Login | Live Chat & Podcast at 1:00PM Eastern on Sunday! |
 Search | |
| |
18-Feb-2010, 11:37 PM
#1 | ||||||
| Computer possible infected with sdra64.exe virus |
| |
04-Mar-2010, 02:03 AM
#6 | |||||
| Hello there  Welcome to the TSG Forums. My name is NeonFx. I'll be glad to help you with your computer problems. Logs can take some time to research, so please be patient with me. Please note the following:
Sorry for taking so long to get to you. Step 1 Download OTS to your Desktop
Code: %SYSTEMDRIVE%\*.exe /md5start eventlog.dll scecli.dll netlogon.dll cngaudit.dll sceclt.dll ntelogon.dll logevent.dll iaStor.sys nvstor.sys atapi.sys IdeChnDr.sys viasraid.sys AGP440.sys vaxscsi.sys nvatabus.sys viamraid.sys nvata.sys nvgts.sys iastorv.sys ViPrt.sys eNetHook.dll ahcix86.sys KR10N.sys nvstor32.sys ahcix86s.sys nvrd32.sys symmpi.sys adp3132.sys mv61xx.sys /md5stop %systemroot%\*. /mp /s CREATERESTOREPOINT %systemroot%\system32\*.dll /lockedfiles %systemroot%\Tasks\*.job /lockedfiles %systemroot%\system32\drivers\*.sys /lockedfiles %systemroot%\System32\config\*.sav
Please attach the log in your next post. To do so click on the blue "Reply" button or "Go Advanced" and click on the "Manage Attachments" button Step 2  GMER Rootkit Scanner Please download GMER from one of the following locations and save it to your desktop:
__________________ Please post the final results, good or bad. Let me know if you won't be responding any longer. Please don't send me requests for help. Use the forums instead. |
04-Mar-2010, 11:25 PM
#11 | ||||||
| Here is the combofix txt: ComboFix 10-03-02.08 - Chaddrick Johnson 03/03/2010 11:14:07.7.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.502.94 [GMT -5:00] Running from: c:\documents and settings\Chaddrick Johnson\Desktop\ComboFix.exe AV: BitDefender Antivirus *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\AegisP.inf . ((((((((((((((((((((((((( Files Created from 2010-02-03 to 2010-03-03 ))))))))))))))))))))))))))))))) . 2010-02-19 03:06 . 2010-02-19 03:06 -------- d-----w- c:\documents and settings\Chaddrick Johnson\Application Data\Windows Search 2010-02-05 04:21 . 2010-02-05 04:21 -------- d-sh--w- c:\documents and settings\Guest\PrivacIE 2010-02-05 03:58 . 2010-02-05 03:58 -------- d-----w- c:\documents and settings\Guest\Local Settings\Application Data\Google 2010-02-05 03:57 . 2010-02-05 03:57 -------- d-----w- c:\documents and settings\Guest\Application Data\Windows Desktop Search 2010-02-05 03:56 . 2010-02-05 03:56 -------- d-----w- c:\documents and settings\Guest\Application Data\BitDefender 2010-02-05 03:14 . 2010-02-05 03:14 -------- d-----w- c:\program files\Microsoft Office Outlook Connector 2010-02-05 03:12 . 2010-02-05 03:12 -------- d-----w- c:\program files\Windows Live SkyDrive 2010-02-04 07:37 . 2010-02-04 07:37 -------- d-----w- c:\program files\Common Files\Windows Live 2010-02-04 06:02 . 2010-02-04 06:36 -------- dc-h--w- c:\windows\ie8 2010-02-04 05:06 . 2010-02-05 03:12 -------- d-----w- c:\program files\Microsoft 2010-02-04 04:08 . 2010-02-04 04:09 -------- d-----w- c:\windows\system32\XPSViewer 2010-02-04 04:06 . 2010-02-04 04:06 -------- d-----w- c:\program files\MSBuild 2010-02-04 04:04 . 2010-02-04 04:04 -------- d-----w- c:\program files\Reference Assemblies 2010-02-04 03:58 . 2008-07-06 12:06 89088 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll 2010-02-04 03:54 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll 2010-02-04 03:54 . 2008-07-06 12:06 89088 ------w- c:\windows\system32\dllcache\filterpipelineprintproc.dll 2010-02-04 03:54 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe 2010-02-04 03:54 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe 2010-02-04 03:54 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll 2010-02-04 03:54 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\dllcache\xpsshhdr.dll 2010-02-04 03:54 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll 2010-02-04 03:54 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\dllcache\xpssvcs.dll 2010-02-04 03:54 . 2010-02-04 03:59 -------- d-----w- C:\a38af7b2ade0444f90610445 2010-02-04 03:27 . 2010-02-04 05:57 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe 2010-02-04 03:20 . 2010-02-04 03:20 -------- d-----w- c:\documents and settings\Chaddrick Johnson\Application Data\Windows Desktop Search 2010-02-04 03:18 . 2010-02-05 09:18 -------- d-----w- c:\program files\Windows Desktop Search 2010-02-04 03:15 . 2008-03-07 17:02 29696 ------w- c:\windows\system32\dllcache\mimefilt.dll 2010-02-04 03:15 . 2008-03-07 17:02 98304 ------w- c:\windows\system32\dllcache\nlhtml.dll 2010-02-04 03:15 . 2008-03-07 17:02 192000 ------w- c:\windows\system32\dllcache\offfilt.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-02-09 23:44 . 2009-12-07 23:49 106464 ----a-w- c:\windows\system32\drivers\bdhv.sys 2010-02-09 23:44 . 2009-12-07 23:46 153448 ----a-w- c:\windows\system32\drivers\bdfm.sys 2010-02-04 07:36 . 2006-05-03 03:26 70560 -c--a-w- c:\documents and settings\Chaddrick Johnson\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2010-01-31 22:16 . 2010-01-31 05:24 132 ----a-w- c:\windows\system32\rezumatenoi.dat 2010-01-31 05:03 . 2010-01-31 05:03 0 ----a-w- C:\pcwords2.dat 2010-01-31 05:03 . 2010-01-31 05:03 0 ----a-w- C:\pcwords.dat 2010-01-31 04:54 . 2010-01-31 04:49 -------- d-----w- c:\documents and settings\All Users\Application Data\BitDefender 2010-01-31 04:51 . 2010-01-31 04:49 -------- d-----w- c:\documents and settings\Chaddrick Johnson\Application Data\BitDefender 2010-01-31 04:50 . 2010-01-31 04:22 -------- d-----w- c:\program files\Common Files\BitDefender 2010-01-31 04:49 . 2010-01-31 04:49 -------- d-----w- c:\program files\BitDefender 2010-01-31 04:39 . 2008-05-25 00:00 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee 2010-01-22 22:33 . 2008-12-07 14:30 -------- d-----w- c:\program files\Microsoft Silverlight 2010-01-14 02:11 . 2010-01-14 02:08 -------- d-----w- c:\documents and settings\Guest\Application Data\Canon 2010-01-14 02:10 . 2010-01-14 02:10 -------- d--h--w- c:\documents and settings\All Users\Application Data\CanonIJScan 2010-01-01 15:57 . 2009-10-02 04:09 54116 ---ha-w- c:\windows\system32\mlfcache.dat 2009-12-31 16:50 . 2006-04-28 12:47 353792 ----a-w- c:\windows\system32\drivers\srv.sys 2009-12-21 19:14 . 2004-08-11 22:00 916480 ----a-w- c:\windows\system32\wininet.dll 2009-12-16 18:43 . 2004-08-11 22:11 343040 ----a-w- c:\windows\system32\mspaint.exe 2009-12-14 07:08 . 2004-08-11 22:00 33280 ----a-w- c:\windows\system32\csrsrv.dll 2009-12-14 01:26 . 2009-12-14 01:26 127325 ----a-w- c:\documents and settings\Chaddrick Johnson\Application Data\Move Networks\uninstall.exe 2009-12-14 01:26 . 2009-08-13 19:21 4187512 ----a-w- c:\documents and settings\Chaddrick Johnson\Application Data\Move Networks\plugins\npqmp071505000011.dll 2009-12-08 19:26 . 2004-08-11 22:00 2145280 ----a-w- c:\windows\system32\ntoskrnl.exe 2009-12-08 18:43 . 2004-08-04 03:59 2023936 ----a-w- c:\windows\system32\ntkrnlpa.exe 2009-12-04 18:22 . 2006-04-28 12:47 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys 2009-11-29 22:22 . 2006-05-07 05:11 88 --sh--r- c:\windows\system32\C37E08EF72.sys 2009-11-29 22:23 . 2006-05-07 05:11 6580 --sha-w- c:\windows\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2008-10-09 333120] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-29 761947] "CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2008-03-18 1848648] "CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2008-12-12 722256] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-11 417792] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600] "BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2010\IEShow.exe" [2009-10-19 71152] "BDAgent"="c:\program files\BitDefender\BitDefender 2010\bdagent.exe" [2010-01-31 1120704] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-4-28 24576] Service Manager.lnk - c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2005-5-3 81920] Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\Shell ExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ lsdelete [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawser vice] @="Service" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Chaddrick Johnson^Start Menu^Programs^Startup^Scheduler.lnk] path=c:\documents and settings\Chaddrick Johnson\Start Menu\Programs\Startup\Scheduler.lnk backup=c:\windows\pss\Scheduler.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier] 2009-08-13 19:51 177440 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla] 2005-05-31 09:33 122941 ----a-w- c:\windows\system32\dla\tfswctrl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] 2009-11-12 21:33 141600 ----a-w- c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2009-11-11 04:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp] 2005-11-17 02:35 397312 ----a-w- c:\windows\stsystra.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\Auth orizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Azureus\\Azureus.exe"= "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\StubInstaller.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [1/11/2009 7:35 PM 28544] R3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [12/7/2009 6:46 PM 153448] S2 apjcfmuixdjjexx;apjcfmuixdjjexx;\??\c:\windows\system32\drivers\khpjzg.sys --> c:\windows\system32\drivers\khpjzg.sys [?] S2 DellBIOS;DellBIOS;\??\c:\windows\DellBIOS.Sys --> c:\windows\DellBIOS.Sys [?] S3 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe [10/19/2009 4:06 PM 183880] --- Other Services/Drivers In Memory --- *NewlyCreated* - 5ECB38E0 *Deregistered* - 5ecb38e0 [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bdx REG_MULTI_SZ scan . Contents of the 'Scheduled Tasks' folder 2009-12-31 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34] . . ------- Supplementary Scan ------- . uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uStart Page = hxxp://northernvirginia.cox.net/cci/home uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com Trusted Zone: musicmatch.com\online FF - ProfilePath - c:\documents and settings\Chaddrick Johnson\Application Data\Mozilla\Firefox\Profiles\ogs28x6e.default\ FF - prefs.js: browser.search.selectedEngine - Ask.com FF - prefs.js: browser.startup.homepage - hxxp://en-US.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US  fficialFF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q= FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ . - - - - ORPHANS REMOVED - - - - HKLM-Run-Easy Dock - (no file) SafeBoot-mcmscsvc SafeBoot-MCODS MSConfigStartUp-Yahoo! Pager - c:\program files\Yahoo!\Messenger\YahooMessenger.exe AddRemove-WebCyberCoach_wtrb - c:\program files\WebCyberCoach\b_Dell\WCC_Wipe.exe WebCyberCoach ext\wtrb ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-03-03 11:25 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(936) c:\windows\system32\igfxdev.dll . Completion time: 2010-03-03 11:33:03 ComboFix-quarantined-files.txt 2010-03-03 16:32 ComboFix2.txt 2009-01-12 00:22 Pre-Run: 2,410,102,784 bytes free Post-Run: 2,564,898,816 bytes free - - End Of File - - AF91D70085796C7B15C0A4F44BAE2846 |
05-Mar-2010, 01:00 AM
#14 | |||||
| Try the following instead: Download RootRepeal from one of the following locations and save it to your desktop: Link 1
If the report is not too long, post the contents of RootRepeal.txt in your next reply. If the report is very long, it will not be complete if you post it, so please attach it to your reply instead.
__________________ Please post the final results, good or bad. Let me know if you won't be responding any longer. Please don't send me requests for help. Use the forums instead. |
 |
| |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
| You Are Using:  |
Advertisements do not imply our endorsement of that product or service. All times are GMT -4. The time now is 10:25 PM. Copyright © 1996 - 2011 TechGuy, Inc. All rights reserved. |  |
to start the program
button
button and save the report to your Desktop as RootRepeal.txt
Facebook
Twitter
TechGuy.tv
TSG Mobile