Please help...infected!

WyldRose · May 17, 2011

My daughter came to me yesterday saying that she was getting popups alerting her that the computer was infected with multiple viruses. I came in to find an alert that looked like it was Windows Security Center. Tried to close the window to no avail. I have run Avast antivirus and malware bytes several times and the repeatedly remove viruses. However as soon as I reboot the system they are back. I haven't gotten any more "Windows Security Center" alerts however Avast keeps notifying me that malicious URLs are being blocked even when there is no browser window open. I have done all the preliminary scans and attached them here. Thank you in advance for your help.

Also, I had to use a different computer to post this as the infected one kept giving me errors.

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6593

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

5/17/2011 10:04:39 AM

mbam-log-2011-05-17 (10-04-39).txt

Scan type: Quick scan

Objects scanned: 165876

Time elapsed: 6 minute(s), 33 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 2

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\documents and settings\Kayla\local settings\Temp\9.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\A.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.

.

DDS (Ver_11-03-05.01) - NTFSx86

Run by Kayla at 10:24:36.96 on Tue 05/17/2011

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_18

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2039.1415 [GMT -5:00]

.

AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\System32\WLTRYSVC.EXE

C:\WINDOWS\System32\bcmwltry.exe

C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\system32\WLTRAY.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe

svchost.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Kodak\AiO\Center\ekdiscovery.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Documents and Settings\Kayla\pbdud.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Kayla\Desktop\dds.com

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://google.com/

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

BHO: Search Toolbar: {9d425283-d487-4337-bab6-ab8354a81457} - c:\program files\search toolbar\SearchToolbar.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: Search Toolbar: {9d425283-d487-4337-bab6-ab8354a81457} - c:\program files\search toolbar\SearchToolbar.dll

uRun: [Wzihiyifan] rundll32.exe "c:\windows\nrvrch.dll",Startup

uRun: [Google Update] "c:\documents and settings\kayla\local settings\application data\google\update\GoogleUpdate.exe" /c

uRun: [pbdud] c:\documents and settings\kayla\pbdud.exe /M

mRun: [igfxtray] c:\windows\system32\igfxtray.exe

mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe

mRun: [igfxpers] c:\windows\system32\igfxpers.exe

mRun: [broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [avast5] c:\progra~1\alwils~1\avast5\avastUI.exe /nogui

mRun: [Conime] %windir%\system32\conime.exe

mRun: [EKIJ5000StatusMonitor] c:\windows\system32\spool\drivers\w32x86\3\EKIJ5000MUI.exe

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll

IE: {7F9DB11C-E358-4ca6-A83D-ACC663939424} - {9999A076-A9E2-4C99-8A2B-632FC9429223} - c:\program files\bonjour\ExplorerPlugin.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1258066091515

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1259609673890

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll

Notify: igfxcui - igfxdev.dll

Notify: itlntfy - itlnfw32.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\docume~1\kayla\applic~1\mozilla\firefox\profiles\88j4bg82.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/|http://www.facebook.com/

FF - plugin: c:\documents and settings\kayla\local settings\application data\google\update\1.3.21.53\npGoogleUpdate3.dll

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

.

============= SERVICES / DRIVERS ===============

.

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-2-19 165456]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-2-19 17744]

R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast5\AvastSvc.exe [2010-2-19 40384]

R2 cpuz134;cpuz134;c:\windows\system32\drivers\cpuz134_x32.sys [2010-12-9 20328]

R2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files\kodak\aio\center\ekdiscovery.exe [2010-2-11 300400]

R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-2-19 40384]

R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast5\AvastSvc.exe [2010-2-19 40384]

.

=============== Created Last 30 ================

.

2011-05-17 15:07:47 249856 --sh--r- c:\documents and settings\kayla\pbdud.exe

2011-05-17 14:25:38 135168 ----a-w- c:\documents and settings\kayla\svc32.exe

2011-05-17 14:08:36 116224 -c--a-w- c:\windows\system32\dllcache\xrxwiadr.dll

2011-05-17 14:08:32 23040 -c--a-w- c:\windows\system32\dllcache\xrxwbtmp.dll

2011-05-17 14:08:31 18944 -c--a-w- c:\windows\system32\dllcache\xrxscnui.dll

2011-05-17 14:08:26 27648 -c--a-w- c:\windows\system32\dllcache\xrxftplt.exe

2011-05-17 14:08:22 4608 -c--a-w- c:\windows\system32\dllcache\xrxflnch.exe

2011-05-17 14:08:01 99865 -c--a-w- c:\windows\system32\dllcache\xlog.exe

2011-05-17 14:07:52 16970 -c--a-w- c:\windows\system32\dllcache\xem336n5.sys

2011-05-17 14:07:50 19455 -c--a-w- c:\windows\system32\dllcache\wvchntxx.sys

2011-05-17 14:07:47 19200 -c--a-w- c:\windows\system32\dllcache\wstcodec.sys

2011-05-17 14:07:45 12063 -c--a-w- c:\windows\system32\dllcache\wsiintxx.sys

2011-05-17 14:07:43 8192 -c--a-w- c:\windows\system32\dllcache\wshirda.dll

2011-05-17 14:07:26 8832 -c--a-w- c:\windows\system32\dllcache\wmiacpi.sys

2011-05-17 14:07:20 154624 -c--a-w- c:\windows\system32\dllcache\wlluc48.sys

2011-05-17 14:07:15 34890 -c--a-w- c:\windows\system32\dllcache\wlandrv2.sys

2011-05-17 14:07:04 771581 -c--a-w- c:\windows\system32\dllcache\winacisa.sys

2011-05-17 14:05:56 397502 -c--a-w- c:\windows\system32\dllcache\vpctcom.sys

2011-05-17 14:04:58 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys

2011-05-17 14:03:50 166784 -c--a-w- c:\windows\system32\dllcache\tridxpm.sys

2011-05-17 14:03:46 525568 -c--a-w- c:\windows\system32\dllcache\tridxp.dll

2011-05-17 14:03:42 159232 -c--a-w- c:\windows\system32\dllcache\tridkbm.sys

2011-05-17 14:03:38 440576 -c--a-w- c:\windows\system32\dllcache\tridkb.dll

2011-05-17 14:03:34 222336 -c--a-w- c:\windows\system32\dllcache\trid3dm.sys

2011-05-17 14:03:30 315520 -c--a-w- c:\windows\system32\dllcache\trid3d.dll

2011-05-17 14:03:25 34375 -c--a-w- c:\windows\system32\dllcache\tpro4.sys

2011-05-17 14:03:21 42496 -c--a-w- c:\windows\system32\dllcache\tp4res.dll

2011-05-17 14:03:19 82944 -c--a-w- c:\windows\system32\dllcache\tp4mon.exe

2011-05-17 14:03:15 31744 -c--a-w- c:\windows\system32\dllcache\tp4.dll

2011-05-17 14:03:09 4992 -c--a-w- c:\windows\system32\dllcache\toside.sys

2011-05-17 14:03:05 230912 -c--a-w- c:\windows\system32\dllcache\tosdvd03.sys

2011-05-17 14:03:01 241664 -c--a-w- c:\windows\system32\dllcache\tosdvd02.sys

2011-05-17 14:02:56 28232 -c--a-w- c:\windows\system32\dllcache\tos4mo.sys

2011-05-17 14:02:51 123995 -c--a-w- c:\windows\system32\dllcache\tjisdn.sys

2011-05-17 14:02:44 138528 -c--a-w- c:\windows\system32\dllcache\tgiulnt5.sys

2011-05-17 14:02:40 81408 -c--a-w- c:\windows\system32\dllcache\tgiul50.dll

2011-05-17 14:02:39 149376 -c--a-w- c:\windows\system32\dllcache\tffsport.sys

2011-05-17 14:02:34 17129 -c--a-w- c:\windows\system32\dllcache\tdkcd31.sys

2011-05-17 14:02:30 37961 -c--a-w- c:\windows\system32\dllcache\tdk100b.sys

2011-05-17 14:02:20 30464 -c--a-w- c:\windows\system32\dllcache\tbatm155.sys

2011-05-17 14:02:15 7040 -c--a-w- c:\windows\system32\dllcache\tandqic.sys

2011-05-17 14:02:11 36640 -c--a-w- c:\windows\system32\dllcache\t2r4mini.sys

2011-05-17 14:02:07 172768 -c--a-w- c:\windows\system32\dllcache\t2r4disp.dll

2011-05-17 14:02:01 32640 -c--a-w- c:\windows\system32\dllcache\symc8xx.sys

2011-05-17 14:00:57 48736 -c--a-w- c:\windows\system32\dllcache\srwlnd5.sys

2011-05-17 14:00:53 99328 -c--a-w- c:\windows\system32\dllcache\srusd.dll

2011-05-17 14:00:45 24660 -c--a-w- c:\windows\system32\dllcache\spxupchk.dll

2011-05-17 14:00:39 61824 -c--a-w- c:\windows\system32\dllcache\speed.sys

2011-05-17 14:00:35 106584 -c--a-w- c:\windows\system32\dllcache\spdports.dll

2011-05-17 14:00:31 19072 -c--a-w- c:\windows\system32\dllcache\sparrow.sys

2011-05-17 14:00:27 7552 -c--a-w- c:\windows\system32\dllcache\sonypvu1.sys

2011-05-17 14:00:24 37040 -c--a-w- c:\windows\system32\dllcache\sonypi.sys

2011-05-17 14:00:20 114688 -c--a-w- c:\windows\system32\dllcache\sonypi.dll

2011-05-17 14:00:16 20752 -c--a-w- c:\windows\system32\dllcache\sonync.sys

2011-05-17 14:00:12 9600 -c--a-w- c:\windows\system32\dllcache\sonymc.sys

2011-05-17 14:00:10 7552 -c--a-w- c:\windows\system32\dllcache\sonyait.sys

2011-05-17 14:00:06 7040 -c--a-w- c:\windows\system32\dllcache\snyaitmc.sys

2011-05-17 13:58:57 94698 -c--a-w- c:\windows\system32\dllcache\sk98xwin.sys

2011-05-17 13:57:57 36480 -c--a-w- c:\windows\system32\dllcache\sfmanm.sys

2011-05-17 13:56:57 198400 -c--a-w- c:\windows\system32\dllcache\s3sav4.dll

2011-05-17 13:55:58 9216 -c--a-w- c:\windows\system32\dllcache\rsmgrstr.dll

2011-05-17 13:55:54 3840 -c--a-w- c:\windows\system32\dllcache\rpfun.sys

2011-05-17 13:55:51 79104 -c--a-w- c:\windows\system32\dllcache\rocket.sys

2011-05-17 13:55:47 37563 -c--a-w- c:\windows\system32\dllcache\rlnet5.sys

2011-05-17 13:55:43 86097 -c--a-w- c:\windows\system32\dllcache\reslog32.dll

2011-05-17 13:55:30 19584 -c--a-w- c:\windows\system32\dllcache\rasirda.sys

2011-05-17 13:55:26 714762 -c--a-w- c:\windows\system32\dllcache\r2mdmkxx.sys

2011-05-17 13:55:22 899146 -c--a-w- c:\windows\system32\dllcache\r2mdkxga.sys

2011-05-17 13:55:18 41472 -c--a-w- c:\windows\system32\dllcache\qvusd.dll

2011-05-17 13:55:15 3328 -c--a-w- c:\windows\system32\dllcache\qv2kux.sys

2011-05-17 13:55:05 49024 -c--a-w- c:\windows\system32\dllcache\ql1280.sys

2011-05-17 13:55:01 40448 -c--a-w- c:\windows\system32\dllcache\ql1240.sys

2011-05-17 13:53:58 19840 -c--a-w- c:\windows\system32\dllcache\philtune.sys

2011-05-17 13:52:51 41984 -c--a-w- c:\windows\system32\dllcache\ovui2rc.dll

2011-05-17 13:51:54 198144 -c--a-w- c:\windows\system32\dllcache\nv3.sys

2011-05-17 13:51:51 123776 -c--a-w- c:\windows\system32\dllcache\nv3.dll

2011-05-17 13:51:43 51552 -c--a-w- c:\windows\system32\dllcache\ntgrip.sys

2011-05-17 13:51:38 9344 -c--a-w- c:\windows\system32\dllcache\ntapm.sys

2011-05-17 13:51:35 7552 -c--a-w- c:\windows\system32\dllcache\nsmmc.sys

2011-05-17 13:51:33 28672 -c--a-w- c:\windows\system32\dllcache\nscirda.sys

2011-05-17 13:51:28 87040 -c--a-w- c:\windows\system32\dllcache\nm6wdm.sys

2011-05-17 13:51:25 126080 -c--a-w- c:\windows\system32\dllcache\nm5a2wdm.sys

2011-05-17 13:51:20 32840 -c--a-w- c:\windows\system32\dllcache\ngrpci.sys

2011-05-17 13:51:15 132695 -c--a-w- c:\windows\system32\dllcache\netwlan5.sys

2011-05-17 13:51:09 65278 -c--a-w- c:\windows\system32\dllcache\netflx3.sys

2011-05-17 13:51:05 39264 -c--a-w- c:\windows\system32\dllcache\neo20xx.sys

2011-05-17 13:51:02 60480 -c--a-w- c:\windows\system32\dllcache\neo20xx.dll

2011-05-17 13:49:55 5504 -c--a-w- c:\windows\system32\dllcache\mstee.sys

2011-05-17 13:49:55 49024 -c--a-w- c:\windows\system32\dllcache\mstape.sys

2011-05-17 13:49:50 12416 -c--a-w- c:\windows\system32\dllcache\msriffwv.sys

2011-05-17 13:49:43 2944 -c--a-w- c:\windows\system32\dllcache\msmpu401.sys

2011-05-17 13:49:41 22016 -c--a-w- c:\windows\system32\dllcache\msircomm.sys

2011-05-17 13:49:09 35200 -c--a-w- c:\windows\system32\dllcache\msgame.sys

2011-05-17 13:49:06 6016 -c--a-w- c:\windows\system32\dllcache\msfsio.sys

2011-05-17 13:49:05 51200 -c--a-w- c:\windows\system32\dllcache\msdv.sys

2011-05-17 13:47:56 22848 -c--a-w- c:\windows\system32\dllcache\lwusbhid.sys

2011-05-17 13:46:50 8192 -c--a-w- c:\windows\system32\dllcache\kbdkor.dll

2011-05-17 13:46:47 8704 -c--a-w- c:\windows\system32\dllcache\kbdjpn.dll

2011-05-17 13:46:34 6144 -c--a-w- c:\windows\system32\dllcache\kbd106.dll

2011-05-17 13:46:31 5632 -c--a-w- c:\windows\system32\dllcache\kbd103.dll

2011-05-17 13:46:29 6144 -c--a-w- c:\windows\system32\dllcache\kbd101c.dll

2011-05-17 13:46:26 6144 -c--a-w- c:\windows\system32\dllcache\kbd101b.dll

2011-05-17 13:46:16 26624 -c--a-w- c:\windows\system32\dllcache\irstusb.sys

2011-05-17 13:46:13 18688 -c--a-w- c:\windows\system32\dllcache\irsir.sys

2011-05-17 13:46:12 28160 -c--a-w- c:\windows\system32\dllcache\irmon.dll

2011-05-17 13:46:09 23552 -c--a-w- c:\windows\system32\dllcache\irmk7.sys

2011-05-17 13:46:09 151552 -c--a-w- c:\windows\system32\dllcache\irftp.exe

2011-05-17 13:46:08 88192 -c--a-w- c:\windows\system32\dllcache\irda.sys

2011-05-17 13:46:02 45632 -c--a-w- c:\windows\system32\dllcache\ip5515.sys

2011-05-17 13:45:59 90200 -c--a-w- c:\windows\system32\dllcache\io8ports.dll

2011-05-17 13:45:56 38784 -c--a-w- c:\windows\system32\dllcache\io8.sys

2011-05-17 13:45:53 13056 -c--a-w- c:\windows\system32\dllcache\inport.sys

2011-05-17 13:45:50 16000 -c--a-w- c:\windows\system32\dllcache\ini910u.sys

2011-05-17 13:45:14 372824 -c--a-w- c:\windows\system32\dllcache\iconf32.dll

2011-05-17 13:45:10 100992 -c--a-w- c:\windows\system32\dllcache\icam5usb.sys

2011-05-17 13:45:07 20480 -c--a-w- c:\windows\system32\dllcache\icam5ext.dll

2011-05-17 13:45:04 45056 -c--a-w- c:\windows\system32\dllcache\icam5com.dll

2011-05-17 13:45:01 154496 -c--a-w- c:\windows\system32\dllcache\icam4usb.sys

2011-05-17 13:43:58 488383 -c--a-w- c:\windows\system32\dllcache\hsf_v124.sys

2011-05-17 13:42:58 165888 -c--a-w- c:\windows\system32\dllcache\hpgt53.dll

2011-05-17 13:41:59 320384 -c--a-w- c:\windows\system32\dllcache\g200m.sys

2011-05-17 13:40:57 12362 -c--a-w- c:\windows\system32\dllcache\f3ab18xi.sys

2011-05-17 13:39:55 19996 -c--a-w- c:\windows\system32\dllcache\em556n4.sys

2011-05-17 13:38:59 8320 -c--a-w- c:\windows\system32\dllcache\dlttape.sys

2011-05-17 13:37:58 117760 -c--a-w- c:\windows\system32\dllcache\d100ib5.sys

2011-05-17 13:36:59 980034 -c--a-w- c:\windows\system32\dllcache\cicap.sys

2011-05-17 13:35:58 31529 -c--a-w- c:\windows\system32\dllcache\brzwlan.sys

2011-05-17 13:34:59 382592 -c--a-w- c:\windows\system32\dllcache\atidrab.dll

2011-05-17 13:33:45 66048 -c--a-w- c:\windows\system32\dllcache\s3legacy.dll

2011-05-17 13:33:22 249856 --sh--r- c:\documents and settings\kayla\rjrouwx.exe

2011-05-16 22:14:08 -------- d-----w- c:\docume~1\kayla\applic~1\Malwarebytes

2011-05-16 22:14:02 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-05-16 22:14:01 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes

2011-05-16 22:13:57 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-05-16 22:13:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-05-16 14:28:42 -------- d-----w- c:\docume~1\kayla\locals~1\applic~1\Google

2011-05-16 14:28:16 -------- d-----w- c:\docume~1\kayla\locals~1\applic~1\Deployment

2011-05-16 02:44:49 -------- d-----w- c:\program files\Search Toolbar

2011-04-19 15:26:48 -------- d-----w- c:\docume~1\kayla\locals~1\applic~1\Microsoft Help

.

==================== Find3M ====================

.

2011-03-07 05:33:50 692736 ----a-w- c:\windows\system32\inetcomm.dll

2011-03-04 06:37:06 420864 ----a-w- c:\windows\system32\vbscript.dll

2011-03-03 13:21:11 1857920 ----a-w- c:\windows\system32\win32k.sys

2011-02-22 23:06:29 916480 ----a-w- c:\windows\system32\wininet.dll

2011-02-22 23:06:29 43520 ----a-w- c:\windows\system32\licmgr10.dll

2011-02-22 23:06:29 1469440 ------w- c:\windows\system32\inetcpl.cpl

2011-02-22 11:41:59 385024 ----a-w- c:\windows\system32\html.iec

2011-02-17 12:32:12 5120 ----a-w- c:\windows\system32\xpsp4res.dll

.

=================== ROOTKIT ====================

.

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net

Windows 5.1.2600 Disk: Hitachi_HTS541040G9AT00 rev.MB2OA61A -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3

.

device: opened successfully

user: MBR read successfully

.

Disk trace:

called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x89D176F0]<<

_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x89d1da10]; MOV EAX, [0x89d1da8c]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }

1 ntkrnlpa!IofCallDriver[0x804EE130] -> \Device\Harddisk0\DR0[0x89D8DAB8]

3 CLASSPNP[0xBA118FD7] -> ntkrnlpa!IofCallDriver[0x804EE130] -> [0x89D9ED80]

\Driver\atapi[0x89E03950] -> IRP_MJ_CREATE -> 0x89D176F0

error: Read A device attached to the system is not functioning.

kernel: MBR read successfully

_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [bP+0x0], CH; JL 0x2e; JNZ 0x3a; }

detected disk devices:

detected hooks:

\Driver\atapi DriverStartIo -> 0x89D1753B

user & kernel MBR OK

Warning: possible TDL3 rootkit infection !

.

============= FINISH: 10:26:02.78 ===============

Attach.zip

LDTate · May 17, 2011

:welcome:

Logs will be closed if you haven't replied within 3 days

Please don't attach the scans / logs from these scans, use "copy/paste".

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

Note: Close all browsers before running ATF Cleaner: IE, FireFox, etc.

Please download ATF Cleaner by Atribune.

Download - ATF Cleaner

WyldRose · May 17, 2011

2011/05/17 11:44:07.0562 1220 TDSS rootkit removing tool 2.5.1.0 May 13 2011 13:20:29

2011/05/17 11:44:08.0031 1220 ================================================================================

2011/05/17 11:44:08.0031 1220 SystemInfo:

2011/05/17 11:44:08.0031 1220

2011/05/17 11:44:08.0031 1220 OS Version: 5.1.2600 ServicePack: 3.0

2011/05/17 11:44:08.0031 1220 Product type: Workstation

2011/05/17 11:44:08.0031 1220 ComputerName: HOUSE

2011/05/17 11:44:08.0031 1220 UserName: Kayla

2011/05/17 11:44:08.0031 1220 Windows directory: C:\WINDOWS

2011/05/17 11:44:08.0031 1220 System windows directory: C:\WINDOWS

2011/05/17 11:44:08.0031 1220 Processor architecture: Intel x86

2011/05/17 11:44:08.0031 1220 Number of processors: 1

2011/05/17 11:44:08.0031 1220 Page size: 0x1000

2011/05/17 11:44:08.0031 1220 Boot type: Normal boot

2011/05/17 11:44:08.0031 1220 ================================================================================

2011/05/17 11:44:08.0406 1220 Initialize success

2011/05/17 11:44:12.0328 3188 ================================================================================

2011/05/17 11:44:12.0328 3188 Scan started

2011/05/17 11:44:12.0328 3188 Mode: Manual;

2011/05/17 11:44:12.0328 3188 ================================================================================

2011/05/17 11:44:15.0671 3188 Aavmker4 (467f062f76e07512ecc1f5f60aab2988) C:\WINDOWS\system32\drivers\Aavmker4.sys

2011/05/17 11:44:15.0781 3188 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys

2011/05/17 11:44:15.0828 3188 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys

2011/05/17 11:44:15.0890 3188 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys

2011/05/17 11:44:15.0984 3188 AFD (7618d5218f2a614672ec61a80d854a37) C:\WINDOWS\System32\drivers\afd.sys

2011/05/17 11:44:16.0156 3188 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys

2011/05/17 11:44:16.0265 3188 aswFsBlk (0c0b08847f2f24baa7bd43d8f2c6c8b0) C:\WINDOWS\system32\drivers\aswFsBlk.sys

2011/05/17 11:44:16.0296 3188 aswMon2 (aa504fa592c9ed79174cb06b8ae340aa) C:\WINDOWS\system32\drivers\aswMon2.sys

2011/05/17 11:44:16.0343 3188 aswRdr (f385ffd39165453fda96736aa3edfd9d) C:\WINDOWS\system32\drivers\aswRdr.sys

2011/05/17 11:44:16.0390 3188 aswSP (45adea26bf613a54fed64ecdd12e58a7) C:\WINDOWS\system32\drivers\aswSP.sys

2011/05/17 11:44:16.0437 3188 aswTdi (c4ee975c87176f1900662d2874233c7f) C:\WINDOWS\system32\drivers\aswTdi.sys

2011/05/17 11:44:16.0468 3188 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

2011/05/17 11:44:16.0500 3188 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

2011/05/17 11:44:16.0546 3188 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

2011/05/17 11:44:16.0703 3188 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

2011/05/17 11:44:16.0828 3188 BCM43XX (b89bcf0a25aeb3b47030ac83287f894a) C:\WINDOWS\system32\DRIVERS\bcmwl5.sys

2011/05/17 11:44:16.0984 3188 bcm4sbxp (78123f44be9e4768852a3a017e02d637) C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys

2011/05/17 11:44:17.0046 3188 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

2011/05/17 11:44:17.0125 3188 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

2011/05/17 11:44:17.0187 3188 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

2011/05/17 11:44:17.0265 3188 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

2011/05/17 11:44:17.0390 3188 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys

2011/05/17 11:44:17.0468 3188 cercsr6 (84853b3fd012251690570e9e7e43343f) C:\WINDOWS\system32\drivers\cercsr6.sys

2011/05/17 11:44:17.0546 3188 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys

2011/05/17 11:44:17.0578 3188 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys

2011/05/17 11:44:17.0687 3188 cpuz134 (75fa19142531cbf490770c2988a7db64) C:\WINDOWS\system32\drivers\cpuz134_x32.sys

2011/05/17 11:44:17.0750 3188 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

2011/05/17 11:44:17.0828 3188 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys

2011/05/17 11:44:18.0000 3188 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys

2011/05/17 11:44:18.0109 3188 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

2011/05/17 11:44:18.0156 3188 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

2011/05/17 11:44:18.0250 3188 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

2011/05/17 11:44:18.0312 3188 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

2011/05/17 11:44:18.0359 3188 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys

2011/05/17 11:44:18.0390 3188 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys

2011/05/17 11:44:18.0421 3188 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys

2011/05/17 11:44:18.0468 3188 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys

2011/05/17 11:44:18.0531 3188 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

2011/05/17 11:44:18.0625 3188 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

2011/05/17 11:44:18.0734 3188 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

2011/05/17 11:44:18.0812 3188 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys

2011/05/17 11:44:18.0937 3188 HSFHWICH (a84bbbdd125d370593004f6429f8445c) C:\WINDOWS\system32\DRIVERS\HSFHWICH.sys

2011/05/17 11:44:19.0156 3188 HSF_DPV (b678fa91cf4a1c19b462d8db04cd02ab) C:\WINDOWS\system32\DRIVERS\HSF_DPV.SYS

2011/05/17 11:44:19.0296 3188 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys

2011/05/17 11:44:19.0484 3188 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

2011/05/17 11:44:19.0593 3188 ialm (d705558b6a678e894c5c67430eef67a2) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys

2011/05/17 11:44:19.0734 3188 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

2011/05/17 11:44:19.0796 3188 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys

2011/05/17 11:44:19.0828 3188 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys

2011/05/17 11:44:19.0859 3188 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys

2011/05/17 11:44:19.0921 3188 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

2011/05/17 11:44:20.0015 3188 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

2011/05/17 11:44:20.0062 3188 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

2011/05/17 11:44:20.0140 3188 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

2011/05/17 11:44:20.0156 3188 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

2011/05/17 11:44:20.0203 3188 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys

2011/05/17 11:44:20.0234 3188 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

2011/05/17 11:44:20.0296 3188 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys

2011/05/17 11:44:20.0390 3188 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

2011/05/17 11:44:20.0437 3188 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys

2011/05/17 11:44:20.0578 3188 mdmxsdk (3c318b9cd391371bed62126581ee9961) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys

2011/05/17 11:44:20.0875 3188 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

2011/05/17 11:44:20.0921 3188 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys

2011/05/17 11:44:20.0953 3188 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys

2011/05/17 11:44:20.0984 3188 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys

2011/05/17 11:44:21.0046 3188 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

2011/05/17 11:44:21.0093 3188 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

2011/05/17 11:44:21.0218 3188 MRxSmb (0ea4d8ed179b75f8afa7998ba22285ca) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

2011/05/17 11:44:21.0265 3188 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

2011/05/17 11:44:21.0453 3188 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

2011/05/17 11:44:21.0484 3188 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

2011/05/17 11:44:21.0531 3188 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

2011/05/17 11:44:21.0593 3188 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

2011/05/17 11:44:21.0687 3188 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys

2011/05/17 11:44:21.0734 3188 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

2011/05/17 11:44:21.0781 3188 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

2011/05/17 11:44:21.0812 3188 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

2011/05/17 11:44:21.0828 3188 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

2011/05/17 11:44:21.0875 3188 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys

2011/05/17 11:44:21.0890 3188 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

2011/05/17 11:44:21.0968 3188 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys

2011/05/17 11:44:22.0140 3188 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys

2011/05/17 11:44:22.0187 3188 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

2011/05/17 11:44:22.0234 3188 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

2011/05/17 11:44:22.0328 3188 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

2011/05/17 11:44:22.0375 3188 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

2011/05/17 11:44:22.0421 3188 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

2011/05/17 11:44:22.0468 3188 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys

2011/05/17 11:44:22.0609 3188 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys

2011/05/17 11:44:22.0765 3188 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

2011/05/17 11:44:22.0796 3188 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys

2011/05/17 11:44:22.0890 3188 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys

2011/05/17 11:44:22.0953 3188 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\drivers\PCIIde.sys

2011/05/17 11:44:23.0000 3188 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\DRIVERS\pcmcia.sys

2011/05/17 11:44:23.0203 3188 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

2011/05/17 11:44:23.0234 3188 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

2011/05/17 11:44:23.0250 3188 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

2011/05/17 11:44:23.0453 3188 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

2011/05/17 11:44:23.0468 3188 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

2011/05/17 11:44:23.0531 3188 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

2011/05/17 11:44:23.0546 3188 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

2011/05/17 11:44:23.0609 3188 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

2011/05/17 11:44:23.0640 3188 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

2011/05/17 11:44:23.0687 3188 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys

2011/05/17 11:44:23.0750 3188 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys

2011/05/17 11:44:23.0781 3188 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys

2011/05/17 11:44:23.0843 3188 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

2011/05/17 11:44:23.0875 3188 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys

2011/05/17 11:44:23.0937 3188 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys

2011/05/17 11:44:24.0031 3188 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys

2011/05/17 11:44:24.0156 3188 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

2011/05/17 11:44:24.0187 3188 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys

2011/05/17 11:44:24.0296 3188 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys

2011/05/17 11:44:24.0468 3188 STAC97 (305cc42945a713347f978d78566113f3) C:\WINDOWS\system32\drivers\STAC97.sys

2011/05/17 11:44:24.0578 3188 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

2011/05/17 11:44:24.0625 3188 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

2011/05/17 11:44:24.0875 3188 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

2011/05/17 11:44:24.0984 3188 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys

2011/05/17 11:44:25.0062 3188 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

2011/05/17 11:44:25.0109 3188 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

2011/05/17 11:44:25.0156 3188 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

2011/05/17 11:44:25.0281 3188 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

2011/05/17 11:44:25.0531 3188 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

2011/05/17 11:44:25.0687 3188 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys

2011/05/17 11:44:25.0734 3188 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys

2011/05/17 11:44:25.0750 3188 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

2011/05/17 11:44:25.0843 3188 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

2011/05/17 11:44:25.0875 3188 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys

2011/05/17 11:44:25.0906 3188 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

2011/05/17 11:44:25.0953 3188 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys

2011/05/17 11:44:26.0187 3188 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

2011/05/17 11:44:26.0265 3188 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

2011/05/17 11:44:26.0390 3188 winachsf (0c5b9cf1bdf998750d9c5eeb5f8c55ac) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys

2011/05/17 11:44:26.0625 3188 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys

2011/05/17 11:44:26.0750 3188 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys

2011/05/17 11:44:26.0859 3188 \HardDisk0 - detected Rootkit.Win32.TDSS.tdl4 (0)

2011/05/17 11:44:26.0875 3188 ================================================================================

2011/05/17 11:44:26.0875 3188 Scan finished

2011/05/17 11:44:26.0875 3188 ================================================================================

2011/05/17 11:44:26.0890 3300 Detected object count: 1

2011/05/17 11:44:48.0390 3300 \HardDisk0 (Rootkit.Win32.TDSS.tdl4) - will be cured after reboot

2011/05/17 11:44:48.0390 3300 \HardDisk0 - ok

2011/05/17 11:44:48.0390 3300 Rootkit.Win32.TDSS.tdl4(\HardDisk0) - User select action: Cure

2011/05/17 11:44:53.0328 0192 Deinitialize success

After reboot I immediately received a warning from Avast...this is a copy from the log

* avast! Real-time Shield Scan Report

* This file is generated automatically

*

* Started on: Tuesday, May 17, 2011 11:46:25 AM

*

5/17/2011 11:48:15 AM C:\Documents and Settings\Kayla\ppp.exe [L] Win32:Zbot-NCP [Trj] (0)

File was successfully moved to chest...

I have also already gotten the malicious URL blocked warning and a suspicious file detection warning.

LDTate · May 17, 2011

Please run TDSSKiller again to be sure it's gone.

WyldRose · May 17, 2011

It doesn't appear to be gone. Getting virus warnings like crazy since reboot.

2011/05/17 12:01:23.0046 1356 TDSS rootkit removing tool 2.5.1.0 May 13 2011 13:20:29

2011/05/17 12:01:23.0593 1356 ================================================================================

2011/05/17 12:01:23.0593 1356 SystemInfo:

2011/05/17 12:01:23.0593 1356

2011/05/17 12:01:23.0593 1356 OS Version: 5.1.2600 ServicePack: 3.0

2011/05/17 12:01:23.0593 1356 Product type: Workstation

2011/05/17 12:01:23.0593 1356 ComputerName: HOUSE

2011/05/17 12:01:23.0593 1356 UserName: Kayla

2011/05/17 12:01:23.0593 1356 Windows directory: C:\WINDOWS

2011/05/17 12:01:23.0593 1356 System windows directory: C:\WINDOWS

2011/05/17 12:01:23.0593 1356 Processor architecture: Intel x86

2011/05/17 12:01:23.0593 1356 Number of processors: 1

2011/05/17 12:01:23.0593 1356 Page size: 0x1000

2011/05/17 12:01:23.0593 1356 Boot type: Normal boot

2011/05/17 12:01:23.0593 1356 ================================================================================

2011/05/17 12:01:24.0000 1356 Initialize success

2011/05/17 12:01:27.0765 1652 ================================================================================

2011/05/17 12:01:27.0765 1652 Scan started

2011/05/17 12:01:27.0765 1652 Mode: Manual;

2011/05/17 12:01:27.0765 1652 ================================================================================

2011/05/17 12:01:31.0406 1652 Aavmker4 (467f062f76e07512ecc1f5f60aab2988) C:\WINDOWS\system32\drivers\Aavmker4.sys

2011/05/17 12:01:31.0562 1652 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys

2011/05/17 12:01:31.0718 1652 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys

2011/05/17 12:01:31.0812 1652 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys

2011/05/17 12:01:31.0890 1652 AFD (7618d5218f2a614672ec61a80d854a37) C:\WINDOWS\System32\drivers\afd.sys

2011/05/17 12:01:32.0109 1652 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys

2011/05/17 12:01:32.0218 1652 aswFsBlk (0c0b08847f2f24baa7bd43d8f2c6c8b0) C:\WINDOWS\system32\drivers\aswFsBlk.sys

2011/05/17 12:01:32.0234 1652 aswMon2 (aa504fa592c9ed79174cb06b8ae340aa) C:\WINDOWS\system32\drivers\aswMon2.sys

2011/05/17 12:01:32.0281 1652 aswRdr (f385ffd39165453fda96736aa3edfd9d) C:\WINDOWS\system32\drivers\aswRdr.sys

2011/05/17 12:01:32.0312 1652 aswSP (45adea26bf613a54fed64ecdd12e58a7) C:\WINDOWS\system32\drivers\aswSP.sys

2011/05/17 12:01:32.0484 1652 aswTdi (c4ee975c87176f1900662d2874233c7f) C:\WINDOWS\system32\drivers\aswTdi.sys

2011/05/17 12:01:32.0515 1652 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

2011/05/17 12:01:32.0593 1652 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

2011/05/17 12:01:32.0640 1652 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

2011/05/17 12:01:32.0796 1652 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

2011/05/17 12:01:32.0921 1652 BCM43XX (b89bcf0a25aeb3b47030ac83287f894a) C:\WINDOWS\system32\DRIVERS\bcmwl5.sys

2011/05/17 12:01:33.0031 1652 bcm4sbxp (78123f44be9e4768852a3a017e02d637) C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys

2011/05/17 12:01:33.0125 1652 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

2011/05/17 12:01:33.0203 1652 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

2011/05/17 12:01:33.0312 1652 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

2011/05/17 12:01:33.0406 1652 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

2011/05/17 12:01:33.0437 1652 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys

2011/05/17 12:01:33.0500 1652 cercsr6 (84853b3fd012251690570e9e7e43343f) C:\WINDOWS\system32\drivers\cercsr6.sys

2011/05/17 12:01:33.0593 1652 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys

2011/05/17 12:01:33.0671 1652 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys

2011/05/17 12:01:33.0796 1652 cpuz134 (75fa19142531cbf490770c2988a7db64) C:\WINDOWS\system32\drivers\cpuz134_x32.sys

2011/05/17 12:01:33.0890 1652 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

2011/05/17 12:01:33.0984 1652 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys

2011/05/17 12:01:34.0140 1652 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys

2011/05/17 12:01:34.0265 1652 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

2011/05/17 12:01:34.0296 1652 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

2011/05/17 12:01:34.0484 1652 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

2011/05/17 12:01:34.0546 1652 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

2011/05/17 12:01:34.0593 1652 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys

2011/05/17 12:01:34.0625 1652 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys

2011/05/17 12:01:34.0734 1652 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys

2011/05/17 12:01:34.0781 1652 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys

2011/05/17 12:01:34.0828 1652 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

2011/05/17 12:01:34.0875 1652 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

2011/05/17 12:01:34.0937 1652 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

2011/05/17 12:01:35.0031 1652 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys

2011/05/17 12:01:35.0109 1652 HSFHWICH (a84bbbdd125d370593004f6429f8445c) C:\WINDOWS\system32\DRIVERS\HSFHWICH.sys

2011/05/17 12:01:35.0171 1652 HSF_DPV (b678fa91cf4a1c19b462d8db04cd02ab) C:\WINDOWS\system32\DRIVERS\HSF_DPV.SYS

2011/05/17 12:01:35.0359 1652 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys

2011/05/17 12:01:35.0484 1652 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

2011/05/17 12:01:35.0718 1652 ialm (d705558b6a678e894c5c67430eef67a2) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys

2011/05/17 12:01:35.0859 1652 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

2011/05/17 12:01:35.0921 1652 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys

2011/05/17 12:01:35.0953 1652 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys

2011/05/17 12:01:36.0109 1652 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys

2011/05/17 12:01:36.0187 1652 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

2011/05/17 12:01:36.0234 1652 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

2011/05/17 12:01:36.0281 1652 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

2011/05/17 12:01:36.0328 1652 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

2011/05/17 12:01:36.0390 1652 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

2011/05/17 12:01:36.0421 1652 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys

2011/05/17 12:01:36.0484 1652 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

2011/05/17 12:01:36.0562 1652 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys

2011/05/17 12:01:36.0593 1652 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

2011/05/17 12:01:36.0640 1652 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys

2011/05/17 12:01:36.0812 1652 mdmxsdk (3c318b9cd391371bed62126581ee9961) C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys

2011/05/17 12:01:36.0875 1652 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

2011/05/17 12:01:36.0921 1652 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys

2011/05/17 12:01:36.0937 1652 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys

2011/05/17 12:01:36.0968 1652 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys

2011/05/17 12:01:37.0015 1652 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

2011/05/17 12:01:37.0109 1652 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

2011/05/17 12:01:37.0218 1652 MRxSmb (0ea4d8ed179b75f8afa7998ba22285ca) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

2011/05/17 12:01:37.0265 1652 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

2011/05/17 12:01:37.0312 1652 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

2011/05/17 12:01:37.0328 1652 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

2011/05/17 12:01:37.0421 1652 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

2011/05/17 12:01:37.0453 1652 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

2011/05/17 12:01:37.0484 1652 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys

2011/05/17 12:01:37.0531 1652 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

2011/05/17 12:01:37.0593 1652 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

2011/05/17 12:01:37.0625 1652 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

2011/05/17 12:01:37.0640 1652 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

2011/05/17 12:01:37.0703 1652 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys

2011/05/17 12:01:37.0734 1652 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

2011/05/17 12:01:37.0828 1652 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys

2011/05/17 12:01:37.0953 1652 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys

2011/05/17 12:01:38.0015 1652 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

2011/05/17 12:01:38.0156 1652 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

2011/05/17 12:01:38.0265 1652 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

2011/05/17 12:01:38.0343 1652 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

2011/05/17 12:01:38.0375 1652 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

2011/05/17 12:01:38.0406 1652 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys

2011/05/17 12:01:38.0500 1652 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys

2011/05/17 12:01:38.0562 1652 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

2011/05/17 12:01:38.0593 1652 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys

2011/05/17 12:01:38.0625 1652 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys

2011/05/17 12:01:38.0765 1652 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\drivers\PCIIde.sys

2011/05/17 12:01:38.0781 1652 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\DRIVERS\pcmcia.sys

2011/05/17 12:01:39.0031 1652 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

2011/05/17 12:01:39.0062 1652 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

2011/05/17 12:01:39.0093 1652 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

2011/05/17 12:01:39.0203 1652 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

2011/05/17 12:01:39.0234 1652 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

2011/05/17 12:01:39.0265 1652 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

2011/05/17 12:01:39.0281 1652 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

2011/05/17 12:01:39.0312 1652 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

2011/05/17 12:01:39.0343 1652 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

2011/05/17 12:01:39.0468 1652 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys

2011/05/17 12:01:39.0515 1652 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys

2011/05/17 12:01:39.0546 1652 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys

2011/05/17 12:01:39.0703 1652 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

2011/05/17 12:01:39.0750 1652 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys

2011/05/17 12:01:39.0812 1652 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys

2011/05/17 12:01:39.0875 1652 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys

2011/05/17 12:01:40.0062 1652 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

2011/05/17 12:01:40.0171 1652 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys

2011/05/17 12:01:40.0250 1652 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys

2011/05/17 12:01:40.0359 1652 STAC97 (305cc42945a713347f978d78566113f3) C:\WINDOWS\system32\drivers\STAC97.sys

2011/05/17 12:01:40.0500 1652 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

2011/05/17 12:01:40.0546 1652 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

2011/05/17 12:01:40.0656 1652 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

2011/05/17 12:01:40.0812 1652 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys

2011/05/17 12:01:40.0906 1652 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

2011/05/17 12:01:40.0937 1652 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

2011/05/17 12:01:41.0000 1652 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

2011/05/17 12:01:41.0109 1652 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

2011/05/17 12:01:41.0218 1652 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

2011/05/17 12:01:41.0468 1652 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys

2011/05/17 12:01:41.0546 1652 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys

2011/05/17 12:01:41.0593 1652 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

2011/05/17 12:01:41.0656 1652 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

2011/05/17 12:01:41.0703 1652 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys

2011/05/17 12:01:41.0718 1652 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

2011/05/17 12:01:41.0781 1652 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys

2011/05/17 12:01:41.0921 1652 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

2011/05/17 12:01:42.0000 1652 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

2011/05/17 12:01:42.0187 1652 winachsf (0c5b9cf1bdf998750d9c5eeb5f8c55ac) C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys

2011/05/17 12:01:42.0453 1652 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys

2011/05/17 12:01:42.0484 1652 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys

2011/05/17 12:01:42.0546 1652 \HardDisk0 - detected Rootkit.Win32.TDSS.tdl4 (0)

2011/05/17 12:01:42.0546 1652 ================================================================================

2011/05/17 12:01:42.0546 1652 Scan finished

2011/05/17 12:01:42.0546 1652 ================================================================================

2011/05/17 12:01:42.0562 1956 Detected object count: 1

2011/05/17 12:01:54.0359 1956 \HardDisk0 (Rootkit.Win32.TDSS.tdl4) - will be cured after reboot

2011/05/17 12:01:54.0359 1956 \HardDisk0 - ok

2011/05/17 12:01:54.0359 1956 Rootkit.Win32.TDSS.tdl4(\HardDisk0) - User select action: Cure

2011/05/17 12:02:05.0093 1676 Deinitialize success

LDTate · May 17, 2011

Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan

On completion of the scan click save log, save it to your desktop and post in your next reply

WyldRose · May 17, 2011