Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

« previous next »
Pages: [1] 2 3 ... 9   Go Down

Author Topic: Rootkit.Win32.TDSS.d on Vista  (Read 80183 times)

0 Members and 1 Guest are viewing this topic.

pancakejohn

    Topic Starter


    Beginner

    Rootkit.Win32.TDSS.d on Vista
    « on: April 14, 2010, 09:57:42 AM »
    Hi,
     I have been infected with "Rootkit.Win32.TDSS.d" that Kaspersky claims is residing in my system memory. I have also been infected with rogue anitspyware called "vista antivirus" and "total vista security". I believe I have been able to remove both using a combination of malwarebytes, the kaspersky system rescue disk, hitman pro, the kaspersky tool "TDSSkiller" and combofix.
     However, I still get redirected on google searches and Kaspersky still informs me I am infected with Rootkit.Win32.TDSS.d residing in system memory. This is even after it performs its "special disinfection procedure" and reboots.
     Any help would be greatly appreciated. Thanks

    My GSI log:
    http://www.getsysteminfo.com/read.php?file=738955a92cfb22e4cbe6d825ce44bc11
    ------------------------------------------------------------------------------------------------------------------------------------------------
    SUPERAntiSpyware Scan Log
    http://www.superantispyware.com

    Generated 04/13/2010 at 05:02 AM

    Application Version : 4.35.1002

    Core Rules Database Version : 4798
    Trace Rules Database Version: 2610

    Scan type       : Complete Scan
    Total Scan Time : 05:57:10

    Memory items scanned      : 668
    Memory threats detected   : 0
    Registry items scanned    : 8717
    Registry threats detected : 0
    File items scanned        : 311224
    File threats detected     : 72

    Adware.Tracking Cookie
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][3].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][5].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][6].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@adbrite[1].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@advertise[1].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@advertise[2].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@advertise[3].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@advertise[5].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@advertising[1].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@advertising[2].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@apmebf[2].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@atdmt[1].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@atdmt[2].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@azjmp[2].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@casalemedia[2].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@clicksor[2].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][3].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][4].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][5].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][6].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][7].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@doubleclick[1].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@doubleclick[2].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@doubleclick[3].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@doubleclick[5].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@enhance[2].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@fastclick[1].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@invitemedia[1].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@invitemedia[3].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@invitemedia[4].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@invitemedia[5].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@lucidmedia[1].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@lynxtrack[1].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@media6degrees[1].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@mediaplex[2].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@mediatraffic[1].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@myroitracking[1].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@overture[1].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@pointroll[2].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@pointroll[3].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@questionmarket[1].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@questionmarket[3].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@realmedia[1].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@realmedia[2].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@realmedia[3].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@revsci[1].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@revsci[2].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@revsci[3].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@sitirifinds[1].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@specificclick[2].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@specificmedia[1].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@statcounter[2].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
       C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt

    ------------------------------------------------------------------------------------------------------------------------------------------------My  MBAM log:

    Malwarebytes' Anti-Malware 1.45
    www.malwarebytes.org

    Database version: 3983

    Windows 6.0.6001 Service Pack 1
    Internet Explorer 8.0.6001.18904

    4/13/2010 8:59:19 PM
    mbam-log-2010-04-13 (20-59-19).txt

    Scan type: Quick scan
    Objects scanned: 107559
    Time elapsed: 6 minute(s), 4 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 1

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    C:\Windows\Temp\ggak.tmp\svchost.exe (Adware.Agent) -> Quarantined and deleted successfully.

    ------------------------------------------------------------------------------------------------------------------------------------------------

    My HJT log:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:02:32 PM, on 4/13/2010
    Platform: Windows Vista SP1 (WinNT 6.00.1905)
    MSIE: Internet Explorer v8.00 (8.00.6001.18904)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wuauclt.exe
    C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtblfs.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Program Files\Trend Micro\HijackThis\sniper.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: (no name) - MRI_DISABLED - (no file)
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
    O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
    O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
    O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKUS\S-1-5-18\..\Run: [DevconDefaultDB] C:\Windows\system32\READREG /SILENT /FAIL=1 (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [DevconDefaultDB] C:\Windows\system32\READREG /SILENT /FAIL=1 (User 'Default user')
    O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
    O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
    O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware player\vsocklib.dll
    O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware player\vsocklib.dll
    O13 - Gopher Prefix:
    O16 - DPF: {7557F5AA-D486-401D-BE55-0163FA78B5B8} (SkyFex Expert Object) - https://skyfex.com/download/SkyFexExpert.cab
    O16 - DPF: {B3E32D88-8E7F-468F-B0E2-3A300FD4A82C} (Enlite 2.x Simulation Engine Installer) - http://myitlab.pearsoned.com/Pegasus/Modules/SIMIntegration/Resources/ax/stub.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
    O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15108/CTPID.cab
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
    O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
    O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
    O22 - SharedTaskScheduler: Deskscapes - {EC654325-1273-C2A9-2B7C-45D29BCE68FB} - C:\PROGRA~1\Stardock\OBJECT~1\DESKSC~1\deskscapes.dll
    O22 - SharedTaskScheduler: Ave's FolderBg - {73526E5A-FD53-4BE7-B5E2-D3C89D7413DC} - C:\Windows\System32\Branding\folderbg\VistaFolderBackground.dll
    O22 - SharedTaskScheduler: Stardock Vista ControlPanel Extension - {EC654325-1273-C2A9-2B7C-45D29BCE68FD} - (no file)
    O22 - SharedTaskScheduler: StardockDreamController - {EC654325-1273-C2A9-2B7C-45D29BCE68FF} - C:\PROGRA~1\Stardock\OBJECT~1\DESKSC~1\DreamControl.dll
    O23 - Service: Access Utility Service - SprintNextel - C:\Program Files\Sprint\Mobile Broadband\SMBAUtilSvc.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Creative ALchemy AL6 Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe
    O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
    O23 - Service: CopySafe Helper Service (CSHelper) - Unknown owner - C:\Windows\system32\CSHelper.exe
    O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
    O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Professional Home XII.SP2c\RpcAgentSrv.exe
    O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
    O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
    O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files\VMware\VMware Player\vmware-ufad.exe
    O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Player\vmware-authd.exe
    O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\Windows\system32\vmnetdhcp.exe
    O23 - Service: VMware NAT Service - VMware, Inc. - C:\Windows\system32\vmnat.exe

    --
    End of file - 9742 bytes
    Logged

    SuperDave

    • Malware Removal Specialist


      • Genius
      • Thanked: 1020
    • Certifications: List
    • Experience: Expert
    • OS: Windows 10
    Re: Rootkit.Win32.TDSS.d on Vista
    « Reply #1 on: April 14, 2010, 12:16:48 PM »
    Hello  and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer. I am working under the guidance of one of the specialist of this forum so it may take a bit longer to process your logs.

    1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
    2. The fixes are specific to your problem and should only be used for this issue on this machine.
    3. If you don't know or understand something, please don't hesitate to ask.
    4. Please DO NOT run any other tools or scans while I am helping you.
    5. It is important that you reply to this thread. Do not start a new topic.
    6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
    7. Absence of symptoms does not mean that everything is clear.

    I am analyzing your logs and I'll be back in a little while with the results.
    Logged
    Windows 8 and Windows 10 dual boot with two SSD's

    SuperDave

    • Malware Removal Specialist


      • Genius
      • Thanked: 1020
    • Certifications: List
    • Experience: Expert
    • OS: Windows 10
    Re: Rootkit.Win32.TDSS.d on Vista
    « Reply #2 on: April 14, 2010, 01:02:23 PM »
    The GSI site is password protected. This is a good tool but not very useful if I can't get into it.

    Right click HijackThis and choose Run as Administrator

    Next select Do a system scan only

    Place a check mark next to the following entries: (if there)

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O2 - BHO: (no name) - MRI_DISABLED - (no file)
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
    (Description: RealPlayer scheduler. Completely unnecessary. Removing this entry will free up a small amount of system resources.)
    O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
    O22 - SharedTaskScheduler: Stardock Vista ControlPanel Extension - {EC654325-1273-C2A9-2B7C-45D29BCE68FD} - (no file)


    Important: Close all open windows except for HijackThis and then click Fix checked.

    Once completed, exit HijackThis.
    ==================================

    * Download the following tool: RootRepeal - Rootkit Detector
    * Direct download link is here: RootRepeal.zip

    * Close all programs and temporarily disable your anti-virus, Firewall and any anti-malware real-time protection before performing a scan.
    * Click this link to see a list of such programs and how to disable them.

    * Extract the program file to a new folder such as C:\RootRepeal
    * Run the program RootRepeal.exe and go to the REPORT tab and click on the Scan button.
    * Select ALL of the checkboxes and then click OK and it will start scanning your system.
    * If you have multiple drives you only need to check the C: drive or the one Windows is installed on.
    * When done, click on Save Report
    * Save it to the same location where you ran it from, such as C:RootRepeal
    * Save it as rootrepeal.txt
    * Then open that log and select all and copy/paste it back on your next reply please.
    * Close RootRepeal.

    Logged
    Windows 8 and Windows 10 dual boot with two SSD's

    pancakejohn

      Topic Starter


      Beginner

      Re: Rootkit.Win32.TDSS.d on Vista
      « Reply #3 on: April 14, 2010, 10:54:07 PM »
      Hi Dave,
      I appreciate your help.
       
      If you don't have a login to the GSI site you may use the following login:

      Username: kasperskyantivirus
      Password: password

      I ran HJT and followed the directions.

      Here is my log from RootRepeal:
      (Note: at the end of the scan I recieved the error message "Unable to scan the system registry, please contact the program author")

      ROOTREPEAL (c) AD, 2007-2009
      ==================================================
      Scan Start Time:      2010/04/14 23:35
      Program Version:      Version 1.3.5.0
      Windows Version:      Windows Vista SP1
      ==================================================

      Drivers
      -------------------
      Name: dump_atapi.sys
      Image Path: C:\Windows\System32\Drivers\dump_atapi.sys
      Address: 0x98B90000   Size: 32768   File Visible: No   Signed: -
      Status: -

      Name: dump_dumpata.sys
      Image Path: C:\Windows\System32\Drivers\dump_dumpata.sys
      Address: 0x98B85000   Size: 45056   File Visible: No   Signed: -
      Status: -

      Name: dump_dumpfve.sys
      Image Path: C:\Windows\System32\Drivers\dump_dumpfve.sys
      Address: 0x98B98000   Size: 69632   File Visible: No   Signed: -
      Status: -

      Name: rootrepeal.sys
      Image Path: C:\Windows\system32\drivers\rootrepeal.sys
      Address: 0xA8943000   Size: 49152   File Visible: No   Signed: -
      Status: -

      Hidden/Locked Files
      -------------------
      Path: C:\System Volume Information\{3808876b-c176-4e48-b7ae-04046e6cc752}
      Status: Locked to the Windows API!

      Path: C:\System Volume Information\{39df6ed1-4706-11df-b613-001fd080afd9}{3808876b-c176-4e48-b7ae-04046e6cc752}
      Status: Locked to the Windows API!

      Path: C:\System Volume Information\{3ea23e55-41a7-11df-bf1e-001fd080afd9}{3808876b-c176-4e48-b7ae-04046e6cc752}
      Status: Locked to the Windows API!

      Path: C:\System Volume Information\{54718a68-3f3a-11df-8de3-001fd080afd9}{3808876b-c176-4e48-b7ae-04046e6cc752}
      Status: Locked to the Windows API!

      Path: C:\System Volume Information\{54718a81-3f3a-11df-8de3-001fd080afd9}{3808876b-c176-4e48-b7ae-04046e6cc752}
      Status: Locked to the Windows API!

      Path: C:\System Volume Information\{5bfbd797-32fa-11df-9941-001fd080afd9}{3808876b-c176-4e48-b7ae-04046e6cc752}
      Status: Locked to the Windows API!

      Path: C:\System Volume Information\{5bfbd7ba-32fa-11df-9941-001fd080afd9}{3808876b-c176-4e48-b7ae-04046e6cc752}
      Status: Locked to the Windows API!

      Path: C:\System Volume Information\{5bfbd7cc-32fa-11df-9941-001fd080afd9}{3808876b-c176-4e48-b7ae-04046e6cc752}
      Status: Locked to the Windows API!

      Path: C:\System Volume Information\{5bfbd7f7-32fa-11df-9941-001fd080afd9}{3808876b-c176-4e48-b7ae-04046e6cc752}
      Status: Locked to the Windows API!

      Path: C:\System Volume Information\{7e3c21c8-46a8-11df-b99e-001fd080afd9}{3808876b-c176-4e48-b7ae-04046e6cc752}
      Status: Locked to the Windows API!

      Path: C:\System Volume Information\{97d67976-42c2-11df-bbd4-001fd080afd9}{3808876b-c176-4e48-b7ae-04046e6cc752}
      Status: Locked to the Windows API!

      Path: C:\System Volume Information\{9afacf5e-3fa2-11df-bd8a-001fd080afd9}{3808876b-c176-4e48-b7ae-04046e6cc752}
      Status: Locked to the Windows API!

      Path: C:\System Volume Information\{9afacf76-3fa2-11df-bd8a-001fd080afd9}{3808876b-c176-4e48-b7ae-04046e6cc752}
      Status: Locked to the Windows API!

      Path: C:\System Volume Information\{A5A42~1
      Status: Locked to the Windows API!

      Path: C:\System Volume Information\{A5A42~2
      Status: Locked to the Windows API!

      Path: C:\System Volume Information\{A5A42~3
      Status: Locked to the Windows API!

      Path: C:\System Volume Information\{a5a4229b-35f6-11df-a72d-001fd080afd9}{3808876b-c176-4e48-b7ae-04046e6cc752}
      Status: Locked to the Windows API!

      Path: C:\System Volume Information\{AE224~1
      Status: Locked to the Windows API!

      Path: C:\System Volume Information\{a5a4230b-35f6-11df-a72d-001fd080afd9}{3808876b-c176-4e48-b7ae-04046e6cc752}
      Status: Locked to the Windows API!

      Path: C:\System Volume Information\{a5a4233b-35f6-11df-a72d-001fd080afd9}{3808876b-c176-4e48-b7ae-04046e6cc752}
      Status: Locked to the Windows API!

      Path: C:\System Volume Information\{5bfbd79b-32fa-11df-9941-001fd080afd9}{3808876b-c176-4e48-b7ae-04046e6cc752}
      Status: Locked to the Windows API!

      Path: C:\System Volume Information\{A5A42~4
      Status: Locked to the Windows API!

      Path: C:\Windows\System32\3AC100~1.VBS
      Status: Locked to the Windows API!

      Path: C:\Windows\System32\GATHER~1.XSL
      Status: Locked to the Windows API!

      Path: c:\windows\temp\flaff60.tmp
      Status: Allocation size mismatch (API: 589824, Raw: 0)

      Path: C:\Program Files\Windows Media Player\Network Sharing\RENDER~1.XML
      Status: Locked to the Windows API!

      Path: C:\Windows\Microsoft.NET\Framework\NETFXS~1.HKF
      Status: Locked to the Windows API!

      Path: C:\Windows\System32\wbem\MSFEED~1.MOF
      Status: Locked to the Windows API!

      Path: C:\Windows\System32\wbem\PRINTF~1.MOF
      Status: Locked to the Windows API!

      Path: C:\Windows\inf\.NET CLR Data\_DATAP~1.H
      Status: Locked to the Windows API!

      Path: C:\Windows\inf\.NET CLR Networking\_NETWO~1.H
      Status: Locked to the Windows API!

      Path: C:\Windows\inf\.NET Data Provider for SqlServer\_DATAP~2.H
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_da4695fc507e16e1.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.21022.8_none_b59bae9d65014b98.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.21022.8_none_5d1777c2e857a23b.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_none_81c25f21d3d46d84.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_dcc7eae99ad0d9cf.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.openmp_1fc8b3b9a1e18e3b_8.0.50727.762_none_abac38a907ee8801.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.debugcrt_1fc8b3b9a1e18e3b_9.0.30729.1_none_bb1f6aa1308c35eb.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.42_none_d6c3e7af9bae13a2.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.42_none_54c11df268b7c6d9.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_microsoft.flightsimulator.simconnect_67c7c14424d61b5b_10.0.61242.0_none_e079b46b85043c20.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.debugmfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_bfff6c932d60651e.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.4148_none_51ca66a2bbe76806.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_policy.4.20.microsoft.msxml2_6bd6b9abf345378f_4.20.9876.0_none_a6e4a7980e9b18a2.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.openmp_1fc8b3b9a1e18e3b_9.0.21022.8_none_ecdf8c290e547f39.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_9193a620671dde41.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.debugmfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_5c94f2bbe7d4aaf6.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.42_none_0e9c2a8d74fd3ce6.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_10b2f55f9bffb8f8.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_8.0.50727.762_none_7b33aa7d218504d2.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.1_none_818f59bf601aa775.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.debugcrt_1fc8b3b9a1e18e3b_9.0.30729.1_none_61305e07e4f1bc01.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.21022.8_none_bcb86ed6ac711f91.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.openmp_1fc8b3b9a1e18e3b_8.0.50727.42_none_7658964504b9f3b6.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.762_none_8e053e8c6967ba9d.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.openmp_1fc8b3b9a1e18e3b_9.0.21022.8_none_7ab8cc63a6e4c2a3.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_microsoft.msxml2_6bd6b9abf345378f_4.20.9870.0_none_b7e00e6c7b30b69b.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.21022.8_none_5926f98ceadc42c2.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_8550c6b5d18a9128.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_microsoft.msxml2_6bd6b9abf345378f_4.20.9818.0_none_b7e811947b297f6d.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.42_none_58843c41d2730d3f.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.1_none_e29d1181971ae11e.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.762_none_8dd7dea5d5a7a18a.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.4053_none_4ddfc6cd11929a02.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.762_none_0c178a139ee2a7ed.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.4053_none_d1c738ec43578ea1.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_microsoft.msxml2r_6bd6b9abf345378f_4.1.0.0_none_3658456fda6654f6.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_policy.4.1.microsoft.msxml2r_6bd6b9abf345378f_4.1.1.0_none_8b7b15c031cda6db.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.21022.8_none_bdf22a22ab9e15d5.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_microsoft.msxml2_6bd6b9abf345378f_4.20.9876.0_none_b7e610287b2b4ea5.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_policy.4.20.microsoft.msxml2_6bd6b9abf345378f_4.20.9870.0_none_a6dea5dc0ea08098.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_microsoft.msxml2_6bd6b9abf345378f_4.1.0.0_none_6c030d6fdc86522c.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_microsoft.msxml2r_6bd6b9abf345378f_4.1.1.0_none_365945b9da656e4d.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.42_none_db5f52fb98cb24ad.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.21022.8_none_60a5df56e60dc5df.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.1_none_7dd1e0ebd6590e0b.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_microsoft.flightsimulator.simconnect_67c7c14424d61b5b_10.0.60905.0_none_dd92b94d8a196297.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.21022.8_none_5ce47260749ddc2c.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.42_none_dc990e4797f81af1.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.762_none_11ecb0ab9b2caf3c.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.1_none_e163563597edeada.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.42_none_5c4003bc63e949f6.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.atl_1fc8b3b9a1e18e3b_8.0.50727.42_none_58b19c2866332652.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.762_none_43efccf17831d131.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_policy.9.0.microsoft.vc90.atl_1fc8b3b9a1e18e3b_9.0.30729.4148_none_f0efb442f8a0f46c.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_policy.8.0.microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.762_none_8a14c0566bec5b24.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.21022.8_none_b81d038aaf540e86.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\Catalogs\x86_microsoft.vc80.openmp_1fc8b3b9a1e18e3b_8.0.50727.42_none_45e008191e507087.cat
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\msil_jsc_b03f5f7f11d50a3a_6.0.6000.16720_none_a7f9fcdcd724c803\JSCEXE~1.CON
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\msil_jsc_b03f5f7f11d50a3a_6.0.6000.20883_none_91321380f0c70cf6\JSCEXE~1.CON
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\msil_jsc_b03f5f7f11d50a3a_6.0.6001.18111_none_a7d4e192d776d4a4\JSCEXE~1.CON
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\msil_jsc_b03f5f7f11d50a3a_6.0.6001.22230_none_9109522ef11c4db7\JSCEXE~1.CON
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_caspol_b03f5f7f11d50a3a_6.0.6000.16386_none_6c022a44ef879fba\CASPOL~1.CON
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_caspol_b03f5f7f11d50a3a_6.0.6000.16720_none_6bfcb0a8ef8c6f2e\CASPOL~1.CON
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_caspol_b03f5f7f11d50a3a_6.0.6000.20883_none_5534c74d092eb421\CASPOL~1.CON
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_caspol_b03f5f7f11d50a3a_6.0.6001.18111_none_6bd7955eefde7bcf\CASPOL~1.CON
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_caspol_b03f5f7f11d50a3a_6.0.6001.22230_none_550c05fb0983f4e2\CASPOL~1.CON
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.0.6000.17022_none_0eef72aeb7ba5ba2\APPLIC~1.CON
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_6.0.6000.21227_none_0f7e12d1d0d37746\APPLIC~1.CON
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_microsoft-windows-m..-downlevelmanifests_31bf3856ad364e35_6.0.6000.16386_none_0041f38286aeaf07\MICROS~2.MAN
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_microsoft-windows-m..-downlevelmanifests_31bf3856ad364e35_6.0.6000.16386_none_0041f38286aeaf07\MI2095~1.MAN
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.0.6001.18185_none_0b1847174f5614f7\RENDER~1.XML
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_6.0.6000.16386_none_2976d78dde7bcc93\PRINTF~1.MOF
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_microsoft-windows-s..component.resources_31bf3856ad364e35_6.0.6001.18000_en-us_817b5730b9a6e374\W32UIRes.dll.mui2
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_microsoft-windows-setup-component_31bf3856ad364e35_6.0.6001.18000_none_322c7e4ead424897\W32UIRes.dll2
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_regsql_cfg_b03f5f7f11d50a3a_6.0.6000.16720_none_7c654fdc62654993\ASPNET~1.CON
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_regsql_cfg_b03f5f7f11d50a3a_6.0.6000.20883_none_659d66807c078e86\ASPNET~1.CON
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_regsql_cfg_b03f5f7f11d50a3a_6.0.6001.18111_none_7c40349262b75634\ASPNET~1.CON
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_regsql_cfg_b03f5f7f11d50a3a_6.0.6001.22230_none_6574a52e7c5ccf47\ASPNET~1.CON
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.0.6000.16720_none_7325c867d7281910\CHOOSE~1.ASP
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.0.6000.16720_none_7325c867d7281910\MANAGE~1.ASP
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.0.6000.16720_none_7325c867d7281910\MANAGE~2.ASP
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.0.6000.20883_none_5c5ddf0bf0ca5e03\CHOOSE~1.ASP
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.0.6000.20883_none_5c5ddf0bf0ca5e03\MANAGE~1.ASP
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.0.6000.20883_none_5c5ddf0bf0ca5e03\MANAGE~2.ASP
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.0.6001.18111_none_7300ad1dd77a25b1\CHOOSE~1.ASP
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.0.6001.18111_none_7300ad1dd77a25b1\MANAGE~1.ASP
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.0.6001.18111_none_7300ad1dd77a25b1\MANAGE~2.ASP
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.0.6001.22230_none_5c351db9f11f9ec4\CHOOSE~1.ASP
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.0.6001.22230_none_5c351db9f11f9ec4\MANAGE~1.ASP
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_providers_b03f5f7f11d50a3a_6.0.6001.22230_none_5c351db9f11f9ec4\MANAGE~2.ASP
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6000.16720_none_e1f7e8f41a7be9de\CHOOSE~1.RES
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6000.16720_none_e1f7e8f41a7be9de\MANAGE~1.RES
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6000.16720_none_e1f7e8f41a7be9de\MANAGE~2.RES
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6000.16720_none_e1f7e8f41a7be9de\PROVID~1.RES
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6000.20883_none_cb2fff98341e2ed1\CHOOSE~1.RES
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6000.20883_none_cb2fff98341e2ed1\MANAGE~1.RES
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6000.20883_none_cb2fff98341e2ed1\MANAGE~2.RES
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6000.20883_none_cb2fff98341e2ed1\PROVID~1.RES
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6001.18111_none_e1d2cdaa1acdf67f\CHOOSE~1.RES
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6001.18111_none_e1d2cdaa1acdf67f\MANAGE~1.RES
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6001.18111_none_e1d2cdaa1acdf67f\MANAGE~2.RES
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6001.18111_none_e1d2cdaa1acdf67f\PROVID~1.RES
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.0.6000.16720_none_b103fb905f6db0d9\MANAGE~1.RES
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.0.6000.20883_none_9a3c1234790ff5cc\MANAGE~1.RES
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.0.6001.18111_none_b0dee0465fbfbd7a\MANAGE~1.RES
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_users_res_b03f5f7f11d50a3a_6.0.6001.22230_none_9a1350e27965368d\MANAGE~1.RES
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.16720_none_66f75d098c217f33\WIZARD~2.ASC
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.16720_none_66f75d098c217f33\WIZARD~3.ASC
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.16720_none_66f75d098c217f33\WIZARD~4.ASC
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.16720_none_66f75d098c217f33\WI1344~1.ASC
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.16720_none_66f75d098c217f33\WI5BF5~1.ASC
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.20883_none_502f73ada5c3c426\WIZARD~2.ASC
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.20883_none_502f73ada5c3c426\WIZARD~3.ASC
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.20883_none_502f73ada5c3c426\WIZARD~4.ASC
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.20883_none_502f73ada5c3c426\WI1344~1.ASC
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6000.20883_none_502f73ada5c3c426\WI5BF5~1.ASC
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.18111_none_66d241bf8c738bd4\WIZARD~2.ASC
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.18111_none_66d241bf8c738bd4\WIZARD~3.ASC
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.18111_none_66d241bf8c738bd4\WIZARD~4.ASC
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.18111_none_66d241bf8c738bd4\WI1344~1.ASC
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.18111_none_66d241bf8c738bd4\WI5BF5~1.ASC
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webmintrust_config_b03f5f7f11d50a3a_6.0.6000.16720_none_e2c358ab062e054b\WEB_MI~1.CON
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webmintrust_config_b03f5f7f11d50a3a_6.0.6000.20883_none_cbfb6f4f1fd04a3e\WEB_MI~1.CON
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webmintrust_config_b03f5f7f11d50a3a_6.0.6001.18111_none_e29e3d61068011ec\WEB_MI~1.CON
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webmintrust_config_b03f5f7f11d50a3a_6.0.6001.22230_none_cbd2adfd20258aff\WEB_MI~1.CON
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-data_perf_h_b03f5f7f11d50a3a_6.0.6000.16720_none_ea4958dde0dcb61b\_DATAP~1.H
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-data_perf_h_b03f5f7f11d50a3a_6.0.6000.16720_none_ea4958dde0dcb61b\_DATAP~2.H
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-data_perf_h_b03f5f7f11d50a3a_6.0.6000.20883_none_d3816f81fa7efb0e\_DATAP~1.H
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-data_perf_h_b03f5f7f11d50a3a_6.0.6000.20883_none_d3816f81fa7efb0e\_DATAP~2.H
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-data_perf_h_b03f5f7f11d50a3a_6.0.6001.18111_none_ea243d93e12ec2bc\_DATAP~1.H
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-data_perf_h_b03f5f7f11d50a3a_6.0.6001.18111_none_ea243d93e12ec2bc\_DATAP~2.H
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-data_perf_h_b03f5f7f11d50a3a_6.0.6001.22230_none_d358ae2ffad43bcf\_DATAP~1.H
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-data_perf_h_b03f5f7f11d50a3a_6.0.6001.22230_none_d358ae2ffad43bcf\_DATAP~2.H
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-fw_perfcounters_b03f5f7f11d50a3a_6.0.6000.16386_none_96ee0340e66c3abe\_NETWO~1.H
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-fw_perfcounters_b03f5f7f11d50a3a_6.0.6000.16720_none_96e889a4e6710a32\_NETWO~1.H
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-fw_perfcounters_b03f5f7f11d50a3a_6.0.6000.20883_none_8020a04900134f25\_NETWO~1.H
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6001.22230_none_cb073e4634736f92\CHOOSE~1.RES
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6001.22230_none_cb073e4634736f92\MANAGE~1.RES
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6001.22230_none_cb073e4634736f92\MANAGE~2.RES
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_prov_res_b03f5f7f11d50a3a_6.0.6001.22230_none_cb073e4634736f92\PROVID~1.RES
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_roles_res_b03f5f7f11d50a3a_6.0.6001.18111_none_87ae800b19ca9087\MANAGE~1.RES
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_roles_res_b03f5f7f11d50a3a_6.0.6001.18111_none_87ae800b19ca9087\MANAGE~2.RES
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.22230_none_5006b25ba61904e7\WIZARD~2.ASC
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.22230_none_5006b25ba61904e7\WIZARD~3.ASC
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.22230_none_5006b25ba61904e7\WIZARD~4.ASC
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.22230_none_5006b25ba61904e7\WI1344~1.ASC
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-aspnet_webadmin_wizard_b03f5f7f11d50a3a_6.0.6001.22230_none_5006b25ba61904e7\WI5BF5~1.ASC
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-msbuild_commontypes_schema_b03f5f7f11d50a3a_6.0.6000.16720_none_7081409dee51e2d7\4C5DE2~1.XSD
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-msbuild_commontypes_schema_b03f5f7f11d50a3a_6.0.6000.20883_none_59b9574207f427ca\4C5DE2~1.XSD
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-msbuild_commontypes_schema_b03f5f7f11d50a3a_6.0.6001.18111_none_705c2553eea3ef78\4C5DE2~1.XSD
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-msbuild_commontypes_schema_b03f5f7f11d50a3a_6.0.6001.22230_none_599095f00849688b\4C5DE2~1.XSD
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-msbuild_core_schema__b03f5f7f11d50a3a_6.0.6000.16720_none_b462fc0cbe880bcb\MICROS~1.XSD
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-msbuild_core_schema__b03f5f7f11d50a3a_6.0.6000.20883_none_9d9b12b0d82a50be\MICROS~1.XSD
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-msbuild_core_schema__b03f5f7f11d50a3a_6.0.6001.18111_none_b43de0c2beda186c\MICROS~1.XSD
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-msbuild_core_schema__b03f5f7f11d50a3a_6.0.6001.22230_none_9d72515ed87f917f\MICROS~1.XSD
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-netfxsbs12_hkf_31bf3856ad364e35_6.0.6000.16720_none_0bca521ee450d037\NETFXS~1.HKF
      Status: Locked to the Windows API!

      Path: C:\Windows\winsxs\x86_netfx-ado_net_diag_b03f5f7f11d50a3a_6.0.6000.16386_none_6d869912e7931eda\ADONET~1.MOF
      Status: Locked to the Windows API!

      Path: c:\windows\winsxs\x86_wcf-m_tx_bridge_perf_c_ini_31bf3856ad364e35_6.0.6000.16386_none_7e4886cd31591fb3\_transactionbridgeperfcounters_d.ini
      Status: AllocatioProcesses
      -------------------
      Path: System
      PID: 4   Status: Locked to the Windows API!

      Path: C:\Windows\System32\audiodg.exe
      PID: 1428   Status: Locked to the Windows API!

      SSDT
      -------------------
      #: 012   Function Name: NtAdjustPrivilegesToken
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8732ebd0

      #: 021   Function Name: NtAlpcConnectPort
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8733052c

      #: 022   Function Name: NtAlpcCreatePort
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x87330782

      #: 038   Function Name: NtAlpcSendWaitReceivePort
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x873309fc

      #: 048   Function Name: NtClose
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8732f450

      #: 054   Function Name: NtConnectPort
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8732fb32

      #: 058   Function Name: NtCreateEvent
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8732ff3c

      #: 060   Function Name: NtCreateFile
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8732f5f8

      #: 067   Function Name: NtCreateMutant
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8732fe14

      #: 068   Function Name: NtCreateNamedPipeFile
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8732e7d6

      #: 071   Function Name: NtCreatePort
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8732fcd0

      #: 075   Function Name: NtCreateSection
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8732e992

      #: 076   Function Name: NtCreateSemaphore
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8733006e

      #: 077   Function Name: NtCreateSymbolicLinkObject
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x87331cb0

      #: 078   Function Name: NtCreateThread
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8732f0ee

      #: 115   Function Name: NtCreateWaitablePort
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8732fd72

      #: 116   Function Name: NtDebugActiveProcess
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x873316a2

      #: 129   Function Name: NtDuplicateObject
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x87332672

      #: 150   Function Name: NtFsControlFile
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8732f752

      #: 165   Function Name: NtLoadDriver
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x87331734

      #: 177   Function Name: NtMapViewOfSection
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x87331d64

      #: 184   Function Name: NtOpenEvent
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8732ffde

      #: 186   Function Name: NtOpenFile
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8732f4d2

      #: 191   Function Name: NtOpenMutant
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8732feac

      #: 194   Function Name: NtOpenProcess
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8732edd6

      #: 197   Function Name: NtOpenSection
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x87331cda

      #: 198   Function Name: NtOpenSemaphore
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x87330110

      #: 201   Function Name: NtOpenThread
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8732ecfa

      #: 219   Function Name: NtQueryDirectoryObject
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x87330c3e

      #: 242   Function Name: NtQuerySection
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8733207c

      #: 255   Function Name: NtQueueApcThread
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x873319ca

      #: 270   Function Name: NtReplyPort
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8733049a

      #: 271   Function Name: NtReplyWaitReceivePort
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x87330360

      #: 276   Function Name: NtRequestWaitReplyPort
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x87331442

      #: 282   Function Name: NtResumeThread
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x87332554

      #: 286   Function Name: NtSecureConnectPort
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8732f86c

      #: 289   Function Name: NtSetContextThread
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8732f30c

      #: 307   Function Name: NtSetInformationToken
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x87330cf2

      #: 314   Function Name: NtSetSecurityObject
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8733182e

      #: 317   Function Name: NtSetSystemInformation
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x873321bc

      #: 330   Function Name: NtSuspendProcess
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x873322a0

      #: 331   Function Name: NtSuspendThread
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x873323c8

      #: 332   Function Name: NtSystemDebugControl
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x873315ce

      #: 334   Function Name: NtTerminateProcess
      Status: Hooked by "C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS" at address 0x98a8f320

      #: 335   Function Name: NtTerminateThread
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8732eea4

      #: 348   Function Name: NtUnmapViewOfSection
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x87331f32

      #: 358   Function Name: NtWriteVirtualMemory
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8732f02e

      #: 382   Function Name: NtCreateThreadEx
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8732f1ee

      Stealth Objects
      -------------------
      Object: Hidden Module [Name: imageres.dll]
      Process: Explorer.EXE (PID: 2028)   Address: 0x66190000   Size: 21086208

      Shadow SSDT
      -------------------
      #: 013   Function Name: NtGdiBitBlt
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8733fd1c

      #: 235   Function Name: NtGdiMaskBlt
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8733fde6

      #: 245   Function Name: NtGdiPlgBlt
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8733fe50

      #: 301   Function Name: NtGdiStretchBlt
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8733fd80

      #: 317   Function Name: NtUserAttachThreadInput
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8733f930

      #: 333   Function Name: NtUserCallOneParam
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8733fce8

      #: 391   Function Name: NtUserFindWindowEx
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8733fb1e

      #: 397   Function Name: NtUserGetAsyncKeyState
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8733f898

      #: 428   Function Name: NtUserGetKeyboardState
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8733fc20

      #: 430   Function Name: NtUserGetKeyState
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8733f8e4

      #: 479   Function Name: NtUserMessageCall
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8733fa70

      #: 497   Function Name: NtUserPostMessage
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8733f9c6

      #: 498   Function Name: NtUserPostThreadMessage
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8733fa1a

      #: 513   Function Name: NtUserRegisterRawInputDevices
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8733fbb0

      #: 525   Function Name: NtUserSendInput
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8733fad0

      #: 573   Function Name: NtUserSetWindowsHookEx
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8733f7e8

      #: 576   Function Name: NtUserSetWinEventHook
      Status: Hooked by "C:\Windows\system32\DRIVERS\klif.sys" at address 0x8733f83e

      ==EOF==


      Logged

      SuperDave

      • Malware Removal Specialist


        • Genius
        • Thanked: 1020
      • Certifications: List
      • Experience: Expert
      • OS: Windows 10
      Re: Rootkit.Win32.TDSS.d on Vista
      « Reply #4 on: April 15, 2010, 12:51:01 PM »
      Ok. I was able to get into the GSI scan. If you go into it you will see two drivers to update. You can update those drivers from there.

      Download ComboFix by sUBs from one of the below links.  Be sure to save it to the Desktop.

      link # 1
      Link # 2

      Close any open web browsers (Firefox, Internet Explorer, etc) before starting ComboFix.

      Temporarily disable your anti-virus, and any anti-spyware real-time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

      Right-click combofix.exe and select Run as Administrator and follow the prompts.
      When finished, ComboFix will produce a log for you.
      Post the ComboFix log and a new HijackThis log in your next reply.

      NOTE: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

      Remember to re-enable your anti-virus and anti-spyware protection when ComboFix is complete.
      Logged
      Windows 8 and Windows 10 dual boot with two SSD's

      pancakejohn

        Topic Starter


        Beginner

        Re: Rootkit.Win32.TDSS.d on Vista
        « Reply #5 on: April 15, 2010, 06:11:05 PM »
        I updated my ethernet adapter drivers.

        My new GSI:

        http://www.getsysteminfo.com/read.php?file=b5c859b27f67367310fdee6eb9f7f0ff

        I ran Combofix as an administrator from an administrator account, however I received many lines of the error message "Access denied. Unable to complete the operation. Use an administrator command prompt to complete this operation."

        When Combofix finished scanning, I recieved the message "Combofix had detected the presence of rootkit activity and needs to reboot the machine.

        Before rebooting, I recieved more lines of the error message, "Access denied. Unable to complete the operation. Use an administrator command prompt to complete this operation."

        Upon reboot I recieved no confirmation from Combofix, nor did I get a logfile.

        My new HJT log:

        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 7:04:46 PM, on 4/15/2010
        Platform: Windows Vista SP1 (WinNT 6.00.1905)
        MSIE: Internet Explorer v8.00 (8.00.6001.18904)
        Boot mode: Normal

        Running processes:
        C:\Windows\system32\taskeng.exe
        C:\Windows\system32\Dwm.exe
        C:\Windows\Explorer.EXE
        C:\Program Files\Windows Defender\MSASCui.exe
        C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
        C:\Program Files\Windows Sidebar\sidebar.exe
        C:\Program Files\Windows Sidebar\sidebar.exe
        C:\Windows\system32\wbem\unsecapp.exe
        C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtblfs.exe
        C:\Windows\system32\wuauclt.exe
        C:\Windows\system32\SearchFilterHost.exe
        C:\Program Files\Trend Micro\HijackThis\sniper.exe

        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
        R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
        R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
        O1 - Hosts: ::1 localhost
        O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
        O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ievkbd.dll
        O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
        O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
        O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
        O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
        O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
        O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
        O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
        O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe"
        O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
        O4 - HKUS\S-1-5-18\..\Run: [DevconDefaultDB] C:\Windows\system32\READREG /SILENT /FAIL=1 (User 'SYSTEM')
        O4 - HKUS\.DEFAULT\..\Run: [DevconDefaultDB] C:\Windows\system32\READREG /SILENT /FAIL=1 (User 'Default user')
        O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
        O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
        O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
        O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
        O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
        O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
        O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
        O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
        O9 - Extra button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
        O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
        O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtbbho.dll
        O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware player\vsocklib.dll
        O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware player\vsocklib.dll
        O13 - Gopher Prefix:
        O16 - DPF: {7557F5AA-D486-401D-BE55-0163FA78B5B8} (SkyFex Expert Object) - https://skyfex.com/download/SkyFexExpert.cab
        O16 - DPF: {B3E32D88-8E7F-468F-B0E2-3A300FD4A82C} (Enlite 2.x Simulation Engine Installer) - http://myitlab.pearsoned.com/Pegasus/Modules/SIMIntegration/Resources/ax/stub.cab
        O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
        O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15108/CTPID.cab
        O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
        O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
        O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
        O22 - SharedTaskScheduler: Deskscapes - {EC654325-1273-C2A9-2B7C-45D29BCE68FB} - C:\PROGRA~1\Stardock\OBJECT~1\DESKSC~1\deskscapes.dll
        O22 - SharedTaskScheduler: Ave's FolderBg - {73526E5A-FD53-4BE7-B5E2-D3C89D7413DC} - C:\Windows\System32\Branding\folderbg\VistaFolderBackground.dll
        O22 - SharedTaskScheduler: StardockDreamController - {EC654325-1273-C2A9-2B7C-45D29BCE68FF} - C:\PROGRA~1\Stardock\OBJECT~1\DESKSC~1\DreamControl.dll
        O23 - Service: Access Utility Service - SprintNextel - C:\Program Files\Sprint\Mobile Broadband\SMBAUtilSvc.exe
        O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
        O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
        O23 - Service: Creative ALchemy AL6 Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe
        O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
        O23 - Service: CopySafe Helper Service (CSHelper) - Unknown owner - C:\Windows\system32\CSHelper.exe
        O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
        O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
        O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
        O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
        O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
        O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
        O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
        O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Professional Home XII.SP2c\RpcAgentSrv.exe
        O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
        O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
        O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Program Files\VMware\VMware Player\vmware-ufad.exe
        O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Player\vmware-authd.exe
        O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\Windows\system32\vmnetdhcp.exe
        O23 - Service: VMware NAT Service - VMware, Inc. - C:\Windows\system32\vmnat.exe

        --
        End of file - 9008 bytes
         
        Logged

        SuperDave

        • Malware Removal Specialist


          • Genius
          • Thanked: 1020
        • Certifications: List
        • Experience: Expert
        • OS: Windows 10
        Re: Rootkit.Win32.TDSS.d on Vista
        « Reply #6 on: April 15, 2010, 07:57:07 PM »
        Please delete your copy of ComboFix and do this.

        Download this << file >> & extract TDSSKiller.exe onto your Desktop

        Then create this batch file to be placed next to TDSSKiller

        =====

        Open NOTEPAD.exe and copy/paste the text in the quotebox below into it:
        Code: [Select]
        @ECHO OFF
        START /WAIT TDSSKILLER.exe -l Logit.txt -v
        START Logit.txt
        del %0        Save this as fix.bat Choose to "Save type as  - All Files"
        It should look like this:
        Double click on fix.bat & allow it to run

        Post back to tell me what it says

        Logged
        Windows 8 and Windows 10 dual boot with two SSD's

        pancakejohn

          Topic Starter


          Beginner

          Re: Rootkit.Win32.TDSS.d on Vista
          « Reply #7 on: April 15, 2010, 08:18:58 PM »
          It says:

          Scanning              Kernel memory ...
          Driver "atapi" infected by TDSS rootkit!
          File "C:\Windows\system32\drivers\atapi.sys" infected by TDSS rootkit ... will be cured on next reboot.

          The machine then rebooted, the driver atapi.sys was not cured though.
          Logged

          pancakejohn

            Topic Starter


            Beginner

            Re: Rootkit.Win32.TDSS.d on Vista
            « Reply #8 on: April 15, 2010, 08:21:38 PM »
            Here is the log it gave me:

            21:15:03:571 2812   TDSS rootkit removing tool 2.2.8.1 Mar 22 2010 10:43:04
            21:15:03:571 2812   ================================================================================
            21:15:03:571 2812   SystemInfo:

            21:15:03:571 2812   OS Version: 6.0.6001 ServicePack: 1.0
            21:15:03:571 2812   Product type: Workstation
            21:15:03:571 2812   ComputerName: HEAVENH-IPND9NT
            21:15:03:571 2812   UserName: Administrator
            21:15:03:571 2812   Windows directory: C:\Windows
            21:15:03:571 2812   Processor architecture: Intel x86
            21:15:03:571 2812   Number of processors: 4
            21:15:03:571 2812   Page size: 0x1000
            21:15:03:633 2812   Boot type: Normal boot
            21:15:03:633 2812   ================================================================================
            21:15:03:633 2812   UnloadDriverW: NtUnloadDriver error 2
            21:15:03:633 2812   ForceUnloadDriverW: UnloadDriverW(klmd21) error 2
            21:15:04:008 2812   wfopen_ex: Trying to open file C:\Windows\system32\config\system
            21:15:04:008 2812   wfopen_ex: MyNtCreateFileW error 32 (C0000043)
            21:15:04:008 2812   wfopen_ex: Trying to KLMD file open
            21:15:04:008 2812   wfopen_ex: File opened ok (Flags 2)
            21:15:04:023 2812   wfopen_ex: Trying to open file C:\Windows\system32\config\software
            21:15:04:023 2812   wfopen_ex: MyNtCreateFileW error 32 (C0000043)
            21:15:04:023 2812   wfopen_ex: Trying to KLMD file open
            21:15:04:023 2812   wfopen_ex: File opened ok (Flags 2)
            21:15:04:023 2812   Initialize success
            21:15:04:023 2812   
            21:15:04:023 2812   Scanning   Services ...
            21:15:09:218 2812   Raw services enum returned 509 services
            21:15:09:234 2812   
            21:15:09:234 2812   Scanning   Kernel memory ...
            21:15:09:234 2812   Devices to scan: 3
            21:15:09:234 2812   
            21:15:09:234 2812   Driver Name: atapi
            21:15:09:234 2812   IRP_MJ_CREATE                      : 86B720FC
            21:15:09:234 2812   IRP_MJ_CREATE_NAMED_PIPE           : 860D9887
            21:15:09:234 2812   IRP_MJ_CLOSE                       : 86B720FC
            21:15:09:234 2812   IRP_MJ_READ                        : 860D9887
            21:15:09:234 2812   IRP_MJ_WRITE                       : 860D9887
            21:15:09:234 2812   IRP_MJ_QUERY_INFORMATION           : 860D9887
            21:15:09:234 2812   IRP_MJ_SET_INFORMATION             : 860D9887
            21:15:09:234 2812   IRP_MJ_QUERY_EA                    : 860D9887
            21:15:09:234 2812   IRP_MJ_SET_EA                      : 860D9887
            21:15:09:234 2812   IRP_MJ_FLUSH_BUFFERS               : 860D9887
            21:15:09:234 2812   IRP_MJ_QUERY_VOLUME_INFORMATION    : 860D9887
            21:15:09:234 2812   IRP_MJ_SET_VOLUME_INFORMATION      : 860D9887
            21:15:09:234 2812   IRP_MJ_DIRECTORY_CONTROL           : 860D9887
            21:15:09:234 2812   IRP_MJ_FILE_SYSTEM_CONTROL         : 860D9887
            21:15:09:234 2812   IRP_MJ_DEVICE_CONTROL              : 86B609D6
            21:15:09:234 2812   IRP_MJ_INTERNAL_DEVICE_CONTROL     : 86B609A8
            21:15:09:234 2812   IRP_MJ_SHUTDOWN                    : 860D9887
            21:15:09:234 2812   IRP_MJ_LOCK_CONTROL                : 860D9887
            21:15:09:234 2812   IRP_MJ_CLEANUP                     : 860D9887
            21:15:09:234 2812   IRP_MJ_CREATE_MAILSLOT             : 860D9887
            21:15:09:234 2812   IRP_MJ_QUERY_SECURITY              : 860D9887
            21:15:09:234 2812   IRP_MJ_SET_SECURITY                : 860D9887
            21:15:09:234 2812   IRP_MJ_POWER                       : 86B60A04
            21:15:09:234 2812   IRP_MJ_SYSTEM_CONTROL              : 86B6DB70
            21:15:09:234 2812   IRP_MJ_DEVICE_CHANGE               : 860D9887
            21:15:09:234 2812   IRP_MJ_QUERY_QUOTA                 : 860D9887
            21:15:09:234 2812   IRP_MJ_SET_QUOTA                   : 860D9887
            21:15:09:234 2812   C:\Windows\system32\drivers\atapi.sys - Verdict: 1
            21:15:09:234 2812   
            21:15:09:234 2812   Driver Name: atapi
            21:15:09:234 2812   IRP_MJ_CREATE                      : 86B720FC
            21:15:09:234 2812   IRP_MJ_CREATE_NAMED_PIPE           : 860D9887
            21:15:09:234 2812   IRP_MJ_CLOSE                       : 86B720FC
            21:15:09:234 2812   IRP_MJ_READ                        : 860D9887
            21:15:09:234 2812   IRP_MJ_WRITE                       : 860D9887
            21:15:09:234 2812   IRP_MJ_QUERY_INFORMATION           : 860D9887
            21:15:09:234 2812   IRP_MJ_SET_INFORMATION             : 860D9887
            21:15:09:249 2812   IRP_MJ_QUERY_EA                    : 860D9887
            21:15:09:249 2812   IRP_MJ_SET_EA                      : 860D9887
            21:15:09:249 2812   IRP_MJ_FLUSH_BUFFERS               : 860D9887
            21:15:09:249 2812   IRP_MJ_QUERY_VOLUME_INFORMATION    : 860D9887
            21:15:09:249 2812   IRP_MJ_SET_VOLUME_INFORMATION      : 860D9887
            21:15:09:249 2812   IRP_MJ_DIRECTORY_CONTROL           : 860D9887
            21:15:09:249 2812   IRP_MJ_FILE_SYSTEM_CONTROL         : 860D9887
            21:15:09:249 2812   IRP_MJ_DEVICE_CONTROL              : 86B609D6
            21:15:09:249 2812   IRP_MJ_INTERNAL_DEVICE_CONTROL     : 86B609A8
            21:15:09:249 2812   IRP_MJ_SHUTDOWN                    : 860D9887
            21:15:09:249 2812   IRP_MJ_LOCK_CONTROL                : 860D9887
            21:15:09:249 2812   IRP_MJ_CLEANUP                     : 860D9887
            21:15:09:249 2812   IRP_MJ_CREATE_MAILSLOT             : 860D9887
            21:15:09:249 2812   IRP_MJ_QUERY_SECURITY              : 860D9887
            21:15:09:249 2812   IRP_MJ_SET_SECURITY                : 860D9887
            21:15:09:249 2812   IRP_MJ_POWER                       : 86B60A04
            21:15:09:249 2812   IRP_MJ_SYSTEM_CONTROL              : 86B6DB70
            21:15:09:249 2812   IRP_MJ_DEVICE_CHANGE               : 860D9887
            21:15:09:249 2812   IRP_MJ_QUERY_QUOTA                 : 860D9887
            21:15:09:249 2812   IRP_MJ_SET_QUOTA                   : 860D9887
            21:15:09:249 2812   C:\Windows\system32\drivers\atapi.sys - Verdict: 1
            21:15:09:249 2812   
            21:15:09:249 2812   Driver Name: atapi
            21:15:09:249 2812   IRP_MJ_CREATE                      : 8EFA6AC8
            21:15:09:249 2812   IRP_MJ_CREATE_NAMED_PIPE           : 8EFA6AC8
            21:15:09:249 2812   IRP_MJ_CLOSE                       : 8EFA6AC8
            21:15:09:249 2812   IRP_MJ_READ                        : 8EFA6AC8
            21:15:09:249 2812   IRP_MJ_WRITE                       : 8EFA6AC8
            21:15:09:249 2812   IRP_MJ_QUERY_INFORMATION           : 8EFA6AC8
            21:15:09:249 2812   IRP_MJ_SET_INFORMATION             : 8EFA6AC8
            21:15:09:249 2812   IRP_MJ_QUERY_EA                    : 8EFA6AC8
            21:15:09:249 2812   IRP_MJ_SET_EA                      : 8EFA6AC8
            21:15:09:249 2812   IRP_MJ_FLUSH_BUFFERS               : 8EFA6AC8
            21:15:09:249 2812   IRP_MJ_QUERY_VOLUME_INFORMATION    : 8EFA6AC8
            21:15:09:249 2812   IRP_MJ_SET_VOLUME_INFORMATION      : 8EFA6AC8
            21:15:09:249 2812   IRP_MJ_DIRECTORY_CONTROL           : 8EFA6AC8
            21:15:09:249 2812   IRP_MJ_FILE_SYSTEM_CONTROL         : 8EFA6AC8
            21:15:09:249 2812   IRP_MJ_DEVICE_CONTROL              : 8EFA6AC8
            21:15:09:249 2812   IRP_MJ_INTERNAL_DEVICE_CONTROL     : 8EFA6AC8
            21:15:09:249 2812   IRP_MJ_SHUTDOWN                    : 8EFA6AC8
            21:15:09:249 2812   IRP_MJ_LOCK_CONTROL                : 8EFA6AC8
            21:15:09:249 2812   IRP_MJ_CLEANUP                     : 8EFA6AC8
            21:15:09:249 2812   IRP_MJ_CREATE_MAILSLOT             : 8EFA6AC8
            21:15:09:249 2812   IRP_MJ_QUERY_SECURITY              : 8EFA6AC8
            21:15:09:249 2812   IRP_MJ_SET_SECURITY                : 8EFA6AC8
            21:15:09:249 2812   IRP_MJ_POWER                       : 8EFA6AC8
            21:15:09:249 2812   IRP_MJ_SYSTEM_CONTROL              : 8EFA6AC8
            21:15:09:249 2812   IRP_MJ_DEVICE_CHANGE               : 8EFA6AC8
            21:15:09:249 2812   IRP_MJ_QUERY_QUOTA                 : 8EFA6AC8
            21:15:09:249 2812   IRP_MJ_SET_QUOTA                   : 8EFA6AC8
            21:15:09:249 2812   Driver "atapi" infected by TDSS rootkit!
            21:15:09:249 2812   C:\Windows\system32\drivers\atapi.sys - Verdict: 1
            21:15:09:249 2812   File "C:\Windows\system32\drivers\atapi.sys" infected by TDSS rootkit ... 21:15:09:249 2812   Processing driver file: C:\Windows\system32\drivers\atapi.sys
            21:15:11:355 2812   vfvi6
            21:15:11:574 2812   dsvbh1
            21:15:13:759 2812   fdfb1
            21:15:13:759 2812   Backup copy found, using it..
            21:15:14:367 2812   will be cured on next reboot
            21:15:14:367 2812   Reboot required for cure complete..
            21:15:14:398 2812   Cure on reboot scheduled successfully
            21:15:14:398 2812   
            21:15:14:398 2812   Completed
            21:15:14:398 2812   
            21:15:14:398 2812   Results:
            21:15:14:398 2812   Memory objects infected / cured / cured on reboot:   1 / 0 / 0
            21:15:14:398 2812   Registry objects infected / cured / cured on reboot:   0 / 0 / 0
            21:15:14:398 2812   File objects infected / cured / cured on reboot:   1 / 0 / 1
            21:15:14:398 2812   
            21:15:14:398 2812   fclose_ex: Trying to close file C:\Windows\system32\config\system
            21:15:14:398 2812   fclose_ex: Trying to close file C:\Windows\system32\config\software
            21:15:14:398 2812   UnloadDriverW: NtUnloadDriver error 1
            21:15:14:414 2812   KLMD(ARK) unloaded successfully
            Logged

            SuperDave

            • Malware Removal Specialist


              • Genius
              • Thanked: 1020
            • Certifications: List
            • Experience: Expert
            • OS: Windows 10
            Re: Rootkit.Win32.TDSS.d on Vista
            « Reply #9 on: April 16, 2010, 09:34:13 AM »
            Please re-run Combofix as instructed in Reply # 4 and post the log.
            Logged
            Windows 8 and Windows 10 dual boot with two SSD's

            pancakejohn

              Topic Starter


              Beginner

              Re: Rootkit.Win32.TDSS.d on Vista
              « Reply #10 on: April 16, 2010, 11:41:47 AM »
              I re-ran Combofix as instructed in Reply # 4, I got the same results with the error messages. It still stated it found rootkit activity and needed to reboot. Upon reboot no log was generated.
              Logged

              SuperDave

              • Malware Removal Specialist


                • Genius
                • Thanked: 1020
              • Certifications: List
              • Experience: Expert
              • OS: Windows 10
              Re: Rootkit.Win32.TDSS.d on Vista
              « Reply #11 on: April 16, 2010, 12:10:17 PM »
              Ok. Let's try this. Delete your copy of ComboFix and do this.

              Please download ComboFix from BleepingComputer.com

              Alternate link: GeeksToGo.com

              Rename ComboFix.exe to commy.exe before you save it to your Desktop
              Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools A guide to do this can be found here
              Click Start then copy paste the following command into the search box & hit enter: "%userprofile%\desktop\commy.exe" /stepdel
              As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. This will not install in Vista. Just continue scanning, and skip the console install.
              When finished, it shall produce a log for you.  Please include the contents of C:\ComboFix.txt in your next reply.

              If you have problems with ComboFix usage, see How to use ComboFix
              Logged
              Windows 8 and Windows 10 dual boot with two SSD's

              pancakejohn

                Topic Starter


                Beginner

                Re: Rootkit.Win32.TDSS.d on Vista
                « Reply #12 on: April 17, 2010, 10:12:20 AM »
                After many tries of running combofix and many BSOD's i finally got it to complete.

                Below is the log:

                ComboFix 10-04-15.05 - Administrator 04/17/2010  11:18:12.5.4 - x86
                Windows Windows Vista™ Extreme Edition   6.0.6001.1.1252.1.1033.18.3326.2047 [GMT -5:00]
                Running from: c:\users\Administrator\Desktop\commy.exe
                Command switches used :: /stepdel
                SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
                SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
                .

                (((((((((((((((((((((((((   Files Created from 2010-03-17 to 2010-04-17  )))))))))))))))))))))))))))))))
                .

                2010-04-17 16:28 . 2010-04-17 16:28   --------   d-----w-   c:\users\Administrator\AppData\Local\temp
                2010-04-17 16:28 . 2010-04-17 16:28   --------   d-----w-   c:\users\Default\AppData\Local\temp
                2010-04-16 02:20 . 2010-01-21 16:46   441168   ----a-w-   c:\users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\k8nxc5os.default\extensions\[email protected]\plugins\npLogitechDeviceDetection.dll
                2010-04-15 23:21 . 2010-03-05 02:50   261152   ----a-w-   c:\windows\system32\drivers\Rtlh86.sys
                2010-04-15 23:21 . 2010-02-04 01:24   94208   ----a-w-   c:\windows\system32\RTNUninst32.dll
                2010-04-15 23:21 . 2009-12-03 22:27   80416   ----a-w-   c:\windows\system32\RtNicProp32.dll
                2010-04-15 04:33 . 2010-04-15 04:58   --------   d-----w-   C:\RootRepeal
                2010-04-14 02:00 . 2010-04-14 02:00   --------   d-----w-   c:\program files\Trend Micro
                2010-04-13 04:01 . 2010-04-13 04:01   52224   ----a-w-   c:\users\Administrator\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
                2010-04-13 04:01 . 2010-04-13 04:01   117760   ----a-w-   c:\users\Administrator\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
                2010-04-13 04:00 . 2010-04-13 04:00   --------   d-----w-   c:\programdata\SUPERAntiSpyware.com
                2010-04-13 03:59 . 2010-04-13 03:59   --------   d-----w-   c:\program files\SUPERAntiSpyware
                2010-04-13 03:59 . 2010-04-13 03:59   --------   d-----w-   c:\users\Administrator\AppData\Roaming\SUPERAntiSpyware.com
                2010-04-13 03:18 . 2010-04-13 03:18   12872   ----a-w-   c:\windows\system32\bootdelete.exe
                2010-04-13 03:07 . 2010-04-13 03:19   15944   ----a-w-   c:\windows\system32\drivers\hitmanpro35.sys
                2010-04-13 03:07 . 2010-04-13 03:18   --------   d-----w-   c:\programdata\Hitman Pro
                2010-04-13 03:07 . 2010-04-13 03:07   --------   d-----w-   c:\program files\Hitman Pro 3.5
                2010-04-13 02:50 . 2010-04-13 02:50   --------   d-----w-   c:\windows\Vista
                2010-04-09 00:31 . 2010-04-09 00:36   --------   d-----w-   C:\CF21711C
                2010-04-09 00:23 . 2010-04-09 00:25   --------   d-----w-   C:\CF14740C
                2010-04-09 00:21 . 2010-04-09 00:23   --------   d-----w-   C:\CF26000C
                2010-04-09 00:20 . 2010-04-09 00:20   --------   d-----w-   C:\CF
                2010-04-08 04:12 . 2010-04-08 04:12   --------   d-----w-   c:\program files\Sophos
                2010-04-06 18:17 . 2010-04-06 18:17   --------   d-----w-   c:\program files\FileASSASSIN
                2010-04-06 18:12 . 2010-04-06 18:12   --------   d-----w-   c:\program files\Common Files\Gibinsoft Shared
                2010-04-06 18:12 . 2010-04-06 18:12   --------   d-----w-   c:\program files\GiPo@Utilities
                2010-04-06 04:16 . 2010-04-06 17:23   --------   d-----w-   c:\program files\Common Files\PC Tools
                2010-04-04 04:47 . 2010-04-04 04:47   270398   ----a-r-   c:\users\Administrator\AppData\Roaming\Microsoft\Installer\{F2080246-09F7-4AAA-81D3-797A5D495D65}\_6FEFF9B68218417F98F549.exe
                2010-04-04 04:47 . 2010-04-04 04:47   270398   ----a-r-   c:\users\Administrator\AppData\Roaming\Microsoft\Installer\{F2080246-09F7-4AAA-81D3-797A5D495D65}\_62540AA1BC7B99A206401C.exe
                2010-04-04 04:47 . 2010-04-04 04:47   --------   d-----w-   c:\program files\Jugaari
                2010-04-04 04:22 . 2008-03-19 21:13   36864   ----a-w-   c:\windows\system32\V0500Pin.dll
                2010-04-04 04:22 . 2008-03-19 21:13   32768   ----a-w-   c:\windows\system32\V0500Hwx.dll
                2010-04-04 04:22 . 2008-03-19 21:13   262144   ----a-w-   c:\windows\system32\V0500Cvw.dll
                2010-04-04 04:22 . 2008-03-19 21:13   251264   ----a-w-   c:\windows\system32\drivers\V0500Vid.sys
                2010-04-04 04:22 . 2008-03-19 21:13   20480   ----a-w-   c:\windows\system32\V0500Srv.exe
                2010-04-04 04:22 . 2008-03-19 21:12   90112   ----a-w-   c:\windows\CtDrvIns.exe
                2010-03-31 11:16 . 2010-03-31 11:16   658184   ----a-w-   c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
                2010-03-22 21:04 . 2010-03-22 21:04   255472   ----a-w-   c:\users\Administrator\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
                2010-03-20 02:29 . 2010-03-20 02:29   23   --sha-w-   c:\windows\system32\edacded0.dat
                2010-03-20 02:29 . 2010-03-20 02:29   --------   d-----w-   c:\program files\jv16 PowerTools 2009
                2010-03-19 17:44 . 2010-03-19 17:44   --------   d-----w-   c:\program files\SoftLogica
                2010-03-19 02:03 . 2010-03-19 02:05   --------   d-----w-   c:\users\Administrator\AppData\Local\GPUMonitor

                .
                ((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
                .
                2010-04-17 16:06 . 2009-11-04 03:38   62927   ----a-w-   c:\programdata\nvModes.dat
                2010-04-17 16:06 . 2009-10-30 18:58   --------   d-----w-   c:\programdata\Kaspersky Lab
                2010-04-17 16:06 . 2009-05-09 02:19   --------   d-----w-   c:\programdata\VMware
                2010-04-17 16:06 . 2009-01-18 17:15   --------   d-----w-   c:\programdata\NVIDIA
                2010-04-16 17:37 . 2006-11-02 08:51   21560   ----a-w-   c:\windows\system32\drivers\atapi.sys
                2010-04-16 16:00 . 2009-07-11 22:30   --------   d-----w-   c:\users\Administrator\AppData\Roaming\vlc
                2010-04-15 23:21 . 2009-01-18 17:16   --------   d-----w-   c:\program files\Realtek
                2010-04-15 04:28 . 2009-02-03 21:01   --------   d-----w-   c:\users\Administrator\AppData\Roaming\uTorrent
                2010-04-13 14:54 . 2009-09-14 19:46   21520   ----a-w-   c:\windows\system32\drivers\klim6.sys
                2010-04-13 03:58 . 2009-01-18 17:09   --------   d-----w-   c:\program files\Common Files\Wise Installation Wizard
                2010-04-08 13:40 . 2006-11-02 08:51   21560   ----a-w-   c:\windows\system32\drivers\atapi.svs
                2010-04-08 03:59 . 2009-01-18 17:16   --------   d--h--w-   c:\program files\InstallShield Installation Information
                2010-04-06 05:51 . 2009-01-25 20:06   --------   d-----w-   c:\program files\ASTRA32
                2010-04-06 04:29 . 2009-02-03 20:46   --------   d-----w-   c:\program files\Malwarebytes' Anti-Malware
                2010-04-06 04:18 . 2009-04-01 02:24   5918776   ----a-w-   c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
                2010-03-29 20:24 . 2009-02-03 20:46   38224   ----a-w-   c:\windows\system32\drivers\mbamswissarmy.sys
                2010-03-29 20:24 . 2009-02-03 20:46   20824   ----a-w-   c:\windows\system32\drivers\mbam.sys
                2010-03-15 01:36 . 2010-03-15 01:36   --------   d-----w-   c:\program files\QS
                2010-03-15 01:35 . 2010-03-15 01:35   --------   d-----w-   c:\users\Administrator\AppData\Roaming\TeamViewer
                2010-03-14 21:17 . 2009-02-03 21:01   --------   d-----w-   c:\program files\uTorrent
                2010-03-14 03:46 . 2010-03-14 03:44   --------   d-----w-   c:\program files\PhotoRescue PC v3.1.14.12271
                2010-03-14 03:36 . 2009-06-15 06:40   --------   d-----w-   c:\programdata\OfficeRecovery
                2010-03-14 03:33 . 2010-03-14 03:33   --------   d-----w-   c:\users\Administrator\AppData\Roaming\OfficeRecovery
                2010-03-14 03:32 . 2009-06-15 06:40   --------   d-----w-   c:\program files\OfficeRecovery
                2010-03-14 03:27 . 2010-03-14 03:25   --------   d-----w-   c:\users\Administrator\AppData\Roaming\XnView
                2010-03-13 22:49 . 2009-01-22 01:21   --------   d-----w-   c:\program files\DOSBox-0.72
                2010-03-13 04:01 . 2006-11-02 11:18   --------   d-----w-   c:\program files\Windows Mail
                2010-03-13 04:00 . 2009-01-18 16:48   --------   d-----w-   c:\programdata\Microsoft Help
                2010-03-04 22:45 . 2009-04-21 01:02   --------   d-----w-   c:\program files\Palm
                2010-02-24 15:16 . 2009-10-08 16:59   181632   ------w-   c:\windows\system32\MpSigStub.exe
                2010-02-24 14:02 . 2009-01-18 16:45   1356   ----a-w-   c:\users\Administrator\AppData\Local\d3d9caps.dat
                2010-02-23 06:39 . 2010-04-01 02:59   916480   ----a-w-   c:\windows\system32\wininet.dll
                2010-02-23 06:33 . 2010-04-01 02:59   71680   ----a-w-   c:\windows\system32\iesetup.dll
                2010-02-23 06:33 . 2010-04-01 02:59   109056   ----a-w-   c:\windows\system32\iesysprep.dll
                2010-02-23 04:55 . 2010-04-01 02:59   133632   ----a-w-   c:\windows\system32\ieUnatt.exe
                2010-02-20 23:39 . 2010-03-13 03:56   24064   ----a-w-   c:\windows\system32\nshhttp.dll
                2010-02-20 23:37 . 2010-03-13 03:56   31232   ----a-w-   c:\windows\system32\httpapi.dll
                2010-02-20 21:18 . 2010-03-13 03:56   411136   ----a-w-   c:\windows\system32\drivers\http.sys
                2010-02-18 02:21 . 2010-02-18 02:21   --------   d-----w-   c:\program files\PdaNet for iPhone
                2010-01-25 12:48 . 2010-03-02 03:39   472576   ----a-w-   c:\windows\system32\secproc_isv.dll
                2010-01-25 12:48 . 2010-03-02 03:39   151040   ----a-w-   c:\windows\system32\secproc_ssp_isv.dll
                2010-01-25 12:48 . 2010-03-02 03:39   151040   ----a-w-   c:\windows\system32\secproc_ssp.dll
                2010-01-25 12:48 . 2010-03-02 03:39   472064   ----a-w-   c:\windows\system32\secproc.dll
                2010-01-25 12:45 . 2010-03-02 03:39   329216   ----a-w-   c:\windows\system32\msdrm.dll
                2010-01-25 08:35 . 2010-03-02 03:39   346624   ----a-w-   c:\windows\system32\RMActivate_ssp_isv.exe
                2010-01-25 08:35 . 2010-03-02 03:39   523776   ----a-w-   c:\windows\system32\RMActivate_isv.exe
                2010-01-25 08:34 . 2010-03-02 03:39   511488   ----a-w-   c:\windows\system32\RMActivate.exe
                2010-01-25 08:34 . 2010-03-02 03:39   347136   ----a-w-   c:\windows\system32\RMActivate_ssp.exe
                2010-01-23 09:44 . 2010-03-02 03:39   2048   ----a-w-   c:\windows\system32\tzres.dll
                2008-04-04 09:50 . 2008-04-04 09:22   8192   --sha-w-   c:\windows\Users\Default\NTUSER.DAT
                .

                ------- Sigcheck -------

                [-] 2008-01-26 . 2406E3A5FAE743DCE81168A8CDB8573F . 247296 . . [6.0.6000.16386] . . c:\windows\System32\shsvcs.dll
                .
                (((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
                .
                .
                *Note* empty entries & legit default entries are not shown
                REGEDIT4

                [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-04-04 1233920]

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-04-04 1008184]
                "AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe" [2009-10-21 340456]

                [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                "DevconDefaultDB"="c:\windows\system32\READREG" [X]

                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
                "ConsentPromptBehaviorUser"= 0 (0x0)
                "EnableInstallerDetection"= 0 (0x0)
                "EnableLUA"= 0 (0x0)
                "EnableUIADesktopToggle"= 0 (0x0)

                [hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
                "{73526E5A-FD53-4BE7-B5E2-D3C89D7413DC}"= "c:\windows\System32\Branding\folderbg\VistaFolderBackground.dll" [2008-04-05 90112]

                [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
                "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

                [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
                "AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll c:\progra~1\KASPER~1\KASPER~1\kloehk.dll

                [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
                "wave"=DrvTrNTm.dll
                "mixer"=DrvTrNTm.dll

                [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
                @="Service"

                [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^GammaTray.lnk]
                path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\GammaTray.lnk
                backup=c:\windows\pss\GammaTray.lnk.CommonStartup
                backupExtension=.CommonStartup

                [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HotSync Manager.lnk]
                path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HotSync Manager.lnk
                backup=c:\windows\pss\HotSync Manager.lnk.CommonStartup
                backupExtension=.CommonStartup

                [HKLM\~\startupfolder\C:^Users^Administrator^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MEMonitor.lnk]
                path=c:\users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MEMonitor.lnk
                backup=c:\windows\pss\MEMonitor.lnk.Startup
                backupExtension=.Startup

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
                2008-06-12 03:43   640376   ----a-w-   c:\program files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Acrobat Speed Launcher]
                2008-06-12 07:25   37232   ----a-w-   c:\program files\Adobe\Acrobat 9.0\Acrobat\acrobat_sl.exe

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
                2009-02-27 22:10   35696   ----a-w-   c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrMfcWnd]
                2008-05-29 17:49   1085440   ------w-   c:\program files\Brother\Brmfcmon\BrMfcWnd.exe

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter3]
                2007-12-21 22:57   86016   ------w-   c:\program files\Brother\ControlCenter3\BrCtrCen.exe

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
                2009-06-23 16:48   19456   ----a-w-   c:\windows\System32\CtHelper.exe

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
                2008-04-04 09:46   125952   ----a-w-   c:\windows\ehome\ehtray.exe

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
                2009-04-24 01:29   133104   ----atw-   c:\users\Administrator\AppData\Local\Google\Update\GoogleUpdate.exe

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
                2008-10-25 16:44   31072   ----a-w-   c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
                2007-10-12 00:01   46368   ----a-w-   c:\program files\ScanSoft\PaperPort\IndexSearch.exe

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
                2009-07-13 19:03   292128   ----a-w-   c:\program files\iTunes\iTunesHelper.exe

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JMB36X IDE Setup]
                2007-03-20 06:36   36864   ------r-   c:\windows\RaidTool\xInsIDE.exe

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MagicTuneEngine]
                2008-10-08 14:04   69632   ----a-w-   c:\program files\MagicTune Premium\MagicTuneEngine.exe

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
                2007-03-01 20:57   153136   ----a-w-   c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
                2009-09-27 23:47   92776   ----a-w-   c:\windows\System32\nvmctray.dll

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
                2007-10-12 00:03   29984   ----a-w-   c:\program files\ScanSoft\PaperPort\pptd40nt.exe

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PPort11reminder]
                2007-08-31 14:01   328992   ----a-w-   c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
                2009-05-26 22:18   413696   ----a-w-   c:\program files\QuickTime\QTTask.exe

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RivaTunerStartupDaemon]
                2008-12-29 08:30   24576   ----a-w-   c:\program files\RivaTuner v2.22\RivaTunerWrapper.exe

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
                2006-10-25 14:03   210472   ----a-w-   c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
                2009-10-30 18:13   1217808   ----a-w-   c:\program files\Steam\Steam.exe

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
                2009-03-09 10:19   148888   ----a-w-   c:\program files\Java\jre6\bin\jusched.exe

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
                2009-04-10 03:57   198160   ----a-w-   c:\program files\Common Files\Real\Update_OB\realsched.exe

                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VMware hqtray]
                2009-03-27 03:57   64048   ----a-w-   c:\program files\VMware\VMware Player\hqtray.exe

                [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
                "DisableMonitoring"=dword:00000001

                R0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys

                R2 CSHelper;CopySafe Helper Service;c:\windows\system32\CSHelper.exe [2009-02-15 266240]
                R3 COMMONFX.SYS;COMMONFX.SYS;c:\windows\System32\drivers\COMMONFX.SYS [2009-06-23 99352]
                R3 COMMONFX;COMMONFX;c:\windows\system32\drivers\COMMONFX.SYS [2009-06-23 99352]
                R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2009-09-19 79360]
                R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2009-09-19 79360]
                R3 CTAUDFX.SYS;CTAUDFX.SYS;c:\windows\System32\drivers\CTAUDFX.SYS [2009-06-23 555032]
                R3 CTAUDFX;CTAUDFX;c:\windows\system32\drivers\CTAUDFX.SYS [2009-06-23 555032]
                R3 CTERFXFX.SYS;CTERFXFX.SYS;c:\windows\System32\drivers\CTERFXFX.SYS [2009-06-23 100888]
                R3 CTERFXFX;CTERFXFX;c:\windows\system32\drivers\CTERFXFX.SYS [2009-06-23 100888]
                R3 CTSBLFX.SYS;CTSBLFX.SYS;c:\windows\System32\drivers\CTSBLFX.SYS [2009-06-23 566296]
                R3 CTSBLFX;CTSBLFX;c:\windows\system32\drivers\CTSBLFX.SYS [2009-06-23 566296]
                R3 MEMSWEEP2;MEMSWEEP2;c:\windows\system32\270.tmp

                R3 RTTEAMPT;Realtek Teaming Protocol Driver (NDIS 6.0);c:\windows\system32\DRIVERS\RtTeam60.sys [2007-12-04 33792]
                R3 RTVLANPT;Realtek Vlan Protocol Driver (NDIS 6.0);c:\windows\system32\DRIVERS\RtVlan60.sys [2007-12-03 19968]
                R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2010-02-17 12872]
                R3 TEAM;Realtek Virtual Miniport Driver for Teaming (NDIS 6.0);c:\windows\system32\DRIVERS\RtTeam60.sys [2007-12-04 33792]
                R3 V0500Dev;Dynex 1.3MP Webcam Driver;c:\windows\system32\DRIVERS\V0500Vid.sys [2008-03-19 251264]
                R3 VirtualDK;VirtualDK;c:\users\Administrator\Desktop\usb_prep8\vdk.sys [2003-11-10 16283]
                R4 BOHCI;BOHCI;

                R4 BUHCI;BUHCI;

                R4 BUSBD;BUSBD;

                R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-01-19 717296]
                S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-10-15 36880]
                S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2010-04-13 21520]
                S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]
                S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-02-17 66632]
                S2 ASTRA32;ASTRA32 Kernel Driver 5.2.1.0;c:\program files\ASTRA32\ASTRA32.sys [2007-02-22 30864]
                S2 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Professional Home XII.SP2c\RpcAgentSrv.exe [2008-04-24 98488]
                S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2009-09-27 240232]
                S2 vmci;VMware vmci;c:\windows\system32\Drivers\vmci.sys [2009-03-27 54960]
                S2 WinRing0_1_2_0;WinRing0_1_2_0;c:\users\Administrator\AppData\Local\Microsoft\Windows Sidebar\Gadgets\IntelCoreSeries24.gadget\WinRing0.sys [2010-03-19 14416]
                S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-10-03 19472]
                S3 pnetmdm;PdaNet Modem;c:\windows\system32\DRIVERS\pnetmdm.sys [2006-09-28 9472]
                S3 TotRec7;Total Recorder WDM audio driver;c:\windows\system32\drivers\TotRec7.sys [2008-04-17 120472]

                .
                Contents of the 'Scheduled Tasks' folder

                2010-04-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2956117359-1545118147-3684891927-500Core.job
                - c:\users\Administrator\AppData\Local\Google\Update\GoogleUpdate.exe [2009-04-24 01:29]

                2010-04-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2956117359-1545118147-3684891927-500UA.job
                - c:\users\Administrator\AppData\Local\Google\Update\GoogleUpdate.exe [2009-04-24 01:29]
                .
                .
                ------- Supplementary Scan -------
                .
                IE: Add to Anti-Banner - c:\program files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
                IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
                IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
                IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
                IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
                IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
                LSP: c:\program files\VMware\VMware Player\vsocklib.dll
                DPF: {7557F5AA-D486-401D-BE55-0163FA78B5B8} - hxxps://skyfex.com/download/SkyFexExpert.cab
                FF - ProfilePath - c:\users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\k8nxc5os.default\
                FF - component: c:\program files\Mozilla *Blocked Russian URL*\components\KavLinkFilter.dll
                FF - plugin: c:\progra~1\Palm\PACKAG~1\NPInstal.dll
                FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
                FF - plugin: c:\program files\Mozilla Firefox\plugins\npArtistScope42.dll
                FF - plugin: c:\users\Administrator\AppData\Local\Google\Update\1.2.183.23\npGoogleOneClick8.dll
                FF - plugin: c:\users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\k8nxc5os.default\extensions\[email protected]\plugins\npLogitechDeviceDetection.dll
                FF - plugin: c:\users\Administrator\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
                FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

                ---- FIREFOX POLICIES ----
                c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
                c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
                c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
                c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut. enabled", true);
                c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
                c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency",   1600);
                c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
                c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
                c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
                c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug",            false);
                c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight",       2);
                c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize",       1);
                c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
                c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
                c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight",   25);
                c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight",     5);
                c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
                c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_ everywhere__temporarily_available_pref", true);
                c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
                c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_a s_broken", false);
                c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
                c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
                c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
                c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugi n", false);
                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
                .
                - - - - ORPHANS REMOVED - - - -

                SafeBoot-klmdb.sys
                MSConfigStartUp-Ad-Watch - c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
                MSConfigStartUp-DAEMON Tools Lite - c:\program files\DAEMON Tools Lite\daemon.exe
                MSConfigStartUp-FireflyShell - c:\program files\Firefly Media Server\FireflyShell.exe
                MSConfigStartUp-HotSync - c:\program files\PalmSource\Desktop\HotSync.exe
                MSConfigStartUp-NVIDIA nTune - c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe
                AddRemove-BugOff - g:\malware\Utilities\Merijn Tools\BugOff\BugOff.exe
                AddRemove-HijackThis - c:\program files\Trend Micro\HijackThis\HijackThis.exe
                AddRemove-InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1} - c:\program files\InstallShield Installation Information\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}\setup.exe
                AddRemove-InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE} - c:\program files\InstallShield Installation Information\{D36DD326-7280-11D8-97C8-000129760CBE}\Setup.exe



                **************************************************************************

                catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                Rootkit scan 2010-04-17 11:28
                Windows 6.0.6001 Service Pack 1 NTFS

                scanning hidden processes ... 

                scanning hidden autostart entries ...

                scanning hidden files ... 

                scan completed successfully
                hidden files: 0

                **************************************************************************

                Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

                device: opened successfully
                user: MBR read successfully
                called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll >>UNKNOWN [0x8F466AC8]<<
                kernel: MBR read successfully
                detected MBR rootkit hooks:
                \Driver\Disk -> CLASSPNP.SYS @ 0x870ba322
                \Driver\ACPI -> acpi.sys @ 0x86a45d4c
                \Driver\atapi -> ataport.SYS @ 0x86b549a8
                IoDeviceObjectType ->\Device\Harddisk0\DR0 ->user & kernel MBR OK

                **************************************************************************

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MEMSWEEP2]
                "ImagePath"="\??\c:\windows\system32\270.tmp"
                .
                --------------------- LOCKED REGISTRY KEYS ---------------------

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Internet Explorer\User Preferences]
                @Denied: (2) (Administrator)
                "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5 977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
                   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,2d,5c,86,71,22,16,7a,47,80,54,0e,\
                "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839 E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
                   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,2d,5c,86,71,22,16,7a,47,80,54,0e,\

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="WMP11.AssocFile.AIFF"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="WMP11.AssocFile.AIFF"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="WMP11.AssocFile.AIFF"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="WMP11.AssocFile.ASF"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="WMP11.AssocFile.ASX"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="WMP11.AssocFile.AU"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cda\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="WMP11.AssocFile.CDA"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="FirefoxHTML"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="FirefoxHTML"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="WMP11.AssocFile.MPEG"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="WMP11.AssocFile.MPEG"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="WMP11.AssocFile.M3U"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="IE.AssocFile.MHT"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="IE.AssocFile.MHT"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="WMP11.AssocFile.MIDI"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="WMP11.AssocFile.MIDI"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="WMP11.AssocFile.MPEG"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="WMP11.AssocFile.MPEG"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="WMP11.AssocFile.MPEG"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="Applications\\vlc.exe"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="WMP11.AssocFile.MPEG"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="WMP11.AssocFile.MPEG"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="WMP11.AssocFile.MPEG"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="WMP11.AssocFile.MPEG"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="WMP11.AssocFile.MPEG"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="Applications\\AcroRd32.exe"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.plist\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="Applications\\pledit.exe"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="WMP11.AssocFile.MIDI"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="FirefoxHTML"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="WMP11.AssocFile.AU"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.url\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="IE.AssocFile.URL"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wax\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="WMP11.AssocFile.WAX"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="WMP11.AssocFile.ASF"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="WMP11.AssocFile.WMA"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmd\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="WMP11.AssocFile.WMD"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wms\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="WMP11.AssocFile.WMS"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="WMP11.AssocFile.WMV"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmx\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="WMP11.AssocFile.ASX"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmz\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="WMP11.AssocFile.WMZ"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="WMP11.AssocFile.WPL"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="WMP11.AssocFile.WVX"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="FirefoxHTML"

                [HKEY_USERS\S-1-5-21-2956117359-1545118147-3684891927-500\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
                @Denied: (2) (Administrator)
                "Progid"="FirefoxHTML"

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
                @Denied: (A) (Users)
                @Denied: (A) (Everyone)
                @Allowed: (B 1 2 3 4 5) (S-1-5-20)
                "BlindDial"=dword:00000000

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
                @Denied: (A) (Users)
                @Denied: (A) (Everyone)
                @Allowed: (B 1 2 3 4 5) (S-1-5-20)
                "BlindDial"=dword:00000000

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
                @Denied: (A) (Users)
                @Denied: (A) (Everyone)
                @Allowed: (B 1 2 3 4 5) (S-1-5-20)
                "BlindDial"=dword:00000000

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
                @Denied: (A) (Users)
                @Denied: (A) (Everyone)
                @Allowed: (B 1 2 3 4 5) (S-1-5-20)
                "BlindDial"=dword:00000000

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
                @Denied: (A) (Users)
                @Denied: (A) (Everyone)
                @Allowed: (B 1 2 3 4 5) (S-1-5-20)
                "BlindDial"=dword:00000000

                [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
                @Denied: (A) (Users)
                @Denied: (A) (Everyone)
                @Allowed: (B 1 2 3 4 5) (S-1-5-20)
                "BlindDial"=dword:00000000
                .
                Completion time: 2010-04-17  11:32:26
                ComboFix-quarantined-files.txt  2010-04-17 16:32

                Pre-Run: 186,785,914,880 bytes free
                Post-Run: 186,789,507,072 bytes free

                - - End Of File - - 6386249BB3B4BA933A3A9BFA214C2DD3
                « Last Edit: April 17, 2010, 10:37:55 AM by pancakejohn »
                Logged

                SuperDave

                • Malware Removal Specialist


                  • Genius
                  • Thanked: 1020
                • Certifications: List
                • Experience: Expert
                • OS: Windows 10
                Re: Rootkit.Win32.TDSS.d on Vista
                « Reply #13 on: April 17, 2010, 05:22:37 PM »
                Looking over your log it seems you don't have any antivirus software.

                Before we continue download and install a free antivirus.

                Remember to only install one antivirus!
                 
                1) Avast! Home Edition
                2) AVG Free Edition
                3) Avira AntiVir Personal
                4) Microsoft Security Essentials for Windows Vista\Windows 7 - 64 bit Download
                4-a) Microsoft Security Essentials for Windows XP
                5) Comodo Antivirus (Uncheck during installation "Install Comodo SafeSurf..", Make Comodo my default search provider" and "Make Comodo Search my homepage" if you choose this one)
                6) PC Tools AntiVirus Free Edition

                It is strongly recommended that you run only one antivirus program at a time. Having more than one antivirus program active in memory uses additional resources and can result in program conflicts and false virus alerts. If you choose to install more than one antivirus program on your computer, then only one of them should be active in memory at a time.

                ===============================
                P2P - I see you have P2P software installed on your machine. (uTorrent) We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It is certainly contributing to your current situation.

                Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

                I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.
                ================================
                Please go to Jotti's malware scan
                (If more than one file needs scanned they must be done separately and logs posted for each one)

                * Copy the file path in the below Code box:

                Code: [Select]
                C:\CF21711C
                C:\CF14740C
                C:\CF26000C
                C:\CF
                * At the upload site, click once inside the window next to Browse.
                * Press Ctrl+V on the keyboard (both at the same time) to paste the file path into the window.
                * Next click Submit file
                * Your file will possibly be entered into a queue which normally takes less than a minute to clear.
                * This will perform a scan across multiple different virus scanning engines.
                * Important: Wait for all of the scanning engines to complete.
                * Once the scan is finished, Copy and then Paste the link in the address bar into your next reply.

                ================================

                Logged
                Windows 8 and Windows 10 dual boot with two SSD's

                pancakejohn

                  Topic Starter


                  Beginner

                  Re: Rootkit.Win32.TDSS.d on Vista
                  « Reply #14 on: April 17, 2010, 06:10:23 PM »
                  I already have antivirus software. I have Kaspersky Internet Security 2010.

                  Those paths you gave to upload at Jotti's malware scan are directories, not files. Is there a way to scan entire directories using Jotti's malware scan? It would take forever to upload each file in each directory and subdirectory, one at a time. (There are 1,031 files in those 4 directories)
                  « Last Edit: April 17, 2010, 06:25:56 PM by pancakejohn »
                  Logged
                  Pages: [1] 2 3 ... 9   Go Up
                  « previous next »