\windows\system32\SearchFilterHost.exe C:\windows\system32\conhost.exe C:\windows\system32\wbem\wmiprvse.exe C:\windows\system32\svchost.exe -k DcomLaunch C:\windows\system32\svchost.exe -k RPCSS C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\windows\system32\svchost.exe -k netsvcs C:\windows\system32\svchost.exe -k LocalService C:\windows\system32\svchost.exe -k NetworkService C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\windows\system32\svchost.exe -k LocalServiceNoNetwork . ============== Pseudo HJT Report =============== . uSearch Bar = Preserve BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - c:\program files\microsoft office\office14\GROOVEEX.DLL BHO: scriptproxy: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\common files\mcafee\systemcore\ScriptSn.20110921130638.dll BHO: Adobe PDF Conversion Toolbar Helper: {AE7CD045-E861-484f-8273-0445EE161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - c:\program files\microsoft office\office14\URLREDIR.DLL BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: SmartSelect Class: {F4971EE7-DAA0-4053-9964-665D8EE6A077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll TB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll TB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll uRun: [Nt9P0Nyob3ae1g] c:\programdata\Nt9P0Nyob3ae1g.exe mRun: [sysTrayApp] c:\program files\idt\wdm\sttray.exe mRun: [igfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [FreeFallProtection] c:\program files\stmicroelectronics\accelerometerp11\FF_Protection.exe mRun: [broadcom Wireless Manager UI] c:\program files\dell\dw wlan card\WLTRAY.exe mRun: [Dell Webcam Central] "c:\program files\dell webcam\dell webcam central\WebcamDell2.exe" /mode2 mRun: [bCSSync] "c:\program files\microsoft office\office14\BCSSync.exe" /DelayServices mRun: [Adobe Acrobat Speed Launcher] "c:\program files\adobe\acrobat 9.0\acrobat\Acrobat_sl.exe" mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 9.0\acrobat\Acrotray.exe" mRun: [McAfeeUpdaterUI] "c:\program files\mcafee\common framework\udaterui.exe" /StartedFromRunKey mRun: [shStatEXE] "c:\program files\mcafee\virusscan enterprise\SHSTAT.EXE" /STANDALONE mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mPolicies-System: ConsentPromptBehaviorAdmin = dword:5 mPolicies-System: ConsentPromptBehaviorUser = dword:3 mPolicies-System: EnableUIADesktopToggle = dword:0 IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab TCP: NameServer = 192.168.1.1 TCP: Interfaces\{0DAB70FE-037F-4DC6-B846-F5F71A4262C4} : DHCPNameServer = 192.168.1.1 TCP: Interfaces\{0DAB70FE-037F-4DC6-B846-F5F71A4262C4}\2535D41435 : DHCPNameServer = 129.171.97.21 129.171.97.20 TCP: Interfaces\{0DAB70FE-037F-4DC6-B846-F5F71A4262C4}\7457563747 : DHCPNameServer = 129.171.97.20 129.171.97.21 Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL Notify: igfxcui - igfxdev.dll SSODL: WebCheck - <orphaned> SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - c:\program files\microsoft office\office14\GROOVEEX.DLL . ============= SERVICES / DRIVERS =============== . R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2011-9-21 436728] R0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2011-9-21 162928] R0 stdcfltn;Disk Class Filter Driver for Accelerometer;c:\windows\system32\drivers\stdcfltn.sys [2011-9-9 17648] R2 AESTFilters;Andrea ST Filters Service;c:\program files\idt\wdm\AEstSrv.exe [2011-9-9 81920] R2 dcpsysmgrsvc;Dell System Manager Service;c:\program files\dell\dell system manager\DCPSysMgrSvc.exe [2011-1-20 388464] R2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2012-11-15 399432] R2 McAfeeFramework;McAfee Framework Service;c:\program files\mcafee\common framework\FrameworkService.exe [2011-1-12 120128] R2 McShield;McAfee McShield;c:\program files\common files\mcafee\systemcore\mcshield.exe [2011-9-21 159320] R2 McTaskManager;McAfee Task Manager;c:\program files\mcafee\virusscan enterprise\VsTskMgr.exe [2011-1-12 209760] R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2011-9-21 145936] R3 Acceler;Accelerometer Service;c:\windows\system32\drivers\Accelern.sys [2011-9-9 43888] R3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\drivers\CtClsFlt.sys [2011-9-9 144576] R3 cvusbdrv;Dell ControlVault;c:\windows\system32\drivers\cvusbdrv.sys [2011-9-9 33832] R3 IntcDAud;Intel® Display Audio;c:\windows\system32\drivers\IntcDAud.sys [2011-9-9 269824] R3 MEI;Intel® Management Engine Interface;c:\windows\system32\drivers\HECI.sys [2011-9-9 41088] R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2011-9-21 171296] R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2011-9-21 58456] R3 O2SDJRDR;O2SDJRDR;c:\windows\system32\drivers\o2sdjw7.sys [2011-9-9 63848] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-11-15 676936] S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888] S3 CtAudDrv;Provides advanced audio effects for audio devices.;c:\windows\system32\drivers\CtAudDrv.sys [2011-9-9 134144] S3 e1kexpress;Intel® PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\drivers\e1k6032.sys [2009-7-13 164864] S3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [2011-9-9 132480] S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2011-9-21 85152] S3 O2MDFRDR;O2MDFRDR;c:\windows\system32\drivers\o2mdfw7.sys [2011-9-9 60904] S3 O2MDRRDR;O2MDRRDR;c:\windows\system32\drivers\O2MDRw7.sys [2011-9-9 62440] S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-2-14 15872] S3 StorSvc;Storage Service;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992] S3 tcm;tcm;c:\windows\system32\drivers\tcm.sys [2011-9-9 12952] S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2012-2-14 52224] S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2011-10-26 1343400] S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2008-5-6 11520] . =============== Created Last 30 ================ . 2012-11-15 19:15:16 259584 ----a-w- c:\programdata\Nt9P0Nyob3ae1g.exe 2012-11-15 17:49:19 2422272 ----a-w- c:\windows\system32\wucltux.dll 2012-11-15 17:48:48 33792 ----a-w- c:\windows\system32\wuapp.exe 2012-11-15 17:48:48 171904 ----a-w- c:\windows\system32\wuwebv.dll 2012-11-14 16:57:56 -------- d-----w- c:\windows\MSICacheSigmaPlot 2012-11-14 16:57:28 -------- d-----w- c:\program files\SigmaPlot . ==================== Find3M ==================== . 2012-11-15 17:16:24 204 ----a-w- c:\windows\system32\je9sdaj.dll 2012-11-15 17:16:24 100 ----a-w- c:\windows\system32\prsgrc.dll 2012-11-14 16:56:24 72 ----a-w- c:\windows\system32\ssprs.dll 2012-11-14 16:56:24 1025 ----a-w- c:\windows\system32\ldo8dts.dll 2012-11-14 16:56:24 1025 ----a-w- c:\windows\system32\grcauth2.dll 2012-11-14 16:56:24 1025 ----a-w- c:\windows\system32\grcauth1.dll 2012-11-14 16:56:24 1025 ----a-w- c:\windows\system32\clauth2.dll 2012-11-14 16:56:24 1025 ----a-w- c:\windows\system32\clauth1.dll . =================== ROOTKIT ==================== . Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net Windows 6.1.7601 Disk: WDC_WD25 rev.01.0 -> Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 . device: opened successfully user: MBR read successfully . Disk trace: called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x87DD8178]<< _asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV ECX, [EBP+0xc]; PUSH EBX; PUSH ESI; XOR EAX, EAX; CMP [0x87ddfe3c], EAX; PUSH EDI; MOV EDI, [ECX+0x60]; JZ 0x16f; MOV EDX, [EBP+0x8]; } 1 ntkrnlpa!IofCallDriver[0x82E4652A] -> \Device\Harddisk0\DR0[0x87DC0030] 3 CLASSPNP[0x8B5B259E] -> ntkrnlpa!IofCallDriver[0x82E4652A] -> [0x87DBF5C8] \Driver\stdcfltn[0x859174D8] -> IRP_MJ_INTERNAL_DEVICE_CONTROL -> 0x87DD8178 kernel: MBR read successfully _asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; MOV ES, AX; MOV DS, AX; MOV SI, 0x7c00; MOV DI, 0x600; MOV CX, 0x200; CLD ; REP MOVSB ; PUSH AX; PUSH 0x61c; RETF ; STI ; MOV CX, 0x4; MOV BP, 0x7be; CMP BYTE [bP+0x0], 0x0; } user != kernel MBR !!! Warning: possible TDL4 rootkit infection ! TDL4 rootkit infection detected ! Use: "mbr.exe -f" to fix. . ============= FINISH: 20:37:20.09 =============== . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2012-11-07.01) . Microsoft Windows 7 Enterprise Boot Device: \Device\HarddiskVolume2 Install Date: 9/21/2011 7:54:10 AM System Uptime: 11/15/2012 8:28:07 PM (0 hours ago) . Motherboard: Dell Inc. | | 05T3VM Processor: Intel® Core i3-2310M CPU @ 2.10GHz | CPU 1 | 2100/100mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 233 GiB total, 156.483 GiB free. D: is CDROM () . ==== Disabled Device Manager Items ============= . Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318} Description: Cisco Systems VPN Adapter Device ID: ROOT\NET\0000 Manufacturer: Cisco Systems Name: Cisco Systems VPN Adapter PNP Device ID: ROOT\NET\0000 Service: CVirtA . ==== System Restore Points =================== . RP34: 2/23/2012 2:32:42 PM - Installed Adobe Reader X (10.1.0). RP35: 3/2/2012 2:29:38 PM - Scheduled Checkpoint RP36: 3/9/2012 2:33:31 PM - Scheduled Checkpoint RP37: 3/19/2012 10:47:00 AM - Scheduled Checkpoint RP38: 3/20/2012 5:03:04 PM - Windows Update RP39: 4/16/2012 1:45:21 PM - Scheduled Checkpoint RP40: 4/16/2012 3:37:45 PM - Windows Update RP41: 4/17/2012 4:07:00 PM - Windows Update RP42: 4/27/2012 1:25:54 PM - Scheduled Checkpoint RP43: 11/15/2012 12:48:23 PM - Windows Update . ==== Installed Programs ====================== . AccelerometerP11 Adobe Acrobat 9 Pro - English, Français, Deutsch Adobe Flash Player 11 ActiveX Adobe Reader X (10.1.4) Cisco EAP-FAST Module Cisco LEAP Module Cisco PEAP Module Cisco Systems VPN Client 5.0.07.0290 CleanUp! Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition Dell Backup and Recovery Manager Dell System Manager Dell Webcam Central Digital Line Detect DW WLAN Card Utility IDT Audio Intel® Processor Graphics Java Auto Updater Java 6 Update 26 Malwarebytes Anti-Malware version 1.65.1.1000 McAfee Agent McAfee VirusScan Enterprise Microsoft .NET Framework 4 Client Profile Microsoft Office 2010 Language Pack Service Pack 1 (SP1) Microsoft Office 2010 Service Pack 1 (SP1) Microsoft Office Access MUI (English) 2010 Microsoft Office Access Setup Metadata MUI (English) 2010 Microsoft Office Excel MUI (English) 2010 Microsoft Office Groove MUI (English) 2010 Microsoft Office InfoPath MUI (English) 2010 Microsoft Office OneNote MUI (English) 2010 Microsoft Office Outlook MUI (English) 2010 Microsoft Office PowerPoint MUI (English) 2010 Microsoft Office Professional Plus 2010 Microsoft Office Project MUI (English) 2010 Microsoft Office Project Professional 2010 Microsoft Office Proof (English) 2010 Microsoft Office Proof (French) 2010 Microsoft Office Proof (Spanish) 2010 Microsoft Office Proofing (English) 2010 Microsoft Office Publisher MUI (English) 2010 Microsoft Office Shared MUI (English) 2010 Microsoft Office Shared Setup Metadata MUI (English) 2010 Microsoft Office Visio 2010 Microsoft Office Visio MUI (English) 2010 Microsoft Office Word MUI (English) 2010 Microsoft Project 2010 Service Pack 1 (SP1) Microsoft Project Professional 2010 Microsoft Silverlight Microsoft Visio 2010 Service Pack 1 (SP1) Microsoft Visio Premium 2010 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Modem Diagnostic Tool Mozilla Thunderbird 10.0.2 (x86 en-US) Netwaiting Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft Office 2010 (KB2553091) Security Update for Microsoft Office 2010 (KB2553096) Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition Security Update for Microsoft Office 2010 (KB2598039) 32-Bit Edition Security Update for Microsoft PowerPoint 2010 (KB2553185) 32-Bit Edition Security Update for Microsoft SharePoint Workspace 2010 (KB2566445) Security Update for Microsoft Visio 2010 (KB2553374) 32-Bit Edition Security Update for Microsoft Visio Viewer 2010 (KB2597170) 32-Bit Edition SigmaPlot 11.0 Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) Update for Microsoft Excel 2010 (KB2553439) 32-Bit Edition Update for Microsoft Office 2010 (KB2494150) Update for Microsoft Office 2010 (KB2553065) Update for Microsoft Office 2010 (KB2553092) Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition Update for Microsoft Office 2010 (KB2553385) 32-Bit Edition Update for Microsoft Office 2010 (KB2566458) Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition Update for Microsoft Office 2010 (KB2597091) 32-Bit Edition Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition Update for Microsoft Outlook 2010 (KB2553248) 32-Bit Edition Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition . ==== Event Viewer Messages From Past Week ======== . 11/15/2012 8:28:29 PM, Error: Service Control Manager [7001] - The MBAMService service depends on the MBAMProtector service which failed to start because of the following error: The system cannot find the file specified. 11/15/2012 8:28:22 PM, Error: Service Control Manager [7000] - The MBAMProtector service failed to start due to the following error: The system cannot find the file specified. 11/15/2012 3:39:04 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start. 11/15/2012 3:35:49 PM, Error: Microsoft-Windows-WLAN-AutoConfig [10000] - WLAN Extensibility Module has failed to start. Module Path: C:\windows\System32\bcmihvsrv.dll Error Code: 21 11/15/2012 3:35:46 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030} 11/15/2012 3:35:46 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39} 11/15/2012 3:35:43 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF} 11/15/2012 3:35:38 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC} 11/15/2012 3:35:34 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: discache spldr Wanarpv6 11/14/2012 9:58:44 AM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1. 11/14/2012 11:41:01 AM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR2. . ==== End Of File ===========================
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.