Jump to content

Malwarebytes cleaned my PC but my network only works with a static now


Recommended Posts

.

DDS (Ver_2011-06-12.02) - NTFSx86

Internet Explorer: 8.0.6001.18702

Run by Admin at 21:57:33 on 2011-06-14

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.479.94 [GMT -5:00]

.

AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

svchost.exe

c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\WINDOWS\system32\EloSrvce.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe

svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\EloDkMon.exe

C:\WINDOWS\system32\EloTTray.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

.

============== Pseudo HJT Report ===============

.

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey

mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1264447065407

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxps://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://poolcorp.webex.com/client/T27LB/support/ieatgpc.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: DhcpNameServer = 192.168.1.254

TCP: Interfaces\{440304EB-E462-4135-8957-E563954D56D3} : NameServer = 192.168.1.1

Notify: igfxcui - igfxsrvc.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

.

============= SERVICES / DRIVERS ===============

.

R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165264]

R1 MpKsl43d3f881;MpKsl43d3f881;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{2d75fe59-7fad-4e20-a650-1758325b1906}\MpKsl43d3f881.sys [2011-6-14 28752]

R3 EloBus;Elobus Filter Driver;c:\windows\system32\drivers\EloBus.sys [2007-12-24 14848]

R3 EloSer;Elo Serial Driver;c:\windows\system32\drivers\EloSer.Sys [2007-12-24 47104]

.

=============== Created Last 30 ================

.

2011-06-15 02:54:18 28752 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{2d75fe59-7fad-4e20-a650-1758325b1906}\MpKsl43d3f881.sys

2011-06-15 02:53:26 6962000 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{2d75fe59-7fad-4e20-a650-1758325b1906}\mpengine.dll

2011-06-15 02:20:50 -------- d-sha-r- C:\cmdcons

2011-06-15 02:19:19 98816 ----a-w- c:\windows\sed.exe

2011-06-15 02:19:19 518144 ----a-w- c:\windows\SWREG.exe

2011-06-15 02:19:19 256512 ----a-w- c:\windows\PEV.exe

2011-06-15 02:19:19 208896 ----a-w- c:\windows\MBR.exe

2011-06-15 00:28:29 439804 ----a-w- c:\windows\system32\SearchIndexer.exeBAFC439B

2011-06-15 00:10:03 222080 ------w- c:\windows\system32\MpSigStub.exe

2011-06-15 00:06:41 -------- d-----w- c:\program files\Microsoft Security Client

2011-06-15 00:02:08 0 ----a-w- c:\windows\Vrigo.bin

2011-06-14 15:26:02 54016 ----a-w- c:\windows\system32\drivers\apabmqhx.sys

2011-06-14 13:15:42 54016 ----a-w- c:\windows\system32\drivers\bomcsjow.sys

2011-06-14 13:09:50 -------- d-----w- c:\documents and settings\admin\application data\Malwarebytes

2011-06-14 13:09:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-06-14 13:09:46 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes

2011-06-14 13:09:43 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-06-14 13:09:43 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-06-13 21:26:28 -------- d-----w- c:\documents and settings\all users\application data\cB28258GgMpL28258

.

==================== Find3M ====================

.

.

=================== ROOTKIT ====================

.

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net

Windows 5.1.2600 Disk: ST380012A rev.4.06 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3

.

device: opened successfully

user: MBR read successfully

.

Disk trace:

called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x853294D0]<<

_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x8532f7f0]; MOV EAX, [0x8532f86c]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }

1 nt!IofCallDriver[0x804E37D5] -> \Device\Harddisk0\DR0[0x853E3348]

3 CLASSPNP[0xF7848FD7] -> nt!IofCallDriver[0x804E37D5] -> \Device\0000005a[0x853713B8]

5 ACPI[0xF77BF620] -> nt!IofCallDriver[0x804E37D5] -> [0x85371D98]

\Driver\atapi[0x8537FC78] -> IRP_MJ_CREATE -> 0x853294D0

error: Read A device attached to the system is not functioning.

kernel: MBR read successfully

_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [bP+0x0], CH; JL 0x2e; JNZ 0x3a; }

detected disk devices:

detected hooks:

\Driver\atapi DriverStartIo -> 0x8532931B

user & kernel MBR OK

Warning: possible TDL3 rootkit infection !

.

============= FINISH: 22:00:15.60 ===============

attach.zip

Link to post
Share on other sites

  • Staff

Hi and welcome to Malwarebytes.

  • Download the file TDSSKiller.zip and extract it into a folder on the infected PC.
  • Execute the file TDSSKiller.exe by double-clicking on it.
  • Wait for the scan and disinfection process to be over.
  • When its work is over, the utility prompts for a reboot to complete the disinfection.

By default, the utility outputs runtime log into the system disk root directory (the disk where the operating system is installed, C:\ as a rule).

The log is like UtilityName.Version_Date_Time_log.txt.

for example, C:\TDSSKiller.2.2.0_20.12.2009_15.31.43_log.txt.

Please post that log here.

Next, download DDS by sUBs and save it to your Desktop.

Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post only DDS.txt directly into your reply.

-screen317

Link to post
Share on other sites

I noticed that TDss was on the syste so I did that on the 14th. This is the log from that.

2011/06/14 22:47:21.0103 3880 TDSS rootkit removing tool 2.5.4.0 Jun 7 2011 17:31:48

2011/06/14 22:47:21.0594 3880 ================================================================================

2011/06/14 22:47:21.0594 3880 SystemInfo:

2011/06/14 22:47:21.0594 3880

2011/06/14 22:47:21.0594 3880 OS Version: 5.1.2600 ServicePack: 3.0

2011/06/14 22:47:21.0594 3880 Product type: Workstation

2011/06/14 22:47:21.0594 3880 ComputerName: POS

2011/06/14 22:47:21.0594 3880 UserName: Admin

2011/06/14 22:47:21.0594 3880 Windows directory: C:\WINDOWS

2011/06/14 22:47:21.0594 3880 System windows directory: C:\WINDOWS

2011/06/14 22:47:21.0594 3880 Processor architecture: Intel x86

2011/06/14 22:47:21.0594 3880 Number of processors: 1

2011/06/14 22:47:21.0594 3880 Page size: 0x1000

2011/06/14 22:47:21.0594 3880 Boot type: Normal boot

2011/06/14 22:47:21.0594 3880 ================================================================================

2011/06/14 22:47:23.0196 3880 Initialize success

2011/06/14 22:47:24.0789 3968 ================================================================================

2011/06/14 22:47:24.0789 3968 Scan started

2011/06/14 22:47:24.0789 3968 Mode: Manual;

2011/06/14 22:47:24.0789 3968 ================================================================================

2011/06/14 22:47:25.0940 3968 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys

2011/06/14 22:47:26.0101 3968 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys

2011/06/14 22:47:26.0401 3968 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys

2011/06/14 22:47:26.0591 3968 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys

2011/06/14 22:47:26.0742 3968 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys

2011/06/14 22:47:27.0372 3968 ALCXWDM (4e0aca5290b2966f24c45250a56c2da1) C:\WINDOWS\system32\drivers\ALCXWDM.SYS

2011/06/14 22:47:28.0414 3968 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

2011/06/14 22:47:28.0594 3968 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

2011/06/14 22:47:28.0895 3968 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

2011/06/14 22:47:29.0065 3968 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

2011/06/14 22:47:29.0235 3968 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

2011/06/14 22:47:29.0526 3968 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

2011/06/14 22:47:29.0826 3968 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

2011/06/14 22:47:29.0976 3968 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

2011/06/14 22:47:30.0146 3968 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys

2011/06/14 22:47:30.0998 3968 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

2011/06/14 22:47:31.0178 3968 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys

2011/06/14 22:47:31.0408 3968 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys

2011/06/14 22:47:31.0558 3968 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

2011/06/14 22:47:31.0729 3968 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

2011/06/14 22:47:32.0019 3968 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

2011/06/14 22:47:32.0169 3968 EloBus (92c6e1415d71393722cc63552d8dfc1e) C:\WINDOWS\system32\DRIVERS\EloBus.sys

2011/06/14 22:47:32.0340 3968 EloSer (9a0412383cc5dd977add7f675b76ff9c) C:\WINDOWS\system32\DRIVERS\EloSer.sys

2011/06/14 22:47:32.0550 3968 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

2011/06/14 22:47:32.0720 3968 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys

2011/06/14 22:47:32.0870 3968 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys

2011/06/14 22:47:33.0011 3968 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys

2011/06/14 22:47:33.0191 3968 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys

2011/06/14 22:47:33.0351 3968 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

2011/06/14 22:47:33.0521 3968 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

2011/06/14 22:47:33.0672 3968 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

2011/06/14 22:47:33.0852 3968 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys

2011/06/14 22:47:34.0212 3968 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys

2011/06/14 22:47:34.0613 3968 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

2011/06/14 22:47:34.0773 3968 ialm (1406d6ef4436aee970efe13193123965) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys

2011/06/14 22:47:34.0943 3968 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

2011/06/14 22:47:35.0274 3968 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys

2011/06/14 22:47:35.0424 3968 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys

2011/06/14 22:47:35.0574 3968 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys

2011/06/14 22:47:35.0885 3968 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

2011/06/14 22:47:36.0065 3968 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

2011/06/14 22:47:36.0225 3968 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

2011/06/14 22:47:36.0385 3968 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

2011/06/14 22:47:36.0536 3968 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

2011/06/14 22:47:36.0696 3968 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys

2011/06/14 22:47:36.0856 3968 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

2011/06/14 22:47:37.0006 3968 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys

2011/06/14 22:47:37.0167 3968 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

2011/06/14 22:47:37.0357 3968 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys

2011/06/14 22:47:37.0667 3968 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

2011/06/14 22:47:37.0838 3968 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys

2011/06/14 22:47:37.0988 3968 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys

2011/06/14 22:47:38.0138 3968 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys

2011/06/14 22:47:38.0328 3968 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

2011/06/14 22:47:38.0488 3968 MpFilter (7e34bfa1a7b60bba1da03d677f16cd63) C:\WINDOWS\system32\DRIVERS\MpFilter.sys

2011/06/14 22:47:38.0709 3968 MpKsl43d3f881 (5f53edfead46fa7adb78eee9ecce8fdf) c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2D75FE59-7FAD-4E20-A650-1758325B1906}\MpKsl43d3f881.sys

2011/06/14 22:47:39.0019 3968 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

2011/06/14 22:47:39.0240 3968 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

2011/06/14 22:47:39.0410 3968 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

2011/06/14 22:47:39.0580 3968 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

2011/06/14 22:47:39.0750 3968 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

2011/06/14 22:47:39.0900 3968 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

2011/06/14 22:47:40.0061 3968 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

2011/06/14 22:47:40.0271 3968 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys

2011/06/14 22:47:40.0461 3968 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

2011/06/14 22:47:40.0611 3968 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

2011/06/14 22:47:40.0762 3968 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

2011/06/14 22:47:40.0912 3968 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

2011/06/14 22:47:41.0072 3968 NDProxy (6215023940cfd3702b46abc304e1d45a) C:\WINDOWS\system32\drivers\NDProxy.sys

2011/06/14 22:47:41.0262 3968 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

2011/06/14 22:47:41.0483 3968 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

2011/06/14 22:47:41.0653 3968 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

2011/06/14 22:47:41.0833 3968 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

2011/06/14 22:47:41.0963 3968 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

2011/06/14 22:47:42.0114 3968 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

2011/06/14 22:47:42.0314 3968 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys

2011/06/14 22:47:42.0474 3968 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

2011/06/14 22:47:42.0624 3968 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys

2011/06/14 22:47:42.0785 3968 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys

2011/06/14 22:47:43.0075 3968 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys

2011/06/14 22:47:43.0245 3968 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys

2011/06/14 22:47:44.0267 3968 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

2011/06/14 22:47:44.0427 3968 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

2011/06/14 22:47:44.0587 3968 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

2011/06/14 22:47:45.0388 3968 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

2011/06/14 22:47:45.0559 3968 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

2011/06/14 22:47:45.0719 3968 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

2011/06/14 22:47:45.0899 3968 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

2011/06/14 22:47:46.0039 3968 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

2011/06/14 22:47:46.0230 3968 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys

2011/06/14 22:47:46.0400 3968 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys

2011/06/14 22:47:46.0580 3968 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys

2011/06/14 22:47:46.0800 3968 RTL8023xp (cf84b1f0e8b14d4120aaf9cf35cbb265) C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys

2011/06/14 22:47:46.0971 3968 rtl8139 (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS

2011/06/14 22:47:47.0151 3968 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

2011/06/14 22:47:47.0341 3968 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys

2011/06/14 22:47:47.0511 3968 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys

2011/06/14 22:47:47.0682 3968 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys

2011/06/14 22:47:48.0122 3968 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

2011/06/14 22:47:48.0333 3968 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys

2011/06/14 22:47:48.0493 3968 Srv (da852e3e0bf1cea75d756f9866241e57) C:\WINDOWS\system32\DRIVERS\srv.sys

2011/06/14 22:47:48.0663 3968 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

2011/06/14 22:47:48.0823 3968 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

2011/06/14 22:47:49.0524 3968 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

2011/06/14 22:47:49.0745 3968 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys

2011/06/14 22:47:49.0895 3968 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

2011/06/14 22:47:50.0045 3968 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

2011/06/14 22:47:50.0235 3968 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

2011/06/14 22:47:50.0546 3968 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

2011/06/14 22:47:50.0866 3968 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

2011/06/14 22:47:51.0026 3968 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys

2011/06/14 22:47:51.0177 3968 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys

2011/06/14 22:47:51.0337 3968 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

2011/06/14 22:47:51.0487 3968 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys

2011/06/14 22:47:51.0627 3968 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

2011/06/14 22:47:51.0788 3968 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys

2011/06/14 22:47:51.0968 3968 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

2011/06/14 22:47:52.0238 3968 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys

2011/06/14 22:47:52.0418 3968 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

2011/06/14 22:47:52.0719 3968 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

2011/06/14 22:47:52.0999 3968 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys

2011/06/14 22:47:53.0170 3968 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys

2011/06/14 22:47:53.0360 3968 {6080A529-897E-4629-A488-ABA0C29B635E} (fd1f4e9cf06c71c8d73a24acf18d8296) C:\WINDOWS\system32\drivers\ialmsbw.sys

2011/06/14 22:47:53.0520 3968 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91} (d4d7331d33d1fa73e588e5ce0d90a4c1) C:\WINDOWS\system32\drivers\ialmkchw.sys

2011/06/14 22:47:53.0560 3968 MBR (0x1B8) (2839639fa37b8353e792a2a30a12ced3) \Device\Harddisk0\DR0

2011/06/14 22:47:53.0570 3968 \Device\Harddisk0\DR0 - detected Rootkit.Win32.TDSS.tdl4 (0)

2011/06/14 22:47:53.0590 3968 MBR (0x1B8) (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk1\DR2

2011/06/14 22:47:53.0600 3968 ================================================================================

2011/06/14 22:47:53.0600 3968 Scan finished

2011/06/14 22:47:53.0600 3968 ================================================================================

2011/06/14 22:47:53.0620 3960 Detected object count: 1

2011/06/14 22:47:53.0620 3960 Actual detected object count: 1

2011/06/14 22:47:58.0247 3960 \Device\Harddisk0\DR0 (Rootkit.Win32.TDSS.tdl4) - will be cured after reboot

2011/06/14 22:47:58.0287 3960 \Device\Harddisk0\DR0 - ok

2011/06/14 22:47:58.0287 3960 Rootkit.Win32.TDSS.tdl4(\Device\Harddisk0\DR0) - User select action: Cure

2011/06/14 22:48:01.0822 3892 Deinitialize success

DDS:

.

DDS (Ver_2011-06-12.02) - NTFSx86

Internet Explorer: 8.0.6001.18702

Run by Admin at 20:00:15 on 2011-06-18

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.479.186 [GMT -5:00]

.

AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost.exe -k DcomLaunch

svchost.exe

c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\WINDOWS\system32\EloSrvce.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe

svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Microsoft Security Client\msseces.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\EloDkMon.exe

C:\WINDOWS\system32\EloTTray.exe

C:\WINDOWS\system32\wuauclt.exe

.

============== Pseudo HJT Report ===============

.

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1264447065407

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxps://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://poolcorp.webex.com/client/T27LB/support/ieatgpc.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: DhcpNameServer = 192.168.1.254

TCP: Interfaces\{440304EB-E462-4135-8957-E563954D56D3} : NameServer = 192.168.1.1

Notify: igfxcui - igfxsrvc.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

.

============= SERVICES / DRIVERS ===============

.

R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165264]

R1 MpKsl299b7f36;MpKsl299b7f36;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{d83bc7fa-3017-47f9-961a-90742fead5d1}\MpKsl299b7f36.sys [2011-6-18 28752]

R3 EloBus;Elobus Filter Driver;c:\windows\system32\drivers\EloBus.sys [2007-12-24 14848]

R3 EloSer;Elo Serial Driver;c:\windows\system32\drivers\EloSer.Sys [2007-12-24 47104]

.

=============== Created Last 30 ================

.

2011-06-18 21:33:58 28752 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{d83bc7fa-3017-47f9-961a-90742fead5d1}\MpKsl299b7f36.sys

2011-06-18 21:01:18 116224 -c--a-w- c:\windows\system32\dllcache\xrxwiadr.dll

2011-06-18 21:01:13 23040 -c--a-w- c:\windows\system32\dllcache\xrxwbtmp.dll

2011-06-18 21:01:11 18944 -c--a-w- c:\windows\system32\dllcache\xrxscnui.dll

2011-06-18 21:01:07 27648 -c--a-w- c:\windows\system32\dllcache\xrxftplt.exe

2011-06-18 21:01:01 4608 -c--a-w- c:\windows\system32\dllcache\xrxflnch.exe

2011-06-18 21:00:27 99865 -c--a-w- c:\windows\system32\dllcache\xlog.exe

2011-06-18 21:00:19 16970 -c--a-w- c:\windows\system32\dllcache\xem336n5.sys

2011-06-18 21:00:17 19455 -c--a-w- c:\windows\system32\dllcache\wvchntxx.sys

2011-06-18 21:00:12 19200 -c--a-w- c:\windows\system32\dllcache\wstcodec.sys

2011-06-18 21:00:11 12063 -c--a-w- c:\windows\system32\dllcache\wsiintxx.sys

2011-06-18 21:00:09 8192 -c--a-w- c:\windows\system32\dllcache\wshirda.dll

2011-06-18 20:59:48 8832 -c--a-w- c:\windows\system32\dllcache\wmiacpi.sys

2011-06-18 20:59:44 154624 -c--a-w- c:\windows\system32\dllcache\wlluc48.sys

2011-06-18 20:59:40 34890 -c--a-w- c:\windows\system32\dllcache\wlandrv2.sys

2011-06-18 20:59:28 771581 -c--a-w- c:\windows\system32\dllcache\winacisa.sys

2011-06-18 20:59:22 53760 -c--a-w- c:\windows\system32\dllcache\wiamsmud.dll

2011-06-18 20:59:18 87040 -c--a-w- c:\windows\system32\dllcache\wiafbdrv.dll

2011-06-18 20:59:11 701386 -c--a-w- c:\windows\system32\dllcache\wdhaalba.sys

2011-06-18 20:59:10 23615 -c--a-w- c:\windows\system32\dllcache\wch7xxnt.sys

2011-06-18 20:59:08 31744 -c--a-w- c:\windows\system32\dllcache\wceusbsh.sys

2011-06-18 20:59:04 35871 -c--a-w- c:\windows\system32\dllcache\wbfirdma.sys

2011-06-18 20:59:00 33599 -c--a-w- c:\windows\system32\dllcache\watv04nt.sys

2011-06-18 20:57:56 765884 -c--a-w- c:\windows\system32\dllcache\usrti.sys

2011-06-18 20:56:58 50688 -c--a-w- c:\windows\system32\dllcache\umaxscan.dll

2011-06-18 20:55:55 34375 -c--a-w- c:\windows\system32\dllcache\tpro4.sys

2011-06-18 20:55:51 42496 -c--a-w- c:\windows\system32\dllcache\tp4res.dll

2011-06-18 20:55:50 82944 -c--a-w- c:\windows\system32\dllcache\tp4mon.exe

2011-06-18 20:55:46 31744 -c--a-w- c:\windows\system32\dllcache\tp4.dll

2011-06-18 20:55:36 4992 -c--a-w- c:\windows\system32\dllcache\toside.sys

2011-06-18 20:55:32 230912 -c--a-w- c:\windows\system32\dllcache\tosdvd03.sys

2011-06-18 20:55:28 241664 -c--a-w- c:\windows\system32\dllcache\tosdvd02.sys

2011-06-18 20:55:24 28232 -c--a-w- c:\windows\system32\dllcache\tos4mo.sys

2011-06-18 20:55:18 123995 -c--a-w- c:\windows\system32\dllcache\tjisdn.sys

2011-06-18 20:55:10 138528 -c--a-w- c:\windows\system32\dllcache\tgiulnt5.sys

2011-06-18 20:55:06 81408 -c--a-w- c:\windows\system32\dllcache\tgiul50.dll

2011-06-18 20:55:05 149376 -c--a-w- c:\windows\system32\dllcache\tffsport.sys

2011-06-18 20:53:59 10240 -c--a-w- c:\windows\system32\dllcache\swpdflt2.dll

2011-06-18 20:53:55 53760 -c--a-w- c:\windows\system32\dllcache\sw_wheel.dll

2011-06-18 20:53:52 41472 -c--a-w- c:\windows\system32\dllcache\sw_effct.dll

2011-06-18 20:53:50 15232 -c--a-w- c:\windows\system32\dllcache\streamip.sys

2011-06-18 20:53:45 155648 -c--a-w- c:\windows\system32\dllcache\stlnprop.dll

2011-06-18 20:53:42 53248 -c--a-w- c:\windows\system32\dllcache\stlncoin.dll

2011-06-18 20:53:38 285760 -c--a-w- c:\windows\system32\dllcache\stlnata.sys

2011-06-18 20:53:33 16896 -c--a-w- c:\windows\system32\dllcache\stcusb.sys

2011-06-18 20:53:26 48736 -c--a-w- c:\windows\system32\dllcache\srwlnd5.sys

2011-06-18 20:53:20 99328 -c--a-w- c:\windows\system32\dllcache\srusd.dll

2011-06-18 20:53:11 24660 -c--a-w- c:\windows\system32\dllcache\spxupchk.dll

2011-06-18 20:53:04 61824 -c--a-w- c:\windows\system32\dllcache\speed.sys

2011-06-18 20:53:01 106584 -c--a-w- c:\windows\system32\dllcache\spdports.dll

2011-06-18 20:51:59 6912 -c--a-w- c:\windows\system32\dllcache\smbclass.sys

2011-06-18 20:50:59 150144 -c--a-w- c:\windows\system32\dllcache\sis6306v.dll

2011-06-18 20:49:56 17280 -c--a-w- c:\windows\system32\dllcache\scr111.sys

2011-06-18 20:48:57 166720 -c--a-w- c:\windows\system32\dllcache\s3m.sys

2011-06-18 20:47:54 714762 -c--a-w- c:\windows\system32\dllcache\r2mdmkxx.sys

2011-06-18 20:46:58 363520 -c--a-w- c:\windows\system32\dllcache\psisdecd.dll

2011-06-18 20:45:59 27296 -c--a-w- c:\windows\system32\dllcache\perc2.sys

2011-06-18 20:44:59 28032 -c--a-w- c:\windows\system32\dllcache\ovcd.sys

2011-06-18 20:43:59 87040 -c--a-w- c:\windows\system32\dllcache\nm6wdm.sys

2011-06-18 20:42:58 52255 -c--a-w- c:\windows\system32\dllcache\n1000nt5.sys

2011-06-18 20:42:54 75520 -c--a-w- c:\windows\system32\dllcache\mxport.sys

2011-06-18 20:42:51 7168 -c--a-w- c:\windows\system32\dllcache\mxport.dll

2011-06-18 20:42:47 19968 -c--a-w- c:\windows\system32\dllcache\mxnic.sys

2011-06-18 20:42:43 19968 -c--a-w- c:\windows\system32\dllcache\mxicfg.dll

2011-06-18 20:42:40 21888 -c--a-w- c:\windows\system32\dllcache\mxcard.sys

2011-06-18 20:42:33 103296 -c--a-w- c:\windows\system32\dllcache\mtxvideo.sys

2011-06-18 20:42:20 5504 -c--a-w- c:\windows\system32\dllcache\mstee.sys

2011-06-18 20:42:19 49024 -c--a-w- c:\windows\system32\dllcache\mstape.sys

2011-06-18 20:42:14 12416 -c--a-w- c:\windows\system32\dllcache\msriffwv.sys

2011-06-18 20:42:06 2944 -c--a-w- c:\windows\system32\dllcache\msmpu401.sys

2011-06-18 20:42:04 22016 -c--a-w- c:\windows\system32\dllcache\msircomm.sys

2011-06-18 20:41:52 35200 -c--a-w- c:\windows\system32\dllcache\msgame.sys

2011-06-18 20:41:48 6016 -c--a-w- c:\windows\system32\dllcache\msfsio.sys

2011-06-18 20:41:47 51200 -c--a-w- c:\windows\system32\dllcache\msdv.sys

2011-06-18 20:41:38 17280 -c--a-w- c:\windows\system32\dllcache\mraid35x.sys

2011-06-18 20:41:27 15232 -c--a-w- c:\windows\system32\dllcache\mpe.sys

2011-06-18 20:41:22 16128 -c--a-w- c:\windows\system32\dllcache\modemcsa.sys

2011-06-18 20:41:14 6528 -c--a-w- c:\windows\system32\dllcache\miniqic.sys

2011-06-18 20:41:08 320384 -c--a-w- c:\windows\system32\dllcache\mgaum.sys

2011-06-18 20:41:05 235648 -c--a-w- c:\windows\system32\dllcache\mgaud.dll

2011-06-18 20:41:03 26112 -c--a-w- c:\windows\system32\dllcache\memstpci.sys

2011-06-18 20:41:00 47616 -c--a-w- c:\windows\system32\dllcache\memgrp.dll

2011-06-18 20:39:59 20573 -c--a-w- c:\windows\system32\dllcache\lne100.sys

2011-06-18 20:38:58 6144 -c--a-w- c:\windows\system32\dllcache\kbd101b.dll

2011-06-18 20:38:51 26624 -c--a-w- c:\windows\system32\dllcache\irstusb.sys

2011-06-18 20:38:48 18688 -c--a-w- c:\windows\system32\dllcache\irsir.sys

2011-06-18 20:38:47 28160 -c--a-w- c:\windows\system32\dllcache\irmon.dll

2011-06-18 20:38:45 23552 -c--a-w- c:\windows\system32\dllcache\irmk7.sys

2011-06-18 20:38:44 151552 -c--a-w- c:\windows\system32\dllcache\irftp.exe

2011-06-18 20:38:43 88192 -c--a-w- c:\windows\system32\dllcache\irda.sys

2011-06-18 20:38:35 45632 -c--a-w- c:\windows\system32\dllcache\ip5515.sys

2011-06-18 20:38:32 90200 -c--a-w- c:\windows\system32\dllcache\io8ports.dll

2011-06-18 20:38:30 38784 -c--a-w- c:\windows\system32\dllcache\io8.sys

2011-06-18 20:38:26 13056 -c--a-w- c:\windows\system32\dllcache\inport.sys

2011-06-18 20:38:23 16000 -c--a-w- c:\windows\system32\dllcache\ini910u.sys

2011-06-18 20:36:33 488383 -c--a-w- c:\windows\system32\dllcache\hsf_v124.sys

2011-06-18 20:36:30 50751 -c--a-w- c:\windows\system32\dllcache\hsf_tone.sys

2011-06-18 20:36:27 73279 -c--a-w- c:\windows\system32\dllcache\hsf_spkp.sys

2011-06-18 20:36:24 44863 -c--a-w- c:\windows\system32\dllcache\hsf_soar.sys

2011-06-18 20:36:22 57471 -c--a-w- c:\windows\system32\dllcache\hsf_samp.sys

2011-06-18 20:36:19 542879 -c--a-w- c:\windows\system32\dllcache\hsf_msft.sys

2011-06-18 20:36:16 391199 -c--a-w- c:\windows\system32\dllcache\hsf_k56k.sys

2011-06-18 20:36:13 9759 -c--a-w- c:\windows\system32\dllcache\hsf_inst.dll

2011-06-18 20:36:11 115807 -c--a-w- c:\windows\system32\dllcache\hsf_fsks.sys

2011-06-18 20:36:08 199711 -c--a-w- c:\windows\system32\dllcache\hsf_faxx.sys

2011-06-18 20:36:05 289887 -c--a-w- c:\windows\system32\dllcache\hsf_fall.sys

2011-06-18 20:36:02 67167 -c--a-w- c:\windows\system32\dllcache\hsf_bsc2.sys

2011-06-18 20:36:00 150239 -c--a-w- c:\windows\system32\dllcache\hsf_amos.sys

2011-06-18 20:34:59 28288 -c--a-w- c:\windows\system32\dllcache\grserial.sys

2011-06-18 20:33:56 22090 -c--a-w- c:\windows\system32\dllcache\fem556n5.sys

2011-06-18 20:32:57 629952 -c--a-w- c:\windows\system32\dllcache\eqn.sys

2011-06-18 20:31:58 334208 -c--a-w- c:\windows\system32\dllcache\ds1wdm.sys

2011-06-18 20:30:58 24649 -c--a-w- c:\windows\system32\dllcache\dfe650d.sys

2011-06-18 20:29:59 14976 -c--a-w- c:\windows\system32\dllcache\cpqarray.sys

2011-06-18 20:28:24 13824 -c--a-w- c:\windows\system32\dllcache\bulltlp3.sys

2011-06-18 20:27:59 11776 -c--a-w- c:\windows\system32\dllcache\bdasup.sys

2011-06-18 20:26:58 14848 -c--a-w- c:\windows\system32\dllcache\asc3550.sys

2011-06-18 20:25:51 66048 -c--a-w- c:\windows\system32\dllcache\s3legacy.dll

2011-06-18 08:28:39 6962000 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{d83bc7fa-3017-47f9-961a-90742fead5d1}\mpengine.dll

2011-06-16 08:48:41 6962000 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll

2011-06-16 08:15:05 221184 ----a-w- c:\windows\system32\wmpns.dll

2011-06-15 04:25:19 -------- d-----w- c:\windows\system32\wbem\repository\FS

2011-06-15 04:25:19 -------- d-----w- c:\windows\system32\wbem\Repository

2011-06-15 02:20:50 -------- d-sha-r- C:\cmdcons

2011-06-15 02:19:19 98816 ----a-w- c:\windows\sed.exe

2011-06-15 02:19:19 518144 ----a-w- c:\windows\SWREG.exe

2011-06-15 02:19:19 256512 ----a-w- c:\windows\PEV.exe

2011-06-15 02:19:19 208896 ----a-w- c:\windows\MBR.exe

2011-06-15 00:28:29 439804 ----a-w- c:\windows\system32\SearchIndexer.exeBAFC439B

2011-06-15 00:10:03 222080 ------w- c:\windows\system32\MpSigStub.exe

2011-06-15 00:06:41 -------- d-----w- c:\program files\Microsoft Security Client

2011-06-15 00:02:08 0 ----a-w- c:\windows\Vrigo.bin

2011-06-14 15:26:02 54016 ----a-w- c:\windows\system32\drivers\apabmqhx.sys

2011-06-14 13:15:42 54016 ----a-w- c:\windows\system32\drivers\bomcsjow.sys

2011-06-14 13:09:50 -------- d-----w- c:\documents and settings\admin\application data\Malwarebytes

2011-06-14 13:09:46 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-06-14 13:09:46 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes

2011-06-14 13:09:43 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-06-14 13:09:43 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-06-13 21:26:28 -------- d-----w- c:\documents and settings\all users\application data\cB28258GgMpL28258

.

==================== Find3M ====================

.

2011-05-02 15:31:52 692736 ----a-w- c:\windows\system32\inetcomm.dll

2011-04-29 16:19:43 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2011-04-25 16:11:12 916480 ----a-w- c:\windows\system32\wininet.dll

2011-04-25 16:11:11 43520 ----a-w- c:\windows\system32\licmgr10.dll

2011-04-25 16:11:11 1469440 ------w- c:\windows\system32\inetcpl.cpl

2011-04-25 12:01:22 385024 ----a-w- c:\windows\system32\html.iec

2011-04-21 13:37:43 105472 ----a-w- c:\windows\system32\drivers\mup.sys

.

============= FINISH: 20:01:53.27 ===============

Link to post
Share on other sites

  • Staff

Hi,

Please delete your copy of TDSSKiller, grab a fresh copy, then run it again and post its log.

Next, please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

  • When the tool is finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

Link to post
Share on other sites

  • 1 month later...
  • Staff

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.