Novice needs Help - TDSS Rootkit

Uisna88 · November 21, 2012

I'm a bona fide novice and need your help. I'm really really stupid: the virus protection software on our PC expired and I did nothing about it - and I haven't backed up anything in over a year. I'm worried that any computer technician I would take this to would just advise wiping the hard-drive and starting fresh - but my problem is the thousand images and writings that haven't been backed up.

So maybe I could take a deep breath and try to fix this - with your help...

I'm communicating with you right now on our second computer which is a Mac. I'm concerned about spreading any infections between my two computers via thumbdrive, as I have already been transferring free anti-virus software from my mac to my pc.

I read your preliminary notes, but am afraid of getting back onto the infected PC until I have a better idea of what I'm doing. I just purchased the professional Malwarebytes - and now I am wondering how to get it onto my PC. I did order the back-up CD... I suppose I could wait for this to be delivered via snail mail.

So here's what's happened. I'll be succinct. I apologize in advance for not using proper terminology.

* 11/15/12 - Screen went black and twenty pop-up windows warned me of imminent hard-drive failure. Recommended HD cleaner product. Me: suspicious. Wrote down warning message, googled it. Found info about TDSS rootkit, smartHDD, etc. Followed links to "bleepingcomputer.com."

*11/15/12 - Downloaded Malwarebytes free software, transferred this from thumbdrive to pc (in safemode with networking.)

Ran "rootkill," but TDSSKiller wouldn't run, renamed or not. Did a scan of the C Drive with Malwarebytes, this found 7 things: Trojan.Agent and (6)instances of PUM.Hijack in the start menu.

* As soon as I restarted my pc, the problems came back.

*11/16/12 9:40AM Scanned again, found Trojan.FakeAVFile and Trojan.Registry Value

*11/16/12: Porn Sites start popping up of their own accord. Malwarebytes blocks some ("Malwarebytes successfully blocked access to a potentially malicious website 31.184.192.86 type outgoing")

*11/18/12: More porn sites pop up on their own like dandelions on a freshly mown lawn. (www.freehardcore, xxxTube.com, liveJasmin.com)

*11/19/12: I download Comodo onto my mac and transfer this by thumbdrive to my pc. It finds the following:

TrojWare.Win32PkdKrap.AG@99609516 F:\My F Drive Documents\CHIRON 2007\EXL6512721.zip

and Malware@#1knfu38o4uajuC:\Documents and Settings\Shae

LiveJasmin still pops up.

*11/20/12 Comodo finds: Rootkit.hidden file C:\Documents and Settings\Shae\Cookies\DR2R032Z.txt

and Malwarebytes blocks access to bad sites.

* 11/20/12 4:23PM Loaded Avast onto PC. The Virus(es) sneer at it and take me to "xdating.com"

*11/20/12 4:25PM I turn off my demonically-possessed pc.

I'm done trying to sort this out on my own. Any help you can offer will be forever appreciated. Thanks.

MrCharlie · November 21, 2012

Welcome to the forum. See if you can do this:

Please remove any usb or external drives from the computer before you run this scan!

Please download and run RogueKiller to your desktop.

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

MrC

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 48 hours, please send me a PM)

Uisna88 · November 21, 2012

<p>Thank you Mr. C.</p>

<p>My infected pc won't allow me to log into my Malwarebytes account. Can I be spreading this infection by navigating to gmail to email this to myself so I can cut and paste it in the user forum to you?</p>

<p>Uisna88</p>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); border-top-width: 0px; border-top-style: initial; border-top-color: initial; ">RogueKiller V8.3.1 [Nov 20 2012] by Tigzy</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">mail: tigzyRK<at>gmail<dot>com</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">Feedback: <a href="http://www.geekstogo.com/forum/files/file/413-roguekiller/" style="color: rgb(0, 0, 204); outline-style: none; outline-width: initial; outline-color: initial; " target="_blank">http://www.geekstogo.com/forum/files/file/413-roguekiller/</a></div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">Website: <a href="http://tigzy.geekstogo.com/roguekiller.php" style="color: rgb(0, 0, 204); outline-style: none; outline-width: initial; outline-color: initial; " target="_blank">http://tigzy.geekstogo.com/roguekiller.php</a></div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">Blog: <a href="http://tigzyrk.blogspot.com/" style="color: rgb(0, 0, 204); outline-style: none; outline-width: initial; outline-color: initial; " target="_blank">http://tigzyrk.blogspot.com</a></div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">Operating System: Windows XP (5.1.2600 Service Pack 3) 32 bits version</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">Started in : Safe mode with network support</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">User : shae [Admin rights]</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">¤¤¤ Bad processes : 0 ¤¤¤</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">¤¤¤ Registry Entries : 20 ¤¤¤</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">[RUN][sUSP PATH] HKCU\[...]\Run : Google Update ("C:\Documents and Settings\shae\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c) -> FOUND</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">[RUN][sUSP PATH] HKUS\S-1-5-21-220523388-1343024091-1547161642-1004[...]\Run : Google Update ("C:\Documents and Settings\shae\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c) -> FOUND</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">[TASK][sUSP PATH] GoogleUpdateTaskUserS-1-5-21-220523388-1343024091-1547161642-500UA.job : C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe /ua /installsource scheduler -> FOUND</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">[TASK][sUSP PATH] GoogleUpdateTaskUserS-1-5-21-220523388-1343024091-1547161642-500Core.job : C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe /c -> FOUND</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">[TASK][sUSP PATH] GoogleUpdateTaskUserS-1-5-21-220523388-1343024091-1547161642-1004UA.job : C:\Documents and Settings\shae\Local Settings\Application Data\Google\Update\GoogleUpdate.exe /ua /installsource scheduler -> FOUND</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">[TASK][sUSP PATH] GoogleUpdateTaskUserS-1-5-21-220523388-1343024091-1547161642-1004Core.job : C:\Documents and Settings\shae\Local Settings\Application Data\Google\Update\GoogleUpdate.exe /c -> FOUND</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">[HJPOL] HKCU\[...]\System : DisableTaskMgr (0) -> FOUND</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">[HJPOL] HKLM\[...]\System : DisableTaskMgr (0) -> FOUND</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">[HJ SMENU] HKCU\[...]\Advanced : Start_ShowRecentDocs (0) -> FOUND</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">[HJ SMENU] HKCU\[...]\Advanced : Start_ShowUser (0) -> FOUND</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyPics (0) -> FOUND</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyMusic (0) -> FOUND</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">[HJ SMENU] HKCU\[...]\Advanced : Start_ShowPrinters (0) -> FOUND</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">[HJ SMENU] HKCU\[...]\Advanced : Start_ShowSetProgramAccessAndDefaults (0) -> FOUND</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">[HJ DESK] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">[HJ DESK] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">[HJ DESK] HKCU\[...]\ClassicStartMenu : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">¤¤¤ Particular Files / Folders: ¤¤¤</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">¤¤¤ Driver : [NOT LOADED] ¤¤¤</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">¤¤¤ Infection : Root.MBR ¤¤¤</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">¤¤¤ HOSTS File: ¤¤¤</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">--> C:\WINDOWS\system32\drivers\etc\hosts</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">127.0.0.1 localhost</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">¤¤¤ MBR Check: ¤¤¤</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">+++++ PhysicalDrive0: WDC WD400EB-75CPF0 +++++</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">[bSP] f0531316a6163d16f4ba254ab3fe3bf4 : Windows XP MBR Code</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">Partition table:</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 38154 Mo</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">[bSP] f0531316a6163d16f4ba254ab3fe3bf4 : Windows XP MBR Code [possible maxSST in 1!]</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">Partition table:</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 38154 Mo</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">1 - [ACTIVE] NTFS (0x17) [HIDDEN!] Offset (sectors): 78140160 | Size: 12 Mo</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">+++++ PhysicalDrive1: QUANTUM FIREBALLlct20 40 +++++</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">Error reading User MBR!</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">Error reading LL1 MBR!</div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">Finished : << RKreport[1]_S_11202012_02d1900.txt >></div>

<div style="font-family: 'Lucida Grande', Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: rgb(0, 0, 0); ">RKreport[1]_S_11202012_02d1900.txt</div>

MrCharlie · November 21, 2012

That log is not readable, can you attach the log:

To attach a log:

Bottom right corner of this page.

New window that comes up.

MrC

Uisna88 · November 21, 2012

Let's try again. RogueKiller Nov 20 2012.txt

MrCharlie · November 21, 2012

Download, unzip and run the attached TDSSKiller.

Please don't update it when asked!!!!

Run it like this:

Please read the directions carefully so you don't end up deleting something that is good!!

Please note that TDSSKiller can be run in safe mode if needed.

Here's a video that explains how to run it if needed:

Please download the latest version of TDSSKiller from here and save it to your Desktop.

Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.
Put a checkmark beside loaded modules.
A reboot will be needed to apply the changes. Do it.
TDSSKiller will launch automatically after the reboot. Also your computer may seem very slow and unusable. This is normal. Give it enough time to load your background programs.
Then click on Change parameters in TDSSKiller.
Check all boxes then click OK.
Click the Start Scan button.
The scan should take no longer than 2 minutes.
If a suspicious object is detected, the default action will be Skip, click on Continue.

Any entries like this: \Device\Harddisk0\DR0 ( TDSS File System ) - please choose Skip.
If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.

Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here. There may be 3 logs > so post or attach all of them.
Sometimes these logs can be very large, in that case please attach it or zip it up and attach it.

Here's a summary of what to do if you would like to print it out:

If a suspicious object is detected, the default action will be Skip, click on Continue

If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose

Skip and click on Continue

Any entries like this: \Device\Harddisk0\DR0 ( TDSS File System ) - please choose Skip.

If malicious objects are found, they will show in the Scan results and offer three (3) options.

Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.

Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

~~~~~~~~~~~~~~~~~~~~

You can attach the logs if they're too long:

Bottom right corner of this page.

New window that comes up.

MrC

Uisna88 · November 21, 2012

Mr. C.

Should I be attempting to access this forum from the infected PC? Or from my second computer, a Mac, and saving tdsskiller to a thumbdrive and then putting this on my PC?

MrCharlie · November 21, 2012

Do the Mach and flash drive, MrC

Uisna88 · November 22, 2012

I got as far as rebooting the system, checked the boxes and started the scan, but then the screen went blue and read:

"A problem has been detected and Windows has been shut down to prevent further damage to your computer.

If this is the first time you have seen this stop error screen, restart your computer. If this screen appears again follow these steps:

Check to make sure you have adequate disk space. If a driver is id-ed, disable the driver or check for manufacturer updates.

Try changing the video adapters.

Check with hardware vendor for for any Bios updates. Disable Bios memory options such as caching or shadowing, if you need to use safe mode.

TECH INFO:

***STOP:0x0000008E(0xC0000005, 0x87B58097, 0xAF358944, 0x00000000)

Beginning dump of physical memory.

Physical memory dump complete."

Uisna88 · November 22, 2012

I rebooted three times after this and received the same results.

MrCharlie · November 23, 2012

Try this one:

Please create a new system restore point before running Malwarebytes Anti-Rootkit.

MBAR tutorial

Download Malwarebytes Anti-Rootkit from HERE

Unzip the contents to a folder in a convenient location.
Open the folder where the contents were unzipped and run mbar.exe
Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
Click on the Cleanup button to remove any threats and reboot if prompted to do so.
Wait while the system shuts down and the cleanup process is performed.
Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt

To attach a log if needed:

Bottom right corner of this page.

New window that comes up.

MrC

Uisna88 · November 24, 2012

I sure hope doing a "system restore" to two weeks ago will suffice for "creating a new system restore point" because that's what I've just done.

I'm also hoping it will somehow circumvent the whole "blue screen of death" problem.

The mbar tutorial is telling me to back up files before I begin, but that's not possible is it?

Okay, going to go try running mbar, will report back shortly.

Uisna88 · November 24, 2012

The scan kept getting stuck while checking sectors, so after 4 goes, I unchecked the box to check sectors and ran the scan. This worked.

Made it all the way through, found 24 malicious items. Cleaned these up, restarted in normal mode, desktop looked normal for the first time in 8 days.

Ran the scan again (again with "sectors" unchecked), found nothing (!)

Ran the scan again, this time including sectors, the scan made it all the way through this time, no malicious anythings found.

What next? Turn off my PC or leave it on?

Here are the logs:

mbar-log-2012-11-24 (01-23-14).txt

mbar-log-2012-11-24 (02-07-48).txt

mbar-log-2012-11-24 (06-29-59).txt

system-log.txt

MrCharlie · November 24, 2012

Please run the fixdamage tool in the Malwarebytes Anti-Rootkit folder and reboot.

Then...............

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingc...to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

Uisna88 · November 25, 2012

Hello Mr. C.

Did everything you told me to do. Here is the log:

ComboFix.txt

What's next?

(And Thank You.)

MrCharlie · November 25, 2012

Please find this file and upload to VirusTotal for a free scan, let me know the results (just copy back the url)

http://www.virustotal.com/

c:\windows\msisear.exe

MrC


2012-11-22 21:56 . 2012-11-22 21:56 307712 ----a-w- c:\windows\msisear.exe
2012-11-22 20:33 . 2012-11-22 20:33 177496 ----a-w- c:\windows\system32\drivers\53419241.sys
2012-11-22 20:21 . 2012-11-22 20:21 177496 ----a-w- c:\windows\system32\drivers\69148762.sys
2012-11-22 19:44 . 2012-11-22 19:44 177496 ----a-w- c:\windows\system32\drivers\78844860.sys
S0 vqdtrh;vqdtrh; [x]

Uisna88 · November 26, 2012

https://www.virustotal.com/file/5e9fe833cb7f520bbef316ca057e873ee7123bdd34c911ccd46f318e87e95f75/analysis/1353907906/

Things feel like they're much better on my PC. What's next, and will I eventually find the programs that were hidden by the rootkit/viruses/trojans/evil code?

Uisna88 · November 26, 2012

And how do I determine if my thumb drive is safe or infected?

MrCharlie · November 26, 2012

And how do I determine if my thumb drive is safe or infected?

http://research.pand...utoRun-Vaccine/

Then scan with MB

~~~~~~~~~~~~~~~~~~~~~~~

Using ComboFix......

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

4. If ComboFix wants to update.....please allow it to.

File::
c:\windows\msisear.exe
c:\windows\system32\drivers\53419241.sys
c:\windows\system32\drivers\69148762.sys
c:\windows\system32\drivers\78844860.sys
Driver::
vqdtrh
78844860
69148762
53419241
ClearJavaCache::

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

CAUTION: Do not mouse-click ComboFix while it is running. It may cause it to stall.

After reboot, (in case it asks to reboot)......

Please provide the contents of the ComboFix log (C:\ComboFix.txt) in your next reply.

MrC

Uisna88 · November 26, 2012

"Then scan with MB"

Sorry... MB? Malwarebytes?

MrCharlie · November 27, 2012

Yes, sorry.........MrC

Uisna88 · November 27, 2012

ComboFix.txt

The thumb drive is benign and has been inoculated.

Uisna88 · November 27, 2012

DOH! I forgot... there is a second hard drive in this computer, the F-Drive. From the logs generated concerning the threats found on this PC, can you tell whether or not the F-drive was affected? Has it been scanned and were threats contained/removed?

Most programs are hidden. Right now I can access files and photos on the C-Drive (in a round-about way), but the ones on the F-Drive are still hidden.

Thanks!

MrCharlie · November 27, 2012

It appears that you didn't use the CFScript.txt when you ran ComboFix.

I've attached it, please try it again and carefully follow the instructions.

Running unhide on the other drive may unhide the files:

http://www.smartestc...ted-by-a-virus/

You should also scan it with Malwarebytes.

MrC

Uisna88 · November 28, 2012

ComboFix 12-11-27.01 - shae 11/27/2012 22:50:30.6.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1527.1010 [GMT -8:00]

Running from: c:\documents and settings\shae\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\shae\Desktop\CFScript.txt

AV: avast! Internet Security *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

FW: avast! Internet Security *Disabled* {7591DB91-41F0-48A3-B128-1A293FD8233D}

.

FILE ::

"c:\windows\msisear.exe"

"c:\windows\system32\drivers\53419241.sys"

"c:\windows\system32\drivers\69148762.sys"

"c:\windows\system32\drivers\78844860.sys"

.

((((((((((((((((((((((((( Files Created from 2012-10-28 to 2012-11-28 )))))))))))))))))))))))))))))))

.

2012-11-27 05:12 . 2012-11-27 05:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Panda Security

2012-11-27 05:12 . 2012-11-27 05:12 -------- d-----w- C:\Panda USB Vaccine

2012-11-27 05:04 . 2012-11-27 05:04 -------- d-----w- c:\windows\system32\KB905474

2012-11-24 04:27 . 2012-11-24 04:27 -------- d-----w- C:\CCE_Quarantine

2012-11-22 21:56 . 2012-11-22 21:56 307712 ----a-w- c:\windows\msisear.exe

2012-11-22 20:33 . 2012-11-22 20:33 177496 ----a-w- c:\windows\system32\drivers\53419241.sys

2012-11-22 20:21 . 2012-11-22 20:21 177496 ----a-w- c:\windows\system32\drivers\69148762.sys

2012-11-22 19:44 . 2012-11-22 19:44 177496 ----a-w- c:\windows\system32\drivers\78844860.sys

2012-11-20 16:56 . 2012-10-30 23:51 361032 ----a-w- c:\windows\system32\drivers\aswSP.sys

2012-11-20 16:56 . 2012-10-30 23:51 21256 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys

2012-11-20 16:56 . 2012-10-30 23:51 106560 ----a-w- c:\windows\system32\drivers\aswFW.sys

2012-11-20 16:55 . 2012-10-30 23:51 35928 ----a-w- c:\windows\system32\drivers\aswRdr.sys

2012-11-20 16:55 . 2012-10-30 23:51 199320 ----a-w- c:\windows\system32\drivers\aswNdis2.sys

2012-11-20 16:55 . 2012-10-30 23:51 54232 ----a-w- c:\windows\system32\drivers\aswTdi.sys

2012-11-20 16:55 . 2012-10-30 23:51 20624 ----a-w- c:\windows\system32\drivers\aswKbd.sys

2012-11-20 16:55 . 2012-10-30 23:51 738504 ----a-w- c:\windows\system32\drivers\aswSnx.sys

2012-11-20 16:55 . 2012-10-30 23:51 97608 ----a-w- c:\windows\system32\drivers\aswmon2.sys

2012-11-20 16:55 . 2012-10-30 23:51 89752 ----a-w- c:\windows\system32\drivers\aswmon.sys

2012-11-20 16:55 . 2012-10-30 23:51 25256 ----a-w- c:\windows\system32\drivers\aavmker4.sys

2012-11-20 16:52 . 2012-09-21 09:26 12112 ----a-w- c:\windows\system32\drivers\aswNdis.sys

2012-11-20 16:52 . 2012-10-30 23:51 41224 ----a-w- c:\windows\avastSS.scr

2012-11-20 16:52 . 2012-10-30 23:50 227648 ----a-w- c:\windows\system32\aswBoot.exe

2012-11-20 16:51 . 2012-11-20 16:51 -------- d-----w- c:\program files\AVAST Software

2012-11-20 16:51 . 2012-11-20 16:51 -------- d-----w- c:\documents and settings\All Users\Application Data\AVAST Software

2012-11-16 08:30 . 2012-09-30 03:54 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-11-16 08:30 . 2012-11-16 08:31 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2012-11-16 06:14 . 2012-11-16 06:14 -------- d-sh--w- c:\documents and settings\Administrator\IECompatCache

2012-10-30 09:09 . 2012-11-08 00:01 -------- d-----w- c:\program files\Mozilla Thunderbird

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-11-16 05:14 . 2012-07-11 03:36 697272 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-11-16 05:14 . 2011-06-05 12:19 73656 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-10-22 08:37 . 2008-05-03 12:00 1866368 ----a-w- c:\windows\system32\win32k.sys

2012-10-02 18:04 . 2008-05-03 12:00 58368 ----a-w- c:\windows\system32\synceng.dll

2012-06-05 06:18 . 2012-06-05 06:07 22259528 ----a-w- c:\program files\vlc-2.0.1-win32.exe

2003-08-27 14:19 . 2009-02-25 08:36 36963 ----a-r- c:\program files\Common Files\SM1updtr.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2012-10-30 23:50 121528 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-10-19 155648]

"EPSON Stylus C64 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2C1.EXE" [2003-05-27 99840]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-30 421888]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]

"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2012-10-30 4297136]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"nltide_3"="advpack.dll" [2009-03-08 128512]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"DisableCAD"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"MemCheckBoxInRunDlg"= 1 (0x1)

"StartMenuFavorites"= 0 (0x0)

"Start_ShowMyComputer"= 1 (0x1)

"Start_ShowMyDocs"= 1 (0x1)

"Start_ShowMyMusic"= 0 (0x0)

"Start_ShowRun"= 1 (0x1)

"Start_ShowSearch"= 0 (0x0)

.

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

"ForceClassicControlPanel"= 1 (0x1)

"NoResolveTrack"= 1 (0x1)

"NoSMConfigurePrograms"= 1 (0x1)

"MemCheckBoxInRunDlg"= 1 (0x1)

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2011-05-04 17:54 551296 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

@=""

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk

backup=c:\windows\pss\Adobe Gamma Loader.exe.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^EPSON SMART PANEL for Scanner.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\EPSON SMART PANEL for Scanner.lnk

backup=c:\windows\pss\EPSON SMART PANEL for Scanner.lnkCommon Startup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]

c:\docume~1\ADMINI~1\LOCALS~1\Temp\SSUPDATE.EXE Software\SUPERAntiSpyware.com\SUPERAntiSpyware [X]

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2012-01-02 17:07 843712 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2012-03-27 12:41 37296 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C64 Series (Copy 1)]

2003-05-27 03:00 99840 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\E_S4I2C1.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]

2007-01-01 21:22 3739648 ----a-w- c:\program files\Google\Google Talk\googletalk.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]

2005-10-19 08:59 126976 ----a-w- c:\windows\system32\hkcmd.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InstantAccess]

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2010-12-14 01:16 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2010-11-30 01:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegisterDropHandler]

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]

2004-04-13 22:36 1470464 ----a-w- c:\program files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SM1BG]

2003-08-27 14:20 94208 ----a-r- c:\windows\SM1bg.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]

2004-10-14 14:42 1404928 ----a-w- c:\program files\Analog Devices\Core\smax4pnp.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2011-06-09 20:06 254696 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"Bonjour Service"=2 (0x2)

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background

"swg"=c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe"=

"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

.

R0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\drivers\aswNdis.sys [11/20/2012 8:52 AM 12112]

R0 aswNdis2;avast! Firewall Core Firewall Service;c:\windows\system32\drivers\aswNdis2.sys [11/20/2012 8:55 AM 199320]

R1 aswFW;avast! TDI Firewall driver;c:\windows\system32\drivers\aswFW.sys [11/20/2012 8:56 AM 106560]

R1 aswKbd;aswKbd;c:\windows\system32\drivers\aswKbd.sys [11/20/2012 8:55 AM 20624]

R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [11/20/2012 8:55 AM 738504]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [11/20/2012 8:56 AM 361032]

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [7/22/2011 8:27 AM 12880]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [7/12/2011 1:55 PM 67664]

R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCore.exe [8/11/2011 3:38 PM 116608]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [11/20/2012 8:56 AM 21256]

R2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe [11/20/2012 8:52 AM 133912]

R2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [11/16/2012 12:30 AM 399432]

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [11/16/2012 12:30 AM 676936]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [11/16/2012 12:30 AM 22856]

S1 MpKslb2b6002e;MpKslb2b6002e;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E21659E5-641D-4A14-B42A-8F6FED3420D6}\MpKslb2b6002e.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E21659E5-641D-4A14-B42A-8F6FED3420D6}\MpKslb2b6002e.sys [?]

S2 WLSVC;WLSVC;c:\program files\TRENDnet\TEW-424UB\WLSVC.exe [9/27/2011 5:47 PM 167936]

S3 RTL8187B;TRENDnet TEW-424UB 54M USB Dongle;c:\windows\system32\drivers\RTL8187B.sys [9/27/2011 5:47 PM 264576]

S3 SASENUM;SASENUM;\??\c:\??\c:\program files\SUPERAntiSpyware\SASENUM.SYS --> C:c:\program files\SUPERAntiSpyware\SASENUM.SYS [?]

.

Contents of the 'Scheduled Tasks' folder

.

2012-11-12 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-02 11:34]

.

2012-11-27 c:\windows\Tasks\avast! Emergency Update.job

- c:\program files\AVAST Software\Avast\AvastEmUpdate.exe [2012-11-20 23:50]

.

2012-11-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-220523388-1343024091-1547161642-1004Core.job

- c:\documents and settings\shae\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-12-24 14:09]

.

2012-11-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-220523388-1343024091-1547161642-1004UA.job

- c:\documents and settings\shae\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-12-24 14:09]

.

2012-11-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-220523388-1343024091-1547161642-500Core.job

- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-09-28 06:15]

.

2012-11-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-220523388-1343024091-1547161642-500UA.job

- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-09-28 06:15]

.

2012-11-27 c:\windows\Tasks\PandaUSBVaccine.job

- c:\panda usb vaccine\RunInteractiveWin.exe [2012-11-27 00:45]

.

2012-11-27 c:\windows\Tasks\WGASetup.job

- c:\windows\system32\KB905474\wgasetup.exe [2012-11-27 06:18]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

uInternet Settings,ProxyOverride = *.local

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.1.1

DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2012-11-27 23:01

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(992)

c:\program files\SUPERAntiSpyware\SASWINLO.DLL

c:\windows\system32\WININET.dll

.

- - - - - - - > 'explorer.exe'(3512)

c:\windows\system32\WININET.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\IEFRAME.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

Completion time: 2012-11-27 23:03:49

ComboFix-quarantined-files.txt 2012-11-28 07:03

ComboFix2.txt 2012-11-27 07:03

ComboFix3.txt 2012-11-25 05:56

ComboFix4.txt 2011-10-01 23:17

.

Pre-Run: 9,311,186,944 bytes free

Post-Run: 9,300,705,280 bytes free

.

- - End Of File - - 11E2A8D803E08C949A9E7B5D73E316BC

Novice needs Help - TDSS Rootkit

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information