Jump to content

Rootkit.Win32.Pmax.gen infection, shuts down all antivirus antimalware programs, can't get rid of it on my own.

sabusik

By sabusik
in Resolved Malware Removal Logs

 Share

Recommended Posts

sabusik

sabusik

Posted
Posted

A few days ago a file C:\Windows\1328167361:1053218224.exe showed up in my task manager list of processes.

I can't get rid of it, nothing will kill it.

Google searches started being redirected.

Microsoft Security Essentials became disabled and nothing can bring it back to life, it gives some kind of an error.

Eset Online Scanner always finds some kind of Win32/Patched.HN trojan -- usually always attached to a different file.

I downloaded full version of Eset - it became disabled immediately.

I downloaded Malwarebytes - I couldn't run it... it started and was closed immediately.

Windows Defender flags the C:\Windows\1328167361:1053218224.exe file as Trojan:Win32/Sirefef.O but it fails to remove it.

All of these antispyware/antimalware/antivirus programs - once they get disabled - you can't even try running them again - they will give an error: "Windows cannot access the specified device, path or file. You may not have the appropriate permissions to access the item."

I tried to remove the antivirus programs (but I think even the removal process had problems as the virus attached itself into some of their files).

I downloaded TDSSKiller and it finds two infected files - one has the option to cure the other to delete. After reboot the files are there again - so TDSSKiller on its own can't seem to get rid of these files.

Here's the screenshot:

post-98666-0-11165000-1320101164.jpg

I ran the DDS. I'm attaching the log files.

Let me say right away that I do understand the risks, I have changed my passwords on a clean machine, I backed up my essentials and I DO WANT TO PROCEED with cleaning and removal.

DDS.txt

Attach.txt

Link to post
Share on other sites
sabusik

sabusik

Posted
  • Author
Posted

I am also attaching the TDSSKiller.exe log.

00:33:33.0158 1268 TDSS rootkit removing tool 2.6.14.0 Oct 28 2011 11:11:01

00:33:33.0283 1268 ============================================================

00:33:33.0283 1268 Current date / time: 2011/11/01 00:33:33.0283

00:33:33.0283 1268 SystemInfo:

00:33:33.0283 1268

00:33:33.0283 1268 OS Version: 6.0.6002 ServicePack: 2.0

00:33:33.0283 1268 Product type: Workstation

00:33:33.0283 1268 ComputerName: IVA-PC

00:33:33.0283 1268 UserName: Iva

00:33:33.0283 1268 Windows directory: C:\Windows

00:33:33.0283 1268 System windows directory: C:\Windows

00:33:33.0283 1268 Processor architecture: Intel x86

00:33:33.0283 1268 Number of processors: 2

00:33:33.0283 1268 Page size: 0x1000

00:33:33.0283 1268 Boot type: Normal boot

00:33:33.0283 1268 ============================================================

00:33:33.0704 1268 Initialize success

00:33:35.0389 3668 ============================================================

00:33:35.0389 3668 Scan started

00:33:35.0389 3668 Mode: Manual;

00:33:35.0389 3668 ============================================================

00:33:36.0122 3668 53014332 (186b54479d98e48aee0e9ada4b3c4d31) C:\Windows\system32\DRIVERS\53014332.sys

00:33:36.0122 3668 53014332 - ok

00:33:36.0325 3668 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys

00:33:36.0325 3668 ACPI - ok

00:33:36.0434 3668 adp94xx (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys

00:33:36.0450 3668 adp94xx - ok

00:33:36.0575 3668 adpahci (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys

00:33:36.0575 3668 adpahci - ok

00:33:36.0668 3668 adpu160m (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys

00:33:36.0668 3668 adpu160m - ok

00:33:36.0778 3668 adpu320 (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys

00:33:36.0778 3668 adpu320 - ok

00:33:36.0918 3668 AFD (3911b972b55fea0478476b2e777b29fa) C:\Windows\system32\drivers\afd.sys

00:33:36.0934 3668 AFD - ok

00:33:37.0074 3668 agp440 (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys

00:33:37.0074 3668 agp440 - ok

00:33:37.0152 3668 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys

00:33:37.0152 3668 aic78xx - ok

00:33:37.0292 3668 aliide (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys

00:33:37.0308 3668 aliide - ok

00:33:37.0339 3668 amdagp (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys

00:33:37.0339 3668 amdagp - ok

00:33:37.0402 3668 amdide (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys

00:33:37.0402 3668 amdide - ok

00:33:37.0620 3668 AmdK7 (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys

00:33:37.0620 3668 AmdK7 - ok

00:33:37.0682 3668 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys

00:33:37.0682 3668 AmdK8 - ok

00:33:37.0792 3668 ApfiltrService (a80230bd04f0b8bf05185b369bb1cbb8) C:\Windows\system32\DRIVERS\Apfiltr.sys

00:33:37.0807 3668 ApfiltrService - ok

00:33:37.0932 3668 arc (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys

00:33:37.0932 3668 arc - ok

00:33:37.0994 3668 arcsas (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys

00:33:37.0994 3668 arcsas - ok

00:33:38.0150 3668 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys

00:33:38.0150 3668 AsyncMac - ok

00:33:38.0197 3668 atapi (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys

00:33:38.0197 3668 atapi - ok

00:33:38.0338 3668 BCM42RLY - ok

00:33:38.0416 3668 BCM43XX (cdf7f28ffd693b1b4137845dd1ef1ccc) C:\Windows\system32\DRIVERS\bcmwl6.sys

00:33:38.0431 3668 BCM43XX - ok

00:33:38.0572 3668 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys

00:33:38.0572 3668 Beep - ok

00:33:38.0681 3668 BlackBox - ok

00:33:38.0728 3668 blbdrive (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys

00:33:38.0728 3668 blbdrive - ok

00:33:38.0790 3668 bowser (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys

00:33:38.0790 3668 bowser - ok

00:33:38.0915 3668 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys

00:33:38.0915 3668 BrFiltLo - ok

00:33:38.0946 3668 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys

00:33:38.0962 3668 BrFiltUp - ok

00:33:39.0086 3668 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys

00:33:39.0086 3668 Brserid - ok

00:33:39.0118 3668 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys

00:33:39.0118 3668 BrSerWdm - ok

00:33:39.0149 3668 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys

00:33:39.0149 3668 BrUsbMdm - ok

00:33:39.0196 3668 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys

00:33:39.0196 3668 BrUsbSer - ok

00:33:39.0336 3668 BTHMODEM (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys

00:33:39.0336 3668 BTHMODEM - ok

00:33:39.0430 3668 c1392a4f (8f2bb1827cac01aee6a16e30a1260199) C:\Windows\1328167361:1053218224.exe

00:33:39.0430 3668 Suspicious file (Hidden): C:\Windows\1328167361:1053218224.exe. md5: 8f2bb1827cac01aee6a16e30a1260199

00:33:39.0430 3668 c1392a4f ( Rootkit.Win32.PMax.gen ) - infected

00:33:39.0430 3668 c1392a4f - detected Rootkit.Win32.PMax.gen (0)

00:33:39.0539 3668 catchme - ok

00:33:39.0710 3668 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys

00:33:39.0710 3668 cdfs - ok

00:33:39.0773 3668 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys

00:33:39.0773 3668 cdrom - ok

00:33:39.0882 3668 circlass (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\drivers\circlass.sys

00:33:39.0882 3668 circlass - ok

00:33:39.0960 3668 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys

00:33:39.0976 3668 CLFS - ok

00:33:40.0085 3668 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys

00:33:40.0085 3668 CmBatt - ok

00:33:40.0132 3668 cmdide (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys

00:33:40.0132 3668 cmdide - ok

00:33:40.0147 3668 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys

00:33:40.0147 3668 Compbatt - ok

00:33:40.0225 3668 crcdisk (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys

00:33:40.0225 3668 crcdisk - ok

00:33:40.0256 3668 Crusoe (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys

00:33:40.0256 3668 Crusoe - ok

00:33:40.0319 3668 DfsC (622c41a07ca7e6dd91770f50d532cb6c) C:\Windows\system32\Drivers\dfsc.sys

00:33:40.0319 3668 DfsC - ok

00:33:40.0490 3668 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys

00:33:40.0490 3668 disk - ok

00:33:40.0568 3668 Dot4 (4f59c172c094e1a1d46463a8dc061cbd) C:\Windows\system32\DRIVERS\Dot4.sys

00:33:40.0568 3668 Dot4 - ok

00:33:40.0646 3668 Dot4Print (80bf3ba09f6f2523c8f6b7cc6dbf7bd5) C:\Windows\system32\DRIVERS\Dot4Prt.sys

00:33:40.0646 3668 Dot4Print - ok

00:33:40.0709 3668 dot4usb (c55004ca6b419b6695970dfe849b122f) C:\Windows\system32\DRIVERS\dot4usb.sys

00:33:40.0724 3668 dot4usb - ok

00:33:40.0834 3668 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys

00:33:40.0834 3668 drmkaud - ok

00:33:40.0880 3668 DXGKrnl (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys

00:33:40.0880 3668 DXGKrnl - ok

00:33:41.0068 3668 e1express (908ed85b7806e8af3af5e9b74f7809d4) C:\Windows\system32\DRIVERS\e1e6032.sys

00:33:41.0068 3668 e1express - ok

00:33:41.0146 3668 E1G60 (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys

00:33:41.0177 3668 E1G60 - ok

00:33:41.0395 3668 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys

00:33:41.0411 3668 Ecache - ok

00:33:41.0489 3668 elxstor (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys

00:33:41.0489 3668 elxstor - ok

00:33:41.0567 3668 ErrDev (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys

00:33:41.0567 3668 ErrDev - ok

00:33:41.0676 3668 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys

00:33:41.0676 3668 exfat - ok

00:33:41.0785 3668 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys

00:33:41.0785 3668 fastfat - ok

00:33:41.0863 3668 fdc (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys

00:33:41.0863 3668 fdc - ok

00:33:41.0988 3668 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys

00:33:41.0988 3668 FileInfo - ok

00:33:42.0035 3668 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys

00:33:42.0035 3668 Filetrace - ok

00:33:42.0097 3668 flpydisk (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys

00:33:42.0097 3668 flpydisk - ok

00:33:42.0175 3668 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys

00:33:42.0175 3668 FltMgr - ok

00:33:42.0238 3668 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys

00:33:42.0238 3668 Fs_Rec - ok

00:33:42.0284 3668 gagp30kx (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys

00:33:42.0284 3668 gagp30kx - ok

00:33:42.0409 3668 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys

00:33:42.0425 3668 HDAudBus - ok

00:33:42.0472 3668 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys

00:33:42.0472 3668 HidBth - ok

00:33:42.0550 3668 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys

00:33:42.0550 3668 HidIr - ok

00:33:42.0612 3668 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys

00:33:42.0612 3668 HidUsb - ok

00:33:42.0674 3668 HpCISSs (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys

00:33:42.0674 3668 HpCISSs - ok

00:33:42.0784 3668 HSF_DPV (e9e589c9ab799f52e18f057635a2b362) C:\Windows\system32\DRIVERS\HSX_DPV.sys

00:33:42.0799 3668 HSF_DPV - ok

00:33:42.0908 3668 HSXHWAZL (7845d2385f4dc7dfb3ccaf0c2fa4948e) C:\Windows\system32\DRIVERS\HSXHWAZL.sys

00:33:42.0924 3668 HSXHWAZL - ok

00:33:42.0986 3668 HTTP (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys

00:33:43.0002 3668 HTTP - ok

00:33:43.0158 3668 Huawei (c1258adcbe6e51a3c06c234d2bdb81b5) C:\Windows\system32\DRIVERS\ewdcsc.sys

00:33:43.0158 3668 Huawei - ok

00:33:43.0236 3668 hwdatacard (0515065a3c7e8869dd01253e987c5bd1) C:\Windows\system32\DRIVERS\ewusbmdm.sys

00:33:43.0236 3668 hwdatacard - ok

00:33:43.0267 3668 hwusbdev (a259d3619aa23d4562581067f85e2006) C:\Windows\system32\DRIVERS\ewusbdev.sys

00:33:43.0267 3668 hwusbdev - ok

00:33:43.0361 3668 i2omp (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys

00:33:43.0361 3668 i2omp - ok

00:33:43.0408 3668 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys

00:33:43.0408 3668 i8042prt - ok

00:33:43.0548 3668 iaStor (997e8f5939f2d12cd9f2e6b395724c16) C:\Windows\system32\drivers\iastor.sys

00:33:43.0548 3668 iaStor - ok

00:33:43.0579 3668 iaStorV (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys

00:33:43.0579 3668 iaStorV - ok

00:33:43.0735 3668 igfx (c134e69ce901422d1f2d7ea8d69098fe) C:\Windows\system32\DRIVERS\igdkmd32.sys

00:33:43.0751 3668 igfx - ok

00:33:43.0844 3668 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys

00:33:43.0844 3668 iirsp - ok

00:33:43.0922 3668 IntcHdmiAddService (98d303ccb3415e9202e82043b37d66dc) C:\Windows\system32\drivers\IntcHdmi.sys

00:33:43.0922 3668 IntcHdmiAddService - ok

00:33:44.0078 3668 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\DRIVERS\intelide.sys

00:33:44.0078 3668 intelide - ok

00:33:44.0125 3668 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys

00:33:44.0125 3668 intelppm - ok

00:33:44.0250 3668 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys

00:33:44.0250 3668 IpFilterDriver - ok

00:33:44.0266 3668 IpInIp - ok

00:33:44.0297 3668 IPMIDRV (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys

00:33:44.0297 3668 IPMIDRV - ok

00:33:44.0328 3668 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys

00:33:44.0328 3668 IPNAT - ok

00:33:44.0422 3668 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys

00:33:44.0422 3668 IRENUM - ok

00:33:44.0453 3668 isapnp (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys

00:33:44.0453 3668 isapnp - ok

00:33:44.0515 3668 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys

00:33:44.0515 3668 iScsiPrt - ok

00:33:44.0609 3668 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys

00:33:44.0609 3668 iteatapi - ok

00:33:44.0640 3668 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys

00:33:44.0640 3668 iteraid - ok

00:33:44.0671 3668 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys

00:33:44.0671 3668 kbdclass - ok

00:33:44.0765 3668 kbdhid (18247836959ba67e3511b62846b9c2e0) C:\Windows\system32\DRIVERS\kbdhid.sys

00:33:44.0765 3668 kbdhid - ok

00:33:44.0812 3668 KSecDD (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys

00:33:44.0827 3668 KSecDD - ok

00:33:44.0983 3668 LHidFilt (dd83dc92463fce6324fd30a13d17d0da) C:\Windows\system32\DRIVERS\LHidFilt.Sys

00:33:44.0983 3668 LHidFilt - ok

00:33:45.0014 3668 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys

00:33:45.0014 3668 lltdio - ok

00:33:45.0092 3668 LMouFilt (8fe0008e183ff0293a925b78a5581c5f) C:\Windows\system32\DRIVERS\LMouFilt.Sys

00:33:45.0092 3668 LMouFilt - ok

00:33:45.0186 3668 LSI_FC (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys

00:33:45.0186 3668 LSI_FC - ok

00:33:45.0202 3668 LSI_SAS (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys

00:33:45.0202 3668 LSI_SAS - ok

00:33:45.0326 3668 LSI_SCSI (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys

00:33:45.0326 3668 LSI_SCSI - ok

00:33:45.0358 3668 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys

00:33:45.0358 3668 luafv - ok

00:33:45.0498 3668 MBAMSwissArmy (0905dc0814d738cff53577a59ccd81e0) C:\Windows\system32\drivers\mbamswissarmy.sys

00:33:45.0498 3668 MBAMSwissArmy - ok

00:33:45.0529 3668 mdmxsdk (0cea2d0d3fa284b85ed5b68365114f76) C:\Windows\system32\DRIVERS\mdmxsdk.sys

00:33:45.0529 3668 mdmxsdk - ok

00:33:45.0654 3668 megasas (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys

00:33:45.0654 3668 megasas - ok

00:33:45.0701 3668 MegaSR (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys

00:33:45.0701 3668 MegaSR - ok

00:33:45.0841 3668 MLPTDR_Q (b39bf953a3a304a2d12751692ec355a0) C:\Windows\system32\MLPTDR_Q.SYS

00:33:45.0841 3668 MLPTDR_Q - ok

00:33:45.0888 3668 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys

00:33:45.0888 3668 Modem - ok

00:33:45.0935 3668 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys

00:33:45.0935 3668 monitor - ok

00:33:46.0028 3668 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys

00:33:46.0028 3668 mouclass - ok

00:33:46.0106 3668 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys

00:33:46.0106 3668 mouhid - ok

00:33:46.0153 3668 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys

00:33:46.0153 3668 MountMgr - ok

00:33:46.0231 3668 mpio (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys

00:33:46.0231 3668 mpio - ok

00:33:46.0262 3668 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys

00:33:46.0262 3668 mpsdrv - ok

00:33:46.0309 3668 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys

00:33:46.0309 3668 Mraid35x - ok

00:33:46.0372 3668 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys

00:33:46.0372 3668 MRxDAV - ok

00:33:46.0481 3668 mrxsmb (1e94971c4b446ab2290deb71d01cf0c2) C:\Windows\system32\DRIVERS\mrxsmb.sys

00:33:46.0481 3668 mrxsmb - ok

00:33:46.0543 3668 mrxsmb10 (4fccb34d793b116423209c0f8b7a3b03) C:\Windows\system32\DRIVERS\mrxsmb10.sys

00:33:46.0543 3668 mrxsmb10 - ok

00:33:46.0574 3668 mrxsmb20 (c3cb1b40ad4a0124d617a1199b0b9d7c) C:\Windows\system32\DRIVERS\mrxsmb20.sys

00:33:46.0574 3668 mrxsmb20 - ok

00:33:46.0652 3668 msahci (28023e86f17001f7cd9b15a5bc9ae07d) C:\Windows\system32\drivers\msahci.sys

00:33:46.0652 3668 msahci - ok

00:33:46.0699 3668 msdsm (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys

00:33:46.0699 3668 msdsm - ok

00:33:46.0730 3668 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys

00:33:46.0730 3668 Msfs - ok

00:33:46.0840 3668 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys

00:33:46.0840 3668 msisadrv - ok

00:33:46.0918 3668 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys

00:33:46.0918 3668 MSKSSRV - ok

00:33:46.0933 3668 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys

00:33:46.0933 3668 MSPCLOCK - ok

00:33:47.0042 3668 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys

00:33:47.0042 3668 MSPQM - ok

00:33:47.0089 3668 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys

00:33:47.0089 3668 MsRPC - ok

00:33:47.0120 3668 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys

00:33:47.0120 3668 mssmbios - ok

00:33:47.0230 3668 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys

00:33:47.0245 3668 MSTEE - ok

00:33:47.0323 3668 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys

00:33:47.0323 3668 Mup - ok

00:33:47.0417 3668 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys

00:33:47.0417 3668 NativeWifiP - ok

00:33:47.0557 3668 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys

00:33:47.0573 3668 NDIS - ok

00:33:47.0620 3668 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys

00:33:47.0620 3668 NdisTapi - ok

00:33:47.0698 3668 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys

00:33:47.0698 3668 Ndisuio - ok

00:33:47.0760 3668 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys

00:33:47.0776 3668 NdisWan - ok

00:33:47.0822 3668 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys

00:33:47.0822 3668 NDProxy - ok

00:33:47.0916 3668 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys

00:33:47.0916 3668 NetBIOS - ok

00:33:47.0978 3668 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys

00:33:47.0978 3668 netbt - ok

00:33:48.0041 3668 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys

00:33:48.0041 3668 nfrd960 - ok

00:33:48.0212 3668 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys

00:33:48.0212 3668 Npfs - ok

00:33:48.0259 3668 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys

00:33:48.0259 3668 nsiproxy - ok

00:33:48.0384 3668 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys

00:33:48.0400 3668 Ntfs - ok

00:33:48.0493 3668 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys

00:33:48.0493 3668 ntrigdigi - ok

00:33:48.0524 3668 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys

00:33:48.0524 3668 Null - ok

00:33:48.0540 3668 nvraid (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys

00:33:48.0540 3668 nvraid - ok

00:33:48.0571 3668 nvstor (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys

00:33:48.0571 3668 nvstor - ok

00:33:48.0680 3668 nv_agp (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys

00:33:48.0680 3668 nv_agp - ok

00:33:48.0696 3668 NwlnkFlt - ok

00:33:48.0696 3668 NwlnkFwd - ok

00:33:48.0836 3668 OEM02Dev (19cac780b858822055f46c58a111723c) C:\Windows\system32\DRIVERS\OEM02Dev.sys

00:33:48.0836 3668 OEM02Dev - ok

00:33:48.0868 3668 OEM02Vfx (86326062a90494bdd79ce383511d7d69) C:\Windows\system32\DRIVERS\OEM02Vfx.sys

00:33:48.0868 3668 OEM02Vfx - ok

00:33:48.0992 3668 ohci1394 (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys

00:33:48.0992 3668 ohci1394 - ok

00:33:49.0164 3668 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys

00:33:49.0164 3668 Parport - ok

00:33:49.0226 3668 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys

00:33:49.0226 3668 partmgr - ok

00:33:49.0258 3668 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys

00:33:49.0258 3668 Parvdm - ok

00:33:49.0382 3668 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys

00:33:49.0382 3668 pci - ok

00:33:49.0398 3668 pciide (1636d43f10416aeb483bc6001097b26c) C:\Windows\system32\drivers\pciide.sys

00:33:49.0398 3668 pciide - ok

00:33:49.0429 3668 pcmcia (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\drivers\pcmcia.sys

00:33:49.0429 3668 pcmcia - ok

00:33:49.0554 3668 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys

00:33:49.0570 3668 PEAUTH - ok

00:33:49.0632 3668 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys

00:33:49.0632 3668 PptpMiniport - ok

00:33:49.0726 3668 Processor (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys

00:33:49.0726 3668 Processor - ok

00:33:49.0788 3668 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys

00:33:49.0788 3668 PSched - ok

00:33:49.0928 3668 ql2300 (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys

00:33:49.0944 3668 ql2300 - ok

00:33:50.0053 3668 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys

00:33:50.0053 3668 ql40xx - ok

00:33:50.0084 3668 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys

00:33:50.0084 3668 QWAVEdrv - ok

00:33:50.0365 3668 R300 (e642b131fb74caf4bb8a014f31113142) C:\Windows\system32\DRIVERS\atikmdag.sys

00:33:50.0443 3668 R300 - ok

00:33:50.0615 3668 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys

00:33:50.0615 3668 RasAcd - ok

00:33:50.0662 3668 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys

00:33:50.0662 3668 Rasl2tp - ok

00:33:50.0724 3668 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys

00:33:50.0724 3668 RasPppoe - ok

00:33:50.0802 3668 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys

00:33:50.0802 3668 RasSstp - ok

00:33:50.0896 3668 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys

00:33:50.0896 3668 rdbss - ok

00:33:50.0958 3668 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys

00:33:50.0958 3668 RDPCDD - ok

00:33:51.0036 3668 rdpdr (fbc0bacd9c3d7f6956853f64a66e252d) C:\Windows\system32\drivers\rdpdr.sys

00:33:51.0036 3668 rdpdr - ok

00:33:51.0067 3668 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys

00:33:51.0067 3668 RDPENCDD - ok

00:33:51.0176 3668 RDPWD (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys

00:33:51.0176 3668 RDPWD - ok

00:33:51.0301 3668 rimmptsk (355aac141b214bef1dbc1483afd9bd50) C:\Windows\system32\DRIVERS\rimmptsk.sys

00:33:51.0301 3668 rimmptsk - ok

00:33:51.0348 3668 rimsptsk (a4216c71dd4f60b26418ccfd99cd0815) C:\Windows\system32\DRIVERS\rimsptsk.sys

00:33:51.0364 3668 rimsptsk - ok

00:33:51.0504 3668 rismxdp (d231b577024aa324af13a42f3a807d10) C:\Windows\system32\DRIVERS\rixdptsk.sys

00:33:51.0504 3668 rismxdp - ok

00:33:51.0660 3668 ROOTMODEM (75e8a6bfa7374aba833ae92bf41ae4e6) C:\Windows\system32\Drivers\RootMdm.sys

00:33:51.0660 3668 ROOTMODEM - ok

00:33:51.0691 3668 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys

00:33:51.0691 3668 rspndr - ok

00:33:51.0800 3668 s0017bus (594ff5620661d1386475406e78cb6f2f) C:\Windows\system32\DRIVERS\s0017bus.sys

00:33:51.0816 3668 s0017bus - ok

00:33:51.0863 3668 s0017mdfl (7258f550419d543bc5c8e80c578a5d54) C:\Windows\system32\DRIVERS\s0017mdfl.sys

00:33:51.0863 3668 s0017mdfl - ok

00:33:51.0972 3668 s0017mdm (1de4f6607feb17a15dbd4f1b139e6d2f) C:\Windows\system32\DRIVERS\s0017mdm.sys

00:33:51.0988 3668 s0017mdm - ok

00:33:52.0034 3668 s0017mgmt (9814e6bacc06d2526cd52981c7eeedf0) C:\Windows\system32\DRIVERS\s0017mgmt.sys

00:33:52.0066 3668 s0017mgmt - ok

00:33:52.0175 3668 s0017nd5 (2c62cd58225973f26682cd4f783ddede) C:\Windows\system32\DRIVERS\s0017nd5.sys

00:33:52.0175 3668 s0017nd5 - ok

00:33:52.0253 3668 s0017obex (f87c3422e84b2fb1b43e0a26247ad5a5) C:\Windows\system32\DRIVERS\s0017obex.sys

00:33:52.0253 3668 s0017obex - ok

00:33:52.0424 3668 s0017unic (df5e7360a0afa5956bf75da683d0679f) C:\Windows\system32\DRIVERS\s0017unic.sys

00:33:52.0424 3668 s0017unic - ok

00:33:52.0549 3668 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys

00:33:52.0549 3668 sbp2port - ok

00:33:52.0612 3668 sdbus (8f36b54688c31eed4580129040c6a3d3) C:\Windows\system32\DRIVERS\sdbus.sys

00:33:52.0612 3668 sdbus - ok

00:33:52.0627 3668 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys

00:33:52.0643 3668 secdrv - ok

00:33:52.0752 3668 seehcri (e5b56569a9f79b70314fede6c953641e) C:\Windows\system32\DRIVERS\seehcri.sys

00:33:52.0752 3668 seehcri - ok

00:33:52.0799 3668 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys

00:33:52.0799 3668 Serenum - ok

00:33:52.0830 3668 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys

00:33:52.0830 3668 Serial - ok

00:33:52.0846 3668 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys

00:33:52.0846 3668 sermouse - ok

00:33:52.0955 3668 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\DRIVERS\sffdisk.sys

00:33:52.0955 3668 sffdisk - ok

00:33:52.0986 3668 sffp_mmc (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys

00:33:52.0986 3668 sffp_mmc - ok

00:33:53.0048 3668 sffp_sd (9f66a46c55d6f1ccabc79bb7afccc545) C:\Windows\system32\DRIVERS\sffp_sd.sys

00:33:53.0048 3668 sffp_sd - ok

00:33:53.0189 3668 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys

00:33:53.0189 3668 sfloppy - ok

00:33:53.0236 3668 sisagp (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys

00:33:53.0236 3668 sisagp - ok

00:33:53.0251 3668 SiSRaid2 (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys

00:33:53.0251 3668 SiSRaid2 - ok

00:33:53.0360 3668 SiSRaid4 (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys

00:33:53.0376 3668 SiSRaid4 - ok

00:33:53.0423 3668 Smb (9bb8b6fc6c3b2992364f9a83a96b04c6) C:\Windows\system32\DRIVERS\smb.sys

00:33:53.0423 3668 Suspicious file (Forged): C:\Windows\system32\DRIVERS\smb.sys. Real md5: 9bb8b6fc6c3b2992364f9a83a96b04c6, Fake md5: 6bf5b3adacb423ea76ecde82ab0c2805

00:33:53.0423 3668 Smb ( Rootkit.Win32.ZAccess.e ) - infected

00:33:53.0423 3668 Smb - detected Rootkit.Win32.ZAccess.e (0)

00:33:53.0594 3668 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys

00:33:53.0594 3668 spldr - ok

00:33:53.0735 3668 srv (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys

00:33:53.0735 3668 srv - ok

00:33:53.0797 3668 srv2 (ff33aff99564b1aa534f58868cbe41ef) C:\Windows\system32\DRIVERS\srv2.sys

00:33:53.0797 3668 srv2 - ok

00:33:53.0891 3668 srvnet (7605c0e1d01a08f3ecd743f38b834a44) C:\Windows\system32\DRIVERS\srvnet.sys

00:33:53.0906 3668 srvnet - ok

00:33:53.0969 3668 STHDA (6a2a5e809c2c0178326d92b19ee4aad3) C:\Windows\system32\drivers\stwrt.sys

00:33:53.0969 3668 STHDA - ok

00:33:54.0062 3668 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys

00:33:54.0062 3668 swenum - ok

00:33:54.0125 3668 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys

00:33:54.0125 3668 Symc8xx - ok

00:33:54.0250 3668 SymIM - ok

00:33:54.0296 3668 SymIMMP - ok

00:33:54.0889 3668 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys

00:33:54.0889 3668 Sym_hi - ok

00:33:55.0076 3668 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys

00:33:55.0076 3668 Sym_u3 - ok

00:33:55.0295 3668 tap0901 (66cbe7e7ef1b23c71f9402285878b284) C:\Windows\system32\DRIVERS\tap0901.sys

00:33:55.0295 3668 tap0901 - ok

00:33:55.0576 3668 Tcpip (6647fce6fc4970daafe5c64c794513d3) C:\Windows\system32\drivers\tcpip.sys

00:33:55.0591 3668 Tcpip - ok

00:33:55.0856 3668 Tcpip6 (6647fce6fc4970daafe5c64c794513d3) C:\Windows\system32\DRIVERS\tcpip.sys

00:33:55.0872 3668 Tcpip6 - ok

00:33:56.0090 3668 tcpipreg (36606b165d04a397bdf613096986d85d) C:\Windows\system32\drivers\tcpipreg.sys

00:33:56.0090 3668 tcpipreg - ok

00:33:56.0246 3668 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys

00:33:56.0246 3668 TDPIPE - ok

00:33:56.0309 3668 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys

00:33:56.0309 3668 TDTCP - ok

00:33:56.0418 3668 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys

00:33:56.0418 3668 tdx - ok

00:33:56.0527 3668 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys

00:33:56.0527 3668 TermDD - ok

00:33:56.0730 3668 tosporte (8d624d3bd1f2d78bd1c01a2d4e954b4e) C:\Windows\system32\DRIVERS\tosporte.sys

00:33:56.0730 3668 tosporte - ok

00:33:56.0917 3668 tosrfbd (266df087a8c24da34ff40cf3df86ccfb) C:\Windows\system32\DRIVERS\tosrfbd.sys

00:33:56.0917 3668 tosrfbd - ok

00:33:56.0964 3668 tosrfbnp (90c8525bc578aaffe87c2d0ed4379e9e) C:\Windows\system32\Drivers\tosrfbnp.sys

00:33:56.0964 3668 tosrfbnp - ok

00:33:57.0120 3668 Tosrfcom (5ba1ca3b3cddb1ddc67df473f05d1ec2) C:\Windows\system32\Drivers\tosrfcom.sys

00:33:57.0120 3668 Tosrfcom - ok

00:33:57.0151 3668 Tosrfhid (7c807ba9660e2995cc0217a14a24094c) C:\Windows\system32\DRIVERS\Tosrfhid.sys

00:33:57.0151 3668 Tosrfhid - ok

00:33:57.0214 3668 tosrfnds (c52fd27b9adf3a1f22cb90e6bcf9b0cb) C:\Windows\system32\DRIVERS\tosrfnds.sys

00:33:57.0214 3668 tosrfnds - ok

00:33:57.0432 3668 TosRfSnd (a4ce9572bc4ac8d329455059b43c5bea) C:\Windows\system32\drivers\tosrfsnd.sys

00:33:57.0432 3668 TosRfSnd - ok

00:33:57.0650 3668 Tosrfusb (602818649c84eb774d6971da65f79cc8) C:\Windows\system32\DRIVERS\tosrfusb.sys

00:33:57.0666 3668 Tosrfusb - ok

00:33:57.0806 3668 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys

00:33:57.0806 3668 tssecsrv - ok

00:33:57.0947 3668 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys

00:33:57.0947 3668 tunmp - ok

00:33:58.0009 3668 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys

00:33:58.0009 3668 tunnel - ok

00:33:58.0150 3668 uagp35 (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys

00:33:58.0150 3668 uagp35 - ok

00:33:58.0228 3668 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys

00:33:58.0228 3668 udfs - ok

00:33:58.0399 3668 uliagpkx (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys

00:33:58.0399 3668 uliagpkx - ok

00:33:58.0586 3668 uliahci (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys

00:33:58.0586 3668 uliahci - ok

00:33:58.0649 3668 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys

00:33:58.0649 3668 UlSata - ok

00:33:59.0132 3668 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys

00:33:59.0132 3668 ulsata2 - ok

00:33:59.0429 3668 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys

00:33:59.0429 3668 umbus - ok

00:33:59.0585 3668 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys

00:33:59.0600 3668 usbccgp - ok

00:33:59.0959 3668 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys

00:33:59.0959 3668 usbcir - ok

00:34:00.0131 3668 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys

00:34:00.0131 3668 usbehci - ok

00:34:00.0178 3668 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys

00:34:00.0193 3668 usbhub - ok

00:34:00.0334 3668 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys

00:34:00.0334 3668 usbohci - ok

00:34:00.0443 3668 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys

00:34:00.0443 3668 usbprint - ok

00:34:00.0521 3668 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS

00:34:00.0521 3668 USBSTOR - ok

00:34:00.0583 3668 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys

00:34:00.0583 3668 usbuhci - ok

00:34:00.0724 3668 vga (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys

00:34:00.0724 3668 vga - ok

00:34:00.0755 3668 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys

00:34:00.0755 3668 VgaSave - ok

00:34:00.0786 3668 viaagp (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys

00:34:00.0786 3668 viaagp - ok

00:34:00.0833 3668 ViaC7 (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys

00:34:00.0833 3668 ViaC7 - ok

00:34:00.0880 3668 viaide (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys

00:34:00.0880 3668 viaide - ok

00:34:00.0973 3668 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys

00:34:00.0973 3668 volmgr - ok

00:34:01.0051 3668 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys

00:34:01.0051 3668 volmgrx - ok

00:34:01.0207 3668 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys

00:34:01.0207 3668 volsnap - ok

00:34:01.0270 3668 vsmraid (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys

00:34:01.0270 3668 vsmraid - ok

00:34:01.0379 3668 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys

00:34:01.0379 3668 WacomPen - ok

00:34:01.0410 3668 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

00:34:01.0410 3668 Wanarp - ok

00:34:01.0457 3668 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys

00:34:01.0457 3668 Wanarpv6 - ok

00:34:01.0566 3668 Wd (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys

00:34:01.0582 3668 Wd - ok

00:34:01.0628 3668 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys

00:34:01.0644 3668 Wdf01000 - ok

00:34:01.0722 3668 winachsf (4daca8f07537d4d7e3534bb99294aa26) C:\Windows\system32\DRIVERS\HSX_CNXT.sys

00:34:01.0738 3668 winachsf - ok

00:34:01.0847 3668 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys

00:34:01.0847 3668 WmiAcpi - ok

00:34:01.0940 3668 WpdUsb (0cec23084b51b8288099eb710224e955) C:\Windows\system32\DRIVERS\wpdusb.sys

00:34:01.0940 3668 WpdUsb - ok

00:34:02.0034 3668 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys

00:34:02.0034 3668 ws2ifsl - ok

00:34:02.0096 3668 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys

00:34:02.0096 3668 WUDFRd - ok

00:34:02.0237 3668 XAudio (5a7ff9a18ff6d7e0527fe3abf9204ef8) C:\Windows\system32\DRIVERS\xaudio.sys

00:34:02.0237 3668 XAudio - ok

00:34:02.0268 3668 yukonwlh (a4822191c7cea271903c2a4fb6d9809d) C:\Windows\system32\DRIVERS\yk60x86.sys

00:34:02.0268 3668 yukonwlh - ok

00:34:02.0330 3668 MBR (0x1B8) (cdb4de4bbd714f152979da2dcbef57eb) \Device\Harddisk0\DR0

00:34:02.0346 3668 \Device\Harddisk0\DR0 - ok

00:34:02.0346 3668 MBR (0x1B8) (8f558eb6672622401da993e1e865c861) \Device\Harddisk1\DR1

00:34:03.0095 3668 \Device\Harddisk1\DR1 - ok

00:34:03.0157 3668 Boot (0x1200) (1c87bb41b794aa77b498067de1159056) \Device\Harddisk0\DR0\Partition0

00:34:03.0157 3668 \Device\Harddisk0\DR0\Partition0 - ok

00:34:03.0157 3668 Boot (0x1200) (6eb823f88d298c188019456d43267234) \Device\Harddisk0\DR0\Partition1

00:34:03.0157 3668 \Device\Harddisk0\DR0\Partition1 - ok

00:34:03.0157 3668 Boot (0x1200) (e69a4a01f8d22cafabd0fd4590efa75c) \Device\Harddisk1\DR1\Partition0

00:34:03.0157 3668 \Device\Harddisk1\DR1\Partition0 - ok

00:34:03.0173 3668 ============================================================

00:34:03.0173 3668 Scan finished

00:34:03.0173 3668 ============================================================

00:34:03.0173 0796 Detected object count: 2

00:34:03.0173 0796 Actual detected object count: 2

00:34:13.0297 0796 HKLM\SYSTEM\ControlSet001\services\c1392a4f - will be deleted on reboot

00:34:13.0360 0796 HKLM\SYSTEM\ControlSet003\services\c1392a4f - will be deleted on reboot

00:34:13.0422 0796 C:\Windows\1328167361:1053218224.exe - will be deleted on reboot

00:34:13.0422 0796 c1392a4f ( Rootkit.Win32.PMax.gen ) - User select action: Delete

00:34:13.0547 0796 VerifyFileNameVersionInfo: GetFileVersionInfoSizeW(C:\Windows\system32\drivers\smb.sys) error 1813

00:34:13.0968 0796 Backup copy found, using it..

00:34:13.0984 0796 C:\Windows\system32\DRIVERS\smb.sys - will be cured on reboot

00:34:13.0984 0796 Smb ( Rootkit.Win32.ZAccess.e ) - User select action: Cure

00:34:15.0310 1020 Deinitialize success

TDSSKiller.2.6.14.0_01.11.2011_00.33.33_log.txt

Link to post
Share on other sites
sabusik

sabusik

Posted
  • Author
Posted

And since I've seen that we should copy/paste the logs - I'm pasting fresh dds logs here as well.

This is dds.txt

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_29

Run by Iva at 0:40:34 on 2011-11-01

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3061.1882 [GMT 1:00]

.

AV: ESET NOD32 Antivirus 5.0 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}

SP: ESET NOD32 Antivirus 5.0 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\System32\svchost.exe -k secsvcs

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\WLTRYSVC.EXE

C:\Windows\System32\bcmwltry.exe

C:\Windows\system32\WLANExt.exe

C:\Windows\1328167361:1053218224.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\taskeng.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Windows Defender\MSASCui.exe

C:\Windows\System32\WLTRAY.EXE

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE

C:\Windows\system32\aestsrv.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\STacSV.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\DRIVERS\xaudio.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\wbem\wmiprvse.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\conime.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uSearch Page = hxxp://www.google.com

uStart Page = hxxp://www.google.com/

uWindow Title = Internet Explorer provided by Dell

uDefault_Page_URL = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=1080802

uSearch Bar = hxxp://www.google.com/ie

uDefault_Search_URL = hxxp://www.google.com/ie

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

uURLSearchHooks: H - No File

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File

TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File

mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

mRun: [broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe

mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

StartupFolder: c:\users\iva\appdata\roaming\micros~1\windows\startm~1\programs\startup\_UNINS~1.LNK -

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe

mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)

mPolicies-system: EnableLUA = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL

LSP: mswsock.dll

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab

DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

TCP: DhcpNameServer = 192.168.1.1

TCP: Interfaces\{89950BFD-7E7F-49FD-AC45-7EED9FA08DBA} : DhcpNameServer = 192.168.1.1

TCP: Interfaces\{8E2435C2-49A4-40D3-B961-7AA65A003AFE} : NameServer = 160.218.161.60 194.228.211.33

TCP: Interfaces\{E2CA9920-FF64-410D-9780-4B22CE7D39C2} : DhcpNameServer = 192.168.1.1

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Notify: igfxcui - igfxdev.dll

Hosts: 127.0.0.1 www.spywareinfo.com

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\users\iva\appdata\roaming\mozilla\firefox\profiles\hrlpzppt.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - www.google.com

FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=

FF - plugin: c:\program files\google\picasa3\npPicasa3.dll

FF - plugin: c:\program files\musicnotes\npmusicn.dll

FF - plugin: c:\program files\musicnotes\NPSibelius.dll

FF - plugin: c:\users\iva\appdata\local\google\update\1.3.21.79\npGoogleUpdate3.dll

FF - plugin: c:\users\iva\appdata\roaming\move networks\plugins\npqmp071505000011.dll

FF - plugin: c:\users\iva\appdata\roaming\mozilla\plugins\npgoogletalk.dll

FF - plugin: c:\users\iva\appdata\roaming\mozilla\plugins\npgtpo3dautoplugin.dll

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension

.

============= SERVICES / DRIVERS ===============

.

R0 53014332;53014332;c:\windows\system32\drivers\53014332.sys [2011-10-31 133208]

R2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\AEstSrv.exe [2008-8-2 73728]

R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-21 21504]

R3 IntcHdmiAddService;Intel® High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [2008-8-2 111616]

R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [2009-8-15 27632]

S2 MLPTDR_Q;MLPTDR_Q;c:\windows\system32\MLPTDR_Q.SYS [2004-11-18 18848]

S2 OMSI download service;Sony Ericsson OMSI download service;c:\program files\sony ericsson\sony ericsson pc suite\SupServ.exe [2009-8-15 90112]

S3 Huawei;HUAWEI Mobile Connect - USB Smart Card Reader;c:\windows\system32\drivers\ewdcsc.sys [2011-6-29 23424]

S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\drivers\ewusbdev.sys [2011-6-29 101120]

S3 s0017bus;Sony Ericsson Device 0017 driver (WDM);c:\windows\system32\drivers\s0017bus.sys [2009-8-15 86824]

S3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter;c:\windows\system32\drivers\s0017mdfl.sys [2009-8-15 15016]

S3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver;c:\windows\system32\drivers\s0017mdm.sys [2009-8-15 114600]

S3 s0017mgmt;Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s0017mgmt.sys [2009-8-15 108328]

S3 s0017nd5;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS);c:\windows\system32\drivers\s0017nd5.sys [2009-8-15 26024]

S3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface;c:\windows\system32\drivers\s0017obex.sys [2009-8-15 104616]

S3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM);c:\windows\system32\drivers\s0017unic.sys [2009-8-15 109736]

.

=============== Created Last 30 ================

.

2011-10-31 23:35:18 56200 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{b974a56a-e71d-4d2a-9daa-9f704b117454}\offreg.dll

2011-10-31 21:56:26 476904 ----a-w- c:\program files\mozilla firefox\plugins\npdeployJava1.dll

2011-10-31 21:56:26 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-10-31 21:52:07 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-10-31 21:51:59 -------- d-----w- c:\users\iva\appdata\roaming\Malwarebytes

2011-10-31 21:51:54 -------- d-----w- c:\programdata\Malwarebytes

2011-10-31 21:51:51 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-10-31 21:51:51 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-10-31 21:26:24 48016 --sha-w- c:\windows\system32\c_87811.nl_

2011-10-31 20:49:31 98816 ----a-w- c:\windows\sed.exe

2011-10-31 20:49:31 518144 ----a-w- c:\windows\SWREG.exe

2011-10-31 20:49:31 256000 ----a-w- c:\windows\PEV.exe

2011-10-31 20:49:31 208896 ----a-w- c:\windows\MBR.exe

2011-10-31 20:49:26 -------- d-s---w- C:\ComboFix

2011-10-31 20:22:02 -------- d-----w- c:\program files\ESET

2011-10-31 20:11:12 6668624 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{b974a56a-e71d-4d2a-9daa-9f704b117454}\mpengine.dll

2011-10-31 17:57:30 200976 ----a-w- c:\windows\system32\drivers\tmcomm.sys

2011-10-31 17:30:38 -------- d-----w- c:\programdata\Spybot - Search & Destroy

2011-10-31 17:30:38 -------- d-----w- c:\program files\Spybot - Search & Destroy

2011-10-31 17:21:35 133208 ----a-w- c:\windows\system32\drivers\53014332.sys

2011-10-30 11:36:36 -------- d-sh--w- c:\windows\system32\%APPDATA%

2011-10-30 11:32:08 -------- d-sh--w- c:\users\iva\appdata\local\c1392a4f

2011-10-13 21:46:35 57856 ----a-w- c:\windows\system32\MSDvbNP.ax

2011-10-13 21:46:35 293376 ----a-w- c:\windows\system32\psisdecd.dll

2011-10-13 21:46:35 217088 ----a-w- c:\windows\system32\psisrndr.ax

2011-10-13 21:46:34 69632 ----a-w- c:\windows\system32\Mpeg2Data.ax

2011-10-13 21:46:33 2043392 ----a-w- c:\windows\system32\win32k.sys

2011-10-13 21:46:26 563712 ----a-w- c:\windows\system32\oleaut32.dll

2011-10-13 21:46:26 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll

2011-10-13 21:46:26 4096 ----a-w- c:\windows\system32\oleaccrc.dll

2011-10-13 21:46:26 238080 ----a-w- c:\windows\system32\oleacc.dll

.

==================== Find3M ====================

.

2011-10-31 23:35:03 66560 ----a-w- c:\windows\system32\drivers\smb.sys

2011-10-31 21:38:13 273408 ----a-w- c:\windows\system32\drivers\afd.sys

2011-09-01 02:35:59 1798144 ----a-w- c:\windows\system32\jscript9.dll

2011-09-01 02:28:15 1126912 ----a-w- c:\windows\system32\wininet.dll

2011-09-01 02:22:54 2382848 ----a-w- c:\windows\system32\mshtml.tlb

2011-08-31 15:45:36 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-08-09 13:24:52 163424 ----a-w- c:\windows\system32\drivers\eamonm.sys

2011-08-04 08:20:38 103112 ----a-w- c:\windows\system32\drivers\epfwwfpr.sys

2011-08-04 08:20:36 118104 ----a-w- c:\windows\system32\drivers\ehdrv.sys

.

============= FINISH: 0:41:23,73 ===============

And this is attach.txt:

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft® Windows Vista™ Home Premium

Boot Device: \Device\HarddiskVolume3

Install Date: 2. 8. 2008 1:10:19

System Uptime: 1. 11. 2011 0:34:57 (0 hours ago)

.

Motherboard: Dell Inc. | | 0U990C

Processor: Intel® Core2 Duo CPU T5750 @ 2.00GHz | Microprocessor | 1000/166mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 221 GiB total, 104,44 GiB free.

D: is FIXED (NTFS) - 10 GiB total, 5,474 GiB free.

E: is CDROM ()

F: is Removable

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

No restore point in system.

.

==== Installed Programs ======================

.

Update for Microsoft Office 2007 (KB2508958)

µTorrent

7-Zip 4.65

Adobe Flash Player 10 ActiveX

Adobe Flash Player 10 Plugin

Adobe Reader 8.1.3

Advanced Audio FX Engine

Advanced Video FX Engine

Auslogics Disk Defrag

Bluetooth Stack for Windows by Toshiba

CDDRV_Installer

Cisco EAP-FAST Module

Cisco LEAP Module

Cisco PEAP Module

Combined Community Codec Pack 2008-01-24

Compatibility Pack for the 2007 Office system

Conexant HDA D330 MDC V.92 Modem

Dell Touchpad

Dell Webcam Center

Dell Webcam Manager

Dell Wireless WLAN Card

Digital Line Detect

EDocs

ESET Online Scanner v3

Google Chrome

Google Talk (remove only)

Google Talk Plugin

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

HP USB Disk Storage Format Tool

Intel® Matrix Storage Manager

Java Auto Updater

Java 6 Update 29

Java 6 Update 5

KhalInstallWrapper

Laptop Integrated Webcam Driver (1.04.01.1011)

Lightscreen

Live! Cam Avatar Creator

Live! Cam Avatar v1.0

Logitech SetPoint

Malwarebytes' Anti-Malware version 1.51.2.1300

MediaDirect

Microsoft .NET Framework 3.5 SP1

Microsoft Office 2007 Service Pack 2 (SP2)

Microsoft Office Access MUI (English) 2007

Microsoft Office Access Setup Metadata MUI (English) 2007

Microsoft Office Excel MUI (English) 2007

Microsoft Office File Validation Add-In

Microsoft Office InfoPath MUI (English) 2007

Microsoft Office Outlook MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office PowerPoint Viewer 2007 (English)

Microsoft Office Professional Plus 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

Microsoft Office Publisher MUI (English) 2007

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Word MUI (English) 2007

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Modem Diagnostic Tool

Mozilla Firefox (3.6.23)

Music, Photos & Videos Launcher

Musicnotes Software Suite 1.5.3

NetWaiting

O2

OGA Notifier 2.0.0048.0

Picasa 3

Product Documentation Launcher

QuickSet

Security Update for 2007 Microsoft Office System (KB2288621)

Security Update for 2007 Microsoft Office System (KB2288931)

Security Update for 2007 Microsoft Office System (KB2345043)

Security Update for 2007 Microsoft Office System (KB2553074)

Security Update for 2007 Microsoft Office System (KB2553089)

Security Update for 2007 Microsoft Office System (KB2553090)

Security Update for 2007 Microsoft Office System (KB2584063)

Security Update for 2007 Microsoft Office System (KB969559)

Security Update for 2007 Microsoft Office System (KB976321)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)

Security Update for Microsoft Office Access 2007 (KB979440)

Security Update for Microsoft Office Excel 2007 (KB2553073)

Security Update for Microsoft Office InfoPath 2007 (KB2510061)

Security Update for Microsoft Office InfoPath 2007 (KB979441)

Security Update for Microsoft Office PowerPoint 2007 (KB2535818)

Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623)

Security Update for Microsoft Office Publisher 2007 (KB2284697)

Security Update for Microsoft Office system 2007 (972581)

Security Update for Microsoft Office system 2007 (KB974234)

Security Update for Microsoft Office Visio Viewer 2007 (KB973709)

Security Update for Microsoft Office Word 2007 (KB2344993)

Skype™ 4.2

SMAC 2.7

Sony Ericsson PC Suite 6.007.00

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Microsoft Office 2007 System (KB2539530)

Update for Microsoft Office Outlook 2007 (KB2583910)

Update for Outlook 2007 Junk Email Filter (KB2596560)

VLC media player 0.9.4

Windows Media Player Firefox Plugin

.

==== End Of File ===========================

Link to post
Share on other sites
sabusik

sabusik

Posted
  • Author
Posted

Ok - 4 days and no reply - you guys might as well close this thread.

From what I gathered around the net - this is a nasty rootkit and there is never any guarantee that anyone will help to remove it 100%. It hides and infects any antimalware/antispyware/antivirus program you throw at it.

The only thing I could do was to backup the data to a safe location, make sure the backed up data was clean and didn't contain the virus/rootkit and then I formatted the hard drive and did a fresh windows install. It was much quicker than waiting around for help and then dealing with the issue for days and still not being 100% sure it's gone.

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.

  I accept