JasonACS Posted June 16, 2010 ID:268220 Share Posted June 16, 2010 I have been receiving constant messages from Spy Sweeper blocking 873HGF7XX60.com and other sites. Internet Explorer doesn't open, but this may not be a new problem since I normally use Firefox.Before I ran GMER I had tried Combofix on my own which resulted in no change in symptoms. I've included this log in my attachment along with the others. I also tried an offline replacement of atapi.sys with a clean version, but I see that Windows File Protection overwrote it after restarting.Malwarebytes' Anti-Malware 1.46www.malwarebytes.orgDatabase version: 4198Windows 5.1.2600 Service Pack 2Internet Explorer 8.0.6001.1837214/06/2010 1:44:58 PMmbam-log-2010-06-14 (13-44-58).txtScan type: Quick scanObjects scanned: 142233Time elapsed: 7 minute(s), 5 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected)DDS (Ver_10-03-17.01) - NTFSx86 Run by Wayne at 13:25:37.39 on 15/06/2010Internet Explorer: 8.0.6001.18372 BrowserJavaVersion: 1.6.0_17Microsoft Windows XP Professional 5.1.2600.2.1252.2.1033.18.3322.2552 [GMT -7:00]AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}============== Running Processes ===============C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost -k DcomLaunchsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcssvchost.exesvchost.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEsvchost.exeC:\Program Files\Common Files\EPSON\eEBAPI\eEBSVC.exeC:\Program Files\Common Files\Acronis\Schedule2\schedul2.exeC:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exeC:\Program Files\Common Files\Acronis\CDP\afcdpsrv.exeC:\WINDOWS\System32\svchost.exe -k AkamaiC:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exeC:\windows\system32\astsrv.exeC:\Program Files\Alwil Software\Avast5\AvastSvc.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\Common Files\EPSON\eEBAPI\SAgent2.exeC:\Program Files\Nero\Nero 9\InCD\InCDSrv.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\Program Files\Common Files\Motive\McciCMService.exeC:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exeC:\Program Files\Nero\Nero 9\InCD\NBHRegInCDSrv.exeC:\Program Files\CDBurnerXP\NMSAccessU.exeC:\Program Files\Altaro\Oops!Backup\OopsBackup.Service.exeC:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exeC:\WINDOWS\system32\PSIService.exec:\Program Files\Common Files\Protexis\License Service\PsiService_2.exeC:\Program Files\CyberLink\Shared Files\RichVideo.exeC:\WINDOWS\system32\STacSV.exeC:\WINDOWS\system32\svchost.exe -k imgsvcC:\windows\system32\Wacom_Tablet.exeC:\Program Files\Webroot\WebrootSecurity\SpySweeper.exeC:\windows\system32\WTablet\Wacom_TabletUser.exeC:\windows\system32\Wacom_Tablet.exeC:\Program Files\Canon\CAL\CALMAIN.exeC:\WINDOWS\system32\ctfmon.exeC:\PROGRA~1\ALWILS~1\Avast5\avastUI.exeC:\Program Files\TELUS\TELUS security advisor\Tsa.exeC:\windows\sttray.exeC:\Program Files\Razer\Reclusa\razerhid.exeC:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exeC:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exeC:\Program Files\Nero\Nero 9\InCD\NBHGui.exeC:\Program Files\Nero\Nero 9\InCD\InCD.exeC:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exeC:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exeC:\Program Files\Webroot\WebrootSecurity\SpySweeperUI.exeC:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exeC:\Program Files\Registry Mechanic\RegMech.exeC:\Program Files\Altaro\Oops!Backup\OopsBackup.exeC:\Program Files\Common Files\InstallShield\UpdateService\issch.exeC:\Program Files\Avanquest\PowerDesk\pddlghlp.exeC:\Program Files\Altaro\Oops!Backup\OopsBackup.Engine.exeC:\Documents and Settings\Wayne\My Documents\Downloads\dds.com============== Pseudo HJT Report ===============uStart Page = hxxp://www.canoe.cauInternet Settings,ProxyOverride = *.localBHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dllBHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dllBHO: RoboForm: {724d43a9-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dllBHO: LastPass Browser Helper Object: {95d9ecf5-2a4d-4550-be49-70d42f71296e} - c:\program files\lastpass\LPBar.dllBHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dllBHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllBHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dllTB: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dllTB: LastPass Toolbar: {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - c:\program files\lastpass\LPBar.dllEB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dlluRun: [RoboForm] "c:\program files\siber systems\ai roboform\RoboTaskBarIcon.exe"uRun: [RegistryMechanic] "c:\program files\registry mechanic\RegMech.exe" /HuRun: [Oops!Backup] "c:\program files\altaro\oops!backup\OopsBackup.exe" AUTOSTARTuRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -startuRun: [ctfmon.exe] "c:\windows\system32\ctfmon.exe"mRun: [avast5] "c:\progra~1\alwils~1\avast5\avastUI.exe" /noguimRun: [Tsa.exe] "c:\program files\telus\telus security advisor\Tsa.exe" /AUTORUNmRun: [SwitchBoard] "c:\program files\common files\adobe\switchboard\SwitchBoard.exe"mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRunmRun: [SigmatelSysTrayApp] "c:\windows\sttray.exe"mRun: [Reclusa] "c:\program files\razer\reclusa\razerhid.exe"mRun: [Nikon Transfer Monitor] "c:\program files\common files\nikon\monitor\NkMonitor.exe"mRun: [NBHGui] "c:\program files\nero\nero 9\incd\NBHGui.exe"mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startupmRun: [InCD] "c:\program files\nero\nero 9\incd\InCD.exe"mRun: [EEventManager] "c:\program files\epson\creativity suite\event manager\EEventManager.exe"mRun: [AdobeCS5ServiceManager] "c:\program files\common files\adobe\cs5servicemanager\CS5ServiceManager.exe" -launchedbyloginmRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"mRun: [SpySweeper] "c:\program files\webroot\webrootsecurity\SpySweeperUI.exe" /startintraydRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXEdRunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,NStartupFolder: c:\docume~1\wayne\startm~1\programs\startup\dialog~1.lnk - c:\program files\avanquest\powerdesk\pddlghlp.exeStartupFolder: c:\docume~1\wayne\startm~1\programs\startup\nikonm~1.lnk - c:\program files\common files\nikon\monitor\NkMonitor.exeuPolicies-explorer: MaxRecentDocs = 11 (0xb)mPolicies-system: DisableCAD = 1 (0x1)IE: &Webshots Photo Search - c:\program files\webshots\WSToolbar4IE.dll/MENUSEARCH.HTMIE: Copy to &Lightning Note - c:\program files\corel\wordperfect lightning\programs\WPLightningCopyToNote.htaIE: Customize Menu - file://c:\program files\siber systems\ai roboform\RoboFormComCustomizeIEMenu.htmlIE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000IE: Fill Forms - file://c:\program files\siber systems\ai roboform\RoboFormComFillForms.htmlIE: Identities Editor - file://c:\program files\siber systems\ai roboform\RoboFormComEditIdent.htmlIE: LastPass - file://c:\program files\lastpass\context.html?cmd=lastpassIE: LastPass Fill Forms - file://c:\program files\lastpass\context.html?cmd=fillformsIE: Logoff - file://c:\program files\siber systems\ai roboform\RoboFormComLogoff.htmlIE: Open with WordPerfect - c:\program files\wordperfect office x3\programs\WPLauncher.htaIE: Passcards Editor - file://c:\program files\siber systems\ai roboform\RoboFormComEditPass.htmlIE: Password Generator - file://c:\program files\siber systems\ai roboform\RoboFormComPasswordGenerator.htmlIE: RoboForm Options - file://c:\program files\siber systems\ai roboform\RoboFormComOptions.htmlIE: RoboForm TaskBar Icon - file://c:\program files\siber systems\ai roboform\RoboFormComTaskBarIcon.htmlIE: RoboForm Toolbar - file://c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.htmlIE: Safenotes Editor - file://c:\program files\siber systems\ai roboform\RoboFormComEditNote.htmlIE: Save Forms - file://c:\program files\siber systems\ai roboform\RoboFormComSavePass.htmlIE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - c:\program files\siber systems\ai roboform\RoboFormComFillForms.htmlIE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - c:\program files\siber systems\ai roboform\RoboFormComSavePass.htmlIE: {320AF880-6646-11D3-ABEE-C5DBF3571F4C} - c:\program files\siber systems\ai roboform\RoboFormComOptions.htmlIE: {320AF880-6646-11D3-ABEE-C5DBF3571F4E} - c:\program files\siber systems\ai roboform\RoboFormComCustomizeIEMenu.htmlIE: {320AF880-6646-11D3-ABEE-C5DBF3571F50} - c:\program files\siber systems\ai roboform\RoboFormComPasswordGenerator.htmlIE: {320AF880-6646-11D3-ABEE-C5DBF3571F51} - c:\program files\siber systems\ai roboform\RoboFormComTaskBarIcon.htmlIE: {320AF880-6646-11D3-ABEE-C5DBF3571F55} - c:\program files\siber systems\ai roboform\RoboFormComLogoff.htmlIE: {45DB34C3-955C-11D3-ABEF-444553540000} - c:\program files\siber systems\ai roboform\RoboFormComEditIdent.htmlIE: {45DB34C3-955C-11D3-ABEF-444553540001} - c:\program files\siber systems\ai roboform\RoboFormComEditPass.htmlIE: {45DB34C3-955C-11D3-ABEF-444553540002} - c:\program files\siber systems\ai roboform\RoboFormComEditNote.htmlIE: {724d43aa-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.htmlIE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exeIE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exeIE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dllIE: {43699cd0-e34f-11de-8a39-0800200c9a66} - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - c:\program files\lastpass\LPBar.dllIE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dllDPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cabDPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.0.cabDPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cabDPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cabDPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cabDPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9}Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dllHandler: intu-qt2007 - {026BF40D-BA05-467b-9F1F-AD0D7A3F5F11} - c:\program files\quicktax 2007\ic2007pp.dllHandler: intu-qt2008 - {05E53CE9-66C8-4a9e-A99F-FDB7A8E7B596} - c:\program files\quicktax 2008\ic2008pp.dllHandler: intu-qt2009 - {03947252-2355-4e9b-B446-8CCC75C43370} - c:\program files\quicktax 2009\ic2009pp.dllHandler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLLNotify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLLNotify: AtiExtEvent - Ati2evxx.dllNotify: LMIinit - LMIinit.dllSSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dllSEH: Quick View Plus - ShellExecute Hook: {0cab0400-7395-11d0-a5e5-0020afe2fdd9} - qvphook.dllSEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLLSEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll================= FIREFOX ===================FF - ProfilePath - c:\docume~1\wayne\applic~1\mozilla\firefox\profiles\lq2zgfyt.default\FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=FF - prefs.js: browser.search.selectedEngine - GoogleFF - prefs.js: browser.startup.homepage - hxxp://en.canoe.ca/home.htmlFF - prefs.js: keyword.URL - hxxp://mystart.incredimail.com/?loc=ff_address_bar_im2_test_v2&search=FF - component: c:\program files\siber systems\ai roboform\firefox\components\rfproxy_31.dllFF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\---- FIREFOX POLICIES ----c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("ui.use_native_colors", true);c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("ui.use_native_popup_windows", false);c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("browser.enable_click_image_resizing", true);c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("svg.smil.enabled", false);c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("browser.formfill.debug", false);c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("browser.formfill.agedWeight", 2);c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("browser.formfill.bucketSize", 1);c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);c:\program files\mozilla firefox 3.6 beta 5\greprefs\all.js - pref("html5.enable", false);c:\program files\mozilla firefox 3.6 beta 5\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);c:\program files\mozilla firefox 3.6 beta 5\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");c:\program files\mozilla firefox 3.6 beta 5\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);c:\program files\mozilla firefox 3.6 beta 5\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);c:\program files\mozilla firefox 3.6 beta 5\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);c:\program files\mozilla firefox 3.6 beta 5\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);============= SERVICES / DRIVERS ===============R0 hotcore3;hc3ServiceName;c:\windows\system32\drivers\hotcore3.sys [2010-3-12 40560]R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [2009-11-6 29808]R0 tdrpman251;Acronis Try&Decide and Restore Points filter (build 251);c:\windows\system32\drivers\tdrpm251.sys [2009-12-16 902432]R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2009-8-22 164048]R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\SASDIFSV.SYS [2008-5-28 12872]R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2008-5-28 67656]R2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files\adobe\photoshop elements 7.0\PhotoshopElementsFileAgent.exe [2008-9-16 169312]R2 afcdpsrv;Acronis Nonstop Backup service;c:\program files\common files\acronis\cdp\afcdpsrv.exe [2009-12-16 2326920]R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2004-8-4 14336]R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-8-22 19024]R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-1-22 40384]R2 HWiNFO32;HWiNFO32 Kernel Driver;c:\program files\hwinfo32\HWiNFO32.SYS [2008-11-14 15976]R2 NeroRegInCDSrv;Nero Registry InCD Service;c:\program files\nero\nero 9\incd\NBHRegInCDSrv.exe [2008-9-19 108568]R2 OopsBackup.Service.exe;Oops!Backup Service;c:\program files\altaro\oops!backup\OopsBackup.Service.exe [2010-4-20 21504]R2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\common files\pc tools\smonitor\StartManSvc.exe [2009-10-28 632792]R2 TabletServiceWacom;TabletServiceWacom;c:\windows\system32\Wacom_Tablet.exe [2010-1-9 4463400]R2 WebrootSpySweeperService;Webroot Spy Sweeper Engine;c:\program files\webroot\webrootsecurity\SpySweeper.exe [2009-11-6 4048240]R2 WinI2C-DDC;WinI2C-DDC Kernel Mode Driver;c:\program files\blueeye pro\drivers\ddc\x86\ddcdrv.sys [2010-4-23 10240]R2 WRConsumerService;Webroot Client Service;c:\program files\webroot\webrootsecurity\WRConsumerService.exe [2009-12-31 1201640]R3 afcdp;afcdp;c:\windows\system32\drivers\afcdp.sys [2009-12-16 159168]R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-1-22 40384]R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-1-22 40384]S2 gupdate1c985a9da85e38;Google Update Service (gupdate1c985a9da85e38);c:\program files\google\update\GoogleUpdate.exe [2009-2-2 133104]S2 Roxio Upnp Server 10;Roxio Upnp Server 10;c:\program files\roxio\digital home 10\RoxioUpnpService10.exe [2007-8-24 362992]S2 RoxLiveShare10;LiveShare P2P Server 10;c:\program files\common files\roxio shared\10.0\sharedcom\RoxLiveShare10.exe [2007-8-24 309744]S2 RoxWatch10;Roxio Hard Drive Watcher 10;c:\program files\common files\roxio shared\10.0\sharedcom\RoxWatch10.exe [2007-8-24 166384]S2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]S3 c9647179-dbda-4810-8b9c-04334f14cf7c;c9647179-dbda-4810-8b9c-04334f14cf7c;\??\d:\player\cds300.dll --> d:\player\cds300.dll [?]S3 cpuz132;cpuz132;\??\c:\docume~1\wayne\locals~1\temp\cpuz132\cpuz132_x32.sys --> c:\docume~1\wayne\locals~1\temp\cpuz132\cpuz132_x32.sys [?]S3 epppdt;EPSON 1394.3 Class;c:\windows\system32\drivers\epppdt.sys [2008-2-28 31275]S3 epppdtpr;EPSON 1394.3 Printer Class;c:\windows\system32\drivers\epppdtpr.sys [2008-2-28 14463]S3 pwdrvio;pwdrvio;c:\windows\system32\pwdrvio.sys [2009-8-14 16456]S3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys [2009-8-14 11088]S3 RecFltr;Reclusa Keyboard;c:\windows\system32\drivers\RecFltr.sys [2008-2-21 41984]S3 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;c:\program files\roxio\digital home 10\RoxioUPnPRenderer10.exe [2007-8-24 72176]S3 RoxMediaDB10;RoxMediaDB10;c:\program files\common files\roxio shared\10.0\sharedcom\RoxMediaDB10.exe [2007-8-24 1083888]S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2008-5-28 12872]S3 SwitchBoard;Adobe SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096]S3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\system32\drivers\teamviewervpn.sys [2009-11-9 25088]S3 TMPassthruMP;TMPassthruMP;c:\windows\system32\drivers\tmpassthru.sys --> c:\windows\system32\drivers\TMPassthru.sys [?]S3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\drivers\wacmoumonitor.sys [2008-10-30 16168]S3 X-Rite;X-Rite USB Service;c:\windows\system32\drivers\XrUsb.sys [2008-3-9 15040]=============== Created Last 30 ================2010-06-15 20:04:46 0 ----a-w- c:\documents and settings\wayne\defogger_reenable2010-06-15 16:29:41 98816 ----a-w- c:\windows\sed.exe2010-06-15 16:29:41 77312 ----a-w- c:\windows\MBR.exe2010-06-15 16:29:41 256512 ----a-w- c:\windows\PEV.exe2010-06-15 16:29:41 161792 ----a-w- c:\windows\SWREG.exe2010-06-10 04:25:37 476160 ----a-w- c:\windows\system32\wzcsvc.dll2010-06-10 00:42:47 246 ----a-w- c:\windows\system32\reimage.rep2010-06-10 00:27:40 230 ----a-w- c:\windows\system32\reimage.nat2010-06-10 00:11:53 15272 ----a-w- c:\windows\system32\Native.exe2010-06-10 00:11:51 0 d-----w- C:\ReimageUndo2010-06-09 23:34:59 1364 ----a-w- c:\windows\system32\Compress.res2010-06-08 18:44:12 0 d-----w- C:\XP SP32010-06-07 19:28:11 318 ----a-w- c:\windows\reimage.ini2010-06-07 19:27:44 0 d-----r- C:\rei2010-06-07 19:27:41 0 d-----r- c:\program files\Reimage2010-06-05 03:44:38 0 d-----w- c:\docume~1\wayne\applic~1\com.adobe.bridge.PublishPanel2010-06-05 03:44:38 0 d-----r- c:\program files\CCleaner2010-06-03 04:53:36 0 d-----r- c:\program files\VSREVO~12010-06-02 12:12:14 352513 ----a-w- c:\windows\system32\savapi3.dll2010-06-02 12:12:12 1380403 ----a-w- c:\windows\system32\avgsdk.dll2010-05-31 21:04:13 0 d-----w- C:\archive_db2010-05-30 02:18:10 0 d-----w- c:\docume~1\wayne\applic~1\Expression Media 22010-05-27 18:34:55 0 d-----r- c:\program files\AKVIS2010-05-26 23:45:18 552 ----a-w- c:\windows\system32\d3d8caps.dat2010-05-23 21:07:14 0 d-----w- c:\docume~1\wayne\applic~1\com.adobe.configurator2.E7BED6E5DDA59983786DD72EBFA46B1598278E07.12010-05-22 18:27:20 65776 ----a-w- c:\windows\UnDeploy.exe2010-05-22 18:27:20 0 d-----r- c:\program files\Digital Photo Software2010-05-22 04:05:03 4096 ----a-w- c:\windows\system32\crash==================== Find3M ====================2010-06-10 00:42:47 58880 ----a-w- c:\windows\system32\atl.dll2010-05-31 12:07:50 61440 ----a-w- c:\windows\system32\nlssrv32.exe2010-05-31 12:07:50 57344 ----a-w- c:\windows\system32\ASTSRV.EXE2010-05-31 12:02:24 227840 ----a-w- c:\windows\system32\Deco_32.dll2010-05-04 17:06:01 91020 ---ha-w- c:\windows\system32\mlfcache.dat2010-05-04 03:00:07 7835336 ----a-w- c:\program files\common files\lpuninstall.exe2010-04-29 22:39:38 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys2010-04-29 22:39:26 20952 ----a-w- c:\windows\system32\drivers\mbam.sys2010-04-29 03:06:37 7520 --sha-w- c:\docume~1\alluse~1\applic~1\KGyGaAvL.sys2010-04-16 15:33:36 3003680 ----a-w- c:\windows\system32\usbaaplrc.dll2010-04-08 20:20:02 91424 ----a-w- c:\windows\system32\dnssd.dll2010-04-08 20:20:02 107808 ----a-w- c:\windows\system32\dns-sd.exe2010-04-07 01:26:48 143360 ----a-w- c:\windows\system32\atiapfxx.exe2008-03-10 00:59:16 77 --sh--w- c:\program files\common files\Desktop.ini2007-01-12 00:36:56 33600 ------w- c:\windows\inf\xritedrivers\XrUsb64.sys2007-01-12 00:36:54 18168 ------w- c:\windows\inf\xritedrivers\XrUsb.sys2008-04-24 03:24:19 56 --sh--r- c:\windows\system32\0847E69FFB.sys2008-07-26 02:39:34 8 --sh--r- c:\windows\system32\FB9FE64708.sys2010-03-13 02:58:03 5018 --sha-w- c:\windows\system32\KGyGaAvL.sys2009-02-16 00:13:13 32768 --sh--w- c:\windows\system32\config\systemprofile\ietldcache\index.dat2009-08-22 03:28:11 1197088 --sha-w- c:\windows\system32\drivers\fidbox.dat2009-08-22 03:28:11 29472 --sha-w- c:\windows\system32\drivers\fidbox2.dat============= FINISH: 13:26:42.89 ===============attach.zip Link to post Share on other sites More sharing options...
JasonACS Posted June 17, 2010 Author ID:269145 Share Posted June 17, 2010 Did I not receive a reply because I didn't post correctly, or was no one available to help?Nonetheless, I found the culprit. The malicious rootkit was sshrmd.sys, which eluded me only because everything says it belongs to Spy Sweeper, and I do have Spy Sweeper installed. I did an offline rename on it, and now no more warnings, and all my Automatics Updates started coming through. I scanned it on another computer and it is indeed TDSS. Did it infect Spy Sweeper for the sake of irony? Link to post Share on other sites More sharing options...
Staff screen317 Posted July 7, 2010 Staff ID:280552 Share Posted July 7, 2010 Hi and welcome to Malwarebytes.My apologies for the extended delay. Do you still need help? Link to post Share on other sites More sharing options...
Staff screen317 Posted July 24, 2010 Staff ID:289728 Share Posted July 24, 2010 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts