10 replies to this topic

[Griseus]

Infected with the scour.com redirect virus. Tried several tools with no luck. Hopefully some will find me here.

Attached are the two files that are asked for.

Attached Files

•  dds.txt   11.32K   25 downloads
•  attach.txt   15.73K   17 downloads

[Elise]

Hello and

Unfortunately you have a nasty rootkit infection. Please read the following information first.

BACKDOOR WARNING
------------------------------
One or more of the identified infections is known to use a backdoor.

This allows hackers to remotely control your computer, steal critical system information and download and execute files.

I would advice you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the infection has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
When Should I Format, How Should I Reinstall

We can still clean this machine but I can't guarantee that it will be 100% secure afterwards. Let me know what you decide to do. If you decide to go through with the cleanup, please proceed with the following steps.


Please download the TDSS Rootkit Removing Tool (TDSSKiller.exe) and save it to your Desktop. <-Important!!!

• Double-click on TDSSKiller.exe to run the tool for known TDSS variants.
  Vista/Windows 7 users right-click and select Run As Administrator.
  
• If TDSSKiller does not run, try renaming it.
  
• To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123abc.com). If you do not see the file extension, please refer to How to change the file extension.
  
• Click the Start Scan button.
  
• Do not use the computer during the scan
  
• If the scan completes with nothing found, click Close to exit.
  
• If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
  
• Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
  
• A log file named TDSSKiller_version_date_time_log.txt (i.e. TDSSKiller.2.4.0.0_27.07.2010_09.o7.26_log.txt) will be created and saved to the root directory (usually Local Disk C:).
  
• Copy and paste the contents of that file in your next reply.

[Griseus]

Thanks for the reply. I'm can't find my reinstall disc so dell is sending me another and I'm going to reinstall in a day or two. I ran the tdsskiller and it picked up the rootkit and "cured" it. Upon reboot I am no longer redirected. Here is the log. Curious what it did.


21:43:55.0203 9808 ============================================================
21:43:55.0203 9808 Current date / time: 2012/03/18 21:43:55.0203
21:43:55.0203 9808 SystemInfo:
21:43:55.0203 9808
21:43:55.0203 9808 OS Version: 5.1.2600 ServicePack: 3.0
21:43:55.0203 9808 Product type: Workstation
21:43:55.0203 9808 ComputerName: JEFF
21:43:55.0203 9808 UserName: Owner
21:43:55.0203 9808 Windows directory: C:\WINDOWS
21:43:55.0203 9808 System windows directory: C:\WINDOWS
21:43:55.0203 9808 Processor architecture: Intel x86
21:43:55.0203 9808 Number of processors: 2
21:43:55.0203 9808 Page size: 0x1000
21:43:55.0203 9808 Boot type: Normal boot
21:43:55.0203 9808 ============================================================
21:44:06.0015 9808 Drive \Device\Harddisk0\DR0 - Size: 0x9502F9000 (37.25 Gb), SectorSize: 0x200, Cylinders: 0x12FF, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
21:44:06.0078 9808 Drive \Device\Harddisk1\DR1 - Size: 0x2E93E36000 (186.31 Gb), SectorSize: 0x200, Cylinders: 0x5F01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
21:44:06.0187 9808 \Device\Harddisk0\DR0:
21:44:06.0187 9808 MBR used
21:44:06.0187 9808 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x4A7D53F
21:44:06.0187 9808 \Device\Harddisk1\DR1:
21:44:06.0187 9808 MBR used
21:44:06.0187 9808 \Device\Harddisk1\DR1\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x1749DD82
21:44:06.0500 9808 Initialize success
21:44:06.0500 9808 ============================================================
21:44:09.0968 10148 ============================================================
21:44:09.0968 10148 Scan started
21:44:09.0968 10148 Mode: Manual;
21:44:09.0968 10148 ============================================================
21:44:10.0546 10148 Abiosdsk - ok
21:44:10.0578 10148 abp480n5 - ok
21:44:10.0687 10148 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
21:44:10.0718 10148 ACPI - ok
21:44:10.0843 10148 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
21:44:10.0859 10148 ACPIEC - ok
21:44:10.0921 10148 adpu160m - ok
21:44:11.0000 10148 aeaudio (11c04b17ed2abbb4833694bcd644ac90) C:\WINDOWS\system32\drivers\aeaudio.sys
21:44:11.0031 10148 aeaudio - ok
21:44:11.0171 10148 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
21:44:11.0234 10148 aec - ok
21:44:11.0359 10148 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
21:44:11.0406 10148 AFD - ok
21:44:11.0500 10148 Aha154x - ok
21:44:11.0515 10148 aic78u2 - ok
21:44:11.0562 10148 aic78xx - ok
21:44:11.0609 10148 AliIde - ok
21:44:11.0671 10148 amsint - ok
21:44:11.0718 10148 asc - ok
21:44:11.0750 10148 asc3350p - ok
21:44:11.0781 10148 asc3550 - ok
21:44:11.0859 10148 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
21:44:11.0921 10148 AsyncMac - ok
21:44:12.0046 10148 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
21:44:12.0046 10148 atapi - ok
21:44:12.0093 10148 Atdisk - ok
21:44:12.0171 10148 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
21:44:12.0203 10148 Atmarpc - ok
21:44:12.0312 10148 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
21:44:12.0343 10148 audstub - ok
21:44:12.0421 10148 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
21:44:12.0453 10148 Beep - ok
21:44:12.0625 10148 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
21:44:12.0640 10148 cbidf2k - ok
21:44:12.0687 10148 cd20xrnt - ok
21:44:12.0781 10148 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
21:44:12.0812 10148 Cdaudio - ok
21:44:12.0937 10148 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
21:44:12.0984 10148 Cdfs - ok
21:44:13.0046 10148 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
21:44:13.0078 10148 Cdrom - ok
21:44:13.0156 10148 Changer - ok
21:44:13.0265 10148 CmdIde - ok
21:44:13.0312 10148 Cpqarray - ok
21:44:13.0359 10148 dac2w2k - ok
21:44:13.0390 10148 dac960nt - ok
21:44:13.0468 10148 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
21:44:13.0515 10148 Disk - ok
21:44:13.0703 10148 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
21:44:13.0796 10148 dmboot - ok
21:44:14.0015 10148 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
21:44:14.0062 10148 dmio - ok
21:44:14.0218 10148 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
21:44:14.0250 10148 dmload - ok
21:44:14.0359 10148 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
21:44:14.0406 10148 DMusic - ok
21:44:14.0500 10148 dpti2o - ok
21:44:14.0562 10148 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
21:44:14.0578 10148 drmkaud - ok
21:44:14.0750 10148 E100B (98b46b331404a951cabad8b4877e1276) C:\WINDOWS\system32\DRIVERS\e100b325.sys
21:44:14.0781 10148 E100B - ok
21:44:14.0921 10148 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
21:44:14.0953 10148 Fastfat - ok
21:44:15.0156 10148 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
21:44:15.0187 10148 Fdc - ok
21:44:15.0359 10148 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
21:44:15.0390 10148 Fips - ok
21:44:15.0484 10148 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
21:44:15.0515 10148 Flpydisk - ok
21:44:15.0640 10148 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
21:44:15.0671 10148 FltMgr - ok
21:44:15.0812 10148 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
21:44:15.0843 10148 Fs_Rec - ok
21:44:16.0000 10148 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
21:44:16.0062 10148 Ftdisk - ok
21:44:16.0218 10148 GearAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
21:44:16.0250 10148 GearAspiWDM - ok
21:44:16.0343 10148 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
21:44:16.0375 10148 Gpc - ok
21:44:16.0546 10148 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
21:44:16.0578 10148 HidUsb - ok
21:44:16.0656 10148 hpn - ok
21:44:16.0750 10148 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
21:44:16.0765 10148 HTTP - ok
21:44:16.0875 10148 i2omgmt - ok
21:44:16.0890 10148 i2omp - ok
21:44:17.0000 10148 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
21:44:17.0031 10148 i8042prt - ok
21:44:17.0265 10148 ialm (9a883c3c4d91292c0d09de7c728e781c) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
21:44:17.0390 10148 ialm - ok
21:44:17.0546 10148 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
21:44:17.0578 10148 Imapi - ok
21:44:17.0687 10148 ini910u - ok
21:44:17.0765 10148 IntelIde - ok
21:44:17.0843 10148 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
21:44:17.0890 10148 intelppm - ok
21:44:17.0984 10148 ip6fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
21:44:18.0015 10148 ip6fw - ok
21:44:18.0156 10148 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
21:44:18.0187 10148 IpFilterDriver - ok
21:44:18.0281 10148 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
21:44:18.0343 10148 IpInIp - ok
21:44:18.0437 10148 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
21:44:18.0453 10148 IpNat - ok
21:44:18.0562 10148 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
21:44:18.0593 10148 IPSec - ok
21:44:18.0734 10148 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
21:44:18.0750 10148 IRENUM - ok
21:44:18.0906 10148 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
21:44:18.0937 10148 isapnp - ok
21:44:19.0031 10148 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
21:44:19.0078 10148 Kbdclass - ok
21:44:19.0203 10148 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
21:44:19.0234 10148 kbdhid - ok
21:44:19.0375 10148 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
21:44:19.0421 10148 kmixer - ok
21:44:19.0515 10148 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
21:44:19.0546 10148 KSecDD - ok
21:44:19.0656 10148 L8042Kbd (d1968dea7baff4a917858c384339cec8) C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys
21:44:19.0687 10148 L8042Kbd - ok
21:44:19.0796 10148 L8042mou (d6fc755ff505d99e6cc73e83492310df) C:\WINDOWS\system32\DRIVERS\L8042mou.Sys
21:44:19.0828 10148 L8042mou - ok
21:44:19.0890 10148 lbrtfdc - ok
21:44:19.0968 10148 LHidFilt (24e0ddb99aeccf86bb37702611761459) C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys
21:44:19.0984 10148 LHidFilt - ok
21:44:20.0125 10148 LMouFilt (d58b330d318361a66a9fe60d7c9b4951) C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys
21:44:20.0171 10148 LMouFilt - ok
21:44:20.0359 10148 LMouKE (c149bdad13194df16ea33f9f601ed7bf) C:\WINDOWS\system32\DRIVERS\LMouKE.Sys
21:44:20.0406 10148 LMouKE - ok
21:44:20.0531 10148 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
21:44:20.0562 10148 mnmdd - ok
21:44:20.0671 10148 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
21:44:20.0703 10148 Modem - ok
21:44:20.0781 10148 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
21:44:20.0812 10148 Mouclass - ok
21:44:20.0937 10148 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
21:44:20.0984 10148 mouhid - ok
21:44:21.0125 10148 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
21:44:21.0171 10148 MountMgr - ok
21:44:21.0203 10148 mraid35x - ok
21:44:21.0296 10148 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
21:44:21.0343 10148 MRxDAV - ok
21:44:21.0484 10148 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
21:44:21.0640 10148 MRxSmb - ok
21:44:21.0781 10148 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
21:44:21.0796 10148 Msfs - ok
21:44:21.0937 10148 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
21:44:21.0953 10148 MSKSSRV - ok
21:44:22.0078 10148 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
21:44:22.0109 10148 MSPCLOCK - ok
21:44:22.0234 10148 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
21:44:22.0281 10148 MSPQM - ok
21:44:22.0437 10148 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
21:44:22.0453 10148 mssmbios - ok
21:44:22.0640 10148 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
21:44:22.0671 10148 Mup - ok
21:44:22.0796 10148 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
21:44:22.0828 10148 NDIS - ok
21:44:22.0921 10148 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
21:44:22.0953 10148 NdisTapi - ok
21:44:23.0031 10148 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
21:44:23.0062 10148 Ndisuio - ok
21:44:23.0171 10148 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
21:44:23.0218 10148 NdisWan - ok
21:44:23.0359 10148 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
21:44:23.0390 10148 NDProxy - ok
21:44:23.0500 10148 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
21:44:23.0515 10148 NetBIOS - ok
21:44:23.0640 10148 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
21:44:23.0656 10148 NetBT - ok
21:44:23.0765 10148 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
21:44:23.0796 10148 Npfs - ok
21:44:23.0875 10148 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
21:44:23.0921 10148 Ntfs - ok
21:44:24.0015 10148 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
21:44:24.0046 10148 Null - ok
21:44:24.0156 10148 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
21:44:24.0171 10148 NwlnkFlt - ok
21:44:24.0312 10148 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
21:44:24.0343 10148 NwlnkFwd - ok
21:44:24.0453 10148 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
21:44:24.0484 10148 Parport - ok
21:44:24.0546 10148 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
21:44:24.0578 10148 PartMgr - ok
21:44:24.0671 10148 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
21:44:24.0687 10148 ParVdm - ok
21:44:24.0765 10148 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
21:44:24.0796 10148 PCI - ok
21:44:24.0890 10148 PCIDump - ok
21:44:24.0953 10148 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
21:44:24.0984 10148 PCIIde - ok
21:44:25.0093 10148 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
21:44:25.0125 10148 Pcmcia - ok
21:44:25.0203 10148 PDCOMP - ok
21:44:25.0265 10148 PDFRAME - ok
21:44:25.0296 10148 PDRELI - ok
21:44:25.0328 10148 PDRFRAME - ok
21:44:25.0359 10148 perc2 - ok
21:44:25.0390 10148 perc2hib - ok
21:44:25.0515 10148 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
21:44:25.0531 10148 PptpMiniport - ok
21:44:25.0656 10148 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys
21:44:25.0687 10148 Processor - ok
21:44:25.0781 10148 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
21:44:25.0812 10148 PSched - ok
21:44:25.0921 10148 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
21:44:25.0953 10148 Ptilink - ok
21:44:26.0015 10148 ql1080 - ok
21:44:26.0078 10148 Ql10wnt - ok
21:44:26.0171 10148 ql12160 - ok
21:44:26.0187 10148 ql1240 - ok
21:44:26.0218 10148 ql1280 - ok
21:44:26.0281 10148 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
21:44:26.0312 10148 RasAcd - ok
21:44:26.0406 10148 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
21:44:26.0437 10148 Rasl2tp - ok
21:44:26.0593 10148 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
21:44:26.0609 10148 RasPppoe - ok
21:44:26.0703 10148 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
21:44:26.0734 10148 Raspti - ok
21:44:26.0843 10148 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
21:44:26.0875 10148 Rdbss - ok
21:44:26.0968 10148 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
21:44:27.0015 10148 RDPCDD - ok
21:44:27.0156 10148 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
21:44:27.0187 10148 RDPWD - ok
21:44:27.0359 10148 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
21:44:27.0390 10148 redbook - ok
21:44:27.0531 10148 sbaphd (62ba65cc0b4a4bd1eaff5fed6e2b5069) C:\WINDOWS\system32\drivers\sbaphd.sys
21:44:27.0578 10148 sbaphd - ok
21:44:27.0687 10148 sbapifs (3fff8cda4d2f29ca06f1557e85163c30) C:\WINDOWS\system32\drivers\sbapifs.sys
21:44:27.0750 10148 sbapifs - ok
21:44:27.0843 10148 SBRE (1fd538c4feb36b793d2121f20bbdc16f) C:\WINDOWS\system32\drivers\SBREdrv.sys
21:44:27.0875 10148 SBRE - ok
21:44:28.0015 10148 sbtis (8bb1632b79ff24f570956ebb43a07501) C:\WINDOWS\system32\drivers\sbtis.sys
21:44:28.0046 10148 sbtis - ok
21:44:28.0140 10148 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
21:44:28.0171 10148 Secdrv - ok
21:44:28.0312 10148 Ser2pl (de0a165d9f8ea295e62ea702ef2f8125) C:\WINDOWS\system32\DRIVERS\ser2pl.sys
21:44:28.0359 10148 Ser2pl - ok
21:44:28.0484 10148 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
21:44:28.0515 10148 serenum - ok
21:44:28.0609 10148 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
21:44:28.0640 10148 Serial - ok
21:44:28.0781 10148 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
21:44:28.0828 10148 Sfloppy - ok
21:44:28.0875 10148 Simbad - ok
21:44:28.0937 10148 smwdm (5018a9db5eb62e3edb3110f82f556285) C:\WINDOWS\system32\drivers\smwdm.sys
21:44:29.0015 10148 smwdm - ok
21:44:29.0156 10148 Sparrow - ok
21:44:29.0218 10148 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
21:44:29.0265 10148 splitter - ok
21:44:29.0390 10148 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
21:44:29.0437 10148 sr - ok
21:44:29.0593 10148 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
21:44:29.0640 10148 Srv - ok
21:44:29.0765 10148 StillCam (a9573045baa16eab9b1085205b82f1ed) C:\WINDOWS\system32\DRIVERS\serscan.sys
21:44:29.0781 10148 StillCam - ok
21:44:29.0921 10148 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
21:44:29.0937 10148 swenum - ok
21:44:30.0000 10148 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
21:44:30.0031 10148 swmidi - ok
21:44:30.0109 10148 symc810 - ok
21:44:30.0156 10148 symc8xx - ok
21:44:30.0203 10148 sym_hi - ok
21:44:30.0234 10148 sym_u3 - ok
21:44:30.0296 10148 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
21:44:30.0328 10148 sysaudio - ok
21:44:30.0437 10148 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
21:44:30.0468 10148 Tcpip - ok
21:44:30.0609 10148 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
21:44:30.0640 10148 TDPIPE - ok
21:44:30.0781 10148 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
21:44:30.0812 10148 TDTCP - ok
21:44:30.0859 10148 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
21:44:30.0890 10148 TermDD - ok
21:44:30.0968 10148 TosIde - ok
21:44:31.0031 10148 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
21:44:31.0062 10148 Udfs - ok
21:44:31.0171 10148 ultra - ok
21:44:31.0296 10148 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
21:44:31.0359 10148 Update - ok
21:44:31.0515 10148 USBAAPL (eafe1e00739afe6c51487a050e772e17) C:\WINDOWS\system32\Drivers\usbaapl.sys
21:44:31.0546 10148 USBAAPL - ok
21:44:31.0671 10148 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
21:44:31.0718 10148 usbaudio - ok
21:44:31.0828 10148 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
21:44:31.0859 10148 usbccgp - ok
21:44:31.0984 10148 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
21:44:32.0015 10148 usbehci - ok
21:44:32.0125 10148 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
21:44:32.0171 10148 usbhub - ok
21:44:32.0312 10148 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
21:44:32.0343 10148 usbscan - ok
21:44:32.0468 10148 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
21:44:32.0484 10148 USBSTOR - ok
21:44:32.0703 10148 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
21:44:32.0734 10148 usbuhci - ok
21:44:33.0093 10148 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
21:44:33.0140 10148 VgaSave - ok
21:44:33.0437 10148 ViaIde - ok
21:44:33.0875 10148 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
21:44:33.0921 10148 VolSnap - ok
21:44:34.0375 10148 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
21:44:34.0453 10148 Wanarp - ok
21:44:35.0078 10148 Wdf01000 (fd47474bd21794508af449d9d91af6e6) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
21:44:35.0656 10148 Wdf01000 - ok
21:44:35.0781 10148 WDICA - ok
21:44:35.0875 10148 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
21:44:35.0906 10148 wdmaud - ok
21:44:36.0109 10148 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
21:44:36.0156 10148 WS2IFSL - ok
21:44:36.0328 10148 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
21:44:36.0359 10148 WudfPf - ok
21:44:36.0593 10148 {6080A529-897E-4629-A488-ABA0C29B635E} (fd1f4e9cf06c71c8d73a24acf18d8296) C:\WINDOWS\system32\drivers\ialmsbw.sys
21:44:36.0625 10148 {6080A529-897E-4629-A488-ABA0C29B635E} - ok
21:44:36.0796 10148 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91} (d4d7331d33d1fa73e588e5ce0d90a4c1) C:\WINDOWS\system32\drivers\ialmkchw.sys
21:44:36.0812 10148 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91} - ok
21:44:36.0843 10148 MBR (0x1B8) (faee7e40dfb0440ad2cfc39befa1f4c2) \Device\Harddisk0\DR0
21:44:36.0859 10148 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - infected
21:44:36.0859 10148 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.b (0)
21:44:36.0890 10148 MBR (0x1B8) (35c6b2fcde68facbefe0a4a7200bae58) \Device\Harddisk1\DR1
21:44:39.0906 10148 \Device\Harddisk1\DR1 - ok
21:44:39.0906 10148 Boot (0x1200) (9980b912ab393ce53b4d9dc838e2826e) \Device\Harddisk0\DR0\Partition0
21:44:39.0906 10148 \Device\Harddisk0\DR0\Partition0 - ok
21:44:39.0921 10148 Boot (0x1200) (c5d88dc4ce4f30e567e81a8356f35e5a) \Device\Harddisk1\DR1\Partition0
21:44:39.0921 10148 \Device\Harddisk1\DR1\Partition0 - ok
21:44:39.0921 10148 ============================================================
21:44:39.0921 10148 Scan finished
21:44:39.0921 10148 ============================================================
21:44:39.0937 9312 Detected object count: 1
21:44:39.0937 9312 Actual detected object count: 1
21:44:55.0578 9312 \Device\Harddisk0\DR0\# - copied to quarantine
21:44:55.0593 9312 \Device\Harddisk0\DR0 - copied to quarantine
21:44:55.0656 9312 \Device\Harddisk0\DR0\TDLFS\phm - copied to quarantine
21:44:55.0687 9312 \Device\Harddisk0\DR0\TDLFS\ph.dll - copied to quarantine
21:44:55.0703 9312 \Device\Harddisk0\DR0\TDLFS\phx.dll - copied to quarantine
21:44:55.0734 9312 \Device\Harddisk0\DR0\TDLFS\sub.dll - copied to quarantine
21:44:55.0750 9312 \Device\Harddisk0\DR0\TDLFS\subx.dll - copied to quarantine
21:44:55.0781 9312 \Device\Harddisk0\DR0\TDLFS\phd - copied to quarantine
21:44:55.0812 9312 \Device\Harddisk0\DR0\TDLFS\phdx - copied to quarantine
21:44:55.0906 9312 \Device\Harddisk0\DR0\TDLFS\phs - copied to quarantine
21:44:55.0921 9312 \Device\Harddisk0\DR0\TDLFS\phdata - copied to quarantine
21:44:55.0953 9312 \Device\Harddisk0\DR0\TDLFS\phld - copied to quarantine
21:44:56.0000 9312 \Device\Harddisk0\DR0\TDLFS\phln - copied to quarantine
21:44:56.0031 9312 \Device\Harddisk0\DR0\TDLFS\phlx - copied to quarantine
21:44:56.0109 9312 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - will be cured on reboot
21:44:56.0203 9312 \Device\Harddisk0\DR0 - ok
21:45:30.0906 9312 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - User select action: Cure
21:45:35.0125 9348 Deinitialize success

[Elise]

It removed the TDL4 partition variant rootkit. This rootkit creates a small, hidden partition, which it uses to store its code. When your computer is started it boots from that partition so that the malicious code is loaded into Windows.

COMBOFIX
---------------
Please download ComboFix from one of these locations:

Bleepingcomputer
ForoSpyware

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  
• Double click on Combofix.exe and follow the prompts.
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\Combofix.txt in your next reply.

[Griseus]

Very nice and thank you for the help thus far! Here's the combofix log.

Attached Files

•  ComboFix.txt   12.07K   18 downloads

[Elise]

Hi again, please let me know how things are running after the following steps:

CF-SCRIPT
-------------
We need to execute a CF-script.

• Close any open browsers.
  
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  
• Click Start > Run and in the box that opens type notepad and press enter. Copy/paste the text in the codebox below into it:

MIA::
c:\windows\System32\spoolsv.exe

Save this as CFScript.txt, in the same location as ComboFix.exe



Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

[Griseus]

Here you go.

Attached Files

•  log.txt   11.66K   15 downloads

[Elise]

Hi again,
Do you have any problem left at this point?

P2P WARNING
-------------------
Going over your logs I noticed that you have BitLord installed.

• Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.
  
• They are a security risk which can make your computer susceptible to a wide variety of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites.
  
• Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users.
  
• The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.

It is pretty much certain that if you continue to use P2P programs, you will get infected again.
I would recommend that you uninstall BitLord, however that choice is up to you. If you choose to remove these programs, you can do so via Start > Control Panel > Add/Remove Programs.

If you wish to keep it, please do not use it until your computer is cleaned.


Your version of Adobe Reader is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Adobe components and update:

• Download the latest version of Adobe Reader Version X. and save it to your desktop.
  
• Uncheck the "Free McAfee Security plan Plus" option or any other Toolbar you are offered
  
• Click the download button at the bottom.
  
• If you use Internet Explorer and do not wish to install the ActiveX element, simply click on the click here to download link on the next page.
  
• Remove all older version of Adobe Reader: Go to Add/remove and uninstall all versions of Adobe Reader, Acrobat Reader and Adobe Acrobat.
  If you are unsure of how to use Add or Remove Programs, the please see this tutorial:How To Remove An Installed Program From Your Computer
  
• Then from your desktop double-click on Adobe Reader to install the newest version.
  If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
  
• When the "Adobe Setup - Welcome" window opens, click the Install > button.
  
• If offered to install a Toolbar, just uncheck the box before continuing unless you want it.

Your Adobe Reader is now up to date!


Your version of Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system.

• Download the latest version of Java Runtime Environment (JRE) Version 7u3.
  
• Look for "JDK 7u3 (JDK or JRE).
  
• Click the "Download JRE" button at the right.
  
• Read the License Agreement, and then check the box that says: "Accept License Agreement".
  
  • Select "Windows x86 Offline" and click on jre-7-windows-i586.exe
• Save it to your desktop
  
• Close any programs you may have running - especially your web browser.
  
• Uninstall all older versions of Java (any item with Java Runtime Environment, JRE or J2SE in the name).
  
• Reboot your computer once all Java components are removed.
  
• Install the newest version by double clicking (run as Administrator for Windows Vista/Seven) the downloaded file.

Finally, please launch MBAM, update it and run a full scan. Post me the resulting log.

[Griseus]

I'm not experiencing any problems at all. I did a scan after installing the updated java and adobe and it picked up a .pup something, but before I could save it I accidentally clicked restart. Here is the log from just now.

Malwarebytes Anti-Malware (Trial) 1.60.1.1000
www.malwarebytes.org
Database version: v2012.03.22.01
Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Owner :: JEFF [administrator]
Protection: Enabled
3/22/2012 8:47:57 PM
mbam-log-2012-03-22 (20-47-57).txt
Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 264753
Time elapsed: 2 hour(s), 37 minute(s), 3 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)

[Elise]

PUPs are usually pretty harmless, so no problem. Good to hear things are running fine now.

ESET ONLINE SCANNER
----------------------------
I'd like us to scan your machine with ESET OnlineScan

• Hold down Control and click on this link to open ESET OnlineScan in a new window.
  
• Click the button.
  
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop.
    
  • Double click on the
    icon on your desktop.
• Check "YES, I accept the Terms of Use."
  
• Click the Start button.
  
• Accept any security warnings from your browser.
  
• Under scan settings, check "Scan Archives" and "Remove found threats"
  
• Click Advanced settings and select the following:
  • Scan potentially unwanted applications
    
  • Scan for potentially unsafe applications
    
  • Enable Anti-Stealth technology
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  
• When the scan completes, click List Threats
  
• Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  
• Click the Back button.
  
• Click the Finish button.

[Maurice Naggar]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!