Griseus

scour.com redirect virus

11 posts in this topic

Infected with the scour.com redirect virus. Tried several tools with no luck. Hopefully some will find me here.

Attached are the two files that are asked for.

dds.txt

attach.txt

Share this post


Link to post
Share on other sites

Hello and :welcome:

Unfortunately you have a nasty rootkit infection. Please read the following information first.

BACKDOOR WARNING

------------------------------

One or more of the identified infections is known to use a backdoor.

This allows hackers to remotely control your computer, steal critical system information and download and execute files.

I would advice you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the infection has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

When Should I Format, How Should I Reinstall

We can still clean this machine but I can't guarantee that it will be 100% secure afterwards. Let me know what you decide to do. If you decide to go through with the cleanup, please proceed with the following steps.

Please download the TDSS Rootkit Removing Tool (TDSSKiller.exe) and save it to your Desktop. <-Important!!!

  • Double-click on TDSSKiller.exe to run the tool for known TDSS variants.
    Vista/Windows 7 users right-click and select Run As Administrator.
  • If TDSSKiller does not run, try renaming it.
  • To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123abc.com). If you do not see the file extension, please refer to How to change the file extension.
  • Click the Start Scan button.
  • Do not use the computer during the scan
  • If the scan completes with nothing found, click Close to exit.
  • If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
  • Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
  • A log file named TDSSKiller_version_date_time_log.txt (i.e. TDSSKiller.2.4.0.0_27.07.2010_09.o7.26_log.txt) will be created and saved to the root directory (usually Local Disk C:).
  • Copy and paste the contents of that file in your next reply.

Share this post


Link to post
Share on other sites

Thanks for the reply. I'm can't find my reinstall disc so dell is sending me another and I'm going to reinstall in a day or two. I ran the tdsskiller and it picked up the rootkit and "cured" it. Upon reboot I am no longer redirected. Here is the log. Curious what it did.

21:43:55.0203 9808 ============================================================

21:43:55.0203 9808 Current date / time: 2012/03/18 21:43:55.0203

21:43:55.0203 9808 SystemInfo:

21:43:55.0203 9808

21:43:55.0203 9808 OS Version: 5.1.2600 ServicePack: 3.0

21:43:55.0203 9808 Product type: Workstation

21:43:55.0203 9808 ComputerName: JEFF

21:43:55.0203 9808 UserName: Owner

21:43:55.0203 9808 Windows directory: C:\WINDOWS

21:43:55.0203 9808 System windows directory: C:\WINDOWS

21:43:55.0203 9808 Processor architecture: Intel x86

21:43:55.0203 9808 Number of processors: 2

21:43:55.0203 9808 Page size: 0x1000

21:43:55.0203 9808 Boot type: Normal boot

21:43:55.0203 9808 ============================================================

21:44:06.0015 9808 Drive \Device\Harddisk0\DR0 - Size: 0x9502F9000 (37.25 Gb), SectorSize: 0x200, Cylinders: 0x12FF, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054

21:44:06.0078 9808 Drive \Device\Harddisk1\DR1 - Size: 0x2E93E36000 (186.31 Gb), SectorSize: 0x200, Cylinders: 0x5F01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054

21:44:06.0187 9808 \Device\Harddisk0\DR0:

21:44:06.0187 9808 MBR used

21:44:06.0187 9808 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x4A7D53F

21:44:06.0187 9808 \Device\Harddisk1\DR1:

21:44:06.0187 9808 MBR used

21:44:06.0187 9808 \Device\Harddisk1\DR1\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x1749DD82

21:44:06.0500 9808 Initialize success

21:44:06.0500 9808 ============================================================

21:44:09.0968 10148 ============================================================

21:44:09.0968 10148 Scan started

21:44:09.0968 10148 Mode: Manual;

21:44:09.0968 10148 ============================================================

21:44:10.0546 10148 Abiosdsk - ok

21:44:10.0578 10148 abp480n5 - ok

21:44:10.0687 10148 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys

21:44:10.0718 10148 ACPI - ok

21:44:10.0843 10148 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys

21:44:10.0859 10148 ACPIEC - ok

21:44:10.0921 10148 adpu160m - ok

21:44:11.0000 10148 aeaudio (11c04b17ed2abbb4833694bcd644ac90) C:\WINDOWS\system32\drivers\aeaudio.sys

21:44:11.0031 10148 aeaudio - ok

21:44:11.0171 10148 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys

21:44:11.0234 10148 aec - ok

21:44:11.0359 10148 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys

21:44:11.0406 10148 AFD - ok

21:44:11.0500 10148 Aha154x - ok

21:44:11.0515 10148 aic78u2 - ok

21:44:11.0562 10148 aic78xx - ok

21:44:11.0609 10148 AliIde - ok

21:44:11.0671 10148 amsint - ok

21:44:11.0718 10148 asc - ok

21:44:11.0750 10148 asc3350p - ok

21:44:11.0781 10148 asc3550 - ok

21:44:11.0859 10148 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

21:44:11.0921 10148 AsyncMac - ok

21:44:12.0046 10148 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys

21:44:12.0046 10148 atapi - ok

21:44:12.0093 10148 Atdisk - ok

21:44:12.0171 10148 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

21:44:12.0203 10148 Atmarpc - ok

21:44:12.0312 10148 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

21:44:12.0343 10148 audstub - ok

21:44:12.0421 10148 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

21:44:12.0453 10148 Beep - ok

21:44:12.0625 10148 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

21:44:12.0640 10148 cbidf2k - ok

21:44:12.0687 10148 cd20xrnt - ok

21:44:12.0781 10148 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

21:44:12.0812 10148 Cdaudio - ok

21:44:12.0937 10148 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys

21:44:12.0984 10148 Cdfs - ok

21:44:13.0046 10148 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys

21:44:13.0078 10148 Cdrom - ok

21:44:13.0156 10148 Changer - ok

21:44:13.0265 10148 CmdIde - ok

21:44:13.0312 10148 Cpqarray - ok

21:44:13.0359 10148 dac2w2k - ok

21:44:13.0390 10148 dac960nt - ok

21:44:13.0468 10148 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys

21:44:13.0515 10148 Disk - ok

21:44:13.0703 10148 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys

21:44:13.0796 10148 dmboot - ok

21:44:14.0015 10148 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys

21:44:14.0062 10148 dmio - ok

21:44:14.0218 10148 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

21:44:14.0250 10148 dmload - ok

21:44:14.0359 10148 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys

21:44:14.0406 10148 DMusic - ok

21:44:14.0500 10148 dpti2o - ok

21:44:14.0562 10148 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys

21:44:14.0578 10148 drmkaud - ok

21:44:14.0750 10148 E100B (98b46b331404a951cabad8b4877e1276) C:\WINDOWS\system32\DRIVERS\e100b325.sys

21:44:14.0781 10148 E100B - ok

21:44:14.0921 10148 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys

21:44:14.0953 10148 Fastfat - ok

21:44:15.0156 10148 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys

21:44:15.0187 10148 Fdc - ok

21:44:15.0359 10148 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys

21:44:15.0390 10148 Fips - ok

21:44:15.0484 10148 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys

21:44:15.0515 10148 Flpydisk - ok

21:44:15.0640 10148 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys

21:44:15.0671 10148 FltMgr - ok

21:44:15.0812 10148 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

21:44:15.0843 10148 Fs_Rec - ok

21:44:16.0000 10148 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

21:44:16.0062 10148 Ftdisk - ok

21:44:16.0218 10148 GearAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys

21:44:16.0250 10148 GearAspiWDM - ok

21:44:16.0343 10148 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys

21:44:16.0375 10148 Gpc - ok

21:44:16.0546 10148 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys

21:44:16.0578 10148 HidUsb - ok

21:44:16.0656 10148 hpn - ok

21:44:16.0750 10148 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys

21:44:16.0765 10148 HTTP - ok

21:44:16.0875 10148 i2omgmt - ok

21:44:16.0890 10148 i2omp - ok

21:44:17.0000 10148 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

21:44:17.0031 10148 i8042prt - ok

21:44:17.0265 10148 ialm (9a883c3c4d91292c0d09de7c728e781c) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys

21:44:17.0390 10148 ialm - ok

21:44:17.0546 10148 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys

21:44:17.0578 10148 Imapi - ok

21:44:17.0687 10148 ini910u - ok

21:44:17.0765 10148 IntelIde - ok

21:44:17.0843 10148 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys

21:44:17.0890 10148 intelppm - ok

21:44:17.0984 10148 ip6fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys

21:44:18.0015 10148 ip6fw - ok

21:44:18.0156 10148 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

21:44:18.0187 10148 IpFilterDriver - ok

21:44:18.0281 10148 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys

21:44:18.0343 10148 IpInIp - ok

21:44:18.0437 10148 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys

21:44:18.0453 10148 IpNat - ok

21:44:18.0562 10148 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys

21:44:18.0593 10148 IPSec - ok

21:44:18.0734 10148 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys

21:44:18.0750 10148 IRENUM - ok

21:44:18.0906 10148 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys

21:44:18.0937 10148 isapnp - ok

21:44:19.0031 10148 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

21:44:19.0078 10148 Kbdclass - ok

21:44:19.0203 10148 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys

21:44:19.0234 10148 kbdhid - ok

21:44:19.0375 10148 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys

21:44:19.0421 10148 kmixer - ok

21:44:19.0515 10148 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys

21:44:19.0546 10148 KSecDD - ok

21:44:19.0656 10148 L8042Kbd (d1968dea7baff4a917858c384339cec8) C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys

21:44:19.0687 10148 L8042Kbd - ok

21:44:19.0796 10148 L8042mou (d6fc755ff505d99e6cc73e83492310df) C:\WINDOWS\system32\DRIVERS\L8042mou.Sys

21:44:19.0828 10148 L8042mou - ok

21:44:19.0890 10148 lbrtfdc - ok

21:44:19.0968 10148 LHidFilt (24e0ddb99aeccf86bb37702611761459) C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys

21:44:19.0984 10148 LHidFilt - ok

21:44:20.0125 10148 LMouFilt (d58b330d318361a66a9fe60d7c9b4951) C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys

21:44:20.0171 10148 LMouFilt - ok

21:44:20.0359 10148 LMouKE (c149bdad13194df16ea33f9f601ed7bf) C:\WINDOWS\system32\DRIVERS\LMouKE.Sys

21:44:20.0406 10148 LMouKE - ok

21:44:20.0531 10148 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

21:44:20.0562 10148 mnmdd - ok

21:44:20.0671 10148 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys

21:44:20.0703 10148 Modem - ok

21:44:20.0781 10148 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys

21:44:20.0812 10148 Mouclass - ok

21:44:20.0937 10148 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys

21:44:20.0984 10148 mouhid - ok

21:44:21.0125 10148 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys

21:44:21.0171 10148 MountMgr - ok

21:44:21.0203 10148 mraid35x - ok

21:44:21.0296 10148 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

21:44:21.0343 10148 MRxDAV - ok

21:44:21.0484 10148 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

21:44:21.0640 10148 MRxSmb - ok

21:44:21.0781 10148 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys

21:44:21.0796 10148 Msfs - ok

21:44:21.0937 10148 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys

21:44:21.0953 10148 MSKSSRV - ok

21:44:22.0078 10148 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

21:44:22.0109 10148 MSPCLOCK - ok

21:44:22.0234 10148 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys

21:44:22.0281 10148 MSPQM - ok

21:44:22.0437 10148 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

21:44:22.0453 10148 mssmbios - ok

21:44:22.0640 10148 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys

21:44:22.0671 10148 Mup - ok

21:44:22.0796 10148 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys

21:44:22.0828 10148 NDIS - ok

21:44:22.0921 10148 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

21:44:22.0953 10148 NdisTapi - ok

21:44:23.0031 10148 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

21:44:23.0062 10148 Ndisuio - ok

21:44:23.0171 10148 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

21:44:23.0218 10148 NdisWan - ok

21:44:23.0359 10148 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys

21:44:23.0390 10148 NDProxy - ok

21:44:23.0500 10148 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys

21:44:23.0515 10148 NetBIOS - ok

21:44:23.0640 10148 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys

21:44:23.0656 10148 NetBT - ok

21:44:23.0765 10148 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys

21:44:23.0796 10148 Npfs - ok

21:44:23.0875 10148 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys

21:44:23.0921 10148 Ntfs - ok

21:44:24.0015 10148 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

21:44:24.0046 10148 Null - ok

21:44:24.0156 10148 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

21:44:24.0171 10148 NwlnkFlt - ok

21:44:24.0312 10148 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

21:44:24.0343 10148 NwlnkFwd - ok

21:44:24.0453 10148 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys

21:44:24.0484 10148 Parport - ok

21:44:24.0546 10148 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys

21:44:24.0578 10148 PartMgr - ok

21:44:24.0671 10148 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys

21:44:24.0687 10148 ParVdm - ok

21:44:24.0765 10148 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys

21:44:24.0796 10148 PCI - ok

21:44:24.0890 10148 PCIDump - ok

21:44:24.0953 10148 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys

21:44:24.0984 10148 PCIIde - ok

21:44:25.0093 10148 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys

21:44:25.0125 10148 Pcmcia - ok

21:44:25.0203 10148 PDCOMP - ok

21:44:25.0265 10148 PDFRAME - ok

21:44:25.0296 10148 PDRELI - ok

21:44:25.0328 10148 PDRFRAME - ok

21:44:25.0359 10148 perc2 - ok

21:44:25.0390 10148 perc2hib - ok

21:44:25.0515 10148 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys

21:44:25.0531 10148 PptpMiniport - ok

21:44:25.0656 10148 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys

21:44:25.0687 10148 Processor - ok

21:44:25.0781 10148 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys

21:44:25.0812 10148 PSched - ok

21:44:25.0921 10148 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

21:44:25.0953 10148 Ptilink - ok

21:44:26.0015 10148 ql1080 - ok

21:44:26.0078 10148 Ql10wnt - ok

21:44:26.0171 10148 ql12160 - ok

21:44:26.0187 10148 ql1240 - ok

21:44:26.0218 10148 ql1280 - ok

21:44:26.0281 10148 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

21:44:26.0312 10148 RasAcd - ok

21:44:26.0406 10148 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

21:44:26.0437 10148 Rasl2tp - ok

21:44:26.0593 10148 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

21:44:26.0609 10148 RasPppoe - ok

21:44:26.0703 10148 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

21:44:26.0734 10148 Raspti - ok

21:44:26.0843 10148 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys

21:44:26.0875 10148 Rdbss - ok

21:44:26.0968 10148 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

21:44:27.0015 10148 RDPCDD - ok

21:44:27.0156 10148 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys

21:44:27.0187 10148 RDPWD - ok

21:44:27.0359 10148 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys

21:44:27.0390 10148 redbook - ok

21:44:27.0531 10148 sbaphd (62ba65cc0b4a4bd1eaff5fed6e2b5069) C:\WINDOWS\system32\drivers\sbaphd.sys

21:44:27.0578 10148 sbaphd - ok

21:44:27.0687 10148 sbapifs (3fff8cda4d2f29ca06f1557e85163c30) C:\WINDOWS\system32\drivers\sbapifs.sys

21:44:27.0750 10148 sbapifs - ok

21:44:27.0843 10148 SBRE (1fd538c4feb36b793d2121f20bbdc16f) C:\WINDOWS\system32\drivers\SBREdrv.sys

21:44:27.0875 10148 SBRE - ok

21:44:28.0015 10148 sbtis (8bb1632b79ff24f570956ebb43a07501) C:\WINDOWS\system32\drivers\sbtis.sys

21:44:28.0046 10148 sbtis - ok

21:44:28.0140 10148 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

21:44:28.0171 10148 Secdrv - ok

21:44:28.0312 10148 Ser2pl (de0a165d9f8ea295e62ea702ef2f8125) C:\WINDOWS\system32\DRIVERS\ser2pl.sys

21:44:28.0359 10148 Ser2pl - ok

21:44:28.0484 10148 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys

21:44:28.0515 10148 serenum - ok

21:44:28.0609 10148 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys

21:44:28.0640 10148 Serial - ok

21:44:28.0781 10148 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys

21:44:28.0828 10148 Sfloppy - ok

21:44:28.0875 10148 Simbad - ok

21:44:28.0937 10148 smwdm (5018a9db5eb62e3edb3110f82f556285) C:\WINDOWS\system32\drivers\smwdm.sys

21:44:29.0015 10148 smwdm - ok

21:44:29.0156 10148 Sparrow - ok

21:44:29.0218 10148 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys

21:44:29.0265 10148 splitter - ok

21:44:29.0390 10148 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys

21:44:29.0437 10148 sr - ok

21:44:29.0593 10148 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys

21:44:29.0640 10148 Srv - ok

21:44:29.0765 10148 StillCam (a9573045baa16eab9b1085205b82f1ed) C:\WINDOWS\system32\DRIVERS\serscan.sys

21:44:29.0781 10148 StillCam - ok

21:44:29.0921 10148 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys

21:44:29.0937 10148 swenum - ok

21:44:30.0000 10148 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys

21:44:30.0031 10148 swmidi - ok

21:44:30.0109 10148 symc810 - ok

21:44:30.0156 10148 symc8xx - ok

21:44:30.0203 10148 sym_hi - ok

21:44:30.0234 10148 sym_u3 - ok

21:44:30.0296 10148 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys

21:44:30.0328 10148 sysaudio - ok

21:44:30.0437 10148 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys

21:44:30.0468 10148 Tcpip - ok

21:44:30.0609 10148 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys

21:44:30.0640 10148 TDPIPE - ok

21:44:30.0781 10148 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys

21:44:30.0812 10148 TDTCP - ok

21:44:30.0859 10148 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys

21:44:30.0890 10148 TermDD - ok

21:44:30.0968 10148 TosIde - ok

21:44:31.0031 10148 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys

21:44:31.0062 10148 Udfs - ok

21:44:31.0171 10148 ultra - ok

21:44:31.0296 10148 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys

21:44:31.0359 10148 Update - ok

21:44:31.0515 10148 USBAAPL (eafe1e00739afe6c51487a050e772e17) C:\WINDOWS\system32\Drivers\usbaapl.sys

21:44:31.0546 10148 USBAAPL - ok

21:44:31.0671 10148 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys

21:44:31.0718 10148 usbaudio - ok

21:44:31.0828 10148 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys

21:44:31.0859 10148 usbccgp - ok

21:44:31.0984 10148 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys

21:44:32.0015 10148 usbehci - ok

21:44:32.0125 10148 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys

21:44:32.0171 10148 usbhub - ok

21:44:32.0312 10148 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys

21:44:32.0343 10148 usbscan - ok

21:44:32.0468 10148 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

21:44:32.0484 10148 USBSTOR - ok

21:44:32.0703 10148 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys

21:44:32.0734 10148 usbuhci - ok

21:44:33.0093 10148 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys

21:44:33.0140 10148 VgaSave - ok

21:44:33.0437 10148 ViaIde - ok

21:44:33.0875 10148 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys

21:44:33.0921 10148 VolSnap - ok

21:44:34.0375 10148 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys

21:44:34.0453 10148 Wanarp - ok

21:44:35.0078 10148 Wdf01000 (fd47474bd21794508af449d9d91af6e6) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys

21:44:35.0656 10148 Wdf01000 - ok

21:44:35.0781 10148 WDICA - ok

21:44:35.0875 10148 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys

21:44:35.0906 10148 wdmaud - ok

21:44:36.0109 10148 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys

21:44:36.0156 10148 WS2IFSL - ok

21:44:36.0328 10148 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys

21:44:36.0359 10148 WudfPf - ok

21:44:36.0593 10148 {6080A529-897E-4629-A488-ABA0C29B635E} (fd1f4e9cf06c71c8d73a24acf18d8296) C:\WINDOWS\system32\drivers\ialmsbw.sys

21:44:36.0625 10148 {6080A529-897E-4629-A488-ABA0C29B635E} - ok

21:44:36.0796 10148 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91} (d4d7331d33d1fa73e588e5ce0d90a4c1) C:\WINDOWS\system32\drivers\ialmkchw.sys

21:44:36.0812 10148 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91} - ok

21:44:36.0843 10148 MBR (0x1B8) (faee7e40dfb0440ad2cfc39befa1f4c2) \Device\Harddisk0\DR0

21:44:36.0859 10148 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - infected

21:44:36.0859 10148 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.b (0)

21:44:36.0890 10148 MBR (0x1B8) (35c6b2fcde68facbefe0a4a7200bae58) \Device\Harddisk1\DR1

21:44:39.0906 10148 \Device\Harddisk1\DR1 - ok

21:44:39.0906 10148 Boot (0x1200) (9980b912ab393ce53b4d9dc838e2826e) \Device\Harddisk0\DR0\Partition0

21:44:39.0906 10148 \Device\Harddisk0\DR0\Partition0 - ok

21:44:39.0921 10148 Boot (0x1200) (c5d88dc4ce4f30e567e81a8356f35e5a) \Device\Harddisk1\DR1\Partition0

21:44:39.0921 10148 \Device\Harddisk1\DR1\Partition0 - ok

21:44:39.0921 10148 ============================================================

21:44:39.0921 10148 Scan finished

21:44:39.0921 10148 ============================================================

21:44:39.0937 9312 Detected object count: 1

21:44:39.0937 9312 Actual detected object count: 1

21:44:55.0578 9312 \Device\Harddisk0\DR0\# - copied to quarantine

21:44:55.0593 9312 \Device\Harddisk0\DR0 - copied to quarantine

21:44:55.0656 9312 \Device\Harddisk0\DR0\TDLFS\phm - copied to quarantine

21:44:55.0687 9312 \Device\Harddisk0\DR0\TDLFS\ph.dll - copied to quarantine

21:44:55.0703 9312 \Device\Harddisk0\DR0\TDLFS\phx.dll - copied to quarantine

21:44:55.0734 9312 \Device\Harddisk0\DR0\TDLFS\sub.dll - copied to quarantine

21:44:55.0750 9312 \Device\Harddisk0\DR0\TDLFS\subx.dll - copied to quarantine

21:44:55.0781 9312 \Device\Harddisk0\DR0\TDLFS\phd - copied to quarantine

21:44:55.0812 9312 \Device\Harddisk0\DR0\TDLFS\phdx - copied to quarantine

21:44:55.0906 9312 \Device\Harddisk0\DR0\TDLFS\phs - copied to quarantine

21:44:55.0921 9312 \Device\Harddisk0\DR0\TDLFS\phdata - copied to quarantine

21:44:55.0953 9312 \Device\Harddisk0\DR0\TDLFS\phld - copied to quarantine

21:44:56.0000 9312 \Device\Harddisk0\DR0\TDLFS\phln - copied to quarantine

21:44:56.0031 9312 \Device\Harddisk0\DR0\TDLFS\phlx - copied to quarantine

21:44:56.0109 9312 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - will be cured on reboot

21:44:56.0203 9312 \Device\Harddisk0\DR0 - ok

21:45:30.0906 9312 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - User select action: Cure

21:45:35.0125 9348 Deinitialize success

Share this post


Link to post
Share on other sites

It removed the TDL4 partition variant rootkit. :) This rootkit creates a small, hidden partition, which it uses to store its code. When your computer is started it boots from that partition so that the malicious code is loaded into Windows.

COMBOFIX

---------------

Please download ComboFix from one of these locations:


Bleepingcomputer
ForoSpyware

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  • Double click on Combofix.exe and follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Query_RC.gif

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

RC_successful.gif

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\Combofix.txt in your next reply.

Share this post


Link to post
Share on other sites

Hi again, please let me know how things are running after the following steps:

CF-SCRIPT

-------------

We need to execute a CF-script.

  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  • Click Start > Run and in the box that opens type notepad and press enter. Copy/paste the text in the codebox below into it:


MIA::
c:\windows\System32\spoolsv.exe

Save this as CFScript.txt, in the same location as ComboFix.exe

CFScriptB-4.gif

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Share this post


Link to post
Share on other sites

Hi again,

Do you have any problem left at this point?

P2P WARNING

-------------------

Going over your logs I noticed that you have BitLord installed.

  • Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.
  • They are a security risk which can make your computer susceptible to a wide variety of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites.
  • Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users.
  • The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.

It is pretty much certain that if you continue to use P2P programs, you will get infected again.

I would recommend that you uninstall BitLord, however that choice is up to you. If you choose to remove these programs, you can do so via Start > Control Panel > Add/Remove Programs.

If you wish to keep it, please do not use it until your computer is cleaned.

Your version of Adobe Reader is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Adobe components and update:

  • Download the latest version of Adobe Reader Version X. and save it to your desktop.
  • Uncheck the "Free McAfee Security plan Plus" option or any other Toolbar you are offered
  • Click the download button at the bottom.
  • If you use Internet Explorer and do not wish to install the ActiveX element, simply click on the click here to download link on the next page.
  • Remove all older version of Adobe Reader: Go to Add/remove and uninstall all versions of Adobe Reader, Acrobat Reader and Adobe Acrobat.
    If you are unsure of how to use Add or Remove Programs, the please see this tutorial:How To Remove An Installed Program From Your Computer
  • Then from your desktop double-click on Adobe Reader to install the newest version.
    If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
  • When the "Adobe Setup - Welcome" window opens, click the Install > button.
  • If offered to install a Toolbar, just uncheck the box before continuing unless you want it.

Your Adobe Reader is now up to date!

Your version of Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system.

  • Download the latest version of Java Runtime Environment (JRE) Version 7u3.
  • Look for "JDK 7u3 (JDK or JRE).
  • Click the "Download JRE" button at the right.
  • Read the License Agreement, and then check the box that says: "Accept License Agreement".
    • Select "Windows x86 Offline" and click on jre-7-windows-i586.exe

    [*]Save it to your desktop

    [*]Close any programs you may have running - especially your web browser.

    [*]Uninstall all older versions of Java (any item with Java Runtime Environment, JRE or J2SE in the name).

    [*]Reboot your computer once all Java components are removed.

    [*]Install the newest version by double clicking (run as Administrator for Windows Vista/Seven) the downloaded file.

Finally, please launch MBAM, update it and run a full scan. Post me the resulting log.

Share this post


Link to post
Share on other sites

I'm not experiencing any problems at all. I did a scan after installing the updated java and adobe and it picked up a .pup something, but before I could save it I accidentally clicked restart. Here is the log from just now.

Malwarebytes Anti-Malware (Trial) 1.60.1.1000

www.malwarebytes.org

Database version: v2012.03.22.01

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 8.0.6001.18702

Owner :: JEFF [administrator]

Protection: Enabled

3/22/2012 8:47:57 PM

mbam-log-2012-03-22 (20-47-57).txt

Scan type: Full scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 264753

Time elapsed: 2 hour(s), 37 minute(s), 3 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

Share this post


Link to post
Share on other sites

PUPs are usually pretty harmless, so no problem. :) Good to hear things are running fine now.

ESET ONLINE SCANNER

----------------------------

I'd like us to scan your machine with ESET OnlineScan

  1. Hold down Control and click on this link to open ESET OnlineScan in a new window.
  2. Click the esetonlinebtn.png button.
  3. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

    1. Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop.
    2. Double click on the esetsmartinstaller_enu.png
      icon on your desktop.

    3. Check "YES, I accept the Terms of Use."
    4. Click the Start button.
    5. Accept any security warnings from your browser.
    6. Under scan settings, check "Scan Archives" and "Remove found threats"
    7. Click Advanced settings and select the following:
      • Scan potentially unwanted applications
      • Scan for potentially unsafe applications
      • Enable Anti-Stealth technology

[*]ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.

[*]When the scan completes, click List Threats

[*]Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.

[*]Click the Back button.

[*]Click the Finish button.

Share this post


Link to post
Share on other sites

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.

  • Recently Browsing   0 members

    No registered users viewing this page.