alpine
-
Posts
3 -
Joined
-
Last visited
Content Type
Events
Profiles
Forums
Posts posted by alpine
-
-
I ran gmer it showed few infections then i did kaspersky bootscan module and it keeps on showing one thread in c:\windows\system32\drivers\######.sys service every time i reboot also have alot of weird and hidden files and alot of weird traffic in wireshark
that I did some research on and it seemed like bootkit for UEFI so here I am, looking for some help was pointed here by "forum deity" I do own a pro version of malwarebytes however I run it on my desktop PC its laptop im currently having problems with its an ASUS G75VX
so Im doing scans now and will attach all logs in few minutes... Need to close all apps as directed.
-
Can someone Please help me remove the rootkit or bootkit, gmer showed a few hidden services and all I know im infected even my BIOS menu changed recently
I cannot narrow down what it is but here is the log from gmer
GMER 2.1.19163 - http://www.gmer.netRootkit scan 2013-07-30 17:02:22Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000038 Intel___ rev.1.0. 476.90GBRunning: gmer.exe; Driver: C:\Users\ALPINO\AppData\Local\Temp\pxldrpog.sys---- User code sections - GMER 2.1 ----.text C:\WINDOWS\system32\wininit.exe[592] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 698 00007fff5ccf267a 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\wininit.exe[592] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 706 00007fff5ccf2682 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\wininit.exe[592] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 270 00007fff5ccf2faa 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\wininit.exe[592] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 294 00007fff5ccf2fc2 4 bytes {CALL 0xffffffffff5ccf34}.text C:\WINDOWS\system32\services.exe[684] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 698 00007fff5ccf267a 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\services.exe[684] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 706 00007fff5ccf2682 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\services.exe[684] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 270 00007fff5ccf2faa 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\services.exe[684] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 294 00007fff5ccf2fc2 4 bytes {CALL 0xffffffffff5ccf34}.text C:\WINDOWS\system32\lsass.exe[696] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 698 00007fff5ccf267a 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\lsass.exe[696] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 706 00007fff5ccf2682 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\lsass.exe[696] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 270 00007fff5ccf2faa 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\lsass.exe[696] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 294 00007fff5ccf2fc2 4 bytes {CALL 0xffffffffff5ccf34}.text C:\WINDOWS\system32\svchost.exe[812] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 698 00007fff5ccf267a 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\svchost.exe[812] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 706 00007fff5ccf2682 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\svchost.exe[812] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 270 00007fff5ccf2faa 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\svchost.exe[812] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 294 00007fff5ccf2fc2 4 bytes {CALL 0xffffffffff5ccf34}.text C:\WINDOWS\system32\dwm.exe[912] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff5cd016aa 4 bytes [D0, 5C, FF, 7F].text C:\WINDOWS\system32\dwm.exe[912] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff5cd016b2 4 bytes [D0, 5C, FF, 7F].text C:\WINDOWS\system32\dwm.exe[912] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff5cd0181a 4 bytes [D0, 5C, FF, 7F].text C:\WINDOWS\system32\dwm.exe[912] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff5cd01832 4 bytes [D0, 5C, FF, 7F].text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[968] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff5cd016aa 4 bytes [D0, 5C, FF, 7F].text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[968] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff5cd016b2 4 bytes [D0, 5C, FF, 7F].text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[968] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff5cd0181a 4 bytes [D0, 5C, FF, 7F].text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[968] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff5cd01832 4 bytes [D0, 5C, FF, 7F].text C:\WINDOWS\system32\nvvsvc.exe[976] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff5cd016aa 4 bytes [D0, 5C, FF, 7F].text C:\WINDOWS\system32\nvvsvc.exe[976] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff5cd016b2 4 bytes [D0, 5C, FF, 7F].text C:\WINDOWS\system32\nvvsvc.exe[976] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff5cd0181a 4 bytes [D0, 5C, FF, 7F].text C:\WINDOWS\system32\nvvsvc.exe[976] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff5cd01832 4 bytes [D0, 5C, FF, 7F].text C:\WINDOWS\System32\svchost.exe[516] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 698 00007fff5ccf267a 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\System32\svchost.exe[516] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 706 00007fff5ccf2682 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\System32\svchost.exe[516] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 270 00007fff5ccf2faa 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\System32\svchost.exe[516] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 294 00007fff5ccf2fc2 4 bytes {CALL 0xffffffffff5ccf34}.text C:\WINDOWS\system32\svchost.exe[584] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 698 00007fff5ccf267a 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\svchost.exe[584] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 706 00007fff5ccf2682 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\svchost.exe[584] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 270 00007fff5ccf2faa 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\svchost.exe[584] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 294 00007fff5ccf2fc2 4 bytes {CALL 0xffffffffff5ccf34}.text C:\WINDOWS\system32\svchost.exe[900] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 698 00007fff5ccf267a 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\svchost.exe[900] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 706 00007fff5ccf2682 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\svchost.exe[900] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 270 00007fff5ccf2faa 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\svchost.exe[900] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 294 00007fff5ccf2fc2 4 bytes {CALL 0xffffffffff5ccf34}.text C:\WINDOWS\System32\svchost.exe[1064] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 698 00007fff5ccf267a 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\System32\svchost.exe[1064] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 706 00007fff5ccf2682 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\System32\svchost.exe[1064] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 270 00007fff5ccf2faa 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\System32\svchost.exe[1064] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 294 00007fff5ccf2fc2 4 bytes {CALL 0xffffffffff5ccf34}.text C:\WINDOWS\system32\svchost.exe[1216] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 698 00007fff5ccf267a 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\svchost.exe[1216] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 706 00007fff5ccf2682 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\svchost.exe[1216] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 270 00007fff5ccf2faa 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\svchost.exe[1216] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 294 00007fff5ccf2fc2 4 bytes {CALL 0xffffffffff5ccf34}.text C:\WINDOWS\System32\spoolsv.exe[1420] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 698 00007fff5ccf267a 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\System32\spoolsv.exe[1420] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 706 00007fff5ccf2682 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\System32\spoolsv.exe[1420] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 270 00007fff5ccf2faa 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\System32\spoolsv.exe[1420] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 294 00007fff5ccf2fc2 4 bytes {CALL 0xffffffffff5ccf34}.text C:\WINDOWS\System32\spoolsv.exe[1420] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff5cd016aa 4 bytes [D0, 5C, FF, 7F].text C:\WINDOWS\System32\spoolsv.exe[1420] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff5cd016b2 4 bytes [D0, 5C, FF, 7F].text C:\WINDOWS\System32\spoolsv.exe[1420] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff5cd0181a 4 bytes [D0, 5C, FF, 7F].text C:\WINDOWS\System32\spoolsv.exe[1420] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff5cd01832 4 bytes [D0, 5C, FF, 7F].text C:\WINDOWS\system32\svchost.exe[1448] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 698 00007fff5ccf267a 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\svchost.exe[1448] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 706 00007fff5ccf2682 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\svchost.exe[1448] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 270 00007fff5ccf2faa 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\svchost.exe[1448] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 294 00007fff5ccf2fc2 4 bytes {CALL 0xffffffffff5ccf34}.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1776] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 698 00007fff5ccf267a 4 bytes [CF, 5C, FF, 7F].text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1776] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 706 00007fff5ccf2682 4 bytes [CF, 5C, FF, 7F].text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1776] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 270 00007fff5ccf2faa 4 bytes [CF, 5C, FF, 7F].text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[1776] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 294 00007fff5ccf2fc2 4 bytes {CALL 0xffffffffff5ccf34}.text C:\Program Files\Windows Defender\MsMpEng.exe[700] C:\WINDOWS\system32\psapi.dll!GetModuleBaseNameA + 506 00007fff5cd016aa 4 bytes [D0, 5C, FF, 7F].text C:\Program Files\Windows Defender\MsMpEng.exe[700] C:\WINDOWS\system32\psapi.dll!GetModuleBaseNameA + 514 00007fff5cd016b2 4 bytes [D0, 5C, FF, 7F].text C:\Program Files\Windows Defender\MsMpEng.exe[700] C:\WINDOWS\system32\psapi.dll!QueryWorkingSet + 118 00007fff5cd0181a 4 bytes [D0, 5C, FF, 7F].text C:\Program Files\Windows Defender\MsMpEng.exe[700] C:\WINDOWS\system32\psapi.dll!QueryWorkingSet + 142 00007fff5cd01832 4 bytes [D0, 5C, FF, 7F].text C:\Program Files\Windows Defender\MsMpEng.exe[700] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 698 00007fff5ccf267a 4 bytes [CF, 5C, FF, 7F].text C:\Program Files\Windows Defender\MsMpEng.exe[700] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 706 00007fff5ccf2682 4 bytes [CF, 5C, FF, 7F].text C:\Program Files\Windows Defender\MsMpEng.exe[700] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 270 00007fff5ccf2faa 4 bytes [CF, 5C, FF, 7F].text C:\Program Files\Windows Defender\MsMpEng.exe[700] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 294 00007fff5ccf2fc2 4 bytes {CALL 0xffffffffff5ccf34}.text C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe[2148] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 698 00007fff5ccf267a 4 bytes [CF, 5C, FF, 7F].text C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe[2148] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 706 00007fff5ccf2682 4 bytes [CF, 5C, FF, 7F].text C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe[2148] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 270 00007fff5ccf2faa 4 bytes [CF, 5C, FF, 7F].text C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe[2148] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 294 00007fff5ccf2fc2 4 bytes {CALL 0xffffffffff5ccf34}.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2688] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 698 00007fff5ccf267a 4 bytes [CF, 5C, FF, 7F].text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2688] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 706 00007fff5ccf2682 4 bytes [CF, 5C, FF, 7F].text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2688] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 270 00007fff5ccf2faa 4 bytes [CF, 5C, FF, 7F].text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2688] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 294 00007fff5ccf2fc2 4 bytes {CALL 0xffffffffff5ccf34}.text C:\WINDOWS\Explorer.EXE[2880] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff5cd016aa 4 bytes [D0, 5C, FF, 7F].text C:\WINDOWS\Explorer.EXE[2880] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff5cd016b2 4 bytes [D0, 5C, FF, 7F].text C:\WINDOWS\Explorer.EXE[2880] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff5cd0181a 4 bytes [D0, 5C, FF, 7F].text C:\WINDOWS\Explorer.EXE[2880] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff5cd01832 4 bytes [D0, 5C, FF, 7F].text C:\WINDOWS\Explorer.EXE[2880] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 698 00007fff5ccf267a 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\Explorer.EXE[2880] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 706 00007fff5ccf2682 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\Explorer.EXE[2880] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 270 00007fff5ccf2faa 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\Explorer.EXE[2880] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 294 00007fff5ccf2fc2 4 bytes {CALL 0xffffffffff5ccf34}.text C:\WINDOWS\system32\svchost.exe[3100] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 698 00007fff5ccf267a 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\svchost.exe[3100] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 706 00007fff5ccf2682 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\svchost.exe[3100] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 270 00007fff5ccf2faa 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\svchost.exe[3100] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 294 00007fff5ccf2fc2 4 bytes {CALL 0xffffffffff5ccf34}.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3356] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 698 00007fff5ccf267a 4 bytes [CF, 5C, FF, 7F].text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3356] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 706 00007fff5ccf2682 4 bytes [CF, 5C, FF, 7F].text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3356] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 270 00007fff5ccf2faa 4 bytes [CF, 5C, FF, 7F].text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3356] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 294 00007fff5ccf2fc2 4 bytes {CALL 0xffffffffff5ccf34}.text C:\WINDOWS\system32\SearchIndexer.exe[3380] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 698 00007fff5ccf267a 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\SearchIndexer.exe[3380] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 706 00007fff5ccf2682 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\SearchIndexer.exe[3380] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 270 00007fff5ccf2faa 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\SearchIndexer.exe[3380] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 294 00007fff5ccf2fc2 4 bytes {CALL 0xffffffffff5ccf34}.text C:\Program Files\Logitech\SetPointP\SetPoint.exe[3704] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 202 00007fff47dc3cfa 4 bytes [DC, 47, FF, 7F].text C:\Program Files\Logitech\SetPointP\SetPoint.exe[3704] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 226 00007fff47dc3d12 4 bytes [DC, 47, FF, 7F].text C:\Program Files\Logitech\SetPointP\SetPoint.exe[3704] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff5cd016aa 4 bytes [D0, 5C, FF, 7F].text C:\Program Files\Logitech\SetPointP\SetPoint.exe[3704] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff5cd016b2 4 bytes [D0, 5C, FF, 7F].text C:\Program Files\Logitech\SetPointP\SetPoint.exe[3704] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff5cd0181a 4 bytes [D0, 5C, FF, 7F].text C:\Program Files\Logitech\SetPointP\SetPoint.exe[3704] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff5cd01832 4 bytes [D0, 5C, FF, 7F].text C:\Program Files\Logitech\SetPointP\SetPoint.exe[3704] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 698 00007fff5ccf267a 4 bytes [CF, 5C, FF, 7F].text C:\Program Files\Logitech\SetPointP\SetPoint.exe[3704] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 706 00007fff5ccf2682 4 bytes [CF, 5C, FF, 7F].text C:\Program Files\Logitech\SetPointP\SetPoint.exe[3704] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 270 00007fff5ccf2faa 4 bytes [CF, 5C, FF, 7F].text C:\Program Files\Logitech\SetPointP\SetPoint.exe[3704] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 294 00007fff5ccf2fc2 4 bytes {CALL 0xffffffffff5ccf34}.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3348] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 698 00007fff5ccf267a 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\wbem\wmiprvse.exe[3348] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 706 00007fff5ccf2682 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\wbem\wmiprvse.exe[3348] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 270 00007fff5ccf2faa 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\wbem\wmiprvse.exe[3348] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 294 00007fff5ccf2fc2 4 bytes {CALL 0xffffffffff5ccf34}.text C:\WINDOWS\system32\wbem\wmiprvse.exe[992] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 698 00007fff5ccf267a 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\wbem\wmiprvse.exe[992] C:\WINDOWS\system32\NSI.dll!NsiGetAllPersistentParametersWithMask + 706 00007fff5ccf2682 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\wbem\wmiprvse.exe[992] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 270 00007fff5ccf2faa 4 bytes [CF, 5C, FF, 7F].text C:\WINDOWS\system32\wbem\wmiprvse.exe[992] C:\WINDOWS\system32\NSI.dll!NsiSetAllPersistentParametersWithMask + 294 00007fff5ccf2fc2 4 bytes {CALL 0xffffffffff5ccf34}---- Threads - GMER 2.1 ----Thread C:\WINDOWS\system32\csrss.exe [600:2076] fffff96000966d40Thread C:\WINDOWS\system32\csrss.exe [600:4200] fffff96000966d40---- Registry - GMER 2.1 ----Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\RNG@RNGAuxiliarySeed 1301831310Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@Rw 0x64 0x62 0x03 0x00 ...Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@RwMask 0x64 0x62 0x03 0x00 ...Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\1@Rw 0x64 0x62 0x03 0x00 ...Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\1@RwMask 0x64 0x62 0x03 0x00 ...Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\2@Rw 0x64 0x62 0x03 0x00 ...Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\2@RwMask 0x64 0x62 0x03 0x00 ...Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\3@Rw 0x64 0x62 0x03 0x00 ...Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\3@RwMask 0x64 0x62 0x03 0x00 ...Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shutdown@CleanShutdown 1Reg HKCU\Software\Microsoft\Windows\CurrentVersion\ImmersiveShell\Grid@Logo100 %USERPROFILE%\AppData\Local\Microsoft\Windows\Explorer\TileCacheLogo-4451000_100.datReg HKCU\Software\Microsoft\Windows\CurrentVersion\ImmersiveShell\Grid@Tickle80 %USERPROFILE%\AppData\Local\Microsoft\Windows\Explorer\TileCacheTickle-4450890_80.datReg HKCU\Software\Microsoft\Windows\CurrentVersion\Store\RefreshBannedAppList@BannedAppsLastModified 0x00 0x72 0xDD 0x46 ...---- EOF - GMER 2.1 ----Here is log of autostart from GMERGMER 2.1.19163 - http://www.gmer.netAutostart scan 2013-07-30 17:26:18Windows 6.2.9200HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\Canon BJ Language Monitor iP2600 series@Driver = CNMLM97.DLLHKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LBTWlgn@DLLName = c:\program files\common files\logishrd\bluetooth\LBTWlgn.dllHKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows@AppInit_DLLs = C:\PROGRA~1\NVIDIA~1\NVSTRE~1\rxinput.dllHKLM\SYSTEM\CurrentControlSet\Services\ >>>asComSvc@ = C:\Program Files (x86)\ASUS\AXSP\1.00.12\atkexComSvc.exeASLDRService@ = C:\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exeAsSysCtrlService@ = C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exeATKGFNEXSrv@ = C:\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exegupdate@ = "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svcIAStorDataMgrSvc@ = "C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe"NvStreamSvc@ = "C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe"nvsvc@ = "C:\WINDOWS\system32\nvvsvc.exe"nvUpdatusService@ = "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe"PnkBstrA@ = C:\WINDOWS\system32\PnkBstrA.exe /*file not found*/Stereo Service@ = "C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe"VMAuthdService@ = "C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe"VMnetDHCP@ = C:\WINDOWS\system32\vmnetdhcp.exe /*file not found*/VMUSBArbService@ = "C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe"VMware NAT Service@ = C:\WINDOWS\system32\vmnat.exe /*file not found*/WinDefend@ = "%ProgramFiles%\Windows Defender\MsMpEng.exe" /*file not found*/WiTopiaService@ = "C:\Program Files\WiTopia\WiTopiaService.exe"XTU3SERVICE@ = "C:\Program Files (x86)\Intel\Extreme Tuning Utility\XtuService.exe"HKLM\Software\Microsoft\Windows\CurrentVersion\Run >>>@SynTPEnh%ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe /*file not found*/ = %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe /*file not found*/@RTHDVCPLC:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s = C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s@IAStorIcon"C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIconLaunch.exe" "C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" 60 = "C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIconLaunch.exe" "C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" 60@EvtMgr6C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming = C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming@Nvtmru"C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" = "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"@Launch LCoreC:\Program Files\Logitech Gaming Software\LCore.exe /minimized = C:\Program Files\Logitech Gaming Software\LCore.exe /minimizedHKCU\Software\Microsoft\Windows\CurrentVersion\Run >>>@WiTopiaC:\Program Files\tojatwuj\WiTopia.exe /*file not found*/ = C:\Program Files\tojatwuj\WiTopia.exe /*file not found*/@DAEMON Tools Lite"C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun = "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun@Google Update"C:\Users\ALPINO\AppData\Local\Google\Update\GoogleUpdate.exe" /c = "C:\Users\ALPINO\AppData\Local\Google\Update\GoogleUpdate.exe" /c@MusicManager"C:\Users\ALPINO\AppData\Local\Programs\Google\MusicManager\MusicManager.exe" = "C:\Users\ALPINO\AppData\Local\Programs\Google\MusicManager\MusicManager.exe"HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad@WebCheck =HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe@DisableExceptionChainValidation = 3 /*file not found*/HKLM\Software\Classes\.hta@ = C:\Windows\SysWOW64\mshta.exe "%1" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}%U{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} %*HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved >>>@{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} /*Contacts folder*/(null) =@{E6FB5E20-DE35-11CF-9C87-00AA005127ED} /*WebCheck*/(null) =@{2F603045-309F-11CF-9774-0020AFD0CFF6} /*Synaptics Control Panel*/%ProgramFiles%\Synaptics\SynTP\SynTPCpl.dll /*file not found*/ = %ProgramFiles%\Synaptics\SynTP\SynTPCpl.dll /*file not found*/@{23170F69-40C1-278A-1000-000100020000} /*7-Zip Shell Extension*/C:\Program Files\7-Zip\7-zip.dll = C:\Program Files\7-Zip\7-zip.dll@{3DBEE9A1-C471-4B95-BBCA-F39310064458} /*Microsoft Camera Raw Property Store*/C:\Program Files\Common Files\Microsoft Shared\Microsoft Camera Codec Pack\MicrosoftRawCodec.dll = C:\Program Files\Common Files\Microsoft Shared\Microsoft Camera Codec Pack\MicrosoftRawCodec.dll@{B1883831-F0D8-4453-8245-EEAAD866DD6E} /*HashTab Context Menu*/(null) =@{8A56567E-A333-4843-B6E1-C3A262E41D8C} /*HashTab Property Page*/C:\Program Files\HashTab Shell Extension\HashTab64-5.1.0.23.dll = C:\Program Files\HashTab Shell Extension\HashTab64-5.1.0.23.dll@Logitech Setpoint Extension /*{B9B9F083-2B04-452A-8691-83694AC1037B}*/(null) =@{DC70C4A5-2044-4c59-B806-DEFB9AE0DF7C} /*Logitech Setpoint Extension*/C:\Program Files\Logitech\SetPointP\kbcplext.dll = C:\Program Files\Logitech\SetPointP\kbcplext.dll@{A70C977A-BF00-412C-90B7-034C51DA2439} /*NvCpl DesktopContext Class*/C:\Program Files\NVIDIA Corporation\Display\nvui.dll = C:\Program Files\NVIDIA Corporation\Display\nvui.dll@{3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} /*NVIDIA Play On My TV Context Menu Extension*/%SystemRoot%\system32\nvshext.dll = %SystemRoot%\system32\nvshext.dll@{45AC2688-0253-4ED8-97DE-B5370FA7D48A} /*Shell Extension for Malware scanning*/(null) =HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ >>>7-Zip@{23170F69-40C1-278A-1000-000100020000} = C:\Program Files\7-Zip\7-zip.dllANotepad++64@{B298D29A-A6ED-11DE-BA8C-A68E55D89593} = C:\Program Files (x86)\Notepad++\NppShell_05.dllHKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\7-Zip@{23170F69-40C1-278A-1000-000100020000} = C:\Program Files\7-Zip\7-zip.dllHKLM\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers\NvCplDesktopContext@{3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} = %SystemRoot%\system32\nvshext.dllHKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\MBAMShlExt@{57CE581A-0CB6-4266-9CA0-19364C90A0B3} = C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamext.dllHKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects@{AF949550-9094-4807-95EC-D1C317803333} = C:\Program Files\Logitech\SetPointP\SetPointSmooth.dllHKLM\Software\Microsoft\Internet Explorer\Main >>>@Default_Page_URLhttp://go.microsoft.com/fwlink/p/?LinkId=255141 = http://go.microsoft.com/fwlink/p/?LinkId=255141@Start Pagehttp://go.microsoft.com/fwlink/p/?LinkId=255141 = http://go.microsoft.com/fwlink/p/?LinkId=255141@Local PageC:\Windows\System32\blank.htm = C:\Windows\System32\blank.htmHKCU\Software\Microsoft\Internet Explorer\Main >>>@Start Pagehttps://www.google.com/ = https://www.google.com/@Local PageC:\WINDOWS\system32\blank.htm = C:\WINDOWS\system32\blank.htmHKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{1390ECB8-7172-4FF6-B6FD-EC9C2E02CA4D} /*VMware Network Adapter VMnet1*/ >>>@IPAddress192.168.2.122 = 192.168.2.122@NameServer192.168.2.1 = 192.168.2.1@DefaultGateway192.168.2.1 = 192.168.2.1@Domainfasss.fghde.dsg = fasss.fghde.dsgHKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{4E4F2840-69C3-4059-B067-981C68B3F61B} /*Wi-Fi*/ >>>@IPAddress =@NameServer =@DefaultGateway =@Domain =HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{F0BB2A76-F1AF-4637-9861-C19DA6E7DDE0} /*VMware Network Adapter VMnet8*/ >>>@IPAddress192.168.199.1 = 192.168.199.1@NameServer =@Domain =HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\ >>>000000000011@PackedCatalogItem = %windir%\system32\vsocklib.dll000000000012@PackedCatalogItem = %windir%\system32\vsocklib.dllHKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64\ >>>000000000011@PackedCatalogItem = %windir%\system32\vsocklib.dllHKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries64\000000000012@PackedCatalogItem = %windir%\system32\vsocklib.dll---- EOF - GMER 2.1 ----
Have a bootkit/rootkit need help tried almost everything
in Resolved Malware Removal Logs
Posted
here is hijackthis log I cannot run dds since I run on windows 8.1
hijackthis.log