google redirect, TDL3 or TDSS rootkit suspected

sfpm · April 30, 2010

I've been experiencing google redirects using firefox and all symptoms point to a persistent rootkit, possibly TDL3. I've run TDSSkiller and it says atapi.sys is infected but is unable to clean it up. MBAM can't fix it either, although it does a good job removing all the secondary trojans this rootkit keeps trying to install. GMER can't complete a full scan so I'll post what logs I am able to get. I've attached my DDS scans too.

GMER initial quickscan:

GMER 1.0.15.15281 - http://www.gmer.net

Rootkit quick scan 2010-04-30 09:36:53

Windows 5.1.2600 Service Pack 3

Running: i0w5xsj8.exe; Driver: C:\DOCUME~1\Daniel\LOCALS~1\Temp\fgeyifow.sys

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

Device -> \Driver\atapi \Device\Harddisk0\DR0 8A511EE4

---- Files - GMER 1.0.15 ----

File C:\WINDOWS\system32\drivers\atapi.sys suspicious modification

---- EOF - GMER 1.0.15 ----

GMER partial scan with only "sections" and "c:\" ticked:

GMER 1.0.15.15281 - http://www.gmer.net

Rootkit scan 2010-04-30 15:49:10

Windows 5.1.2600 Service Pack 3

Running: i0w5xsj8.exe; Driver: C:\DOCUME~1\Daniel\LOCALS~1\Temp\fgeyifow.sys

---- Kernel code sections - GMER 1.0.15 ----

.rsrc C:\WINDOWS\system32\drivers\pciide.sys entry point in ".rsrc" section [0xF7A4F814]

.text C:\WINDOWS\system32\DRIVERS\ati2mtag.sys section is writeable [0xF6D1B000, 0x1BDF16, 0xE8000020]

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\System32\svchost.exe[1516] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 007E000A

.text C:\WINDOWS\System32\svchost.exe[1516] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 007F000A

.text C:\WINDOWS\System32\svchost.exe[1516] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 007D000C

.text C:\WINDOWS\System32\svchost.exe[1516] USER32.dll!GetCursorPos 7E42974E 5 Bytes JMP 00F0000A

.text C:\WINDOWS\System32\svchost.exe[1516] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 00EF000A

.text C:\WINDOWS\Explorer.EXE[2656] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00A1000A

.text C:\WINDOWS\Explorer.EXE[2656] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00AF000A

.text C:\WINDOWS\Explorer.EXE[2656] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00A0000C

.text C:\WINDOWS\system32\wuauclt.exe[3312] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00AB000A

.text C:\WINDOWS\system32\wuauclt.exe[3312] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00AC000A

.text C:\WINDOWS\system32\wuauclt.exe[3312] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 003D000C

---- Files - GMER 1.0.15 ----

File C:\WINDOWS\system32\drivers\pciide.sys suspicious modification

---- EOF - GMER 1.0.15 ----

DDS

DDS (Ver_10-03-17.01) - NTFSx86

Run by Daniel at 10:16:13.57 on Fri 04/30/2010

Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_14

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1538 [GMT -7:00]

============== Running Processes ===============

C:\WINDOWS\system32\ibmpmsvc.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\Program Files\Intel\WiFi\bin\S24EvMon.exe

C:\WINDOWS\system32\Ati2evxx.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe

C:\Program Files\Intel\WiFi\bin\EvtEng.exe

C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE

C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe

C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe

C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe

C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe

C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Analog Devices\Core\smax4pnp.exe

C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe

C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe

C:\Program Files\Lenovo\Zoom\TpScrex.exe

C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

C:\WINDOWS\system32\taskmgr.exe

C:\WINDOWS\system32\wuauclt.exe

C:\PROGRA~1\ThinkPad\UTILIT~1\PWMUIAux.exe

C:\WINDOWS\system32\mmc.exe

C:\Program Files\K-Meleon\k-meleon.exe

C:\Documents and Settings\Daniel\Desktop\dds.scr

============== Pseudo HJT Report ===============

uInternet Settings,ProxyOverride = <local>

uRun: [HydraVisionDesktopManager] "c:\program files\ati technologies\ati hydravision\HydraDM.exe"

mRun: [TPHOTKEY] c:\program files\lenovo\hotkey\TPOSDSVC.exe

mRun: [PSQLLauncher] "c:\program files\thinkvantage fingerprint software\launcher.exe" /startup

mRun: [ACTray] c:\program files\thinkpad\connectutilities\ACTray.exe

mRun: [ACWLIcon] c:\program files\thinkpad\connectutilities\ACWLIcon.exe

mRun: [PWRMGRTR] rundll32 c:\progra~1\thinkpad\utilit~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor

mRun: [bLOG] rundll32 c:\progra~1\thinkpad\utilit~1\BatLogEx.DLL,StartBattLog

mRun: [soundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe

mRun: [EZEJMNAP] c:\progra~1\thinkpad\utilit~1\EzEjMnAp.Exe

mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe

mRun: [AtiPTA] atiptaxx.exe

mRun: [FRYMXINS] "c:\program files\ati technologies\fire gl 3d studio max\atiimxgl"

mRun: [HitmanPro35] "c:\program files\hitman pro 3.5\HitmanPro35.exe" /scan:boot

dPolicies-explorer: NoSetActiveDesktop = 1 (0x1)

dPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000

IE: Send to &Bluetooth Device... - c:\program files\thinkpad\bluetooth software\btsendto_ie_ctx.htm

IE: Send To Bluetooth - c:\program files\thinkpad\bluetooth software\btsendto_ie.htm

IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\thinkpad\bluetooth software\btsendto_ie.htm

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll

Notify: AtiExtEvent - Ati2evxx.dll

Notify: psfus - c:\program files\thinkvantage fingerprint software\psqlpwd.dll

Notify: tpfnf2 - c:\program files\lenovo\hotkey\notifyf2.dll

Notify: tphotkey - c:\program files\lenovo\hotkey\tphklock.dll

SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\daniel\applic~1\mozilla\firefox\profiles\di3rsfmi.default\

FF - plugin: c:\documents and settings\daniel\application data\move networks\plugins\npqmp071701000002.dll

FF - plugin: c:\documents and settings\daniel\application data\move networks\plugins\npqmp071705000014.dll

FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npFoxitReaderPlugin.dll

FF - plugin: c:\program files\veetle\player\npvlc.dll

FF - plugin: c:\program files\veetle\plugins\npVeetle.dll

FF - plugin: c:\program files\veetle\vlcbroadcast\npvbp.dll

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]

R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-2-17 66632]

R1 SAVRKBootTasks;Boot Tasks Driver;c:\windows\system32\SAVRKBootTasks.sys [2010-4-29 18816]

R2 Power Manager DBC Service;Power Manager DBC Service;c:\program files\thinkpad\utilities\PWMDBSVC.exe [2009-6-2 53248]

R2 smihlp;SMI Helper Driver (smihlp);c:\program files\common files\thinkvantage fingerprint software\drivers\smihlp.sys [2008-11-21 12560]

R3 swmx01;Sierra Wireless USB MUX Driver (#01);c:\windows\system32\drivers\swmx01.sys [2007-4-10 72576]

R3 SWNC5E01;Sierra Wireless MUX NDIS Driver (#01);c:\windows\system32\drivers\SWNC5E01.sys [2007-1-12 102144]

S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\e.tmp --> c:\windows\system32\E.tmp [?]

S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2010-2-17 12872]

=============== Created Last 30 ================

2010-04-30 17:15:54 0 ----a-w- c:\documents and settings\daniel\defogger_reenable

2010-04-30 07:51:17 0 d-----w- C:\c51d2543fa025044485d6971a55f

2010-04-30 07:03:14 221184 ----a-w- c:\windows\system32\wmpns.dll

2010-04-30 04:44:50 18816 ------w- c:\windows\system32\SAVRKBootTasks.sys

2010-04-29 10:11:35 0 d-sha-r- C:\cmdcons

2010-04-29 10:09:51 98816 ----a-w- c:\windows\sed.exe

2010-04-29 10:09:51 77312 ----a-w- c:\windows\MBR.exe

2010-04-29 10:09:51 256512 ----a-w- c:\windows\PEV.exe

2010-04-29 10:09:51 161792 ----a-w- c:\windows\SWREG.exe

2010-04-29 10:06:49 0 d-----w- C:\VundoFix Backups

2010-04-29 09:20:56 272128 -c----w- c:\windows\system32\dllcache\bthport.sys

2010-04-29 09:20:56 272128 ------w- c:\windows\system32\drivers\bthport.sys

2010-04-29 09:20:11 455680 -c----w- c:\windows\system32\dllcache\mrxsmb.sys

2010-04-29 08:40:11 2146304 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe

2010-04-29 08:40:10 2189952 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe

2010-04-29 08:40:10 2024448 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe

2010-04-29 08:34:47 2888 ----a-w- c:\windows\system32\.crusader

2010-04-29 07:45:36 0 d-----w- c:\program files\Sophos

2010-04-29 07:38:55 15944 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys

2010-04-29 07:38:37 0 d-----w- c:\docume~1\alluse~1\applic~1\Hitman Pro

2010-04-29 07:38:36 0 d-----w- c:\program files\Hitman Pro 3.5

2010-04-29 06:34:14 2560 ------w- c:\windows\system32\xpsp4res.dll

2010-04-29 06:28:01 0 d-----w- c:\windows\system32\PreInstall

2010-04-29 06:27:59 0 d--h--w- c:\windows\$hf_mig$

2010-04-29 03:35:43 0 d-----w- c:\windows\system32\SoftwareDistribution

2010-04-28 07:10:33 0 d-----w- c:\program files\SUPERAntiSpyware

2010-04-28 07:10:33 0 d-----w- c:\docume~1\daniel\applic~1\SUPERAntiSpyware.com

2010-04-28 07:10:15 0 d-----w- c:\program files\common files\Wise Installation Wizard

2010-04-28 06:23:38 0 d-----w- c:\program files\AVG

2010-04-28 06:23:22 0 d-----w- c:\docume~1\alluse~1\applic~1\avg9

2010-04-28 06:23:11 0 d-----w- c:\windows\SxsCaPendDel

2010-04-28 06:15:11 0 d-----w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com

2010-04-28 06:02:38 0 d-s---w- c:\documents and settings\daniel\UserData

2010-04-26 03:13:26 0 d-----w- C:\SIMANT

2010-04-24 05:27:13 85504 ----a-w- c:\windows\system32\ff_vfw.dll

2010-04-24 05:27:13 547 ----a-w- c:\windows\system32\ff_vfw.dll.manifest

2010-04-11 20:42:23 0 d-----w- c:\program files\Veetle

2010-04-11 19:16:16 0 d-----w- c:\docume~1\daniel\applic~1\Foxit Software

2010-04-11 03:21:49 0 d-----w- c:\docume~1\alluse~1\applic~1\DivX

2010-04-06 04:12:51 0 d-----w- c:\windows\system32\LogFiles

==================== Find3M ====================

2010-04-30 17:10:08 96512 ----a-w- c:\windows\system32\drivers\atapi.sys

2010-04-29 22:39:38 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-29 22:39:26 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-04-29 16:34:19 691696 ----a-w- c:\windows\system32\drivers\sptd.sys

2010-03-31 01:58:04 9200 ------w- c:\windows\system32\drivers\cdralw2k.sys

2010-03-31 01:58:04 9072 ------w- c:\windows\system32\drivers\cdr4_xp.sys

2010-03-31 01:58:04 44944 ----a-w- c:\windows\system32\drivers\pxhelp20.sys

2010-03-31 01:58:04 133616 ------w- c:\windows\system32\pxafs.dll

2010-03-31 01:58:04 125424 ------w- c:\windows\system32\pxinsi64.exe

2010-03-31 01:58:04 123888 ------w- c:\windows\system32\pxcpyi64.exe

2010-03-09 11:09:18 430080 ----a-w- c:\windows\system32\vbscript.dll

2010-03-08 17:59:18 94208 ----a-w- c:\windows\system32\dpl100.dll

2010-02-26 05:43:57 667136 ----a-w- c:\windows\system32\wininet.dll

2010-02-26 05:43:54 81920 ----a-w- c:\windows\system32\ieencode.dll

2010-02-19 19:27:36 720384 ----a-w- c:\windows\system32\DivX.dll

2010-02-19 19:27:16 856064 ----a-w- c:\windows\system32\divx_xx0c.dll

2010-02-19 19:27:16 856064 ----a-w- c:\windows\system32\divx_xx07.dll

2010-02-19 19:27:16 847872 ----a-w- c:\windows\system32\divx_xx0a.dll

2010-02-19 19:27:16 843776 ----a-w- c:\windows\system32\divx_xx16.dll

2010-02-19 19:27:16 839680 ----a-w- c:\windows\system32\divx_xx11.dll

2010-02-16 14:08:49 2146304 ----a-w- c:\windows\system32\ntoskrnl.exe

2010-02-16 13:25:04 2024448 ----a-w- c:\windows\system32\ntkrnlpa.exe

2010-02-12 04:33:11 100864 ----a-w- c:\windows\system32\6to4svc.dll

============= FINISH: 10:16:50.42 ===============

MBAM says I'm clean but I can post that log if it would be helpful.

Any help is much appreciated!

Attach.txt

xixo_12 · May 1, 2010

Hello and

My name is xixo_12 and I will guide you.
Refrain from running self fixes as this will hinder the malware removal process.
You may wish to print them off or copy the instruction into Notepad.
If you have any question please don't hesitate to ask.
The instructions that I will give to you are specific to your current problem and shouldn't be used on other systems.
If you are receiving help or have received help on this problem elsewhere, please let us know.
Keep interact with me until your computer is clean.

Please! If you need more time to do all the instructions, let me know before 72hours is done. Otherwise, your thread will be closed

First,

SystemLook by jpshortstuff.

Please download from one of the links below and save it to the Desktop.

Download Mirror #1

Download Mirror #2

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
```
:filefind
*atapi*
*pciide*
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Next,

Checklist.

Please post.

Content of SystemLook.txt

sfpm · May 1, 2010

Hello xixo_12, thanks so much for helping me!

Here is the result of the SystemLook scan:

SystemLook v1.0 by jpshortstuff (11.01.10)

Log created at 21:15 on 30/04/2010 by Daniel (Administrator - Elevation successful)

========== filefind ==========

Searching for "*atapi*"

C:\cmdcons\ATAPI.SY_ --a--- 49558 bytes [05:59 04/08/2004] [05:59 04/08/2004] 28541D14647BB58502D09D1CEAEE6684

C:\WINDOWS\ERDNT\cache\atapi.sys --a--- 96512 bytes [10:32 29/04/2010] [08:29 30/04/2010] 9F3A2F5AA6875C72BF062C712CFA2674

C:\WINDOWS\I386\ATAPI.SY_ --a--- 50028 bytes [23:19 01/06/2009] [12:00 21/08/2008] C32657CE5311711A42CD6ECBC728FB0B

C:\WINDOWS\I386\COMPDATA\DECATAPI.HTM --a--- 881 bytes [23:19 01/06/2009] [12:00 21/08/2008] FDA00ABB8831E4903E9442E9B01843ED

C:\WINDOWS\I386\COMPDATA\DECATAPI.TXT --a--- 449 bytes [23:19 01/06/2009] [12:00 21/08/2008] F5A5EAC5B4790D90031B913DD5D559A5

C:\WINDOWS\system32\dllcache\atapi.sys --a--c 96512 bytes [00:10 14/04/2008] [07:10 14/04/2008] 9F3A2F5AA6875C72BF062C712CFA2674

C:\WINDOWS\system32\drivers\atapi.sys --a--- 96512 bytes [00:10 14/04/2008] [18:58 30/04/2010] 9F3A2F5AA6875C72BF062C712CFA2674

C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\i386\atapi.sys --a--- 96512 bytes [15:54 02/06/2009] [12:00 21/08/2008] 9F3A2F5AA6875C72BF062C712CFA2674

Searching for "*pciide*"

C:\cmdcons\PCIIDE.SY_ --a--- 1695 bytes [20:51 17/08/2001] [20:51 17/08/2001] DD70748EDC4DB912A6603D87760EE322

C:\cmdcons\PCIIDEX.SY_ --a--- 13610 bytes [05:59 04/08/2004] [05:59 04/08/2004] 074806F8AC6493BFD75FE120D0D895C2

C:\Qoobox\Quarantine\C\WINDOWS\system32\Drivers\pciide.sys.vir --a--- 3328 bytes [13:51 17/08/2001] [20:51 17/08/2001] C97FD7033297CB380E2EE551F00F233C

C:\WINDOWS\I386\PCIIDE.SY_ --a--- 1695 bytes [23:20 01/06/2009] [12:00 21/08/2008] DD70748EDC4DB912A6603D87760EE322

C:\WINDOWS\I386\PCIIDEX.SY_ --a--- 13602 bytes [23:20 01/06/2009] [12:00 21/08/2008] 4F4D10789BB6989B2B2DCC5195913B1B

C:\WINDOWS\system32\dllcache\pciide.sys --a--c 3328 bytes [13:51 17/08/2001] [20:51 17/08/2001] CCF5F451BB1A5A2A522A76E670000FF0

C:\WINDOWS\system32\dllcache\pciidex.sys --a--c 24960 bytes [00:10 14/04/2008] [07:10 14/04/2008] 52E60F29221D0D1AC16737E8DBF7C3E9

C:\WINDOWS\system32\drivers\pciide.sys --a--- 3328 bytes [13:51 17/08/2001] [20:51 17/08/2001] CCF5F451BB1A5A2A522A76E670000FF0

C:\WINDOWS\system32\drivers\pciidex.sys --a--- 24960 bytes [00:10 14/04/2008] [07:10 14/04/2008] 52E60F29221D0D1AC16737E8DBF7C3E9

C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\i386\pciide.sys --a--- 3328 bytes [15:54 02/06/2009] [12:00 21/08/2008] CCF5F451BB1A5A2A522A76E670000FF0

C:\WINDOWS\system32\ReinstallBackups\0009\DriverFiles\i386\pciidex.sys --a--- 24960 bytes [15:54 02/06/2009] [12:00 21/08/2008] 52E60F29221D0D1AC16737E8DBF7C3E9

-=End Of File=-

Hello and
My name is xixo_12 and I will guide you.
Refrain from running self fixes as this will hinder the malware removal process.
You may wish to print them off or copy the instruction into Notepad.
If you have any question please don't hesitate to ask.
The instructions that I will give to you are specific to your current problem and shouldn't be used on other systems.
If you are receiving help or have received help on this problem elsewhere, please let us know.
Keep interact with me until your computer is clean.
Please! If you need more time to do all the instructions, let me know before 72hours is done. Otherwise, your thread will be closed
First,
SystemLook by jpshortstuff.
Please download from one of the links below and save it to the Desktop.
Download Mirror #1
Download Mirror #2
Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
:filefind
*atapi*
*pciide*
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
Next,
Checklist.
Please post.
Content of SystemLook.txt

xixo_12 · May 1, 2010

Hi,

Let's proceed.

Please do not quote my instructions Just use add reply button.

First,

Copy file

Open Notepad.exe

Copy and paste below code into the notepad.

COPY /Y C:\WINDOWS\system32\dllcache\atapi.sys c:\atapi.sys
COPY /Y C:\WINDOWS\system32\dllcache\pciide.sys c:\pciide.sys
DEL %0

Click on File > Save As
Save in : Desktop
File name : xixo.bat
Save as type : All Files
It will look like this :
Double click on xixo.bat and the batch file will perform the task and auto delete itself.

Next,

Avenger2 by Swandog46

Please download fromHERE, save to the desktop and unzip it.

Note: This programme must be run from an account with Administrator priviledges.

Open the Avenger folder and double click Avenger.exe to launch the programme.
Copy the text in the code box below and Paste it into the Input script here: box.

Files to move:
c:\atapi.sys | C:\WINDOWS\system32\drivers\atapi.sys
c:\pciide.sys | C:\WINDOWS\system32\DRIVERS\pciide.sys

Note: the above code was created specifically for this user. If you are not this user, DO NOT follow these directions as they could damage the workings of your system.

Ensure the following:
- Scan for Rootkits is checked.
- Automatically disable any rootkits found is Unchecked.
[*]Press the Execute key.
[*]Avenger will now process the script you've pasted (this may involve more than one re-boot), when finished it will produce a log file.
[*]Post the log back here please. (it can also be found at C:\avenger.txt)

Next,

GMER.

Please download from HERE and save to the desktop.

Unzip/extract the file to its own folder.
Disconnect from the Internet and close all running programs.
There is a small chance this application may crash your computer so save any work you have open.
Double-click on Gmer.exe to start the program.
Allow the gmer.sys driver to load if asked.
If it gives you a warning at program start about rootkit activity and asks if you want to run a scan,click NO.
Click on >>> symbol and choose on the Rootkit tab.
Look at the right hand side (under Files) and uncheck all drives with the exception of your C drive.
Make sure all other boxes on the right of the screen are checked, EXCEPT for "Show All".
Click on the Scan and wait for the scan to finish.
Note: Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while this scan completes. Also do not use your computer during the scan.
When completed, click on the Copy button and right-click on your Desktop, choose "New" > Text document. Once the file is created, open it and right-click again and choose Paste or Ctrl+V. Save the file as gmer.txt and copy the information in your next reply.
Note: If you have any problems, try running GMER in SAFE MODE"

Important! Please do not select the "Show all" checkbox during the scan..

Next,

Checklist.

Please post.

Content of avenger.txt
Content of GMER.txt

sfpm · May 1, 2010

Oops sorry about quoting the post!

GMER took forever to run but it actually finished this time.

Here is my avenger.txt

Logfile of The Avenger Version 2.0, © by Swandog46

http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.

Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.

No rootkits found!

File move operation "c:\atapi.sys|C:\WINDOWS\system32\drivers\atapi.sys" completed successfully.

File move operation "c:\pciide.sys|C:\WINDOWS\system32\DRIVERS\pciide.sys" completed successfully.

Completed script processing.

*******************

Finished! Terminate.

And here is GMER.txt

GMER 1.0.15.15281 - http://www.gmer.net

Rootkit scan 2010-04-30 23:34:28

Windows 5.1.2600 Service Pack 3

Running: gmer.exe; Driver: C:\DOCUME~1\Daniel\LOCALS~1\Temp\fgeyifow.sys

---- Kernel code sections - GMER 1.0.15 ----

? kvni.sys The system cannot find the file specified. !

.text C:\WINDOWS\system32\DRIVERS\ati2mtag.sys section is writeable [0xF6D1B000, 0x1BDF16, 0xE8000020]

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\System32\svchost.exe[1504] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 007E000A

.text C:\WINDOWS\System32\svchost.exe[1504] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 007F000A

.text C:\WINDOWS\System32\svchost.exe[1504] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 007D000C

.text C:\WINDOWS\system32\wuauclt.exe[1664] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 0083000A

.text C:\WINDOWS\system32\wuauclt.exe[1664] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 0084000A

.text C:\WINDOWS\system32\wuauclt.exe[1664] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 003D000C

.text C:\WINDOWS\Explorer.EXE[2080] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00A1000A

.text C:\WINDOWS\Explorer.EXE[2080] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00AF000A

.text C:\WINDOWS\Explorer.EXE[2080] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00A0000C

.text C:\WINDOWS\system32\wuauclt.exe[2544] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00AB000A

.text C:\WINDOWS\system32\wuauclt.exe[2544] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00AC000A

.text C:\WINDOWS\system32\wuauclt.exe[2544] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 003D000C

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

Device -> \Driver\atapi \Device\Harddisk0\DR0 8A4F6EE4

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\

Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0

Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xB0 0x7C 0x5C 0x52 ...

Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...

Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xA5 0xFE 0x71 0xDE ...

Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x0D 0xDB 0x92 0xA9 ...

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x41 0xE0 0xAC 0xDB ...

Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)

Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0

Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x41 0xE0 0xAC 0xDB ...

---- Files - GMER 1.0.15 ----

File C:\WINDOWS\system32\drivers\atapi.sys suspicious modification

---- EOF - GMER 1.0.15 ----

Hope this helps!

xixo_12 · May 1, 2010

Hi,

Do this.

First,

DeFogger - Disable

Please download from HERE and save to the desktop.

Double click DeFogger to run the tool.
The application window will appear
Click the Disable button to disable your CD Emulation drivers
Click Yes to continue
A 'Finished!' message will appear
Click OK
DeFogger will now ask to reboot the machine - click OK

IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.

Do not re-enable these drivers until otherwise instructed.

Next,

GMER

Please run it again.

Next,

Checklist.

Please post.

Content of GMER.txt
Please let me know how is your system now?

sfpm · May 1, 2010

So when I run Defogger and disable emulation, it doesn't ask me to reboot. Should I still reboot, and will the drivers remain disabled after a reboot?

Also, I noticed that after I connect to the internet, my machine becomes unresponsive and the CPU cycles go to 100%. I'm guessing that the rootkit is updating or receiving some activation signal because I don't get this problem if I'm offline. Should I keep this machine offline so that the rootkit can't update?

Thanks again for your help.

xixo_12 · May 1, 2010

Hi,

Please reboot the machine manually, and have the gmer scan again.

I will think some step after get the gmer from your side. No worries.

Just minimize the time that you used for surf the net.

Thanks!

sfpm · May 1, 2010

Something odd happened when I connected to the internet to post this reply.

CPU was at 100% and the primary culprit was wuauclt.exe. The computer was unresponsive so I killed wuauclt.exe. Then svchost ate up the CPU cycles so I killed that one too. After that, I could connect to websites but I would notice a flickering effect every once in a while, like when you hit refresh and things on the screen flash on and off for a second. As I'm typing this, another svchost process is using all my CPU power so I think I'm still infected.

Also, I can't shut down or hibernate my computer. I have to do a hard shutdown by holding down the power button for 5 seconds.

Here is the new GMER log

GMER 1.0.15.15281 - http://www.gmer.net

Rootkit scan 2010-05-01 02:48:08