Lorgeo Posted September 7, 2009 ID:122331 Share Posted September 7, 2009 Hello All,I seem to be yet another victim of this rootkit infection. I am running xp pro sp3, and Malwarebytes will not run nor will any other tools it seems. I also ran win32diag....can someone please help me out with this?Thanks.Log file is located at: C:\Documents and Settings\Sharon Lornie\Desktop\Win32kDiag.txtWARNING: Could not get backup privileges!Searching 'C:\WINDOWS'...Found mount point : C:\WINDOWS\$hf_mig$\KB932168\KB932168Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$hf_mig$\KB933729\KB933729Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\$hf_mig$\KB943460\KB943460Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\ADDINS\ADDINSMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\ASSEMBLY\NativeImages1_v1.1.4322\AlertView\AlertViewMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\ASSEMBLY\NativeImages1_v1.1.4322\AllertEula\AllertEulaMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\ASSEMBLY\NativeImages1_v1.1.4322\ClientApplicationFrameWork\ClientApplicationFrameWorkMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\ASSEMBLY\NativeImages1_v1.1.4322\EUSWUtil\EUSWUtilMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\ASSEMBLY\NativeImages1_v1.1.4322\NotifyAlert\NotifyAlertMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\ASSEMBLY\NativeImages1_v1.1.4322\Protocol\ProtocolMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\ASSEMBLY\NativeImages_v2.0.50727_32\Temp\ZAP370.tmp\ZAP370.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\ASSEMBLY\NativeImages_v2.0.50727_32\Temp\ZAP450.tmp\ZAP450.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\ASSEMBLY\NativeImages_v2.0.50727_32\Temp\ZAP46F.tmp\ZAP46F.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\ASSEMBLY\NativeImages_v2.0.50727_32\Temp\ZAP489.tmp\ZAP489.tmpMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\ASSEMBLY\TMP\TMPMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Config\ConfigMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Connection Wizard\Connection WizardMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\CSC\d1\d1Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\CSC\d2\d2Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\CSC\d3\d3Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\CSC\d4\d4Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\CSC\d5\d5Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\CSC\d6\d6Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\CSC\d7\d7Mount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\CSC\d8\d8Mount point destination : \Device\__max++>\^Cannot access: C:\WINDOWS\ecimuhyjut.db[1] 2009-08-29 22:51:28 14753 C:\WINDOWS\ecimuhyjut.db ()Cannot access: C:\WINDOWS\esobyham._sy[1] 2009-08-21 14:20:17 11682 C:\WINDOWS\esobyham._sy ()Found mount point : C:\WINDOWS\ftpcache\ftpcacheMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Help\SBSI\Training\WXPPRO\Cbz\CbzMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Help\SBSI\Training\WXPPRO\Lib\LibMount point destination : \Device\__max++>\^Found mount point : C:\WINDOWS\Help\SBSI\Training\WXPPRO\Wave\WaveMount point destination : \Device\__max++>\^Cannot access: C:\WINDOWS\hudusa.sys[1] 2009-08-29 22:51:28 11080 C:\WINDOWS\hudusa.sys () Link to post Share on other sites More sharing options...
Staff screen317 Posted September 8, 2009 Staff ID:122701 Share Posted September 8, 2009 Hi and welcome to Malwarebytes.Please visit this webpage for instructions for running ComboFix: http://www.bleepingcomputer.com/combofix/how-to-use-combofixWhen the tool is finished, it will produce a report for you.Please post the C:\ComboFix.txt along with a new HijackThis log so we may continue cleaning the system.-screen317 Link to post Share on other sites More sharing options...
Staff screen317 Posted September 26, 2009 Staff ID:133718 Share Posted September 26, 2009 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts