Jump to content

kahlua

Members
  • Posts

    13
  • Joined

  • Last visited

Everything posted by kahlua

  1. Hey MrC, Done, Done, & Done! I have to say, I've been happily clicking along for years with Microsoft Security Essential installed thinking I was safe. WRONG. First pass with MalWarebytes uncovered 9 (count em nine) trojans, the MSE missed! I had no idea. Your help ( hand holding ) was superb! I'll be donating for sure. You The Man! Best Regards & Thanks, B.
  2. Hey MrC, Ran Security check... Heres the file... Results of screen317's Security Check version 0.99.63 Windows XP Service Pack 3 x86 Internet Explorer 8 ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Enabled! WMI entry may not exist for antivirus; attempting automatic update. `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware version 1.75.0.1300 Adobe Reader 9 Adobe Reader out of Date! ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Malwarebytes' Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C:: 1% ````````````````````End of Log``````````````````````
  3. Hello MrC, Malwarebytes is finished. Nothing to check or remove appeared.. Heres the file... Malwarebytes Anti-Malware (PRO) 1.75.0.1300 www.malwarebytes.org Database version: v2013.05.06.05 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 Administrator :: COMP1 [administrator] Protection: Enabled 5/6/2013 10:03:27 AM mbam-log-2013-05-06 (10-03-27).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 225772 Time elapsed: 2 minute(s), 31 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)
  4. MrC, AdwCleaner has don its thing... Here's the file... I'll do the Malwarebytes next # AdwCleaner v2.300 - Logfile created 05/06/2013 at 09:49:49 # Updated 28/04/2013 by Xplode # Operating system : Microsoft Windows XP Service Pack 3 (32 bits) # User : Administrator - COMP1 # Boot Mode : Normal # Running from : C:\Documents and Settings\Administrator\Desktop\adwcleaner.exe # Option [Delete] ***** [services] ***** Stopped & Deleted : BrowserProtect ***** [Files / Folders] ***** File Deleted : C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\bProtector Web Data File Deleted : C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\bprotectorpreferences File Deleted : C:\Program Files\Mozilla FireFox\Components\AskSearch.js File Deleted : C:\user.js File Deleted : C:\WINDOWS\Tasks\BrowserProtect.job File Deleted : C:\WINDOWS\Tasks\EPUpdater.job Folder Deleted : C:\Documents and Settings\Administrator\Application Data\AVG Secure Search Folder Deleted : C:\Documents and Settings\Administrator\Application Data\BabSolution Folder Deleted : C:\Documents and Settings\Administrator\Application Data\Babylon Folder Deleted : C:\Documents and Settings\Administrator\Application Data\Delta Folder Deleted : C:\Documents and Settings\Administrator\Application Data\Media Finder Folder Deleted : C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\gencrawler@some.com Folder Deleted : C:\Documents and Settings\Administrator\Application Data\yourfiledownloader Folder Deleted : C:\Documents and Settings\Administrator\Local Settings\Application Data\AskToolbar Folder Deleted : C:\Documents and Settings\Administrator\Local Settings\Application Data\AVG Secure Search Folder Deleted : C:\Documents and Settings\Administrator\Local Settings\Application Data\Conduit Folder Deleted : C:\Documents and Settings\Administrator\Start Menu\Programs\BrowserProtect Folder Deleted : C:\Documents and Settings\All Users\Application Data\AVG Secure Search Folder Deleted : C:\Documents and Settings\All Users\Application Data\Babylon Folder Deleted : C:\Documents and Settings\All Users\Application Data\BrowserProtect Folder Deleted : C:\Documents and Settings\All Users\Application Data\InstallMate Folder Deleted : C:\Documents and Settings\All Users\Application Data\Tarma Installer Folder Deleted : C:\Documents and Settings\All Users\Application Data\WeCareReminder Folder Deleted : C:\Program Files\Ask.com Folder Deleted : C:\Program Files\AskBarDis Folder Deleted : C:\Program Files\AVG Secure Search Folder Deleted : C:\Program Files\Common Files\AVG Secure Search Folder Deleted : C:\Program Files\Conduit Folder Deleted : C:\Program Files\Delta ***** [Registry] ***** Key Deleted : HKCU\Software\828d8be635be43 Key Deleted : HKCU\Software\BabylonToolbar Key Deleted : HKCU\Software\Conduit Key Deleted : HKCU\Software\ConduitSearchScopes Key Deleted : HKCU\Software\DataMngr_Toolbar Key Deleted : HKCU\Software\Delta Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com Key Deleted : HKLM\SOFTWARE\828d8be635be43 Key Deleted : HKLM\Software\Babylon Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL Key Deleted : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL Key Deleted : HKLM\SOFTWARE\Classes\AppID\esrv.EXE Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{261DD098-8A3E-43D4-87AA-63324FA897D8} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4FCB4630-2A1C-4AA1-B422-345E8DC8A6DE} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{86838207-681D-469D-9511-D0DCC6F19F9B} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E97A663B-81A6-49C5-A6D3-BCB05BA1DE26} Key Deleted : HKLM\SOFTWARE\Classes\delta.deltaappCore Key Deleted : HKLM\SOFTWARE\Classes\delta.deltaappCore.1 Key Deleted : HKLM\SOFTWARE\Classes\escort.escortIEPane Key Deleted : HKLM\SOFTWARE\Classes\escort.escortIEPane.1 Key Deleted : HKLM\SOFTWARE\Classes\esrv.deltaESrvc Key Deleted : HKLM\SOFTWARE\Classes\esrv.deltaESrvc.1 Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3027696 Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{39CB8175-E224-4446-8746-00566302DF8D} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4599D05A-D545-4069-BB42-5895B4EAE05B} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} Key Deleted : HKLM\Software\Conduit Key Deleted : HKLM\Software\Delta Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\eooncjejnppfjjklapaamhcdmjbilmde Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{348C2DF3-1191-4C3E-92A6-B3A89A9D9C85} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Delta Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Delta Chrome Toolbar Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Main [bprotector start page] Value Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [bProtectorDefaultScope] ***** [internet Browsers] ***** -\\ Internet Explorer v8.0.6001.18702 Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://www2.delta-search.com/?affID=119556&tt=gc_050513_d9114_gc_&babsrc=NT_ss&mntrId=C4CB3860778C23CC --> hxxp://www.google.com Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - bProtectTabs] = hxxp://www2.delta-search.com/?affID=119556&tt=gc_050513_d9114_gc_&babsrc=NT_ss&mntrId=C4CB3860778C23CC --> hxxp://www.google.com -\\ Google Chrome v [unable to get version] File : C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences [OK] File is clean. ************************* AdwCleaner[R1].txt - [7386 octets] - [06/05/2013 09:31:25] AdwCleaner[s1].txt - [7082 octets] - [06/05/2013 09:49:49] ########## EOF - C:\AdwCleaner[s1].txt - [7142 octets] ##########
  5. Hello MrC, Adwarecleaner is finished. Nothing in the log file I see as important. Here's the file... # AdwCleaner v2.300 - Logfile created 05/06/2013 at 09:31:25 # Updated 28/04/2013 by Xplode # Operating system : Microsoft Windows XP Service Pack 3 (32 bits) # User : Administrator - COMP1 # Boot Mode : Normal # Running from : C:\Documents and Settings\Administrator\Desktop\adwcleaner.exe # Option [search] ***** [services] ***** Found : BrowserProtect ***** [Files / Folders] ***** File Found : C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\bProtector Web Data File Found : C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\bprotectorpreferences File Found : C:\Program Files\Mozilla FireFox\Components\AskSearch.js File Found : C:\user.js File Found : C:\WINDOWS\Tasks\BrowserProtect.job File Found : C:\WINDOWS\Tasks\EPUpdater.job Folder Found : C:\Documents and Settings\Administrator\Application Data\AVG Secure Search Folder Found : C:\Documents and Settings\Administrator\Application Data\BabSolution Folder Found : C:\Documents and Settings\Administrator\Application Data\Babylon Folder Found : C:\Documents and Settings\Administrator\Application Data\Delta Folder Found : C:\Documents and Settings\Administrator\Application Data\Media Finder Folder Found : C:\Documents and Settings\Administrator\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\gencrawler@some.com Folder Found : C:\Documents and Settings\Administrator\Application Data\yourfiledownloader Folder Found : C:\Documents and Settings\Administrator\Local Settings\Application Data\AskToolbar Folder Found : C:\Documents and Settings\Administrator\Local Settings\Application Data\AVG Secure Search Folder Found : C:\Documents and Settings\Administrator\Local Settings\Application Data\Conduit Folder Found : C:\Documents and Settings\Administrator\Start Menu\Programs\BrowserProtect Folder Found : C:\Documents and Settings\All Users\Application Data\AVG Secure Search Folder Found : C:\Documents and Settings\All Users\Application Data\Babylon Folder Found : C:\Documents and Settings\All Users\Application Data\BrowserProtect Folder Found : C:\Documents and Settings\All Users\Application Data\InstallMate Folder Found : C:\Documents and Settings\All Users\Application Data\Tarma Installer Folder Found : C:\Documents and Settings\All Users\Application Data\WeCareReminder Folder Found : C:\Program Files\Ask.com Folder Found : C:\Program Files\AskBarDis Folder Found : C:\Program Files\AVG Secure Search Folder Found : C:\Program Files\Common Files\AVG Secure Search Folder Found : C:\Program Files\Conduit Folder Found : C:\Program Files\Delta ***** [Registry] ***** Key Found : HKCU\Software\828d8be635be43 Key Found : HKCU\Software\BabylonToolbar Key Found : HKCU\Software\Conduit Key Found : HKCU\Software\ConduitSearchScopes Key Found : HKCU\Software\DataMngr_Toolbar Key Found : HKCU\Software\Delta Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9} Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com Key Found : HKLM\SOFTWARE\828d8be635be43 Key Found : HKLM\Software\Babylon Key Found : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947} Key Found : HKLM\SOFTWARE\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D} Key Found : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} Key Found : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D} Key Found : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} Key Found : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} Key Found : HKLM\SOFTWARE\Classes\AppID\escort.DLL Key Found : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL Key Found : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL Key Found : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL Key Found : HKLM\SOFTWARE\Classes\AppID\esrv.EXE Key Found : HKLM\SOFTWARE\Classes\CLSID\{261DD098-8A3E-43D4-87AA-63324FA897D8} Key Found : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} Key Found : HKLM\SOFTWARE\Classes\CLSID\{4FCB4630-2A1C-4AA1-B422-345E8DC8A6DE} Key Found : HKLM\SOFTWARE\Classes\CLSID\{86838207-681D-469D-9511-D0DCC6F19F9B} Key Found : HKLM\SOFTWARE\Classes\CLSID\{E97A663B-81A6-49C5-A6D3-BCB05BA1DE26} Key Found : HKLM\SOFTWARE\Classes\delta.deltaappCore Key Found : HKLM\SOFTWARE\Classes\delta.deltaappCore.1 Key Found : HKLM\SOFTWARE\Classes\escort.escortIEPane Key Found : HKLM\SOFTWARE\Classes\escort.escortIEPane.1 Key Found : HKLM\SOFTWARE\Classes\esrv.deltaESrvc Key Found : HKLM\SOFTWARE\Classes\esrv.deltaESrvc.1 Key Found : HKLM\SOFTWARE\Classes\Prod.cap Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3027696 Key Found : HKLM\SOFTWARE\Classes\TypeLib\{39CB8175-E224-4446-8746-00566302DF8D} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{4599D05A-D545-4069-BB42-5895B4EAE05B} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} Key Found : HKLM\Software\Conduit Key Found : HKLM\Software\Delta Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\eooncjejnppfjjklapaamhcdmjbilmde Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{348C2DF3-1191-4C3E-92A6-B3A89A9D9C85} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Delta Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Delta Chrome Toolbar Key Found : HKU\S-1-5-21-839522115-861567501-682003330-500\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9} Key Found : HKU\S-1-5-21-839522115-861567501-682003330-500\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Value Found : HKCU\Software\Microsoft\Internet Explorer\Main [bprotector start page] Value Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [bProtectorDefaultScope] ***** [internet Browsers] ***** -\\ Internet Explorer v8.0.6001.18702 [HKCU\Software\Microsoft\Internet Explorer\Main - bProtector Start Page] = hxxp://www2.delta-search.com/?affID=119556&tt=gc_050513_d9114_gc_&babsrc=HP_ss&mntrId=C4CB3860778C23CC [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://www2.delta-search.com/?affID=119556&tt=gc_050513_d9114_gc_&babsrc=NT_ss&mntrId=C4CB3860778C23CC [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - bProtectTabs] = hxxp://www2.delta-search.com/?affID=119556&tt=gc_050513_d9114_gc_&babsrc=NT_ss&mntrId=C4CB3860778C23CC -\\ Google Chrome v [unable to get version] File : C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences [OK] File is clean. ************************* AdwCleaner[R1].txt - [7257 octets] - [06/05/2013 09:31:25] ########## EOF - C:\AdwCleaner[R1].txt - [7317 octets] ##########
  6. Hello MrCharlie, Success. ComboFix ran and completed ( 12 minutes ) Here's ComboFix.txt ComboFix 13-05-06.01 - Administrator 05/06/2013 8:49.3.2 - x86 MINIMAL Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3493.3214 [GMT -4:00] Running from: c:\documents and settings\Administrator\desktop\combofix.exe Command switches used :: /nombr . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . . -------\Legacy_hwinterface -------\Service_hwinterface . . ((((((((((((((((((((((((( Files Created from 2013-04-06 to 2013-05-06 ))))))))))))))))))))))))))))))) . . 2013-05-06 00:19 . 2013-05-06 00:19 -------- d-----w- c:\windows\system32\searchplugins 2013-05-06 00:19 . 2013-05-06 00:19 -------- d-----w- c:\windows\system32\Extensions 2013-05-06 00:19 . 2013-05-06 00:19 -------- d-----w- c:\documents and settings\All Users\Application Data\BrowserProtect 2013-05-06 00:19 . 2013-05-06 00:19 -------- d-----w- c:\documents and settings\Administrator\Application Data\BabSolution 2013-05-06 00:19 . 2013-05-06 00:19 -------- d-----w- c:\program files\Delta 2013-05-06 00:19 . 2013-05-06 00:19 -------- d-----w- c:\program files\LessTabs 2013-05-06 00:19 . 2013-05-06 00:19 -------- d-----w- c:\documents and settings\Administrator\Application Data\Delta 2013-05-06 00:19 . 2013-05-06 00:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Babylon 2013-05-06 00:19 . 2013-05-06 00:19 -------- d-----w- c:\documents and settings\Administrator\Application Data\Babylon 2013-05-05 22:43 . 2013-05-05 22:49 15616 ----a-w- c:\windows\system32\drivers\TrueSight.sys 2013-05-04 22:37 . 2013-05-04 22:37 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes 2013-05-04 22:37 . 2013-05-04 22:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2013-05-04 22:37 . 2013-05-04 12:55 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2013-05-04 22:37 . 2013-04-04 18:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys 2013-05-04 22:36 . 2013-05-06 12:41 -------- d-----w- C:\MALWAREBYTES DOWNLOAD 2013-05-03 14:21 . 2013-05-03 14:21 -------- d-----w- c:\windows\system32\wbem\Repository 2013-04-16 12:15 . 2013-04-19 12:48 -------- d-----w- C:\IRISH RECORDINGS 2013-04-06 19:20 . 2013-04-06 19:21 -------- d-----w- C:\BIGMOUTH 2013-04-06 18:55 . 2013-04-06 19:24 -------- d-----w- c:\program files\Voicent 2013-04-06 18:42 . 2001-08-17 17:57 16128 -c--a-w- c:\windows\system32\dllcache\modemcsa.sys 2013-04-06 18:42 . 2001-08-17 17:57 16128 ----a-w- c:\windows\system32\drivers\MODEMCSA.sys 2013-04-06 18:42 . 2013-04-06 18:42 -------- d-----w- c:\program files\CONEXANT 2013-04-06 18:42 . 2005-06-20 01:57 110592 ----a-r- c:\windows\system32\uci32100.dll 2013-04-06 18:42 . 2004-03-17 03:04 13059 ----a-r- c:\windows\system32\drivers\mdmxsdk.sys 2013-04-06 18:42 . 2004-03-17 03:00 86016 ----a-r- c:\windows\system32\mdmxsdk.dll 2013-04-06 18:42 . 2005-08-22 08:07 1035008 ----a-r- c:\windows\system32\drivers\HSF_DPV.sys 2013-04-06 18:42 . 2005-08-22 08:06 244480 ----a-r- c:\windows\system32\drivers\HSFHWBS2.sys 2013-04-06 18:42 . 2005-08-22 08:06 718464 ----a-r- c:\windows\system32\drivers\HSF_CNXT.sys . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-05-02 15:28 . 2012-01-10 17:12 238872 ------w- c:\windows\system32\MpSigStub.exe 2013-03-12 19:51 . 2012-10-16 21:04 693976 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2013-03-12 19:51 . 2012-01-10 23:00 73432 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2013-03-08 08:36 . 2008-04-13 23:00 293376 ----a-w- c:\windows\system32\winsrv.dll 2013-03-07 01:32 . 2008-04-13 23:00 2149888 ----a-w- c:\windows\system32\ntoskrnl.exe 2013-03-07 00:50 . 2008-04-14 00:01 2028544 ----a-w- c:\windows\system32\ntkrnlpa.exe 2013-03-02 02:06 . 2008-04-13 23:00 916480 ----a-w- c:\windows\system32\wininet.dll 2013-03-02 02:06 . 2008-04-13 23:00 43520 ------w- c:\windows\system32\licmgr10.dll 2013-03-02 02:06 . 2008-04-13 23:00 1469440 ------w- c:\windows\system32\inetcpl.cpl 2013-03-02 01:25 . 2008-04-13 23:00 1867264 ----a-w- c:\windows\system32\win32k.sys 2013-03-02 01:08 . 2008-04-13 23:00 385024 ------w- c:\windows\system32\html.iec 2013-02-27 07:56 . 2012-01-10 09:07 2067456 ----a-w- c:\windows\system32\mstscax.dll 2013-02-12 00:32 . 2008-04-13 23:00 12928 ----a-w- c:\windows\system32\drivers\usb8023.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{3178A392-8963-471E-B7A2-969CB58D6496}] 2013-04-05 07:38 143896 ----a-w- c:\program files\LessTabs\IE32\LessTabsClientIE.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-03-02 142360] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-03-02 182296] "Persistence"="c:\windows\system32\igfxpers.exe" [2011-03-02 166424] "RTHDCPL"="RTHDCPL.EXE" [2011-02-17 20029032] "NUSB3MON"="c:\program files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-04 37296] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712] "NA1Messenger"="c:\ups\WSTD\UPSNA1Msgr.exe" [2012-03-03 24576] "Wondershare Helper Compact.exe"="c:\program files\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe" [2012-03-27 1686528] "Aimersoft Helper Compact.exe"="c:\program files\Common Files\Aimersoft\Aimersoft Helper Compact\ASHelper.exe" [2012-02-20 1666560] "KMCONFIG"="c:\program files\Micro Innovations\Multimedia Keyboard Driver\StartAutorun.exe" [2007-03-06 212992] . [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160] . c:\documents and settings\All Users\Start Menu\Programs\Startup\ UPS WorldShip Messaging Utility.lnk - c:\ups\WSTD\WSTDMessaging.exe [2011-12-2 422912] UPS WorldShip PLD Reminder Utility.lnk - c:\ups\WSTD\wstdPldReminder.exe [2011-12-2 34304] . [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 . [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\WINDOWS\\system32\\sessmgr.exe"= . R0 Achernar;Achernar - SCSI Command Filter Drivers;c:\windows\system32\drivers\Achernar.sys [9/2/2012 10:13 AM 18432] R0 pssnap;Paramount Software Snapshot Filter;c:\windows\system32\drivers\pssnap.sys [5/20/2008 9:32 AM 15328] R2 BrowserProtect;BrowserProtect;c:\documents and settings\All Users\Application Data\BrowserProtect\2.6.1249.132\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe [5/5/2013 8:19 PM 2787280] R2 inpout32;inpout32;c:\windows\system32\drivers\inpout32.sys [1/25/2012 3:03 PM 11936] R2 Intel® PROSet Monitoring Service;Intel® PROSet Monitoring Service;c:\windows\system32\IPROSetMonitor.exe [1/10/2012 6:32 AM 109728] R2 KMWDSERVICE;Keyboard And Mouse Communication Service;c:\program files\Micro Innovations\Multimedia Keyboard Driver\KMWDSrv.exe [6/9/2007 1:23 AM 208896] R2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [5/4/2013 6:37 PM 418376] R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [5/4/2013 6:37 PM 701512] R2 MSSQL$UPSWSDBSERVER;MSSQL$UPSWSDBSERVER;c:\ups\WSTD\MSSQL$UPSWSDBSERVER\Binn\sqlservr.exe -sUPSWSDBSERVER --> c:\ups\WSTD\MSSQL$UPSWSDBSERVER\Binn\sqlservr.exe -sUPSWSDBSERVER [?] R2 ReflectService;Macrium Reflect Image Mounting Service;c:\program files\Macrium\Reflect\ReflectService.exe [8/6/2008 12:34 PM 216032] R2 UNS;Intel® Management and Security Application User Notification Service;c:\program files\Intel\Intel® Management Engine Components\UNS\UNS.exe [1/10/2012 6:31 AM 2656280] R3 IntcDAud;Intel® Display Audio;c:\windows\system32\drivers\IntcDAud.sys [1/10/2012 6:25 AM 260864] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [5/4/2013 6:37 PM 22856] R3 MEI;Intel® Management Engine Interface;c:\windows\system32\drivers\HECI.sys [1/10/2012 6:31 AM 41088] R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys [2/10/2011 2:52 AM 63872] R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys [2/10/2011 2:52 AM 141952] S0 cerc6;cerc6; [x] S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [1/10/2012 6:26 AM 1691480] S3 HP DS Service;HP DS Service;c:\program files\HP\HPBDSService\HPBDSService.exe [10/27/2010 2:02 PM 13824] S3 NmPar;PCI Parallel Port;c:\windows\system32\drivers\NmPar.sys [12/24/2008 6:40 AM 80256] S3 nmserial;PCI Serial Port;c:\windows\system32\drivers\NmSerial.sys [12/16/2008 7:10 AM 70016] S3 PciPPorts;PCI ECP Parallel Port;c:\windows\system32\drivers\PciPPorts.sys [5/22/2008 2:04 PM 82432] S3 PCIVIEW;PCIVIEW;\??\c:\pci view download\98654656PCIview\PCIVIEW.sys --> c:\pci view download\98654656PCIview\PCIVIEW.sys [?] S3 PSMounter;Macrium Reflect Image Explorer Service;c:\windows\system32\drivers\psmounter.sys [7/8/2008 1:39 PM 31712] S3 SQLAgent$UPSWSDBSERVER;SQLAgent$UPSWSDBSERVER;c:\ups\WSTD\MSSQL$UPSWSDBSERVER\Binn\sqlagent.EXE -i UPSWSDBSERVER --> c:\ups\WSTD\MSSQL$UPSWSDBSERVER\Binn\sqlagent.EXE -i UPSWSDBSERVER [?] . [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 . Contents of the 'Scheduled Tasks' folder . 2013-05-06 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-16 19:51] . 2013-05-06 c:\windows\Tasks\BrowserProtect.job - c:\windows\system32\sc.exe [2008-04-13 10:39] . 2013-05-06 c:\windows\Tasks\EPUpdater.job - c:\docume~1\ADMINI~1\APPLIC~1\BABSOL~1\Shared\BabMaint.exe [2013-05-06 09:48] . 2013-05-06 c:\windows\Tasks\FreeFileViewerUpdateChecker.job - c:\program files\FreeFileViewer\FFVCheckForUpdates.exe [2012-09-13 19:24] . 2013-05-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2012-10-16 21:04] . 2013-05-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2012-10-16 21:04] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.yahoo.com/?ilc=34 uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch TCP: DhcpNameServer = 75.75.75.75 75.75.76.76 . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) . . . ************************************************************************** . catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2013-05-06 08:59 Windows 5.1.2600 Service Pack 3 NTFS . scanning hidden processes ... . scanning hidden autostart entries ... . scanning hidden files ... . scan completed successfully hidden files: 0 . ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_USERS\S-1-5-21-839522115-861567501-682003330-500\Software\DataMngr_Toolbar] @Denied: (2) (Administrator) @Allowed: (Read) (RestrictedCode) . [HKEY_USERS\S-1-5-21-839522115-861567501-682003330-500\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (Administrator) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d8,4c,74,56,1b,67,41,41,95,a5,64,\ "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d8,4c,74,56,1b,67,41,41,95,a5,64,\ . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*] @="?????????????????? v1" . [HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID] @="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}" . [HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*] @="?????????????????? v2" . [HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID] @="{9BE31822-FDAD-461B-AD51-BE1D1C159921}" . [HKEY_LOCAL_MACHINE\software\Microsoft\Environment*] "Licence"="01EB87B-DD9C-07F0-C0F0-5A7E" . --------------------- DLLs Loaded Under Running Processes --------------------- . - - - - - - - > 'explorer.exe'(4016) c:\windows\system32\WININET.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\corel\Graphics8\programs\CMFFld80.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\RTHDCPL.EXE c:\program files\Micro Innovations\Multimedia Keyboard Driver\KMConfig.exe c:\program files\Intel\Intel® Management Engine Components\LMS\LMS.exe c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe c:\ups\WSTD\MSSQL$UPSWSDBSERVER\Binn\sqlservr.exe c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe c:\program files\Micro Innovations\Multimedia Keyboard Driver\KMProcess.exe c:\program files\Canon\CAL\CALMAIN.exe . ************************************************************************** . Completion time: 2013-05-06 09:01:43 - machine was rebooted ComboFix-quarantined-files.txt 2013-05-06 13:01 . Pre-Run: 463,511,801,856 bytes free Post-Run: 463,366,688,768 bytes free . - - End Of File - - 9175E78EC94487D1752E9C78F91AE5CB
  7. Good Morning MrCharlie, Ran Combofix last night, program seemed to run ( dos mode ) but gave no indication that it was finished. Rather than shut it down, I let it run all night. No indication of completion ( done, finished, nothing ) Exited out of ComboFix and rebooted. All seems ok, except.... No file called combofix.txt on my computer. Also, when I run a file search on my computer, the search engine goes into an endless search loop searching the same folders over and over without end ( strange ). Sooooo...no malware found this morning ( Malwarebyes or Mbar ) No "Sites Blocked" baloon on bootup ( or after ) What do you think Mr. Wizard? B.
  8. Good Morning MrCharlie, Ran Combofix last night, program seemed to run ( dos mode ) but gave no indication that it was finished. Rather than shut it down, I let it run all night. No indication of completion ( done, finished, nothing ) Exited out of ComboFix and rebooted. All seems ok, except.... No file called combofix.txt on my computer. Also, when I run a file search on my computer, the search engine goes into an endless search loop searching the same folders over and over without end ( strange ). Sooooo...no malware found this morning ( Malwarebyes or Mbar ) No "Sites Blocked" baloon on bootup ( or after ) What do you think Mr. Wizard? B.
  9. Hello MrCharlie, Here it is system-log.txt --------------------------------------- Malwarebytes Anti-Rootkit BETA 1.05.0.1001 © Malwarebytes Corporation 2011-2012 OS version: 5.1.2600 Windows XP Service Pack 3 x86 Account is Administrative Internet Explorer version: 8.0.6001.18702 File system is: NTFS Disk drives: C:\ DRIVE_FIXED CPU speed: 2.594000 GHz Memory total: 3663093760, free: 3065147392 ------------ Kernel report ------------ 05/05/2013 19:48:00 ------------ Loaded modules ----------- \WINDOWS\system32\ntkrnlpa.exe \WINDOWS\system32\hal.dll \WINDOWS\system32\KDCOM.DLL \WINDOWS\system32\BOOTVID.dll ACPI.sys \WINDOWS\system32\DRIVERS\WMILIB.SYS pci.sys isapnp.sys ohci1394.sys \WINDOWS\system32\DRIVERS\1394BUS.SYS pciide.sys \WINDOWS\system32\DRIVERS\PCIIDEX.SYS MountMgr.sys ftdisk.sys dmload.sys dmio.sys PartMgr.sys Achernar.sys VolSnap.sys atapi.sys disk.sys \WINDOWS\system32\DRIVERS\CLASSPNP.SYS fltMgr.sys sr.sys KSecDD.sys Ntfs.sys NDIS.sys pssnap.sys Mup.sys \SystemRoot\system32\DRIVERS\igxpmp32.sys \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS \SystemRoot\system32\DRIVERS\HECI.sys \SystemRoot\system32\DRIVERS\e1c5132.sys \SystemRoot\system32\DRIVERS\usbehci.sys \SystemRoot\system32\DRIVERS\USBPORT.SYS \SystemRoot\system32\DRIVERS\HDAudBus.sys \SystemRoot\system32\DRIVERS\nusb3xhc.sys \SystemRoot\system32\DRIVERS\USBD.SYS \SystemRoot\system32\DRIVERS\nic1394.sys \SystemRoot\system32\DRIVERS\imapi.sys \SystemRoot\system32\DRIVERS\cdrom.sys \SystemRoot\system32\DRIVERS\redbook.sys \SystemRoot\system32\DRIVERS\ks.sys \SystemRoot\system32\DRIVERS\intelppm.sys \SystemRoot\system32\DRIVERS\usbscan.sys \SystemRoot\system32\DRIVERS\audstub.sys \SystemRoot\system32\DRIVERS\rasl2tp.sys \SystemRoot\system32\DRIVERS\ndistapi.sys \SystemRoot\system32\DRIVERS\ndiswan.sys \SystemRoot\system32\DRIVERS\raspppoe.sys \SystemRoot\system32\DRIVERS\raspptp.sys \SystemRoot\system32\DRIVERS\TDI.SYS \SystemRoot\system32\DRIVERS\psched.sys \SystemRoot\system32\DRIVERS\msgpc.sys \SystemRoot\system32\DRIVERS\ptilink.sys \SystemRoot\system32\DRIVERS\raspti.sys \SystemRoot\system32\DRIVERS\rdpdr.sys \SystemRoot\system32\DRIVERS\termdd.sys \SystemRoot\system32\DRIVERS\kbdclass.sys \SystemRoot\system32\DRIVERS\mouclass.sys \SystemRoot\system32\DRIVERS\swenum.sys \SystemRoot\system32\DRIVERS\update.sys \SystemRoot\system32\DRIVERS\mssmbios.sys \SystemRoot\System32\Drivers\NDProxy.SYS \SystemRoot\system32\DRIVERS\usbhub.sys \SystemRoot\system32\DRIVERS\nusb3hub.sys \SystemRoot\system32\drivers\RtkHDAud.sys \SystemRoot\system32\drivers\portcls.sys \SystemRoot\system32\drivers\drmk.sys \SystemRoot\system32\DRIVERS\IntcDAud.sys \SystemRoot\system32\DRIVERS\usbccgp.sys \SystemRoot\system32\DRIVERS\hidusb.sys \SystemRoot\system32\DRIVERS\HIDCLASS.SYS \SystemRoot\system32\DRIVERS\HIDPARSE.SYS \SystemRoot\system32\DRIVERS\emOEM.sys \SystemRoot\system32\DRIVERS\emBDA.sys \SystemRoot\system32\DRIVERS\BdaSup.SYS \SystemRoot\system32\drivers\emAudio.sys \SystemRoot\system32\DRIVERS\mouhid.sys \SystemRoot\System32\Drivers\Fs_Rec.SYS \SystemRoot\System32\Drivers\Null.SYS \SystemRoot\System32\Drivers\Beep.SYS \SystemRoot\System32\drivers\vga.sys \SystemRoot\System32\Drivers\mnmdd.SYS \SystemRoot\System32\DRIVERS\RDPCDD.sys \SystemRoot\System32\Drivers\Msfs.SYS \SystemRoot\System32\Drivers\Npfs.SYS \SystemRoot\system32\DRIVERS\rasacd.sys \SystemRoot\system32\DRIVERS\ipsec.sys \SystemRoot\system32\DRIVERS\tcpip.sys \SystemRoot\system32\DRIVERS\netbt.sys \SystemRoot\system32\DRIVERS\ipnat.sys \SystemRoot\System32\drivers\afd.sys \SystemRoot\system32\DRIVERS\netbios.sys \SystemRoot\system32\DRIVERS\rdbss.sys \SystemRoot\system32\DRIVERS\mrxsmb.sys \SystemRoot\System32\Drivers\hwinterface.sys \SystemRoot\System32\Drivers\Fips.SYS \SystemRoot\System32\Drivers\Cdfs.SYS \SystemRoot\system32\DRIVERS\wanarp.sys \SystemRoot\system32\DRIVERS\arp1394.sys \??\C:\WINDOWS\System32\Drivers\KMWDFilter.SYS \SystemRoot\system32\DRIVERS\kbdhid.sys \SystemRoot\System32\Drivers\dump_atapi.sys \SystemRoot\System32\Drivers\dump_WMILIB.SYS \SystemRoot\System32\win32k.sys \SystemRoot\System32\drivers\Dxapi.sys \SystemRoot\System32\watchdog.sys \SystemRoot\System32\drivers\dxg.sys \SystemRoot\System32\drivers\dxgthk.sys \SystemRoot\System32\igxpgd32.dll \SystemRoot\System32\igxprd32.dll \SystemRoot\System32\igxpdv32.DLL \SystemRoot\System32\igxpdx32.DLL \SystemRoot\System32\ATMFD.DLL \??\C:\WINDOWS\system32\drivers\mbam.sys \SystemRoot\system32\DRIVERS\ndisuio.sys \SystemRoot\system32\drivers\wdmaud.sys \SystemRoot\system32\drivers\sysaudio.sys \SystemRoot\system32\DRIVERS\mrxdav.sys \SystemRoot\System32\Drivers\inpout32.sys \SystemRoot\system32\DRIVERS\srv.sys \SystemRoot\system32\DRIVERS\mdmxsdk.sys \SystemRoot\system32\DRIVERS\ipfltdrv.sys \SystemRoot\System32\Drivers\HTTP.sys \??\C:\WINDOWS\system32\drivers\mbamchameleon.sys \??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys \WINDOWS\system32\ntdll.dll ----------- End ----------- <<<1>>> Upper Device Name: \Device\Harddisk0\DR0 Upper Device Object: 0xffffffff8afa4ab8 Upper Device Driver Name: \Driver\Disk\ Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-3\ Lower Device Object: 0xffffffff8afa9d98 Lower Device Driver Name: \Driver\atapi\ Driver name found: atapi Initialization returned 0x0 Load Function returned 0x0 Downloaded database version: v2013.05.05.07 Downloaded database version: v2013.05.01.01 Initializing... Done! <<<2>>> Device number: 0, partition: 1 Physical Sector Size: 512 Drive: 0, DevicePointer: 0xffffffff8afa4ab8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ --------- Disk Stack ------ DevicePointer: 0xffffffff8afa4960, DeviceName: Unknown, DriverName: \Driver\pssnap\ DevicePointer: 0xffffffff8af26e08, DeviceName: Unknown, DriverName: \Driver\PartMgr\ DevicePointer: 0xffffffff8afa4ab8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ DevicePointer: 0xffffffff8afaaf18, DeviceName: \Device\00000067\, DriverName: \Driver\ACPI\ DevicePointer: 0xffffffff8afa9d98, DeviceName: \Device\Ide\IdeDeviceP0T0L0-3\, DriverName: \Driver\atapi\ ------------ End ---------- Alternate DeviceName: Unknown, DriverName: \Driver\PartMgr\ Upper DeviceData: 0xffffffffe192fc60, 0xffffffff8afa4ab8, 0xffffffff8a047488 Lower DeviceData: 0xffffffffe365a878, 0xffffffff8afa9d98, 0xffffffff8a60e6e8 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Scanning directory: C:\WINDOWS\system32\drivers... <<<2>>> Device number: 0, partition: 1 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Done! Drive 0 Scanning MBR on drive 0... Inspecting partition table: MBR Signature: 55AA Disk Signature: 1E901E9 Partition information: Partition 0 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 63 Numsec = 976751937 Partition file system is NTFS Partition is bootable Partition 1 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 2 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Disk Size: 500107862016 bytes Sector size: 512 bytes Scanning physical sectors of unpartitioned space on drive 0 (1-62-976753168-976773168)... Done! Performing system, memory and registry scan... Done! Scan finished ======================================= --------------------------------------- Malwarebytes Anti-Rootkit BETA 1.05.0.1001 © Malwarebytes Corporation 2011-2012 OS version: 5.1.2600 Windows XP Service Pack 3 x86 Account is Administrative Internet Explorer version: 8.0.6001.18702 File system is: NTFS Disk drives: C:\ DRIVE_FIXED CPU speed: 2.594000 GHz Memory total: 3663093760, free: 3078590464 Removal queue found; removal started Removal finished =======================================
  10. MrCharlie, Where should I look for the other logs that show the infection? (do you have filenames?) B.
  11. Hello MrCharlie, Downloaded mbar.exe and ran the program. First run, 1 infection found, clicked clean up. Rebooted. Second run, No infections found. Also, the trojan backdoor communications seem to have stopped! You sir, Are a true wizard. Thank You! Best Regards, B. Here are the files you requested... Malwarebytes Anti-Rootkit BETA 1.05.0.1001 www.malwarebytes.org Database version: v2013.05.05.07 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 Administrator :: COMP1 [administrator] 5/5/2013 7:59:02 PM mbar-log-2013-05-05 (19-59-02).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P Scan options disabled: Objects scanned: 26452 Time elapsed: 10 minute(s), 17 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) --------------------------------------- Malwarebytes Anti-Rootkit BETA 1.05.0.1001 © Malwarebytes Corporation 2011-2012 OS version: 5.1.2600 Windows XP Service Pack 3 x86 Account is Administrative Internet Explorer version: 8.0.6001.18702 File system is: NTFS Disk drives: C:\ DRIVE_FIXED CPU speed: 2.594000 GHz Memory total: 3663093760, free: 3065147392 ------------ Kernel report ------------ 05/05/2013 19:48:00 ------------ Loaded modules ----------- \WINDOWS\system32\ntkrnlpa.exe \WINDOWS\system32\hal.dll \WINDOWS\system32\KDCOM.DLL \WINDOWS\system32\BOOTVID.dll ACPI.sys \WINDOWS\system32\DRIVERS\WMILIB.SYS pci.sys isapnp.sys ohci1394.sys \WINDOWS\system32\DRIVERS\1394BUS.SYS pciide.sys \WINDOWS\system32\DRIVERS\PCIIDEX.SYS MountMgr.sys ftdisk.sys dmload.sys dmio.sys PartMgr.sys Achernar.sys VolSnap.sys atapi.sys disk.sys \WINDOWS\system32\DRIVERS\CLASSPNP.SYS fltMgr.sys sr.sys KSecDD.sys Ntfs.sys NDIS.sys pssnap.sys Mup.sys \SystemRoot\system32\DRIVERS\igxpmp32.sys \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS \SystemRoot\system32\DRIVERS\HECI.sys \SystemRoot\system32\DRIVERS\e1c5132.sys \SystemRoot\system32\DRIVERS\usbehci.sys \SystemRoot\system32\DRIVERS\USBPORT.SYS \SystemRoot\system32\DRIVERS\HDAudBus.sys \SystemRoot\system32\DRIVERS\nusb3xhc.sys \SystemRoot\system32\DRIVERS\USBD.SYS \SystemRoot\system32\DRIVERS\nic1394.sys \SystemRoot\system32\DRIVERS\imapi.sys \SystemRoot\system32\DRIVERS\cdrom.sys \SystemRoot\system32\DRIVERS\redbook.sys \SystemRoot\system32\DRIVERS\ks.sys \SystemRoot\system32\DRIVERS\intelppm.sys \SystemRoot\system32\DRIVERS\usbscan.sys \SystemRoot\system32\DRIVERS\audstub.sys \SystemRoot\system32\DRIVERS\rasl2tp.sys \SystemRoot\system32\DRIVERS\ndistapi.sys \SystemRoot\system32\DRIVERS\ndiswan.sys \SystemRoot\system32\DRIVERS\raspppoe.sys \SystemRoot\system32\DRIVERS\raspptp.sys \SystemRoot\system32\DRIVERS\TDI.SYS \SystemRoot\system32\DRIVERS\psched.sys \SystemRoot\system32\DRIVERS\msgpc.sys \SystemRoot\system32\DRIVERS\ptilink.sys \SystemRoot\system32\DRIVERS\raspti.sys \SystemRoot\system32\DRIVERS\rdpdr.sys \SystemRoot\system32\DRIVERS\termdd.sys \SystemRoot\system32\DRIVERS\kbdclass.sys \SystemRoot\system32\DRIVERS\mouclass.sys \SystemRoot\system32\DRIVERS\swenum.sys \SystemRoot\system32\DRIVERS\update.sys \SystemRoot\system32\DRIVERS\mssmbios.sys \SystemRoot\System32\Drivers\NDProxy.SYS \SystemRoot\system32\DRIVERS\usbhub.sys \SystemRoot\system32\DRIVERS\nusb3hub.sys \SystemRoot\system32\drivers\RtkHDAud.sys \SystemRoot\system32\drivers\portcls.sys \SystemRoot\system32\drivers\drmk.sys \SystemRoot\system32\DRIVERS\IntcDAud.sys \SystemRoot\system32\DRIVERS\usbccgp.sys \SystemRoot\system32\DRIVERS\hidusb.sys \SystemRoot\system32\DRIVERS\HIDCLASS.SYS \SystemRoot\system32\DRIVERS\HIDPARSE.SYS \SystemRoot\system32\DRIVERS\emOEM.sys \SystemRoot\system32\DRIVERS\emBDA.sys \SystemRoot\system32\DRIVERS\BdaSup.SYS \SystemRoot\system32\drivers\emAudio.sys \SystemRoot\system32\DRIVERS\mouhid.sys \SystemRoot\System32\Drivers\Fs_Rec.SYS \SystemRoot\System32\Drivers\Null.SYS \SystemRoot\System32\Drivers\Beep.SYS \SystemRoot\System32\drivers\vga.sys \SystemRoot\System32\Drivers\mnmdd.SYS \SystemRoot\System32\DRIVERS\RDPCDD.sys \SystemRoot\System32\Drivers\Msfs.SYS \SystemRoot\System32\Drivers\Npfs.SYS \SystemRoot\system32\DRIVERS\rasacd.sys \SystemRoot\system32\DRIVERS\ipsec.sys \SystemRoot\system32\DRIVERS\tcpip.sys \SystemRoot\system32\DRIVERS\netbt.sys \SystemRoot\system32\DRIVERS\ipnat.sys \SystemRoot\System32\drivers\afd.sys \SystemRoot\system32\DRIVERS\netbios.sys \SystemRoot\system32\DRIVERS\rdbss.sys \SystemRoot\system32\DRIVERS\mrxsmb.sys \SystemRoot\System32\Drivers\hwinterface.sys \SystemRoot\System32\Drivers\Fips.SYS \SystemRoot\System32\Drivers\Cdfs.SYS \SystemRoot\system32\DRIVERS\wanarp.sys \SystemRoot\system32\DRIVERS\arp1394.sys \??\C:\WINDOWS\System32\Drivers\KMWDFilter.SYS \SystemRoot\system32\DRIVERS\kbdhid.sys \SystemRoot\System32\Drivers\dump_atapi.sys \SystemRoot\System32\Drivers\dump_WMILIB.SYS \SystemRoot\System32\win32k.sys \SystemRoot\System32\drivers\Dxapi.sys \SystemRoot\System32\watchdog.sys \SystemRoot\System32\drivers\dxg.sys \SystemRoot\System32\drivers\dxgthk.sys \SystemRoot\System32\igxpgd32.dll \SystemRoot\System32\igxprd32.dll \SystemRoot\System32\igxpdv32.DLL \SystemRoot\System32\igxpdx32.DLL \SystemRoot\System32\ATMFD.DLL \??\C:\WINDOWS\system32\drivers\mbam.sys \SystemRoot\system32\DRIVERS\ndisuio.sys \SystemRoot\system32\drivers\wdmaud.sys \SystemRoot\system32\drivers\sysaudio.sys \SystemRoot\system32\DRIVERS\mrxdav.sys \SystemRoot\System32\Drivers\inpout32.sys \SystemRoot\system32\DRIVERS\srv.sys \SystemRoot\system32\DRIVERS\mdmxsdk.sys \SystemRoot\system32\DRIVERS\ipfltdrv.sys \SystemRoot\System32\Drivers\HTTP.sys \??\C:\WINDOWS\system32\drivers\mbamchameleon.sys \??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys \WINDOWS\system32\ntdll.dll ----------- End ----------- <<<1>>> Upper Device Name: \Device\Harddisk0\DR0 Upper Device Object: 0xffffffff8afa4ab8 Upper Device Driver Name: \Driver\Disk\ Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-3\ Lower Device Object: 0xffffffff8afa9d98 Lower Device Driver Name: \Driver\atapi\ Driver name found: atapi Initialization returned 0x0 Load Function returned 0x0 Downloaded database version: v2013.05.05.07 Downloaded database version: v2013.05.01.01 Initializing... Done! <<<2>>> Device number: 0, partition: 1 Physical Sector Size: 512 Drive: 0, DevicePointer: 0xffffffff8afa4ab8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ --------- Disk Stack ------ DevicePointer: 0xffffffff8afa4960, DeviceName: Unknown, DriverName: \Driver\pssnap\ DevicePointer: 0xffffffff8af26e08, DeviceName: Unknown, DriverName: \Driver\PartMgr\ DevicePointer: 0xffffffff8afa4ab8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ DevicePointer: 0xffffffff8afaaf18, DeviceName: \Device\00000067\, DriverName: \Driver\ACPI\ DevicePointer: 0xffffffff8afa9d98, DeviceName: \Device\Ide\IdeDeviceP0T0L0-3\, DriverName: \Driver\atapi\ ------------ End ---------- Alternate DeviceName: Unknown, DriverName: \Driver\PartMgr\ Upper DeviceData: 0xffffffffe192fc60, 0xffffffff8afa4ab8, 0xffffffff8a047488 Lower DeviceData: 0xffffffffe365a878, 0xffffffff8afa9d98, 0xffffffff8a60e6e8 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Scanning directory: C:\WINDOWS\system32\drivers... <<<2>>> Device number: 0, partition: 1 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Done! Drive 0 Scanning MBR on drive 0... Inspecting partition table: MBR Signature: 55AA Disk Signature: 1E901E9 Partition information: Partition 0 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 63 Numsec = 976751937 Partition file system is NTFS Partition is bootable Partition 1 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 2 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Disk Size: 500107862016 bytes Sector size: 512 bytes Scanning physical sectors of unpartitioned space on drive 0 (1-62-976753168-976773168)... Done! Performing system, memory and registry scan... Done! Scan finished =======================================
  12. Hello MrCharlie Ran Roughkiller and when i cliched the "Scan" button, ran a few minutes and got the blue screen.
  13. Hello. Bought your and ran your pro software, my computer is trying to comunicate with bad sites, even when showing no trojans in your log. Here's ddx.txt... DDS (Ver_2012-11-20.01) - NTFS_x86 Internet Explorer: 8.0.6001.18702 Run by Administrator at 17:55:57 on 2013-05-05 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3493.1689 [GMT -4:00] . . ============== Running Processes ================ . C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe C:\UPS\WSTD\UPSNA1Msgr.exe C:\Program Files\Common Files\Aimersoft\Aimersoft Helper Compact\ASHelper.exe C:\Program Files\Micro Innovations\Multimedia Keyboard Driver\StartAutorun.exe C:\WINDOWS\system32\ctfmon.exe C:\UPS\WSTD\WSTDMessaging.exe C:\Program Files\Micro Innovations\Multimedia Keyboard Driver\KMConfig.exe C:\Program Files\Micro Innovations\Multimedia Keyboard Driver\KMProcess.exe C:\WINDOWS\system32\IProsetMonitor.exe C:\Program Files\Micro Innovations\Multimedia Keyboard Driver\KMWDSrv.exe C:\Program Files\Intel\Intel® Management Engine Components\LMS\LMS.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\UPS\WSTD\MSSQL$UPSWSDBSERVER\Binn\sqlservr.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe C:\Program Files\Macrium\Reflect\ReflectService.exe C:\Program Files\Intel\Intel® Management Engine Components\UNS\UNS.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k NetworkService C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\system32\svchost.exe -k imgsvc . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.yahoo.com/ uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch uURLSearchHooks: <No Name>: - LocalServer32 - <no file> BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - <orphaned> BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\5.7.8313.1002\swg.dll BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [igfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [RTHDCPL] RTHDCPL.EXE mRun: [NUSB3MON] "c:\program files\renesas electronics\usb 3.0 host controller driver\application\nusb3mon.exe" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [NA1Messenger] c:\ups\wstd\UPSNA1Msgr.exe mRun: [Wondershare Helper Compact.exe] c:\program files\common files\wondershare\wondershare helper compact\WSHelper.exe mRun: [Aimersoft Helper Compact.exe] c:\program files\common files\aimersoft\aimersoft helper compact\ASHelper.exe mRun: [KMCONFIG] c:\program files\micro innovations\multimedia keyboard driver\StartAutorun.exe KMConfig.exe dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\upswor~2.lnk - c:\ups\wstd\WSTDMessaging.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\upswor~1.lnk - c:\ups\wstd\wstdPldReminder.exe uPolicies-Explorer: NoDriveTypeAutoRun = dword:145 mPolicies-Explorer: NoDriveTypeAutoRun = dword:145 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe . INFO: HKCU has more than 50 listed domains. If you wish to scan all of them, select the 'Force scan all domains' option. . DPF: {106E49CF-797A-11D2-81A2-00E02C015623} - hxxp://www.alternatiff.com/distribution/alternatiff-ax-w32-2.0.4.cab DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} - hxxps://h50203.www5.hp.com/CSMWeb/Customer/cabs/HPISDataManager.CAB TCP: NameServer = 75.75.75.75 75.75.76.76 TCP: Interfaces\{691CBF23-0B9E-4D30-9688-0F59F5E0D897} : DHCPNameServer = 75.75.75.75 75.75.76.76 Notify: igfxcui - igfxdev.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll Hosts: 127.0.0.1 www.spywareinfo.com . ============= SERVICES / DRIVERS =============== . R0 Achernar;Achernar - SCSI Command Filter Drivers;c:\windows\system32\drivers\Achernar.sys [2012-9-2 18432] R0 pssnap;Paramount Software Snapshot Filter;c:\windows\system32\drivers\pssnap.sys [2008-5-20 15328] R1 hwinterface;hwinterface;c:\windows\system32\drivers\hwinterface.sys [2012-1-23 3026] R2 inpout32;inpout32;c:\windows\system32\drivers\inpout32.sys [2012-1-25 11936] R2 Intel® PROSet Monitoring Service;Intel® PROSet Monitoring Service;c:\windows\system32\IPROSetMonitor.exe [2012-1-10 109728] R2 KMWDSERVICE;Keyboard And Mouse Communication Service;c:\program files\micro innovations\multimedia keyboard driver\KMWDSrv.exe [2007-6-9 208896] R2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2013-5-4 418376] R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2013-5-4 701512] R2 MSSQL$UPSWSDBSERVER;MSSQL$UPSWSDBSERVER;c:\ups\wstd\mssql$upswsdbserver\binn\sqlservr.exe -supswsdbserver --> c:\ups\wstd\mssql$upswsdbserver\binn\sqlservr.exe -sUPSWSDBSERVER [?] R2 ReflectService;Macrium Reflect Image Mounting Service;c:\program files\macrium\reflect\ReflectService.exe [2008-8-6 216032] R2 UNS;Intel® Management and Security Application User Notification Service;c:\program files\intel\intel® management engine components\uns\UNS.exe [2012-1-10 2656280] R3 IntcDAud;Intel® Display Audio;c:\windows\system32\drivers\IntcDAud.sys [2012-1-10 260864] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-5-4 22856] R3 MEI;Intel® Management Engine Interface;c:\windows\system32\drivers\HECI.sys [2012-1-10 41088] R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys [2011-2-10 63872] R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys [2011-2-10 141952] S0 cerc6;cerc6; [x] S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2012-1-10 1691480] S3 HP DS Service;HP DS Service;c:\program files\hp\hpbdsservice\HPBDSService.exe [2010-10-27 13824] S3 NmPar;PCI Parallel Port;c:\windows\system32\drivers\NmPar.sys [2008-12-24 80256] S3 nmserial;PCI Serial Port;c:\windows\system32\drivers\NmSerial.sys [2008-12-16 70016] S3 PciPPorts;PCI ECP Parallel Port;c:\windows\system32\drivers\PciPPorts.sys [2008-5-22 82432] S3 PCIVIEW;PCIVIEW;\??\c:\pci view download\98654656pciview\pciview.sys --> c:\pci view download\98654656pciview\PCIVIEW.sys [?] S3 PSMounter;Macrium Reflect Image Explorer Service;c:\windows\system32\drivers\psmounter.sys [2008-7-8 31712] S3 SQLAgent$UPSWSDBSERVER;SQLAgent$UPSWSDBSERVER;c:\ups\wstd\mssql$upswsdbserver\binn\sqlagent.exe -i upswsdbserver --> c:\ups\wstd\mssql$upswsdbserver\binn\sqlagent.EXE -i UPSWSDBSERVER [?] . =============== Created Last 30 ================ . 2013-05-04 22:37:52 -------- d-----w- c:\documents and settings\administrator\application data\Malwarebytes 2013-05-04 22:37:39 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes 2013-05-04 22:37:37 22856 ----a-w- c:\windows\system32\drivers\mbam.sys 2013-05-04 22:37:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2013-05-04 22:36:40 -------- d-----w- C:\MALWAREBYTES DOWNLOAD 2013-05-03 14:21:21 -------- d-----w- c:\windows\system32\wbem\repository\FS 2013-05-03 14:21:21 -------- d-----w- c:\windows\system32\wbem\Repository 2013-04-16 12:15:10 -------- d-----w- C:\IRISH RECORDINGS 2013-04-06 19:20:41 -------- d-----w- C:\BIGMOUTH 2013-04-06 18:55:42 -------- d-----w- c:\program files\Voicent 2013-04-06 18:42:14 16128 -c--a-w- c:\windows\system32\dllcache\modemcsa.sys 2013-04-06 18:42:14 16128 ----a-w- c:\windows\system32\drivers\MODEMCSA.sys 2013-04-06 18:42:06 86016 ----a-r- c:\windows\system32\mdmxsdk.dll 2013-04-06 18:42:06 13059 ----a-r- c:\windows\system32\drivers\mdmxsdk.sys 2013-04-06 18:42:06 110592 ----a-r- c:\windows\system32\uci32100.dll 2013-04-06 18:42:06 -------- d-----w- c:\program files\CONEXANT 2013-04-06 18:42:05 244480 ----a-r- c:\windows\system32\drivers\HSFHWBS2.sys 2013-04-06 18:42:05 1035008 ----a-r- c:\windows\system32\drivers\HSF_DPV.sys 2013-04-06 18:42:04 718464 ----a-r- c:\windows\system32\drivers\HSF_CNXT.sys . ==================== Find3M ==================== . 2013-05-02 15:28:50 238872 ------w- c:\windows\system32\MpSigStub.exe 2013-03-12 19:51:12 73432 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2013-03-12 19:51:12 693976 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2013-03-08 08:36:22 293376 ----a-w- c:\windows\system32\winsrv.dll 2013-03-07 01:32:25 2149888 ----a-w- c:\windows\system32\ntoskrnl.exe 2013-03-07 00:50:30 2028544 ----a-w- c:\windows\system32\ntkrnlpa.exe 2013-03-02 02:06:31 916480 ----a-w- c:\windows\system32\wininet.dll 2013-03-02 02:06:30 43520 ------w- c:\windows\system32\licmgr10.dll 2013-03-02 02:06:30 1469440 ------w- c:\windows\system32\inetcpl.cpl 2013-03-02 01:25:02 1867264 ----a-w- c:\windows\system32\win32k.sys 2013-03-02 01:08:47 385024 ------w- c:\windows\system32\html.iec 2013-02-27 07:56:51 2067456 ----a-w- c:\windows\system32\mstscax.dll 2013-02-12 00:32:23 12928 ----a-w- c:\windows\system32\drivers\usb8023.sys . =================== ROOTKIT ==================== . Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net Windows 5.1.2600 Disk: ST500DM002-1BC142 rev.JC4B -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 . device: opened successfully user: MBR read successfully . Disk trace: called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8ACF34B1]<< _asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x8acfa93c]; MOV EAX, [0x8acfaab0]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; } 1 ntkrnlpa!IofCallDriver[0x804EF200] -> \Device\Harddisk0\DR0[0x8AFADAB8] 3 CLASSPNP[0xB9918FD7] -> ntkrnlpa!IofCallDriver[0x804EF200] -> \Device\00000066[0x8AFDFF18] 5 ACPI[0xB977F620] -> ntkrnlpa!IofCallDriver[0x804EF200] -> [0x8AF7B940] \Driver\atapi[0x8AE9D030] -> IRP_MJ_CREATE -> 0x8ACF34B1 error: Read A device attached to the system is not functioning. kernel: MBR read successfully _asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [bP+0x0], CH; JL 0x2e; JNZ 0x3a; } detected disk devices: detected hooks: \Driver\atapi DriverStartIo -> 0x8ACF32E2 user & kernel MBR OK Warning: possible TDL3 rootkit infection ! . ============= FINISH: 17:56:42.87 ===============
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.