TDL3 rootkit problem-Atapi.sys infected

novemberwhisky · March 2, 2010

Hi,

I was wondering if you could help with what seems an identical problem posted on your forum?

Atapi.sys infection? Start of Problems???

Deltalima was the expert involved with solving the TDL3 rootkit problem. How easily can it be fixed?

please see attached scans logs from Mbam, GMER and Hijack this.

It took a bit of work getting Mbam and spybot with the latest updates as they were being blocked. Now the problem seems to be the Atapi.sys. I believe that if I I delete atapi.sys i will not be able to reboot, the system.

I have an IBM system with Rescue and Recover and the PRE-Load is on a partition of the hard drive. I want to avoid reformatting, as i have already done so about 3 months ago.

Many thanks

New member "novemberwhisky"

GMER 1.0.15.15281 - http://www.gmer.net

Rootkit scan 2010-02-24 20:52:41

Windows 5.1.2600 Service Pack 3

Running: 5s9i679h.exe; Driver: C:\DOCUME~1\DAD\LOCALS~1\Temp\awrdapow.sys

---- Kernel code sections - GMER 1.0.15 ----

.rsrc C:\WINDOWS\system32\drivers\atapi.sys entry point in ".rsrc" section [0xF73FB780]

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\DOCUME~1\DAD\LOCALS~1\Temp\Ykb.exe[2904] @ C:\WINDOWS\system32\ole32.dll [uSER32.dll!CreateWindowExA] [004179E4] C:\DOCUME~1\DAD\LOCALS~1\Temp\Ykb.exe

IAT C:\DOCUME~1\DAD\LOCALS~1\Temp\Ykb.exe[2904] @ C:\WINDOWS\system32\ole32.dll [uSER32.dll!CreateWindowExW] [00417A5E] C:\DOCUME~1\DAD\LOCALS~1\Temp\Ykb.exe

IAT C:\DOCUME~1\DAD\LOCALS~1\Temp\Ykb.exe[2904] @ C:\WINDOWS\system32\ole32.dll [uSER32.dll!ShowWindow] [00417AD8] C:\DOCUME~1\DAD\LOCALS~1\Temp\Ykb.exe

IAT C:\DOCUME~1\DAD\LOCALS~1\Temp\Ykb.exe[2904] @ C:\WINDOWS\system32\SHLWAPI.dll [uSER32.dll!CreateWindowExA] [004179E4] C:\DOCUME~1\DAD\LOCALS~1\Temp\Ykb.exe

IAT C:\DOCUME~1\DAD\LOCALS~1\Temp\Ykb.exe[2904] @ C:\WINDOWS\system32\SHLWAPI.dll [uSER32.dll!CreateWindowExW] [00417A5E] C:\DOCUME~1\DAD\LOCALS~1\Temp\Ykb.exe

IAT C:\DOCUME~1\DAD\LOCALS~1\Temp\Ykb.exe[2904] @ C:\WINDOWS\system32\SHLWAPI.dll [uSER32.dll!SetWindowPos] [00417B8A] C:\DOCUME~1\DAD\LOCALS~1\Temp\Ykb.exe

IAT C:\DOCUME~1\DAD\LOCALS~1\Temp\Ykb.exe[2904] @ C:\WINDOWS\system32\SHLWAPI.dll [uSER32.dll!ShowWindow] [00417AD8] C:\DOCUME~1\DAD\LOCALS~1\Temp\Ykb.exe

IAT C:\DOCUME~1\DAD\LOCALS~1\Temp\Ykb.exe[2904] @ C:\WINDOWS\system32\wininet.dll [uSER32.dll!SetWindowPos] [00417B8A] C:\DOCUME~1\DAD\LOCALS~1\Temp\Ykb.exe

IAT C:\DOCUME~1\DAD\LOCALS~1\Temp\Ykb.exe[2904] @ C:\WINDOWS\system32\wininet.dll [uSER32.dll!CreateWindowExW] [00417A5E] C:\DOCUME~1\DAD\LOCALS~1\Temp\Ykb.exe

IAT C:\DOCUME~1\DAD\LOCALS~1\Temp\Ykb.exe[2904] @ C:\WINDOWS\system32\shell32.dll [uSER32.dll!CreateWindowExW] [00417A5E] C:\DOCUME~1\DAD\LOCALS~1\Temp\Ykb.exe

IAT C:\DOCUME~1\DAD\LOCALS~1\Temp\Ykb.exe[2904] @ C:\WINDOWS\system32\shell32.dll [uSER32.dll!ShowWindow] [00417AD8] C:\DOCUME~1\DAD\LOCALS~1\Temp\Ykb.exe

IAT C:\DOCUME~1\DAD\LOCALS~1\Temp\Ykb.exe[2904] @ C:\WINDOWS\system32\shell32.dll [uSER32.dll!SetWindowPos] [00417B8A] C:\DOCUME~1\DAD\LOCALS~1\Temp\Ykb.exe

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs ibmfilter.sys (IBM Rescue and Recovery filter driver/IBM)

AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-1b [F73EEB3A] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xac]}

Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 [F73EEB3A] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xac]}

Device \Driver\atapi \Device\Ide\IdePort0 [F73EEB3A] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xac]}

Device \Driver\atapi \Device\Ide\IdePort1 [F73EEB3A] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xac]}

Device \Driver\atapi \Device\Ide\IdePort2 [F73EEB3A] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xac]}

Device \Driver\atapi \Device\Ide\IdePort3 [F73EEB3A] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xac]}

Device \Driver\atapi \Device\Ide\IdeDeviceP3T0L0-10 [F73EEB3A] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xac]}

AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Files - GMER 1.0.15 ----

File C:\RRbackups\C 0 bytes

File C:\RRbackups\Documents and Settings 0 bytes

File C:\RRbackups\Documents and Settings\All Users 0 bytes

File C:\RRbackups\Documents and Settings\All Users\Application Data 0 bytes

File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft 0 bytes

File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto 0 bytes

File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA 0 bytes

File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys 0 bytes

File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\fc1e3851f429ea606d6ff1e01a5229f1_c90750f4-1a9a-4385-b16f-b780e69ce3dc 52 bytes

File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18 0 bytes

File C:\RRbackups\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\S-1-5-18\d42cc0c3858a58db2db37658219e6400_c90750f4-1a9a-4385-b16f-b780e69ce3dc 893 bytes

File C:\RRbackups\Documents and Settings\All Users\Application Data\ThinkVantage 0 bytes

File C:\RRbackups\Documents and Settings\All Users\Application Data\ThinkVantage\Client Security 0 bytes

File C:\RRbackups\Documents and Settings\All Users\Application Data\ThinkVantage\Client Security\css.ini 26 bytes

File C:\RRbackups\Documents and Settings\All Users\Application Data\ThinkVantage\Client Security\encobject.dat 1608 bytes

File C:\RRbackups\Documents and Settings\All Users\Application Data\ThinkVantage\Client Security\swkeys.dat 6372 bytes

File C:\RRbackups\Documents and Settings\All Users\Application Data\ThinkVantage\Client Security\symkeys.dat 656 bytes

File C:\RRbackups\Documents and Settings\DAD 0 bytes

File C:\RRbackups\Documents and Settings\DAD\Application Data 0 bytes

File C:\RRbackups\Documents and Settings\DAD\Application Data\Microsoft 0 bytes

File C:\RRbackups\Documents and Settings\DAD\Application Data\Microsoft\Crypto 0 bytes

File C:\RRbackups\Documents and Settings\DAD\Application Data\Microsoft\Crypto\RSA 0 bytes

File C:\RRbackups\Documents and Settings\DAD\Application Data\Microsoft\Crypto\RSA\S-1-5-21-913010512-750300659-3987821213-1006 0 bytes

File C:\RRbackups\Documents and Settings\DAD\Application Data\Microsoft\Crypto\RSA\S-1-5-21-913010512-750300659-3987821213-1006\095eef4ec6fbefd1e618f6bcc8a2c409_c90750f4-1a9a-4385-b16f-b780e69ce3dc 44 bytes

File C:\RRbackups\Documents and Settings\DAD\Application Data\Microsoft\Crypto\RSA\S-1-5-21-913010512-750300659-3987821213-1006\533145ef011ddf5ca3983e2545a902b4_c90750f4-1a9a-4385-b16f-b780e69ce3dc 2075 bytes

File C:\RRbackups\Documents and Settings\DAD\Application Data\Microsoft\Crypto\RSA\S-1-5-21-913010512-750300659-3987821213-1006\83aa4cc77f591dfc2374580bbd95f6ba_c90750f4-1a9a-4385-b16f-b780e69ce3dc 45 bytes

File C:\RRbackups\Documents and Settings\DAD\Application Data\Microsoft\Protect 0 bytes

File C:\RRbackups\Documents and Settings\DAD\Application Data\Microsoft\Protect\CREDHIST 296 bytes

File C:\RRbackups\Documents and Settings\DAD\Application Data\Microsoft\Protect\S-1-5-21-3463794273-3861453470-3792677237-1003 0 bytes

File C:\RRbackups\Documents and Settings\DAD\Application Data\Microsoft\Protect\S-1-5-21-3463794273-3861453470-3792677237-1003\bcc758da-8202-4f98-8e02-b38aaef0f0a2 388 bytes

File C:\RRbackups\Documents and Settings\DAD\Application Data\Microsoft\Protect\S-1-5-21-3463794273-3861453470-3792677237-1003\Preferred 24 bytes

File C:\RRbackups\Documents and Settings\DAD\Application Data\Microsoft\Protect\S-1-5-21-3594824112-253328111-277388107-1003 0 bytes

File C:\RRbackups\Documents and Settings\DAD\Application Data\Microsoft\Protect\S-1-5-21-3594824112-253328111-277388107-1003\b494fd33-76f6-4b91-9917-7145d83c8e0f 388 bytes

File C:\RRbackups\Documents and Settings\DAD\Application Data\Microsoft\Protect\S-1-5-21-3594824112-253328111-277388107-1003\Preferred 24 bytes

File C:\RRbackups\Documents and Settings\DAD\Application Data\Microsoft\Protect\S-1-5-21-913010512-750300659-3987821213-1006 0 bytes

File C:\RRbackups\Documents and Settings\DAD\Application Data\Microsoft\Protect\S-1-5-21-913010512-750300659-3987821213-1006\56bdf13a-bad8-4cd1-ab44-1a2499927ac1 388 bytes

File C:\RRbackups\Documents and Settings\DAD\Application Data\Microsoft\Protect\S-1-5-21-913010512-750300659-3987821213-1006\e8018cf0-b6e6-4359-aa8a-6a671f2cae47 388 bytes

File C:\RRbackups\Documents and Settings\DAD\Application Data\Microsoft\Protect\S-1-5-21-913010512-750300659-3987821213-1006\Preferred 24 bytes

File C:\RRbackups\Documents and Settings\DAD\Application Data\Microsoft\SystemCertificates 0 bytes

File C:\RRbackups\Documents and Settings\DAD\Application Data\Microsoft\SystemCertificates\My 0 bytes

File C:\RRbackups\Documents and Settings\DAD\Application Data\Microsoft\SystemCertificates\My\Certificates 0 bytes

File C:\RRbackups\Documents and Settings\DAD\Application Data\Microsoft\SystemCertificates\My\CRLs 0 bytes

File C:\RRbackups\Documents and Settings\DAD\Application Data\Microsoft\SystemCertificates\My\CTLs 0 bytes

File C:\RRbackups\Documents and Settings\DAD\Application Data\ThinkVantage 0 bytes

File C:\RRbackups\Documents and Settings\DAD\Application Data\ThinkVantage\Client Security 0 bytes

File C:\RRbackups\Documents and Settings\DAD\Application Data\ThinkVantage\Client Security\encobject.dat 6432 bytes

File C:\RRbackups\Documents and Settings\DAD\Application Data\ThinkVantage\Client Security\hibernation.dat 4 bytes

File C:\RRbackups\Documents and Settings\DAD\Application Data\ThinkVantage\Client Security\swkeys.dat 4248 bytes

File C:\RRbackups\Documents and Settings\DAD\Application Data\ThinkVantage\Client Security\symkeys.dat 1968 bytes

File C:\RRbackups\Documents and Settings\Default User 0 bytes

File C:\RRbackups\Documents and Settings\Default User\Application Data 0 bytes

File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft 0 bytes

File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Protect 0 bytes

File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Protect\CREDHIST 24 bytes

File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Protect\S-1-5-21-3463794273-3861453470-3792677237-1003 0 bytes

File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Protect\S-1-5-21-3463794273-3861453470-3792677237-1003\bcc758da-8202-4f98-8e02-b38aaef0f0a2 388 bytes

File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Protect\S-1-5-21-3463794273-3861453470-3792677237-1003\Preferred 24 bytes

File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Protect\S-1-5-21-3594824112-253328111-277388107-1003 0 bytes

File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Protect\S-1-5-21-3594824112-253328111-277388107-1003\b494fd33-76f6-4b91-9917-7145d83c8e0f 388 bytes

File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\Protect\S-1-5-21-3594824112-253328111-277388107-1003\Preferred 24 bytes

File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates 0 bytes

File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My 0 bytes

File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\Certificates 0 bytes

File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CRLs 0 bytes

File C:\RRbackups\Documents and Settings\Default User\Application Data\Microsoft\SystemCertificates\My\CTLs 0 bytes

File C:\RRbackups\Documents and Settings\KIDS 0 bytes

File C:\RRbackups\Documents and Settings\KIDS\Application Data 0 bytes

File C:\RRbackups\Documents and Settings\KIDS\Application Data\Microsoft 0 bytes

File C:\RRbackups\Documents and Settings\KIDS\Application Data\Microsoft\Crypto 0 bytes

File C:\RRbackups\Documents and Settings\KIDS\Application Data\Microsoft\Crypto\RSA 0 bytes

File C:\RRbackups\Documents and Settings\KIDS\Application Data\Microsoft\Crypto\RSA\S-1-5-21-913010512-750300659-3987821213-1007 0 bytes

File C:\RRbackups\Documents and Settings\KIDS\Application Data\Microsoft\Crypto\RSA\S-1-5-21-913010512-750300659-3987821213-1007\533145ef011ddf5ca3983e2545a902b4_c90750f4-1a9a-4385-b16f-b780e69ce3dc 2075 bytes

File C:\RRbackups\Documents and Settings\KIDS\Application Data\Microsoft\Protect 0 bytes

File C:\RRbackups\Documents and Settings\KIDS\Application Data\Microsoft\Protect\CREDHIST 24 bytes

File C:\RRbackups\Documents and Settings\KIDS\Application Data\Microsoft\Protect\S-1-5-21-3463794273-3861453470-3792677237-1003 0 bytes

File C:\RRbackups\Documents and Settings\KIDS\Application Data\Microsoft\Protect\S-1-5-21-3463794273-3861453470-3792677237-1003\bcc758da-8202-4f98-8e02-b38aaef0f0a2 388 bytes

File C:\RRbackups\Documents and Settings\KIDS\Application Data\Microsoft\Protect\S-1-5-21-3463794273-3861453470-3792677237-1003\Preferred 24 bytes

File C:\RRbackups\Documents and Settings\KIDS\Application Data\Microsoft\Protect\S-1-5-21-3594824112-253328111-277388107-1003 0 bytes

File C:\RRbackups\Documents and Settings\KIDS\Application Data\Microsoft\Protect\S-1-5-21-3594824112-253328111-277388107-1003\b494fd33-76f6-4b91-9917-7145d83c8e0f 388 bytes

File C:\RRbackups\Documents and Settings\KIDS\Application Data\Microsoft\Protect\S-1-5-21-3594824112-253328111-277388107-1003\Preferred 24 bytes

File C:\RRbackups\Documents and Settings\KIDS\Application Data\Microsoft\Protect\S-1-5-21-913010512-750300659-3987821213-1007 0 bytes

File C:\RRbackups\Documents and Settings\KIDS\Application Data\Microsoft\Protect\S-1-5-21-913010512-750300659-3987821213-1007\979da260-4fa4-4938-86a8-22941fb6619c 388 bytes

File C:\RRbackups\Documents and Settings\KIDS\Application Data\Microsoft\Protect\S-1-5-21-913010512-750300659-3987821213-1007\Preferred 24 bytes

File C:\RRbackups\Documents and Settings\KIDS\Application Data\Microsoft\SystemCertificates 0 bytes

File C:\RRbackups\Documents and Settings\KIDS\Application Data\Microsoft\SystemCertificates\My 0 bytes

File C:\RRbackups\Documents and Settings\KIDS\Application Data\Microsoft\SystemCertificates\My\Certificates 0 bytes

File C:\RRbackups\Documents and Settings\KIDS\Application Data\Microsoft\SystemCertificates\My\CRLs 0 bytes

File C:\RRbackups\Documents and Settings\KIDS\Application Data\Microsoft\SystemCertificates\My\CTLs 0 bytes

File C:\RRbackups\Documents and Settings\KIDS\Application Data\ThinkVantage 0 bytes

File C:\RRbackups\Documents and Settings\KIDS\Application Data\ThinkVantage\Client Security 0 bytes

File C:\RRbackups\Documents and Settings\KIDS\Application Data\ThinkVantage\Client Security\encobject.dat 6432 bytes

File C:\RRbackups\Documents and Settings\KIDS\Application Data\ThinkVantage\Client Security\hibernation.dat 4 bytes

File C:\RRbackups\Documents and Settings\KIDS\Application Data\ThinkVantage\Client Security\swkeys.dat 4248 bytes

File C:\RRbackups\Documents and Settings\KIDS\Application Data\ThinkVantage\Client Security\symkeys.dat 1968 bytes

File C:\RRbackups\Documents and Settings\LocalService 0 bytes

File C:\RRbackups\Documents and Settings\LocalService\Application Data 0 bytes

File C:\RRbackups\Documents and Settings\LocalService\Application Data\Microsoft 0 bytes

File C:\RRbackups\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates 0 bytes

File C:\RRbackups\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My 0 bytes

File C:\RRbackups\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\Certificates 0 bytes

File C:\RRbackups\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CRLs 0 bytes

File C:\RRbackups\Documents and Settings\LocalService\Application Data\Microsoft\SystemCertificates\My\CTLs 0 bytes

File C:\RRbackups\Documents and Settings\NetworkService 0 bytes

File C:\RRbackups\Documents and Settings\NetworkService\Application Data 0 bytes

File C:\RRbackups\Documents and Settings\NetworkService\Application Data\Microsoft 0 bytes

File C:\RRbackups\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates 0 bytes

File C:\RRbackups\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My 0 bytes

File C:\RRbackups\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\Certificates 0 bytes

File C:\RRbackups\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CRLs 0 bytes

File C:\RRbackups\Documents and Settings\NetworkService\Application Data\Microsoft\SystemCertificates\My\CTLs 0 bytes

File C:\RRbackups\Documents and Settings\Owner 0 bytes

File C:\RRbackups\Documents and Settings\Owner\Application Data 0 bytes

File C:\RRbackups\Documents and Settings\Owner\Application Data\Microsoft 0 bytes

File C:\RRbackups\Documents and Settings\Owner\Application Data\Microsoft\Crypto 0 bytes

File C:\RRbackups\Documents and Settings\Owner\Application Data\Microsoft\Crypto\RSA 0 bytes

File C:\RRbackups\Documents and Settings\Owner\Application Data\Microsoft\Protect 0 bytes

File C:\RRbackups\Documents and Settings\Owner\Application Data\Microsoft\Protect\CREDHIST 24 bytes

File C:\RRbackups\Documents and Settings\Owner\Application Data\Microsoft\Protect\S-1-5-21-3463794273-3861453470-3792677237-1003 0 bytes

File C:\RRbackups\Documents and Settings\Owner\Application Data\Microsoft\Protect\S-1-5-21-3463794273-3861453470-3792677237-1003\bcc758da-8202-4f98-8e02-b38aaef0f0a2 388 bytes

File C:\RRbackups\Documents and Settings\Owner\Application Data\Microsoft\Protect\S-1-5-21-3463794273-3861453470-3792677237-1003\Preferred 24 bytes

File C:\RRbackups\Documents and Settings\Owner\Application Data\Microsoft\Protect\S-1-5-21-3594824112-253328111-277388107-1003 0 bytes

File C:\RRbackups\Documents and Settings\Owner\Application Data\Microsoft\Protect\S-1-5-21-3594824112-253328111-277388107-1003\b494fd33-76f6-4b91-9917-7145d83c8e0f 388 bytes

File C:\RRbackups\Documents and Settings\Owner\Application Data\Microsoft\Protect\S-1-5-21-3594824112-253328111-277388107-1003\Preferred 24 bytes

File C:\RRbackups\Documents and Settings\Owner\Application Data\Microsoft\SystemCertificates 0 bytes

File C:\RRbackups\Documents and Settings\Owner\Application Data\Microsoft\SystemCertificates\My 0 bytes

File C:\RRbackups\Documents and Settings\Owner\Application Data\Microsoft\SystemCertificates\My\Certificates 0 bytes

File C:\RRbackups\Documents and Settings\Owner\Application Data\Microsoft\SystemCertificates\My\CRLs 0 bytes

File C:\RRbackups\Documents and Settings\Owner\Application Data\Microsoft\SystemCertificates\My\CTLs 0 bytes

File C:\RRbackups\Documents and Settings\TEMP 0 bytes

File C:\RRbackups\Documents and Settings\TEMP\Application Data 0 bytes

File C:\RRbackups\Documents and Settings\TEMP\Application Data\Microsoft 0 bytes

File C:\RRbackups\Documents and Settings\TEMP\Application Data\Microsoft\Protect 0 bytes

File C:\RRbackups\Documents and Settings\TEMP\Application Data\Microsoft\Protect\S-1-5-21-3463794273-3861453470-3792677237-1003 0 bytes

File C:\RRbackups\Documents and Settings\TEMP\Application Data\Microsoft\Protect\S-1-5-21-3594824112-253328111-277388107-1003 0 bytes

File C:\RRbackups\Documents and Settings\TEMP\Application Data\Microsoft\Protect\S-1-5-21-913010512-750300659-3987821213-1006 0 bytes

File C:\RRbackups\Documents and Settings\TEMP\Application Data\Microsoft\SystemCertificates 0 bytes

File C:\RRbackups\Documents and Settings\TEMP\Application Data\Microsoft\SystemCertificates\My 0 bytes

File C:\RRbackups\Documents and Settings\TEMP\Application Data\Microsoft\SystemCertificates\My\Certificates 0 bytes

File C:\RRbackups\Documents and Settings\TEMP\Application Data\Microsoft\SystemCertificates\My\CRLs 0 bytes

File C:\RRbackups\Documents and Settings\TEMP\Application Data\Microsoft\SystemCertificates\My\CTLs 0 bytes

File C:\RRbackups\Documents and Settings\TEMP\Application Data\ThinkVantage 0 bytes

File C:\RRbackups\Documents and Settings\TEMP\Application Data\ThinkVantage\Client Security 0 bytes

File C:\RRbackups\hints.dat 8192 bytes

File C:\RRbackups\osfilter.txt 7563 bytes

File C:\RRbackups\regcerts.dat 8192 bytes

File C:\RRbackups\rr.log 3016 bytes

File C:\RRbackups\SAM 262144 bytes

File C:\RRbackups\system 6815744 bytes

File C:\RRbackups\system.dat 12288 bytes

File C:\RRbackups\tvt.txt 10076 bytes

File C:\RRbackups\usersids.dat 11440 bytes

File C:\WINDOWS\system32\drivers\atapi.sys suspicious modification

---- EOF - GMER 1.0.15 ----

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 21:07:33, on 24/02/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\AVG\AVG9\avgchsvx.exe

C:\Program Files\AVG\AVG9\avgrsx.exe

C:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\AVG\AVG9\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\dllhost.exe

C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

C:\Program Files\AVG\AVG9\avgnsx.exe

C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\IBM ThinkVantage\Rescue and Recovery\rrservice.exe

C:\Program Files\IBM ThinkVantage\Common\Scheduler\tvtsched.exe

C:\Program Files\ThinkVantage\SystemUpdate\UCLauncherService.exe

C:\Program Files\AVG\AVG9\avgemc.exe

C:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\Program Files\IBM ThinkVantage\Common\Logger\logmon.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\ICO.EXE

C:\WINDOWS\system32\FSRremoS.EXE

C:\PROGRA~1\Lenovo\LENOVO~2\LPMGR.exe

C:\Program Files\IBM ThinkVantage\Client Security Solution\cssauthe.exe

C:\Program Files\Lenovo\Productivity Keyboard\SKDaemon.exe

C:\PROGRA~1\AVG\AVG9\avgtray.exe

C:\WINDOWS\SOUNDMAN.EXE

D:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe

C:\Documents and Settings\DAD\Application Data\SystemProc\lsass.exe

C:\Program Files\IBM ThinkVantage\Client Security Solution\pwmgre.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.bt.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.lenovo.com/us/en/

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll

R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll

O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE

O4 - HKLM\..\Run: [suScheduler] C:\Program Files\ThinkVantage\SystemUpdate\UCLauncher.exe /SCHEDULER

O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"

O4 - HKLM\..\Run: [iSUSPM Startup] c:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup

O4 - HKLM\..\Run: [iSUSScheduler] "c:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [LPManager] C:\PROGRA~1\Lenovo\LENOVO~2\LPMGR.exe

O4 - HKLM\..\Run: [cssauthe] "C:\Program Files\IBM ThinkVantage\Client Security Solution\cssauthe.exe" silent

O4 - HKLM\..\Run: [sKDaemon.exe] C:\Program Files\Lenovo\Productivity Keyboard\SKDaemon.exe

O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe

O4 - HKLM\..\Run: [EarthLink Installer] " /C

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [POINTER] point32.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon

O4 - HKCU\..\Run: [TOY5KNQ8OC] C:\DOCUME~1\DAD\LOCALS~1\Temp\Ykb.exe

O4 - HKLM\..\Policies\Explorer\Run: [RTHDBPL] C:\Documents and Settings\DAD\Application Data\SystemProc\lsass.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Belkin Wireless USB Utility.lnk = C:\Program Files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe

O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html

O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html

O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html

O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html

O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\IBM\Java142\jre\bin\NPJPI142.dll

O9 - Extra 'Tools' menuitem: IBM Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\IBM\Java142\jre\bin\NPJPI142.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O11 - Options group: [JAVA_IBM] Java (IBM)

O14 - IERESET.INF: START_PAGE_URL=http://www.lenovo.com/us/en/

O16 - DPF: {2DAD3559-2923-4935-AD49-B673D2539944} (IASRunner Class) - http://www-307.ibm.com/pc/support/acpir.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{382CDC68-6BEF-4ADC-B514-E72B86A01101}: NameServer = 93.188.164.224,93.188.166.70

O17 - HKLM\System\CCS\Services\Tcpip\..\{3AB7A6DB-36A0-45D6-8267-468F18D94C87}: NameServer = 93.188.164.224,93.188.166.70

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 93.188.164.224,93.188.166.70

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 93.188.164.224,93.188.166.70

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 93.188.164.224,93.188.166.70

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe

O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Sony Ericsson OMSI download service (OMSI download service) - Unknown owner - C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe

O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)

O23 - Service: TVT Backup Service - Unknown owner - C:\Program Files\IBM ThinkVantage\Rescue and Recovery\rrservice.exe

O23 - Service: TVT Scheduler - Unknown owner - C:\Program Files\IBM ThinkVantage\Common\Scheduler\tvtsched.exe

O23 - Service: ThinkVantage System Update (UCLauncherService) - Unknown owner - C:\Program Files\ThinkVantage\SystemUpdate\UCLauncherService.exe

--

End of file - 10282 bytes

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:31:26, on 28/02/2010Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\AVG\AVG9\avgchsvx.exe

C:\Program Files\AVG\AVG9\avgrsx.exe

C:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\AVG\AVG9\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\dllhost.exe

C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\AVG\AVG9\avgemc.exe

C:\Program Files\AVG\AVG9\avgnsx.exe

C:\Program Files\AVG\AVG9\avgcsrvx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\ICO.EXE

C:\PROGRA~1\Lenovo\LENOVO~2\LPMGR.exe

C:\WINDOWS\system32\FSRremoS.EXE

C:\Program Files\IBM ThinkVantage\Client Security Solution\cssauthe.exe

C:\Program Files\ThinkVantage\SystemUpdate\PipeServer.exe

C:\Program Files\Lenovo\Productivity Keyboard\SKDaemon.exe

C:\PROGRA~1\AVG\AVG9\avgtray.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\Microsoft Hardware\Mouse\point32.exe

D:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe

C:\Program Files\IBM ThinkVantage\Client Security Solution\pwmgre.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.bt.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.lenovo.com/us/en/

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll