possible trojan

jjuletid · January 25, 2013

I found this forum (http://forums.malwarebytes.org/index.php?showtopic=113340) after looking around for information on the results of Malwarebytes scan I performed (and I entered the string from the malicious file), and I followed all of the instructions and removed the infected files, but I'm still concerned about my computer. I think I may have a trojan, but I'm not entirely sure. Norton isn't picking anything up, and actually, the rogue killer .exe that's on this page was identified as malware, which prevented the download. I used Malwarebytes rootkit program instead, which also located malicious files.

If you can recommend a better antivirus product (I even had a Norton tech manually scan my computer with no results), then I would greatly appreciate it. Incidentally, my Norton identity protection keeps crashing in chrome and the browser's speed has been impacted significantly.

Thanks a lot,

Jim

dds.txt

attach.txt

gringo_pr · January 25, 2013

Greetings and Welcome to The Forums!!

My name is Gringo and I'll be glad to help you with your malware problems.

I have put together somethings for you to keep in mind while I am helping you to make things go easier and faster for both of us

Please do not run any tools unless instructed to do so.
- We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
[*]Please do not attach logs or use code boxes, just copy and paste the text.
- Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
[*]Please read every post completely before doing anything.
- Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
[*]Please provide feedback about your experience as we go.
- A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the Watch Topic Button, select Immediate Notification, and click on Proceed. This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

These are the programs I would like you to run next, if you have any problems with these just skip it and run the next one.

-Security Check-

Download Security Check by screen317 from

here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

-AdwCleaner-

Please download

AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Delete.
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next answer.
You can find the logfile at C:\AdwCleaner[s1].txt as well.

--RogueKiller--

Download & SAVE to your Desktop RogueKiller or from here
- Quit all programs that you may have started.
- Please disconnect any USB or external drives from the computer before you run this scan!
- For Vista or Windows 7, right-click and select "Run as Administrator to start"
- For Windows XP, double-click to start.
- Wait until Prescan has finished ...
- Then Click on "Scan" button
- Wait until the Status box shows "Scan Finished"
- click on "delete"
- Wait until the Status box shows "Deleting Finished"
- Click on "Report" and copy/paste the content of the Notepad into your next reply.
- The log should be found in RKreport[1].txt on your Desktop
- Exit/Close RogueKiller+

Gringo

gringo_pr · January 27, 2013

Hello

48 Hour bump

It has been more than 48 hours since my last post.

do you still need help with this?
do you need more time?
are you having problems following my instructions?
if after 48hrs you have not replied to this thread then it will have to be closed!

Gringo

jjuletid · January 29, 2013

Hi Gringo (well done on your name choice ,

I didn't receive a notification when you posted originally, so my apologies fo the delay - I'll go through the steps you've detailed above and get back in touch once I've finished. Thank you for your help.

Best,

Jim

gringo_pr · January 29, 2013

I will be here when you are ready

The name fits that is why I l;ike it also

jjuletid · January 30, 2013

Hi Gringo,

I've performed the first two steps, but RogueKiller is still being flagged as "not safe" by Norton and being removed. How should I proceed?

Jim

gringo_pr · January 30, 2013

try turning norton off to download it please

jjuletid · February 1, 2013

Hi Gringo,

I ran all of the scans, and I'm enclosing the results. FYI, the 'check FAKED' button was checked off when I ran the RogueKiller scan, but it started that way automatically. It seems as though I had a ZeroAccess rootkit. By the way, can you recommend any good resources for learning about malware / malvertising (e.g. books, articles, websites)? Thanks again for all of your help.

Jim

Results of screen317's Security Check version 0.99.57

Windows Vista Service Pack 2 x86 (UAC is enabled)

Internet Explorer 9

``````````````Antivirus/Firewall Check:``````````````

Windows Firewall Disabled!

Norton 360

WMI entry may not exist for antivirus; attempting automatic update.

`````````Anti-malware/Other Utilities Check:`````````

Spybot - Search & Destroy

Malwarebytes Anti-Malware version 1.70.0.1100

CCleaner

JavaFX 2.1.1

Java 6 Update 32

Java 7 Update 9

Java 6 Update 2

Java 6 Update 7

Java SE Development Kit 6 Update 30

Java DB 10.6.2.1

Java version out of Date!

Adobe Flash Player 11.5.502.146

Adobe Reader 9 Adobe Reader out of Date!

Mozilla Firefox 14.0.1 Firefox out of Date!

Google Chrome 24.0.1312.56

````````Process Check: objlist.exe by Laurent````````

Norton ccSvcHst.exe

Malwarebytes Anti-Malware mbamservice.exe

Malwarebytes Anti-Malware mbamgui.exe

Spybot Teatimer.exe is disabled!

Malwarebytes' Anti-Malware mbamscheduler.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C: 1 %

````````````````````End of Log``````````````````````

------------------------------------------------------------------------------------------------------------------

# AdwCleaner v2.109 - Logfile created 01/29/2013 at 18:16:22

# Updated 26/01/2013 by Xplode

# Operating system : Windows Vista Home Premium Service Pack 2 (32 bits)

# User : Jim - JJ

# Boot Mode : Normal

# Running from : C:\Users\Jim\Desktop\adwcleaner.exe

# Option [search]

***** [services] *****

***** [Files / Folders] *****

File Found : C:\Users\Jim\AppData\Roaming\Mozilla\Firefox\Profiles\npwykqgg.default\searchplugins\safesearch.xml

Folder Found : C:\Program Files\Mozilla Firefox\Extensions\afurladvisor@anchorfree.com

Folder Found : C:\Program Files\Viewpoint

Folder Found : C:\ProgramData\~0

Folder Found : C:\ProgramData\Viewpoint

***** [Registry] *****

Key Found : HKCU\Software\Conduit

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ViewpointMediaPlayer

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}

Key Found : HKCU\Software\Softonic

Key Found : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl

Key Found : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl.1

Key Found : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary

Key Found : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary.1

Key Found : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{03F998B2-0E00-11D3-A498-00104B6EB52E}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{761F6A83-F007-49E4-8EAC-CDB6808EF06F}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{76C45B18-A29E-43EA-AAF8-AF55C2E1AE17}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{96EF404C-24C7-43D0-9096-4CCC8BB7CCAC}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{97720195-206A-42AE-8E65-260B9BA5589F}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{97D69524-BB57-4185-9C7F-5F05593B771A}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{986F7A5A-9676-47E1-8642-F41F8C3FCF82}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{B18788A4-92BD-440E-A4D1-380C36531119}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}

Key Found : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}

Key Found : HKLM\SOFTWARE\Classes\S

Key Found : HKLM\Software\Conduit

Key Found : HKLM\Software\Freeze.com

Key Found : HKLM\Software\MetaStream

Key Found : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{03F998B2-0E00-11D3-A498-00104B6EB52E}

Key Found : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966

Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094

Key Found : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ViewpointMediaPlayer

Key Found : HKLM\SOFTWARE\MozillaPlugins\@viewpoint.com/VMP

Key Found : HKLM\SOFTWARE\Software

Key Found : HKLM\Software\Viewpoint

Value Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Run []

***** [internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16457

[OK] Registry is clean.

-\\ Mozilla Firefox v14.0.1 (en-US)

File : C:\Users\Jim\AppData\Roaming\Mozilla\Firefox\Profiles\npwykqgg.default\prefs.js

Found : user_pref("keyword.URL", "hxxp://search.hotspotshield.com/g/results.php?c=s&q=");

-\\ Google Chrome v24.0.1312.56

File : C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [4502 octets] - [29/01/2013 18:16:22]

########## EOF - C:\AdwCleaner[R1].txt - [4562 octets] ##########

----------------------------------------------------------------------------------------------------------------

# AdwCleaner v2.109 - Logfile created 01/29/2013 at 18:21:36

# Updated 26/01/2013 by Xplode

# Operating system : Windows Vista Home Premium Service Pack 2 (32 bits)

# User : Jim - JJ

# Boot Mode : Normal

# Running from : C:\Users\Jim\Desktop\adwcleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

File Deleted : C:\Users\Jim\AppData\Roaming\Mozilla\Firefox\Profiles\npwykqgg.default\searchplugins\safesearch.xml

Folder Deleted : C:\Program Files\Mozilla Firefox\Extensions\afurladvisor@anchorfree.com

Folder Deleted : C:\Program Files\Viewpoint

Folder Deleted : C:\ProgramData\~0

Folder Deleted : C:\ProgramData\Viewpoint

***** [Registry] *****

Key Deleted : HKCU\Software\Conduit

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ViewpointMediaPlayer

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}

Key Deleted : HKCU\Software\Softonic

Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl

Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtl.1

Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary

Key Deleted : HKLM\SOFTWARE\Classes\AxMetaStream.MetaStreamCtlSecondary.1

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{03F998B2-0E00-11D3-A498-00104B6EB52E}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{761F6A83-F007-49E4-8EAC-CDB6808EF06F}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{76C45B18-A29E-43EA-AAF8-AF55C2E1AE17}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{96EF404C-24C7-43D0-9096-4CCC8BB7CCAC}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{97720195-206A-42AE-8E65-260B9BA5589F}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{97D69524-BB57-4185-9C7F-5F05593B771A}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{986F7A5A-9676-47E1-8642-F41F8C3FCF82}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B18788A4-92BD-440E-A4D1-380C36531119}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}

Key Deleted : HKLM\SOFTWARE\Classes\S

Key Deleted : HKLM\Software\Conduit

Key Deleted : HKLM\Software\Freeze.com

Key Deleted : HKLM\Software\MetaStream

Key Deleted : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{03F998B2-0E00-11D3-A498-00104B6EB52E}

Key Deleted : HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ViewpointMediaPlayer

Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@viewpoint.com/VMP

Key Deleted : HKLM\SOFTWARE\Software

Key Deleted : HKLM\Software\Viewpoint

Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run []

***** [internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16457

[OK] Registry is clean.

-\\ Mozilla Firefox v14.0.1 (en-US)

File : C:\Users\Jim\AppData\Roaming\Mozilla\Firefox\Profiles\npwykqgg.default\prefs.js

Deleted : user_pref("keyword.URL", "hxxp://search.hotspotshield.com/g/results.php?c=s&q=");

-\\ Google Chrome v24.0.1312.56

File : C:\Users\Jim\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [4631 octets] - [29/01/2013 18:16:22]

AdwCleaner[s1].txt - [325 octets] - [29/01/2013 18:18:32]

AdwCleaner[s2].txt - [4713 octets] - [29/01/2013 18:21:36]

########## EOF - C:\AdwCleaner[s2].txt - [4773 octets] ##########

-------------------------------------------------------------------------------------------------------------------

RogueKiller V8.4.3 [Jan 31 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows Vista (6.0.6002 Service Pack 2) 32 bits version

Started in : Normal mode

User : Jim [Admin rights]

Mode : Remove -- Date : 01/31/2013 20:52:18

| ARK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 2 ¤¤¤

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

¤¤¤ Particular Files / Folders: ¤¤¤

[ZeroAccess][FILE] @ : C:\Users\Jim\AppData\Local\{ff24043d-55f8-5ce9-a20a-8337d9b4b888}\@ --> REMOVED

¤¤¤ Driver : [LOADED] ¤¤¤

SSDT[13] : NtAlertResumeThread @ 0x8269365D -> HOOKED (Unknown @ 0x8846A9A0)

SSDT[14] : NtAlertThread @ 0x8260C295 -> HOOKED (Unknown @ 0x8846AA80)

SSDT[18] : NtAllocateVirtualMemory @ 0x8264854B -> HOOKED (Unknown @ 0x8847A430)

SSDT[21] : NtAlpcConnectPort @ 0x825EA88B -> HOOKED (Unknown @ 0x852FCAC0)

SSDT[42] : NtAssignProcessToJobObject @ 0x825BDB47 -> HOOKED (Unknown @ 0x8846A0D0)

SSDT[67] : NtCreateMutant @ 0x82620862 -> HOOKED (Unknown @ 0x8846A6F0)

SSDT[77] : NtCreateSymbolicLinkObject @ 0x825C035E -> HOOKED (Unknown @ 0x8846BDF0)

SSDT[78] : NtCreateThread @ 0x82691C74 -> HOOKED (Unknown @ 0x8847A918)

SSDT[116] : NtDebugActiveProcess @ 0x82664D78 -> HOOKED (Unknown @ 0x8846A1B0)

SSDT[129] : NtDuplicateObject @ 0x825F8581 -> HOOKED (Unknown @ 0x8847A600)

SSDT[147] : NtFreeVirtualMemory @ 0x82484F1D -> HOOKED (Unknown @ 0x8847A1E8)

SSDT[156] : NtImpersonateAnonymousToken @ 0x825BAF16 -> HOOKED (Unknown @ 0x8846A7E0)

SSDT[158] : NtImpersonateThread @ 0x825D0553 -> HOOKED (Unknown @ 0x8846A8C0)

SSDT[165] : NtLoadDriver @ 0x8256BDEE -> HOOKED (Unknown @ 0x8846A370)

SSDT[177] : NtMapViewOfSection @ 0x826108DA -> HOOKED (Unknown @ 0x8847A0E8)

SSDT[184] : NtOpenEvent @ 0x825F9DFF -> HOOKED (Unknown @ 0x8846A610)

SSDT[194] : NtOpenProcess @ 0x82620FFE -> HOOKED (Unknown @ 0x8847A7E0)

SSDT[195] : NtOpenProcessToken @ 0x82601A60 -> HOOKED (Unknown @ 0x8847A520)

SSDT[197] : NtOpenSection @ 0x826116AD -> HOOKED (Unknown @ 0x8846A450)

SSDT[201] : NtOpenThread @ 0x8261C54F -> HOOKED (Unknown @ 0x8847A6F0)

SSDT[210] : NtProtectVirtualMemory @ 0x8261A332 -> HOOKED (Unknown @ 0x8846BFC0)

SSDT[282] : NtResumeThread @ 0x8261BB9A -> HOOKED (Unknown @ 0x8846AB60)

SSDT[289] : NtSetContextThread @ 0x8269310B -> HOOKED (Unknown @ 0x8846AE00)

SSDT[305] : NtSetInformationProcess @ 0x82614908 -> HOOKED (Unknown @ 0x8846AEE0)

SSDT[317] : NtSetSystemInformation @ 0x825E6EEF -> HOOKED (Unknown @ 0x8846A290)

SSDT[330] : NtSuspendProcess @ 0x82693597 -> HOOKED (Unknown @ 0x8846A530)

SSDT[331] : NtSuspendThread @ 0x8259A92D -> HOOKED (Unknown @ 0x8846AC40)

SSDT[334] : NtTerminateProcess @ 0x825F1173 -> HOOKED (Unknown @ 0x88466AD8)

SSDT[335] : unknown @ 0x8261C584 -> HOOKED (Unknown @ 0x8846AD20)

SSDT[348] : NtUnmapViewOfSection @ 0x82610B9D -> HOOKED (Unknown @ 0x8846AFD0)

SSDT[358] : NtWriteVirtualMemory @ 0x8260D96D -> HOOKED (Unknown @ 0x8847A2D8)

SSDT[382] : NtCreateThreadEx @ 0x8261C039 -> HOOKED (Unknown @ 0x8846BEE0)

S_SSDT[317] : NtUserAttachThreadInput -> HOOKED (Unknown @ 0x88A7D490)

S_SSDT[397] : NtUserGetAsyncKeyState -> HOOKED (Unknown @ 0x88481AD8)

S_SSDT[428] : NtUserGetKeyboardState -> HOOKED (Unknown @ 0x88A7F448)

S_SSDT[430] : NtUserGetKeyState -> HOOKED (Unknown @ 0x88481B98)

S_SSDT[442] : NtUserGetRawInputData -> HOOKED (Unknown @ 0x874FF880)

S_SSDT[479] : NtUserMessageCall -> HOOKED (Unknown @ 0x88A80CB8)

S_SSDT[497] : NtUserPostMessage -> HOOKED (Unknown @ 0x88A7F378)

S_SSDT[498] : NtUserPostThreadMessage -> HOOKED (Unknown @ 0x88A7F2A8)

S_SSDT[573] : NtUserSetWindowsHookEx -> HOOKED (Unknown @ 0x88A820C8)

S_SSDT[576] : NtUserSetWinEventHook -> HOOKED (Unknown @ 0x87500D10)

¤¤¤ Infection : ZeroAccess ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

127.0.0.1 localhost

::1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: FUJITSU MHZ2250BH G2 +++++

--- User ---

[MBR] f3e79be839f498db4cfd6a1a515cc5bd

[bSP] 892a711584017c3455ee860c33419776 : HP tatooed MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 226486 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 463844745 | Size: 11985 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[2]_D_01312013_02d2052.txt >>

RKreport[1]_S_01312013_02d2050.txt ; RKreport[2]_D_01312013_02d2052.txt