Troj/Rustok-N - Have read other posts and still need some he

View previous topic View next topic Go down

Solved Troj/Rustok-N - Have read other posts and still need some help

Post by RPal129 on Thu Jan 01, 2009 9:19 pm

Hello, like another person posting right now I am having the same issues with the Troj/Rustok-N trojan. I have run spybot s&d, mbam, symantec antivirus, tons of stuff and i am not finding anything. Below is my HijackThis log. Please help me if you can. Thank you very much for you help.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:16:33 PM, on 1/1/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\sstray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\Program Files\AIM6\aim6.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe
C:\Documents and Settings\Jas\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "D:\AIM\\DeadAIM.ocm",ExportedCheckODLs
O4 - HKLM\..\Run: [BlackBerryAutoUpdate] C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe /background
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US [You must be registered and logged in to see this link.]
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Jas\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Convert link target to Adobe PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\AIM\aim.exe
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - [You must be registered and logged in to see this link.]
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - [You must be registered and logged in to see this link.]
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {F5D98C43-DB16-11CF-8ECA-0000C0FD59C7} (ActiveCGM Control) - [You must be registered and logged in to see this link.]
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--
End of file - 10357 bytes

RPal129
Novice
Novice

Posts Posts : 18
Joined Joined : 2009-01-01
OS OS : Windows XP Professional
Points Points : 28950
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Troj/Rustok-N - Have read other posts and still need some he

Post by RPal129 on Thu Jan 01, 2009 9:24 pm

Uninstall List Also
Ad-Aware
Adobe Acrobat 7.0 Professional
Adobe Flash Player 10 Plugin
Adobe Flash Player ActiveX
Adobe Photoshop 7.0
Adobe Reader 8
Adobe Shockwave Player
Age of Empires III
Age of Empires III - The WarChiefs
Age of Mythology
Age of Mythology - The Titans Expansion
AIM 6
AOL Instant Messenger
AsusUpdate
AviSynth 2.5
Azureus
Becker CPA Review CD-ROM Course and PassMaster - 2008 Edition
BlackBerry Desktop Software 4.7
BlackBerry Desktop Software 4.7
blueMSX
Bodog Poker Version 2.8.0.41
BS.Player PRO
CCleaner (remove only)
Chronic 2005 v1.2.1
Civilization III
Combined Community Codec Pack 2007-07-22
COMODO Firewall Pro
Compatibility Pack for the 2007 Office system
Creative DVD Audio Plugin for Audigy Series
Day of Defeat: Source
Daycare Nightmare
DeadAIM
DJ ToneXpress 4.5.1
Excel OM 2
Fable - The Lost Chapters
FLV Player
Game Elements PC Recoil Pad
Gleim's CPA Test Prep 2008 2008 WebDeploy
Gold Miner Special Edition
Gold Miner Vegas
Google Earth
Grand Theft Auto Vice City
GTA San Andreas
GTAIII
Half-Life 2: CTF 1.7
Half-Life(R) 2
Hidden Expedition Titanic (remove only)
HijackThis 2.0.2
Hometown Hero
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
InterVideo WinDVD 7
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Java(TM) 6 Update 2
Java(TM) 6 Update 3
Java(TM) 6 Update 5
Java(TM) 6 Update 7
Java(TM) SE Runtime Environment 6 Update 1
Jeopardy! 2003
Kazaa Lite K++ v2.4.3
Lexmark Z54
LIVE gaming on Windows Runtime Version 1.0.6027
LiveUpdate 2.7 (Symantec Corporation)
LOTR The Return of the King tm
Magic ISO Maker v5.5 (build 0261)
Malwarebytes' Anti-Malware
Marvell Miniport Driver
Max Payne
Metal Gear Solid
MetalGearSolid2 Substance
Microsoft .NET Framework 1.1
Microsoft .NET Framework 2.0
Microsoft Age of Empires Gold
Microsoft Age of Empires II
Microsoft Age of Empires II: The Conquerors Expansion
Microsoft Halo
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office XP Professional with FrontPage
Microsoft Rise Of Nations
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (3.0.5)
MSXML 4.0 SP2 Parser and SDK
MSXML 6.0 Parser (KB933579)
MSXML4 Parser
Mummy Maze Deluxe 1.1
Need For Speed Underground
Need for Speed Underground 2
NVIDIA Drivers
NVIDIA System Utility
Plan of Attack
PokerStars
POM for Windows (Version 3)
QuickTime
Registry Mechanic 7.0
Ringtone Media Studio
Rise of Nations Thrones and Patriots
Risk (remove only)
Risk II
Roxio Media Manager
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905749)
Sid Meier's Civilization 4
SimCity 4
Sophos Anti-Rootkit 1.3.1
Spybot - Search & Destroy
Spybot - Search & Destroy 1.4
Star Wars Battlefront
Steam(TM)
StyleXP (remove only)
SUPERAntiSpyware Free Edition
Symantec AntiVirus
Team Fortress 2
The Rosetta Stone
The Sims 2
The Sims 2 University
The Sims™ 2 Seasons
The Weather Channel Desktop 6
Thief 2
TrackMania Nations ESWC - Update 2
True Sword 5
Update for Windows XP (KB898461)
Update for Windows XP (KB904942)
Winamp (remove only)
Windows Genuine Advantage v1.3.0254.0
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Format 9 Series SDK
Windows Media Format Runtime
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB905915
Windows XP Service Pack 2
WinRAR archiver

RPal129
Novice
Novice

Posts Posts : 18
Joined Joined : 2009-01-01
OS OS : Windows XP Professional
Points Points : 28950
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Troj/Rustok-N - Have read other posts and still need some he

Post by Belahzur on Thu Jan 01, 2009 9:43 pm

Hello.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs if present.

  • J2SE Runtime Environment 5.0 Update 10
  • J2SE Runtime Environment 5.0 Update 11
  • J2SE Runtime Environment 5.0 Update 6
  • J2SE Runtime Environment 5.0 Update 9
  • Java(TM) 6 Update 2
  • Java(TM) 6 Update 3
  • Java(TM) 6 Update 5
  • Java(TM) 6 Update 7
  • Java(TM) SE Runtime Environment 6 Update 1



  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245059
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Troj/Rustok-N - Have read other posts and still need some he

Post by RPal129 on Thu Jan 01, 2009 10:09 pm

Thank you so much for such a quick response. MBAM was clean. I uninstalled those files. Here is the log

Malwarebytes' Anti-Malware 1.31
Database version: 1590
Windows 5.1.2600 Service Pack 2

1/1/2009 4:09:47 PM
mbam-log-2009-01-01 (16-09-47).txt

Scan type: Quick Scan
Objects scanned: 57845
Time elapsed: 4 minute(s), 27 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

RPal129
Novice
Novice

Posts Posts : 18
Joined Joined : 2009-01-01
OS OS : Windows XP Professional
Points Points : 28950
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Troj/Rustok-N - Have read other posts and still need some he

Post by Belahzur on Thu Jan 01, 2009 10:14 pm

Looks okay.


  • Please download DDS by sUBs to your Desktop (Important!!) from one of these locations:
    [You must be registered and logged in to see this link.]
    [You must be registered and logged in to see this link.]
    [You must be registered and logged in to see this link.]
  • Double click DDS.scr to run
  • When complete, DDS.txt will open.
  • Click No for Optional Scan.
  • Save the report to your Desktop.
  • Copy and paste the report back here.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245059
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Troj/Rustok-N - Have read other posts and still need some he

Post by RPal129 on Fri Jan 02, 2009 10:55 pm

Ok. I had to run to the suburbs but I will do that as soon as I get back later this evening.

RPal129
Novice
Novice

Posts Posts : 18
Joined Joined : 2009-01-01
OS OS : Windows XP Professional
Points Points : 28950
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Troj/Rustok-N - Have read other posts and still need some he

Post by RPal129 on Sat Jan 03, 2009 8:38 am

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Version 1.0)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 12/30/2005 2:07:50 AM
System Uptime: 1/3/2009 2:23:49 AM (0 hours ago)

Motherboard: ASUSTeK Computer INC. | | A7N8X-E
Processor: AMD Athlon(tm) XP 2800+ | Socket A | 2079/166mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 93 GiB total, 21.909 GiB free.
D: is FIXED (NTFS) - 75 GiB total, 10.562 GiB free.
E: is FIXED (NTFS) - 153 GiB total, 7.79 GiB free.
F: is CDROM ()
G: is CDROM ()
H: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: NVIDIA nForce MCP Networking Controller
Device ID: PCI\VEN_10DE&DEV_0066&SUBSYS_80A71043&REV_A1\3&13C0B0C5&0&20
Manufacturer: Nvidia
Name: NVIDIA nForce MCP Networking Controller
PNP Device ID: PCI\VEN_10DE&DEV_0066&SUBSYS_80A71043&REV_A1\3&13C0B0C5&0&20
Service: NVENET

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Marvell Yukon Gigabit Ethernet 10/100/1000Base-T Adapter, Copper RJ-45
Device ID: PCI\VEN_11AB&DEV_4320&SUBSYS_811A1043&REV_13\4&3B1D9AB8&0&2040
Manufacturer: Marvell
Name: Marvell Yukon Gigabit Ethernet 10/100/1000Base-T Adapter, Copper RJ-45
PNP Device ID: PCI\VEN_11AB&DEV_4320&SUBSYS_811A1043&REV_13\4&3B1D9AB8&0&2040
Service: yukonwxp

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: RAID Controller
Device ID: PCI\VEN_1095&DEV_3112&SUBSYS_809D1043&REV_02\4&3B1D9AB8&0&5840
Manufacturer:
Name: RAID Controller
PNP Device ID: PCI\VEN_1095&DEV_3112&SUBSYS_809D1043&REV_02\4&3B1D9AB8&0&5840
Service:

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: 1394 Net Adapter
Device ID: V1394\NIC1394\6FC5BFE01800
Manufacturer: Microsoft
Name: 1394 Net Adapter
PNP Device ID: V1394\NIC1394\6FC5BFE01800
Service: NIC1394

Class GUID: {4D36E97B-E325-11CE-BFC1-08002BE10318}
Description: HPT302 UDMA/ATA133 Controller
Device ID: ROOT\SCSIADAPTER\0000
Manufacturer: HighPoint
Name: HPT302 UDMA/ATA133 Controller
PNP Device ID: ROOT\SCSIADAPTER\0000
Service: HPT302

==== System Restore Points ===================

RP942: 10/3/2008 9:49:41 PM - System Checkpoint
RP943: 10/4/2008 10:40:08 PM - System Checkpoint
RP944: 10/5/2008 11:44:19 PM - System Checkpoint
RP945: 10/7/2008 5:52:10 PM - System Checkpoint
RP946: 10/8/2008 6:09:19 PM - System Checkpoint
RP947: 10/9/2008 7:29:43 PM - System Checkpoint
RP948: 10/10/2008 7:35:54 PM - System Checkpoint
RP949: 10/12/2008 10:58:03 PM - System Checkpoint
RP950: 10/13/2008 11:02:44 PM - System Checkpoint
RP951: 10/15/2008 12:02:57 AM - System Checkpoint
RP952: 10/16/2008 6:57:49 PM - System Checkpoint
RP953: 10/19/2008 4:50:32 PM - System Checkpoint
RP954: 10/20/2008 5:15:07 PM - Removed Google Gears
RP955: 10/21/2008 5:53:38 PM - System Checkpoint
RP956: 10/22/2008 6:59:38 PM - System Checkpoint
RP957: 10/23/2008 7:34:05 PM - System Checkpoint
RP958: 10/26/2008 4:21:37 PM - System Checkpoint
RP959: 10/27/2008 7:16:14 PM - System Checkpoint
RP960: 10/28/2008 7:52:09 PM - System Checkpoint
RP961: 10/29/2008 6:45:18 PM - Made by Registry Mechanic O
RP962: 10/30/2008 7:01:53 PM - System Checkpoint
RP963: 10/31/2008 7:45:59 PM - System Checkpoint
RP964: 11/1/2008 8:28:47 PM - System Checkpoint
RP965: 11/2/2008 8:38:02 PM - System Checkpoint
RP966: 11/3/2008 8:49:45 PM - System Checkpoint
RP967: 11/4/2008 9:09:36 PM - System Checkpoint
RP968: 11/5/2008 9:39:33 PM - System Checkpoint
RP969: 11/6/2008 9:44:36 PM - System Checkpoint
RP970: 11/7/2008 9:52:50 PM - System Checkpoint
RP971: 11/8/2008 10:41:21 PM - System Checkpoint
RP972: 11/10/2008 12:24:19 AM - Installed SUPERAntiSpyware Free Edition
RP973: 11/10/2008 4:56:48 PM - ComboFix created restore point
RP974: 11/11/2008 5:48:53 PM - System Checkpoint
RP975: 11/12/2008 6:04:29 PM - System Checkpoint
RP976: 11/13/2008 8:13:41 PM - System Checkpoint
RP977: 11/29/2008 9:53:49 PM - System Checkpoint
RP978: 12/12/2008 7:23:47 PM - Installed BlackBerry Desktop Software 4.7.
RP979: 12/12/2008 7:37:57 PM - Installed Roxio Media Manager
RP980: 12/14/2008 2:13:59 PM - System Checkpoint
RP981: 12/20/2008 1:42:34 AM - System Checkpoint
RP982: 12/21/2008 1:45:31 AM - System Checkpoint
RP983: 12/23/2008 9:48:52 PM - System Checkpoint
RP984: 12/28/2008 12:03:17 AM - System Checkpoint
RP985: 12/28/2008 11:25:49 AM - Removed Ad-Aware
RP986: 12/28/2008 11:26:38 AM - Removed Apple Software Update
RP987: 12/28/2008 11:31:30 AM - Installed Ad-Aware
RP988: 12/28/2008 1:51:47 PM - ComboFix created restore point
RP989: 12/31/2008 6:58:15 PM - Removed SUPERAntiSpyware Free Edition
RP990: 12/31/2008 7:00:01 PM - Installed SUPERAntiSpyware Free Edition
RP991: 12/31/2008 7:08:16 PM - Removed Microsoft Silverlight
RP992: 1/1/2009 3:50:14 PM - Removed J2SE Runtime Environment 5.0 Update 10
RP993: 1/1/2009 3:51:24 PM - Removed J2SE Runtime Environment 5.0 Update 11
RP994: 1/1/2009 3:52:25 PM - Removed J2SE Runtime Environment 5.0 Update 6
RP995: 1/1/2009 3:53:25 PM - Removed J2SE Runtime Environment 5.0 Update 9
RP996: 1/1/2009 3:54:30 PM - Removed Java(TM) 6 Update 2
RP997: 1/1/2009 3:55:41 PM - Removed Java(TM) 6 Update 3
RP998: 1/1/2009 3:58:09 PM - Removed Java(TM) 6 Update 5
RP999: 1/1/2009 3:59:26 PM - Removed Java(TM) 6 Update 7
RP1000: 1/1/2009 4:00:45 PM - Removed Java(TM) SE Runtime Environment 6 Update 1

==== Installed Programs ======================

Ad-Aware
Adobe Acrobat 7.0 Professional
Adobe Flash Player 10 Plugin
Adobe Flash Player 9 ActiveX
Adobe Flash Player ActiveX
Adobe Photoshop 7.0
Adobe Reader 8
Adobe Shockwave Player
Age of Empires III
Age of Empires III - The WarChiefs
Age of Mythology
Age of Mythology - The Titans Expansion
AIM 6
AOL Instant Messenger
AsusUpdate
AviSynth 2.5
Azureus
Becker CPA Review CD-ROM Course and PassMaster - 2008 Edition
BlackBerry Desktop Software 4.7
blueMSX
Bodog Poker Version 2.8.0.41
Bookworm Adventures Deluxe Demo
BS.Player PRO
CCleaner (remove only)
Chronic 2005 v1.2.1
Civilization III
Combined Community Codec Pack 2007-07-22
COMODO Firewall Pro
Compatibility Pack for the 2007 Office system
Creative DVD Audio Plugin for Audigy Series
Day of Defeat: Source
Daycare Nightmare
DeadAIM
DJ ToneXpress 4.5.1
Dystopia
Excel OM 2
Fable - The Lost Chapters
FLV Player
Game Elements PC Recoil Pad
Gleim's CPA Test Prep 2008 2008 WebDeploy
Gold Miner Special Edition
Gold Miner Vegas
Google Chrome
Google Earth
Grand Theft Auto Vice City
GTA San Andreas
GTAIII
Half-Life 2: CTF 1.7
Half-Life(R) 2
Hidden Expedition Titanic (remove only)
HijackThis 2.0.2
Hometown Hero
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
InterVideo WinDVD 7
IronStorm
Jeopardy! 2003
Lexmark Z54
LIVE gaming on Windows Runtime Version 1.0.6027
LiveUpdate 2.7 (Symantec Corporation)
LOTR The Return of the King tm
Magic ISO Maker v5.5 (build 0261)
Malwarebytes' Anti-Malware
Marvell Miniport Driver
Max Payne
Metal Gear Solid
MetalGearSolid2 Substance
Microsoft .NET Framework 1.1
Microsoft .NET Framework 2.0
Microsoft Age of Empires Gold
Microsoft Age of Empires II
Microsoft Age of Empires II: The Conquerors Expansion
Microsoft Halo
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office XP Professional with FrontPage
Microsoft Rise Of Nations
Microsoft Visual C++ 2005 Redistributable
Mobile Studio
Mozilla Firefox (3.0.5)
MSXML 4.0 SP2 Parser and SDK
MSXML 6.0 Parser (KB933579)
MSXML4 Parser
Mummy Maze Deluxe 1.1
Need For Speed Underground
Need for Speed Underground 2
NVIDIA Drivers
NVIDIA System Utility
Plan of Attack
PokerStars
POM for Windows (Version 3)
QuickTime
Registry Mechanic 7.0
Ringtone Media Studio
Rise of Nations Thrones and Patriots
Risk (remove only)
Risk II
Roxio Media Manager
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905749)
Seven Kingdoms AA
Sid Meier's Civilization 4
SimCity 4
Sophos Anti-Rootkit 1.3.1
Spybot - Search & Destroy
Spybot - Search & Destroy 1.4
Star Wars Battlefront
Steam(TM)
StyleXP (remove only)
SUPERAntiSpyware Free Edition
Symantec AntiVirus
Team Fortress 2
The Rosetta Stone
The Sims 2
The Sims 2 University
The Sims™ 2 Seasons
The Weather Channel Desktop 6
Thief 2
TrackMania Nations ESWC - Update 2
True Sword 5
Update for Windows XP (KB898461)
Update for Windows XP (KB904942)
WebFldrs XP
Winamp (remove only)
Windows Genuine Advantage v1.3.0254.0
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Format 9 Series SDK
Windows Media Format Runtime
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB905915
Windows XP Service Pack 2
WinRAR archiver

==== Event Viewer Messages From Past Week ========

12/27/2008 9:31:08 PM, error: Dhcp [1001] - Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 001EE5FC8F78. The following error occurred: The operation was canceled by the user. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.
12/27/2008 9:31:48 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Roxio Hard Drive Watcher 9 service to connect.
12/28/2008 10:42:34 AM, error: Dhcp [1002] - The IP address lease 192.168.1.132 for the Network Card with network address 001EE5FC8F78 has been denied by the DHCP server 192.168.0.1 (The DHCP Server sent a DHCPNACK message).
12/28/2008 11:24:46 AM, error: Service Control Manager [7000] - The SASDIFSV service failed to start due to the following error: Cannot create a file when that file already exists.
12/28/2008 3:12:25 PM, error: Service Control Manager [7034] - The Viewpoint Manager Service service terminated unexpectedly. It has done this 1 time(s).
12/31/2008 7:00:19 PM, error: Service Control Manager [7000] - The SASDIFSV service failed to start due to the following error: The system cannot find the file specified.
1/3/2009 2:27:00 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the WZCSVC service.
1/3/2009 2:27:00 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the Schedule service.
1/3/2009 2:27:00 AM, error: Service Control Manager [7000] - The Task Scheduler service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
1/3/2009 2:27:00 AM, error: Service Control Manager [7000] - The Windows Audio service failed to start due to the following error: All pipe instances are busy.

==== End Of File ===========================

RPal129
Novice
Novice

Posts Posts : 18
Joined Joined : 2009-01-01
OS OS : Windows XP Professional
Points Points : 28950
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Troj/Rustok-N - Have read other posts and still need some he

Post by Belahzur on Sat Jan 03, 2009 2:54 pm

Hello.
You posted attach.txt, but the log I need is DDS.txt.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245059
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Troj/Rustok-N - Have read other posts and still need some he

Post by RPal129 on Sat Jan 03, 2009 5:23 pm

DDS (Version 1.1.0) - NTFSx86
Run by Jas at 11:22:06.34 on Sat 01/03/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.477 [GMT -6:00]

AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Updated)
FW: COMODO Firewall *enabled*

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\sstray.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\Program Files\AIM6\aim6.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe
C:\Documents and Settings\Jas\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Documents and Settings\Jas\Desktop\dds.com

============== Pseudo HJT Report ===============

uStart Page = [You must be registered and logged in to see this link.]
uInternet Connection Wizard,ShellNext = iexplore
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [STYLEXP] c:\program files\tgtsoft\stylexp\StyleXP.exe -Hide
uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US [You must be registered and logged in to see this link.]
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [DW6] "c:\program files\the weather channel fw\desktop\DesktopWeather.exe"
uRun: [Google Update] "c:\documents and settings\jas\local settings\application data\google\update\GoogleUpdate.exe" /c
mRun: [nForce Tray Options] sstray.exe /r
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [vptray] c:\progra~1\symant~1\VPTray.exe
mRun: [Acrobat Assistant 7.0] "c:\program files\adobe\acrobat 7.0\distillr\Acrotray.exe"
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [DeadAIM] rundll32.exe "d:\aim\\DeadAIM.ocm",ExportedCheckODLs
mRun: [BlackBerryAutoUpdate] c:\program files\common files\research in motion\auto update\RIMAutoUpdate.exe /background
mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe"
mRun: [COMODO Firewall Pro] "c:\program files\comodo\firewall\cfp.exe" -h
mRun: [COMODO Internet Security] "c:\program files\comodo\firewall\cfp.exe" -h
dRunOnce: [RunNarrator] Narrator.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobea~1.lnk - c:\windows\installer\{ac76ba86-1033-0000-7760-000000000002}\SC_Acrobat.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\reader 8.0\reader\reader_sl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~2.lnk - c:\program files\adobe\reader 8.0\reader\AdobeCollabSync.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - d:\aim\aim.exe
IE: {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - c:\program files\bodog poker\BPGame.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: NavLogon - c:\windows\system32\NavLogon.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\jas\applic~1\mozilla\firefox\profiles\j8ljqzxq.default\
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - plugin: c:\documents and settings\jas\application data\mozilla\firefox\profiles\j8ljqzxq.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\documents and settings\jas\local settings\application data\google\update\1.2.133.33\npGoogleOneClick7.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npmozax.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll

============= SERVICES / DRIVERS ===============

R0 HPT302;HPT302;c:\windows\system32\drivers\HPT302.sys [2006-1-2 22867]
R0 hptpro;hptpro;c:\windows\system32\drivers\hptpro.sys [2006-1-2 9809]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [2008-12-28 101776]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2008-12-28 31504]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2008-12-22 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2008-12-22 55024]
R1 SAVRT;SAVRT;c:\program files\symantec antivirus\savrt.sys [2005-8-26 334984]
R1 SAVRTPEL;SAVRTPEL;c:\program files\symantec antivirus\Savrtpel.sys [2005-8-26 53896]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2008-10-29 99376]
R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20081228.003\naveng.sys [2008-12-28 89104]
R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20081228.003\navex15.sys [2008-12-28 876112]
R4 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-9-10 611664]
R4 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2005-12-21 186016]
R4 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSetMgr.exe [2005-12-21 177824]
R4 cmdAgent;COMODO Internet Security Helper Service;c:\program files\comodo\firewall\cmdagent.exe [2008-12-28 618232]
R4 Symantec AntiVirus;Symantec AntiVirus;c:\program files\symantec antivirus\Rtvscan.exe [2006-1-17 1763568]
S3 ASUSHWIO;ASUSHWIO;\??\c:\windows\system32\drivers\asushwio.sys --> c:\windows\system32\drivers\ASUSHWIO.sys [?]
S3 ccPwdSvc;Symantec Password Validation;c:\program files\common files\symantec shared\ccPwdSvc.exe [2005-12-21 83616]
S3 krdpdre;krdpdre;\??\c:\docume~1\jas\locals~1\temp\krdpdre.sys --> c:\docume~1\jas\locals~1\temp\krdpdre.sys [?]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\a62.tmp --> c:\windows\system32\A62.tmp [?]
S3 OMAWGU(Belkin Corporation);My Essential G USB Adapter(Belkin Corporation);c:\windows\system32\drivers\OMAWGU.sys [2008-8-4 408064]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2008-12-22 7408]
S3 SavRoam;SAVRoam;c:\program files\symantec antivirus\SavRoam.exe [2006-1-17 169200]
S3 USBNET_XP;Instant Wireless XP USB Network Adapter ver.2.6 Driver;c:\windows\system32\drivers\netusbxp.sys [2006-1-1 72576]

=============== Created Last 30 ================

2009-01-01 14:38 --d----- c:\docume~1\jas\applic~1\True Sword
2009-01-01 14:37 356,352 a------- c:\windows\eSellerateEngine.dll
2009-01-01 14:37 81,920 a------- c:\windows\eSellerateControl350.dll
2009-01-01 14:37 --d----- c:\program files\True Sword 5
2008-12-31 23:50 147,192 a------- c:\windows\system32\guard32.dll
2008-12-31 19:00 --d----- c:\docume~1\jas\applic~1\SUPERAntiSpyware.com
2008-12-28 16:00 --d----- c:\program files\Sophos
2008-12-28 15:04 --d----- c:\program files\Trend Micro
2008-12-28 14:43 5,883,936 a--sh--- c:\windows\system32\drivers\fidbox.dat
2008-12-28 14:43 72,116 a--sh--- c:\windows\system32\drivers\fidbox.idx
2008-12-28 14:41 --d----- C:\SDFix
2008-12-28 11:55 --d----- c:\docume~1\jas\applic~1\Comodo
2008-12-28 11:55 101,776 a------- c:\windows\system32\drivers\cmdguard.sys
2008-12-28 11:55 31,504 a------- c:\windows\system32\drivers\cmdhlp.sys
2008-12-28 11:55 --d----- c:\docume~1\alluse~1\applic~1\comodo
2008-12-28 11:55 --d----- c:\program files\COMODO
2008-12-28 11:31 --d----- c:\program files\Lavasoft
2008-12-21 17:07 1,703,936 a------- c:\windows\system32\NCTAudioFile.dll
2008-12-21 17:07 360,448 a------- c:\windows\system32\NCTWMAFile.dll
2008-12-21 17:07 233,472 a------- c:\windows\system32\lame_enc.dll
2008-12-21 17:07 40,960 a------- c:\windows\system32\DGPNorm.ocx
2008-12-21 17:07 --d----- c:\program files\ACE-HIGH MP3 WAV WMA OGG Converter
2008-12-21 16:36 --d----- c:\program files\Ringtone Media Studio
2008-12-21 14:14 --d----- c:\docume~1\jas\applic~1\DJ ToneXpress
2008-12-21 14:13 --d----- c:\program files\DJ ToneXpress 4
2008-12-21 12:27 --d----- c:\program files\Total Video Player
2008-12-12 20:00 256 a------- c:\windows\system32\pool.bin
2008-12-12 20:00 --d----- c:\docume~1\jas\applic~1\Research In Motion
2008-12-12 19:38 --d----- c:\program files\common files\Sonic Shared
2008-12-12 19:38 --d----- c:\program files\Roxio
2008-12-12 19:27 26,496 a----r-- c:\windows\system32\drivers\RimSerial.sys
2008-12-12 19:24 --d----- c:\program files\common files\Research In Motion
2008-12-12 19:24 --d----- c:\program files\Research In Motion
2008-12-12 19:19 --d----- c:\program files\MSXML 6.0

==================== Find3M ====================

2008-12-03 19:52 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-03 19:52 15,504 a------- c:\windows\system32\drivers\mbam.sys
2008-08-26 21:43 41,448 a------- c:\docume~1\jas\applic~1\GDIPFONTCACHEV1.DAT
2007-08-09 16:08 3,655,608 a------- c:\program files\FLV PlayerRCATSetup.exe
2007-08-09 16:05 411,248 a------- c:\program files\FLV PlayerRCSetup.exe
2007-01-20 15:23 92,064 a------- c:\documents and settings\jas\mqdmmdm.sys
2007-01-20 15:23 79,328 a------- c:\documents and settings\jas\mqdmserd.sys
2007-01-20 15:23 66,656 a------- c:\documents and settings\jas\mqdmbus.sys
2007-01-20 15:23 25,600 a------- c:\documents and settings\jas\usbsermptxp.sys
2007-01-20 15:23 22,768 a------- c:\documents and settings\jas\usbsermpt.sys
2007-01-20 15:23 9,232 a------- c:\documents and settings\jas\mqdmmdfl.sys
2007-01-20 15:23 6,208 a------- c:\documents and settings\jas\mqdmcmnt.sys
2007-01-20 15:23 5,936 a------- c:\documents and settings\jas\mqdmwhnt.sys
2007-01-20 15:23 4,048 a------- c:\documents and settings\jas\mqdmcr.sys

============= FINISH: 11:22:59.40 ===============

RPal129
Novice
Novice

Posts Posts : 18
Joined Joined : 2009-01-01
OS OS : Windows XP Professional
Points Points : 28950
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Troj/Rustok-N - Have read other posts and still need some he

Post by Belahzur on Sat Jan 03, 2009 5:48 pm

Hello.


  • Download combofix from here, use the top links - [You must be registered and logged in to see this link.]
  • Please disable your local AV (Anti-virus) by right clicking it's icon in the tray, and exit it.
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.


  • The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.



  • Allow ComboFix to download the Recovery Console.
  • Accept the End-User License Agreement.
  • The Recovery Console will be installed.
  • You will then get this next prompt that asks if you want to continue the malware scan, select yes



  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245059
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Troj/Rustok-N - Have read other posts and still need some he

Post by RPal129 on Sat Jan 03, 2009 6:37 pm

ComboFix 09-01-01.02 - Jas 2009-01-03 12:18:20.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.502 [GMT -6:00]
Running from: c:\documents and settings\Jas\Desktop\ComboFix.exe
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated)
FW: COMODO Firewall *disabled*
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-12-03 to 2009-01-03 )))))))))))))))))))))))))))))))
.

2009-01-01 14:38 . 2009-01-01 14:38 d-------- c:\documents and settings\Jas\Application Data\True Sword
2009-01-01 14:37 . 2009-01-01 15:12 d-------- c:\program files\True Sword 5
2009-01-01 14:37 . 2005-10-11 14:40 356,352 --a------ c:\windows\eSellerateEngine.dll
2009-01-01 14:37 . 2003-06-06 11:21 81,920 --a------ c:\windows\eSellerateControl350.dll
2008-12-31 23:50 . 2008-12-31 23:47 147,192 --a------ c:\windows\system32\guard32.dll
2008-12-31 19:00 . 2008-12-31 19:00 d-------- c:\documents and settings\Jas\Application Data\SUPERAntiSpyware.com
2008-12-28 16:00 . 2008-12-28 16:00 d-------- c:\program files\Sophos
2008-12-28 15:04 . 2008-12-28 15:04 d-------- c:\program files\Trend Micro
2008-12-28 14:43 . 2008-12-31 22:58 5,883,936 --ahs---- c:\windows\system32\drivers\fidbox.dat
2008-12-28 14:43 . 2008-12-31 22:58 72,116 --ahs---- c:\windows\system32\drivers\fidbox.idx
2008-12-28 14:41 . 2008-12-28 14:54 d-------- C:\SDFix
2008-12-28 11:55 . 2008-12-28 11:55 d-------- c:\program files\COMODO
2008-12-28 11:55 . 2008-12-28 11:55 d-------- c:\documents and settings\Jas\Application Data\Comodo
2008-12-28 11:55 . 2008-12-31 16:28 d-------- c:\documents and settings\All Users\Application Data\comodo
2008-12-28 11:55 . 2008-12-31 23:47 101,776 --a------ c:\windows\system32\drivers\cmdguard.sys
2008-12-28 11:55 . 2008-12-31 23:47 31,504 --a------ c:\windows\system32\drivers\cmdhlp.sys
2008-12-28 11:31 . 2008-12-28 11:31 d-------- c:\program files\Lavasoft
2008-12-21 17:07 . 2008-12-28 11:26 d-------- c:\program files\ACE-HIGH MP3 WAV WMA OGG Converter
2008-12-21 17:07 . 2002-11-13 11:14 1,703,936 --a------ c:\windows\system32\NCTAudioFile.dll
2008-12-21 17:07 . 2002-11-06 15:12 360,448 --a------ c:\windows\system32\NCTWMAFile.dll
2008-12-21 17:07 . 2002-09-06 11:36 233,472 --a------ c:\windows\system32\lame_enc.dll
2008-12-21 17:07 . 2001-08-08 21:00 40,960 --a------ c:\windows\system32\DGPNorm.ocx
2008-12-21 16:36 . 2008-12-21 16:37 d-------- c:\program files\Ringtone Media Studio
2008-12-21 14:14 . 2008-12-21 14:14 d-------- c:\documents and settings\Jas\Application Data\DJ ToneXpress
2008-12-21 14:13 . 2008-12-21 14:13 d-------- c:\program files\DJ ToneXpress 4
2008-12-21 12:27 . 2008-12-28 11:29 d-------- c:\program files\Total Video Player
2008-12-12 20:02 . 2008-12-12 20:02 d-------- c:\documents and settings\LocalService\Application Data\Roxio
2008-12-12 20:02 . 2008-12-21 16:24 d-------- c:\documents and settings\Jas\Application Data\Roxio
2008-12-12 20:00 . 2008-12-12 20:00 d-------- c:\documents and settings\Jas\Application Data\Research In Motion
2008-12-12 20:00 . 2008-12-24 13:19 256 --a------ c:\windows\system32\pool.bin
2008-12-12 19:42 . 2008-12-12 19:42 d-------- c:\documents and settings\All Users\Application Data\InstallShield
2008-12-12 19:41 . 2008-12-12 19:41 d-------- c:\documents and settings\All Users\Application Data\Sonic
2008-12-12 19:38 . 2008-12-12 19:39 d-------- c:\program files\Roxio
2008-12-12 19:38 . 2008-12-12 19:38 d-------- c:\program files\Common Files\Sonic Shared
2008-12-12 19:38 . 2008-12-12 19:39 d-------- c:\program files\Common Files\Roxio Shared
2008-12-12 19:38 . 2008-12-21 16:24 d-------- c:\documents and settings\All Users\Application Data\Roxio
2008-12-12 19:27 . 2007-01-18 10:24 26,496 -ra------ c:\windows\system32\drivers\RimSerial.sys
2008-12-12 19:24 . 2008-12-12 19:24 d-------- c:\program files\Research In Motion
2008-12-12 19:24 . 2008-12-12 19:25 d-------- c:\program files\Common Files\Research In Motion
2008-12-12 19:19 . 2008-12-12 19:19 d-------- c:\program files\MSXML 6.0

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-03 18:17 --------- d-----w c:\program files\Symantec AntiVirus
2009-01-01 22:01 --------- d-----w c:\program files\Java
2009-01-01 01:07 --------- d-----w c:\documents and settings\All Users\Application Data\BVRP Software
2009-01-01 01:06 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-01 01:00 --------- d-----w c:\program files\SUPERAntiSpyware
2009-01-01 00:59 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-12-31 22:25 --------- d-----w c:\program files\Viewpoint
2008-12-28 21:15 --------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint
2008-12-28 17:56 --------- d-----w c:\documents and settings\Jas\Application Data\Azureus
2008-12-28 17:26 --------- d-----w c:\program files\Apple Software Update
2008-12-28 17:05 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2008-12-13 01:38 --------- d-----w c:\program files\Common Files\InstallShield
2008-12-04 01:52 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-04 01:52 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2008-11-30 18:45 --------- d-----w c:\program files\AIM6
2008-11-30 18:44 --------- d-----w c:\documents and settings\All Users\Application Data\acccore
2008-11-30 18:29 --------- d-----w c:\documents and settings\All Users\Application Data\AOL Downloads
2008-11-14 06:09 --------- d--h--w c:\documents and settings\Jas\Application Data\Move Networks
2008-11-10 06:36 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-11-10 06:24 --------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2008-11-10 06:22 --------- d-----w c:\documents and settings\Jas\Application Data\Malwarebytes
2008-11-10 06:22 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-10 06:14 --------- d-----w c:\program files\CCleaner
2008-11-05 05:57 --------- d-----w c:\documents and settings\Jas\Application Data\Thinstall
2008-08-27 03:43 41,448 ----a-w c:\documents and settings\Jas\Application Data\GDIPFONTCACHEV1.DAT
2007-08-09 22:08 3,655,608 ----a-w c:\program files\FLV PlayerRCATSetup.exe
2007-08-09 22:05 411,248 ----a-w c:\program files\FLV PlayerRCSetup.exe
2007-01-20 21:23 92,064 ----a-w c:\documents and settings\Jas\mqdmmdm.sys
2007-01-20 21:23 9,232 ----a-w c:\documents and settings\Jas\mqdmmdfl.sys
2007-01-20 21:23 79,328 ----a-w c:\documents and settings\Jas\mqdmserd.sys
2007-01-20 21:23 66,656 ----a-w c:\documents and settings\Jas\mqdmbus.sys
2007-01-20 21:23 6,208 ----a-w c:\documents and settings\Jas\mqdmcmnt.sys
2007-01-20 21:23 5,936 ----a-w c:\documents and settings\Jas\mqdmwhnt.sys
2007-01-20 21:23 4,048 ----a-w c:\documents and settings\Jas\mqdmcr.sys
2007-01-20 21:23 25,600 ----a-w c:\documents and settings\Jas\usbsermptxp.sys
2007-01-20 21:23 22,768 ----a-w c:\documents and settings\Jas\usbsermpt.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"STYLEXP"="c:\program files\TGTSoft\StyleXP\StyleXP.exe" [2006-01-30 1363968]
"Aim6"="c:\program files\AIM6\aim6.exe" [2008-10-31 50480]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"DW6"="c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe" [2008-06-10 785520]
"Google Update"="c:\documents and settings\Jas\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-03 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-01-17 85744]
"Acrobat Assistant 7.0"="c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 483328]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"DeadAIM"="d:\aim\\DeadAIM.ocm" [2004-04-10 144896]
"BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2008-09-19 615696]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2008-08-26 236016]
"COMODO Firewall Pro"="c:\program files\COMODO\Firewall\cfp.exe" [2008-12-31 1797880]
"COMODO Internet Security"="c:\program files\COMODO\Firewall\cfp.exe" [2008-12-31 1797880]
"nForce Tray Options"="sstray.exe" [2003-08-12 c:\windows\system32\sstray.exe]
"nwiz"="nwiz.exe" [2007-12-05 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 c:\windows\system32\narrator.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2007-02-08 25214]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-01-03 113664]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0lsdelete

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk]
backup=c:\windows\pss\InterVideo WinCinema Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
--a------ 2008-12-22 11:05 1830128 c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPodService"=3 (0x3)
"iPod Service"=3 (0x3)
"Apple Mobile Device"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Azureus\\Azureus.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Lavasoft\\Ad-Aware\\Ad-Aware.exe"=
"c:\\Program Files\\Lavasoft\\Ad-Aware\\lsupdatemanager.exe"=
"c:\\Program Files\\Lavasoft\\Ad-Aware\\aawservice.exe"=
"c:\\Program Files\\Lavasoft\\Ad-Aware\\AAWLic.exe"=
"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"=
"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbamgui.exe"=
"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam-dor.exe"=
"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbamservice.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=

R0 HPT302;HPT302;c:\windows\system32\DRIVERS\HPT302.sys [2006-01-02 22867]
R0 hptpro;hptpro;c:\windows\system32\DRIVERS\hptpro.sys [2006-01-02 9809]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2008-12-28 101776]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2008-12-28 31504]
R1 SASDIFSV;SASDIFSV;\??\c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2008-12-22 8944]
R1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2008-12-22 55024]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-10-29 99376]
S3 ASUSHWIO;ASUSHWIO;\??\c:\windows\System32\drivers\ASUSHWIO.sys []
S3 krdpdre;krdpdre;\??\c:\docume~1\Jas\LOCALS~1\Temp\krdpdre.sys []
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\A62.tmp []
S3 OMAWGU(Belkin Corporation);My Essential G USB Adapter(Belkin Corporation);c:\windows\system32\DRIVERS\OMAWGU.sys [2008-08-04 408064]
S3 SASENUM;SASENUM;\??\c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-22 7408]
S3 SavRoam;SAVRoam;"c:\program files\Symantec AntiVirus\SavRoam.exe" [2006-01-17 169200]
S3 USBNET_XP;Instant Wireless XP USB Network Adapter ver.2.6 Driver;c:\windows\system32\DRIVERS\netusbxp.sys [2006-01-01 72576]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e8b22327-72c6-11dd-bf07-001ee5fc8f78}]
\shell\p\command - Explorer URL=http://www.abbott.com/
.
Contents of the 'Scheduled Tasks' folder

2009-01-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1004336348-1364589140-725345543-1003.job
- c:\documents and settings\Jas\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-03 23:17]

RPal129
Novice
Novice

Posts Posts : 18
Joined Joined : 2009-01-01
OS OS : Windows XP Professional
Points Points : 28950
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Troj/Rustok-N - Have read other posts and still need some he

Post by RPal129 on Sat Jan 03, 2009 6:38 pm

.
.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
uInternet Connection Wizard,ShellNext = iexplore
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

O16 -: DirectAnimation Java Classes - [You must be registered and logged in to see this link.]
c:\windows\Downloaded Program Files\DirectAnimation Java Classes.osd

O16 -: Microsoft XML Parser for Java - [You must be registered and logged in to see this link.]
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd

c:\windows\System32\msvcrt.dll - c:\windows\System32\snbdpl1.dll
c:\windows\System32\snbd10dm.dll
c:\windows\System32\igsnrn22.dll
c:\windows\System32\igsnpb22.dll
c:\windows\System32\igsnol22.dll
c:\windows\System32\igsncm22.dll
c:\windows\System32\browser.exa
c:\windows\System32\Acgm.Dll
O16 -: {F5D98C43-DB16-11CF-8ECA-0000C0FD59C7}
[You must be registered and logged in to see this link.]
c:\windows\Downloaded Program Files\acgm.inf
FF - ProfilePath - c:\documents and settings\Jas\Application Data\Mozilla\Firefox\Profiles\j8ljqzxq.default\
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - plugin: c:\documents and settings\Jas\Application Data\Mozilla\Firefox\Profiles\j8ljqzxq.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\documents and settings\Jas\Local Settings\Application Data\Google\Update\1.2.133.33\npGoogleOneClick7.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-01-03 12:22:52
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\A62.tmp"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(760)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
Completion time: 2009-01-03 12:24:56
ComboFix-quarantined-files.txt 2009-01-03 18:24:24
ComboFix2.txt 2008-12-28 19:59:38

Pre-Run: 23,404,085,248 bytes free
Post-Run: 23,440,683,008 bytes free

235

RPal129
Novice
Novice

Posts Posts : 18
Joined Joined : 2009-01-01
OS OS : Windows XP Professional
Points Points : 28950
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Troj/Rustok-N - Have read other posts and still need some he

Post by Belahzur on Sat Jan 03, 2009 6:40 pm

Now open a new notepad file.
Input this into the notepad file:

KILLALL::

Driver::
krdpdre
MEMSWEEP2

File::
c:\windows\system32\A62.tmp

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e8b22327-72c6-11dd-bf07-001ee5fc8f78}]
[-HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MEMSWEEP2]

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix.exe again, agree to it's terms and allow it to run, it may want to reboot after it's done. Post the resulting log back here.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245059
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Troj/Rustok-N - Have read other posts and still need some he

Post by RPal129 on Sat Jan 03, 2009 9:50 pm

NOTE: This is the log from the second time I ran it, the first time the log never came up and I got an error message. I hope this is just as good.


ComboFix 09-01-02.01 - Jas 2009-01-03 15:29:16.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.554 [GMT -6:00]
Running from: c:\documents and settings\Jas\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Jas\Desktop\CFscript.txt
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated)
FW: COMODO Firewall *disabled*
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
c:\windows\system32\A62.tmp
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_KRDPDRE
-------\Legacy_MEMSWEEP2
-------\Service_krdpdre


((((((((((((((((((((((((( Files Created from 2008-12-03 to 2009-01-03 )))))))))))))))))))))))))))))))
.

2009-01-03 13:26 . 2009-01-03 13:29 d-------- C:\32788R22FWJFW.0.tmp
2009-01-01 14:38 . 2009-01-01 14:38 d-------- c:\documents and settings\Jas\Application Data\True Sword
2009-01-01 14:37 . 2009-01-01 15:12 d-------- c:\program files\True Sword 5
2009-01-01 14:37 . 2005-10-11 14:40 356,352 --a------ c:\windows\eSellerateEngine.dll
2009-01-01 14:37 . 2003-06-06 11:21 81,920 --a------ c:\windows\eSellerateControl350.dll
2008-12-31 23:50 . 2008-12-31 23:47 147,192 --a------ c:\windows\system32\guard32.dll
2008-12-31 19:00 . 2008-12-31 19:00 d-------- c:\documents and settings\Jas\Application Data\SUPERAntiSpyware.com
2008-12-28 16:00 . 2008-12-28 16:00 d-------- c:\program files\Sophos
2008-12-28 15:04 . 2008-12-28 15:04 d-------- c:\program files\Trend Micro
2008-12-28 14:43 . 2008-12-31 22:58 5,883,936 --ahs---- c:\windows\system32\drivers\fidbox.dat
2008-12-28 14:43 . 2008-12-31 22:58 72,116 --ahs---- c:\windows\system32\drivers\fidbox.idx
2008-12-28 14:41 . 2008-12-28 14:54 d-------- C:\SDFix
2008-12-28 11:55 . 2008-12-28 11:55 d-------- c:\program files\COMODO
2008-12-28 11:55 . 2008-12-28 11:55 d-------- c:\documents and settings\Jas\Application Data\Comodo
2008-12-28 11:55 . 2008-12-31 16:28 d-------- c:\documents and settings\All Users\Application Data\comodo
2008-12-28 11:55 . 2008-12-31 23:47 101,776 --a------ c:\windows\system32\drivers\cmdguard.sys
2008-12-28 11:55 . 2008-12-31 23:47 31,504 --a------ c:\windows\system32\drivers\cmdhlp.sys
2008-12-28 11:31 . 2008-12-28 11:31 d-------- c:\program files\Lavasoft
2008-12-21 17:07 . 2008-12-28 11:26 d-------- c:\program files\ACE-HIGH MP3 WAV WMA OGG Converter
2008-12-21 17:07 . 2002-11-13 11:14 1,703,936 --a------ c:\windows\system32\NCTAudioFile.dll
2008-12-21 17:07 . 2002-11-06 15:12 360,448 --a------ c:\windows\system32\NCTWMAFile.dll
2008-12-21 17:07 . 2002-09-06 11:36 233,472 --a------ c:\windows\system32\lame_enc.dll
2008-12-21 17:07 . 2001-08-08 21:00 40,960 --a------ c:\windows\system32\DGPNorm.ocx
2008-12-21 16:36 . 2008-12-21 16:37 d-------- c:\program files\Ringtone Media Studio
2008-12-21 14:14 . 2008-12-21 14:14 d-------- c:\documents and settings\Jas\Application Data\DJ ToneXpress
2008-12-21 14:13 . 2008-12-21 14:13 d-------- c:\program files\DJ ToneXpress 4
2008-12-21 12:27 . 2008-12-28 11:29 d-------- c:\program files\Total Video Player
2008-12-12 20:02 . 2008-12-12 20:02 d-------- c:\documents and settings\LocalService\Application Data\Roxio
2008-12-12 20:02 . 2008-12-21 16:24 d-------- c:\documents and settings\Jas\Application Data\Roxio
2008-12-12 20:00 . 2008-12-12 20:00 d-------- c:\documents and settings\Jas\Application Data\Research In Motion
2008-12-12 20:00 . 2008-12-24 13:19 256 --a------ c:\windows\system32\pool.bin
2008-12-12 19:42 . 2008-12-12 19:42 d-------- c:\documents and settings\All Users\Application Data\InstallShield
2008-12-12 19:41 . 2008-12-12 19:41 d-------- c:\documents and settings\All Users\Application Data\Sonic
2008-12-12 19:38 . 2008-12-12 19:39 d-------- c:\program files\Roxio
2008-12-12 19:38 . 2008-12-12 19:38 d-------- c:\program files\Common Files\Sonic Shared
2008-12-12 19:38 . 2008-12-12 19:39 d-------- c:\program files\Common Files\Roxio Shared
2008-12-12 19:38 . 2008-12-21 16:24 d-------- c:\documents and settings\All Users\Application Data\Roxio
2008-12-12 19:27 . 2007-01-18 10:24 26,496 -ra------ c:\windows\system32\drivers\RimSerial.sys
2008-12-12 19:24 . 2008-12-12 19:24 d-------- c:\program files\Research In Motion
2008-12-12 19:24 . 2008-12-12 19:25 d-------- c:\program files\Common Files\Research In Motion
2008-12-12 19:19 . 2008-12-12 19:19 d-------- c:\program files\MSXML 6.0

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-03 21:40 --------- d-----w c:\program files\Symantec AntiVirus
2009-01-01 22:01 --------- d-----w c:\program files\Java
2009-01-01 01:07 --------- d-----w c:\documents and settings\All Users\Application Data\BVRP Software
2009-01-01 01:06 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-01 01:00 --------- d-----w c:\program files\SUPERAntiSpyware
2009-01-01 00:59 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-12-31 22:25 --------- d-----w c:\program files\Viewpoint
2008-12-28 21:15 --------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint
2008-12-28 17:56 --------- d-----w c:\documents and settings\Jas\Application Data\Azureus
2008-12-28 17:26 --------- d-----w c:\program files\Apple Software Update
2008-12-28 17:05 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2008-12-13 01:38 --------- d-----w c:\program files\Common Files\InstallShield
2008-12-04 01:52 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-04 01:52 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2008-11-30 18:45 --------- d-----w c:\program files\AIM6
2008-11-30 18:44 --------- d-----w c:\documents and settings\All Users\Application Data\acccore
2008-11-30 18:29 --------- d-----w c:\documents and settings\All Users\Application Data\AOL Downloads
2008-11-14 06:09 --------- d--h--w c:\documents and settings\Jas\Application Data\Move Networks
2008-11-10 06:36 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-11-10 06:24 --------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2008-11-10 06:22 --------- d-----w c:\documents and settings\Jas\Application Data\Malwarebytes
2008-11-10 06:22 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-10 06:14 --------- d-----w c:\program files\CCleaner
2008-11-05 05:57 --------- d-----w c:\documents and settings\Jas\Application Data\Thinstall
2008-08-27 03:43 41,448 ----a-w c:\documents and settings\Jas\Application Data\GDIPFONTCACHEV1.DAT
2007-08-09 22:08 3,655,608 ----a-w c:\program files\FLV PlayerRCATSetup.exe
2007-08-09 22:05 411,248 ----a-w c:\program files\FLV PlayerRCSetup.exe
2007-01-20 21:23 92,064 ----a-w c:\documents and settings\Jas\mqdmmdm.sys
2007-01-20 21:23 9,232 ----a-w c:\documents and settings\Jas\mqdmmdfl.sys
2007-01-20 21:23 79,328 ----a-w c:\documents and settings\Jas\mqdmserd.sys
2007-01-20 21:23 66,656 ----a-w c:\documents and settings\Jas\mqdmbus.sys
2007-01-20 21:23 6,208 ----a-w c:\documents and settings\Jas\mqdmcmnt.sys
2007-01-20 21:23 5,936 ----a-w c:\documents and settings\Jas\mqdmwhnt.sys
2007-01-20 21:23 4,048 ----a-w c:\documents and settings\Jas\mqdmcr.sys
2007-01-20 21:23 25,600 ----a-w c:\documents and settings\Jas\usbsermptxp.sys
2007-01-20 21:23 22,768 ----a-w c:\documents and settings\Jas\usbsermpt.sys
.

((((((((((((((((((((((((((((( [You must be registered and logged in to see this link.] )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-21 02:02:28 163,328 ----a-w c:\windows\ERDNT\subs\ERDNT.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"STYLEXP"="c:\program files\TGTSoft\StyleXP\StyleXP.exe" [2006-01-30 1363968]
"Aim6"="c:\program files\AIM6\aim6.exe" [2008-10-31 50480]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"DW6"="c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe" [2008-06-10 785520]
"Google Update"="c:\documents and settings\Jas\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-03 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-01-17 85744]
"Acrobat Assistant 7.0"="c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 483328]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"DeadAIM"="d:\aim\\DeadAIM.ocm" [2004-04-10 144896]
"BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2008-09-19 615696]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2008-08-26 236016]
"COMODO Firewall Pro"="c:\program files\COMODO\Firewall\cfp.exe" [2008-12-31 1797880]
"COMODO Internet Security"="c:\program files\COMODO\Firewall\cfp.exe" [2008-12-31 1797880]
"nForce Tray Options"="sstray.exe" [2003-08-12 c:\windows\system32\sstray.exe]
"nwiz"="nwiz.exe" [2007-12-05 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 c:\windows\system32\narrator.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2007-02-08 25214]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-01-03 113664]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0lsdelete

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk]
backup=c:\windows\pss\InterVideo WinCinema Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
--a------ 2008-12-22 11:05 1830128 c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPodService"=3 (0x3)
"iPod Service"=3 (0x3)
"Apple Mobile Device"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Azureus\\Azureus.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Lavasoft\\Ad-Aware\\Ad-Aware.exe"=
"c:\\Program Files\\Lavasoft\\Ad-Aware\\lsupdatemanager.exe"=
"c:\\Program Files\\Lavasoft\\Ad-Aware\\aawservice.exe"=
"c:\\Program Files\\Lavasoft\\Ad-Aware\\AAWLic.exe"=
"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"=
"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbamgui.exe"=
"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam-dor.exe"=
"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbamservice.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=

R0 HPT302;HPT302;c:\windows\system32\drivers\HPT302.sys [2006-01-02 22867]
R0 hptpro;hptpro;c:\windows\system32\drivers\hptpro.sys [2006-01-02 9809]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [2008-12-28 101776]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2008-12-28 31504]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-12-22 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-12-22 55024]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-10-29 99376]
S3 ASUSHWIO;ASUSHWIO;\??\c:\windows\System32\drivers\ASUSHWIO.sys --> c:\windows\System32\drivers\ASUSHWIO.sys [?]
S3 OMAWGU(Belkin Corporation);My Essential G USB Adapter(Belkin Corporation);c:\windows\system32\drivers\OMAWGU.sys [2008-08-04 408064]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-22 7408]
S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [2006-01-17 169200]
S3 USBNET_XP;Instant Wireless XP USB Network Adapter ver.2.6 Driver;c:\windows\system32\drivers\netusbxp.sys [2006-01-01 72576]
.
Contents of the 'Scheduled Tasks' folder

2009-01-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1004336348-1364589140-725345543-1003.job
- c:\documents and settings\Jas\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-03 23:17]
.
.


Last edited by RPal129 on Sat Jan 03, 2009 9:52 pm; edited 1 time in total

RPal129
Novice
Novice

Posts Posts : 18
Joined Joined : 2009-01-01
OS OS : Windows XP Professional
Points Points : 28950
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Troj/Rustok-N - Have read other posts and still need some he

Post by RPal129 on Sat Jan 03, 2009 9:51 pm

------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
uInternet Connection Wizard,ShellNext = iexplore
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

O16 -: DirectAnimation Java Classes - [You must be registered and logged in to see this link.]
c:\windows\Downloaded Program Files\DirectAnimation Java Classes.osd

O16 -: Microsoft XML Parser for Java - [You must be registered and logged in to see this link.]
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd

c:\windows\System32\msvcrt.dll - c:\windows\System32\snbdpl1.dll
c:\windows\System32\snbd10dm.dll
c:\windows\System32\igsnrn22.dll
c:\windows\System32\igsnpb22.dll
c:\windows\System32\igsnol22.dll
c:\windows\System32\igsncm22.dll
c:\windows\System32\browser.exa
c:\windows\System32\Acgm.Dll
O16 -: {F5D98C43-DB16-11CF-8ECA-0000C0FD59C7}
[You must be registered and logged in to see this link.]
c:\windows\Downloaded Program Files\acgm.inf
FF - ProfilePath - c:\documents and settings\Jas\Application Data\Mozilla\Firefox\Profiles\j8ljqzxq.default\
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - plugin: c:\documents and settings\Jas\Application Data\Mozilla\Firefox\Profiles\j8ljqzxq.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\documents and settings\Jas\Local Settings\Application Data\Google\Update\1.2.133.33\npGoogleOneClick7.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-01-03 15:40:38
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(772)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\TGTSoft\StyleXP\StyleXPService.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\COMODO\Firewall\cmdagent.exe
c:\program files\Symantec AntiVirus\DefWatch.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\program files\Symantec AntiVirus\Rtvscan.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\windows\system32\rundll32.exe
c:\program files\AIM6\aolsoftware.exe
c:\program files\AIM6\aolsoftware.exe
.
**************************************************************************
.
Completion time: 2009-01-03 15:46:42 - machine was rebooted [Jas]
ComboFix-quarantined-files.txt 2009-01-03 21:46:36
ComboFix2.txt 2009-01-03 18:25:01
ComboFix3.txt 2008-12-28 19:59:38

Pre-Run: 23,460,851,712 bytes free
Post-Run: 23,432,892,416 bytes free

266

RPal129
Novice
Novice

Posts Posts : 18
Joined Joined : 2009-01-01
OS OS : Windows XP Professional
Points Points : 28950
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Troj/Rustok-N - Have read other posts and still need some he

Post by Belahzur on Sat Jan 03, 2009 10:12 pm

Looks good now, what problems remain?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245059
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Troj/Rustok-N - Have read other posts and still need some he

Post by RPal129 on Sun Jan 04, 2009 8:04 am

I still get a notification that I am infected with the troj/rustok-n. Not sure if that is total crap and I am not infected or what. Let me know what I should do. Thanks so much for your again.

RPal129
Novice
Novice

Posts Posts : 18
Joined Joined : 2009-01-01
OS OS : Windows XP Professional
Points Points : 28950
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Troj/Rustok-N - Have read other posts and still need some he

Post by Belahzur on Sun Jan 04, 2009 2:02 pm

Okay, lets run a rootkit check.

1. Please download The Avenger by Swandog46 to your Desktop
Link: [You must be registered and logged in to see this link.] or [You must be registered and logged in to see this link.].

  • Click on Avenger.zip to open the file
  • Extract avenger.exe to your desktop

3. Now, start The Avenger program by clicking on its icon on your desktop.

  • Leave the script box blank.
  • Leave the ticked box "Scan for rootkit" ticked.
  • Then tick "Disable any rootkits found"
  • Now click on the Execute to begin execution of the script.
  • Answer "Yes" twice when prompted.

    The Avenger will automatically do the following:

  • It will Restart your computer.
  • On reboot, it will briefly open a black command window on your desktop, this is normal.
  • After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
4. Please copy/paste the content of c:\avenger.txt into your reply.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245059
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Troj/Rustok-N - Have read other posts and still need some he

Post by RPal129 on Sun Jan 04, 2009 6:30 pm

Appears thats clean too.

Logfile of The Avenger Version 2.0, (c) by Swandog46
[You must be registered and logged in to see this link.]

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Completed script processing.

*******************

Finished! Terminate.

RPal129
Novice
Novice

Posts Posts : 18
Joined Joined : 2009-01-01
OS OS : Windows XP Professional
Points Points : 28950
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Troj/Rustok-N - Have read other posts and still need some he

Post by Belahzur on Sun Jan 04, 2009 7:15 pm

No rootkits seen by the avenger, but lets go deeper.

Please run a GMER Rootkit scan:

Download GMER's application from here:
[You must be registered and logged in to see this link.]

Unzip it and start the GMER.exe
Click the Rootkit tab and click the Scan button.

Once done, click the Copy button.
This will copy the results to your clipboard.
Paste the results in your next reply.

Warning ! Please, do not select the "Show all" checkbox during the scan.

If you're having problems with running GMER.exe, try it in safe mode.
This tools works in safe mode. Other rootkitrevealers don't.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245059
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Troj/Rustok-N - Have read other posts and still need some he

Post by RPal129 on Sun Jan 04, 2009 9:39 pm

GMER 1.0.14.14536 - [You must be registered and logged in to see this link.]
Rootkit scan 2009-01-04 15:38:00
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.14 ----

SSDT \\SystemRoot\\System32\\DRIVERS\\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwAdjustPrivilegesToken [0xF3F5E906]
SSDT 865ED620 ZwConnectPort
SSDT \\SystemRoot\\System32\\DRIVERS\\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateFile [0xF3F5E4C2]
SSDT \\SystemRoot\\System32\\DRIVERS\\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateKey [0xF3F5F0D0]
SSDT \\SystemRoot\\System32\\DRIVERS\\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreatePort [0xF3F5DBC0]
SSDT \\SystemRoot\\System32\\DRIVERS\\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateSection [0xF3F5FDC0]
SSDT \\SystemRoot\\System32\\DRIVERS\\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateSymbolicLinkObject [0xF3F5EAEC]
SSDT \\SystemRoot\\System32\\DRIVERS\\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateThread [0xF3F5D796]
SSDT \\SystemRoot\\System32\\DRIVERS\\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwDeleteKey [0xF3F5ED3A]
SSDT \\??\\C:\\Program Files\\Symantec\\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteValueKey [0xF3EF5DC0]
SSDT 860C9288 ZwDuplicateObject
SSDT sptd.sys ZwEnumerateKey [0xF73C0C22]
SSDT sptd.sys ZwEnumerateValueKey [0xF73C0F9A]
SSDT \\SystemRoot\\System32\\DRIVERS\\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwLoadDriver [0xF3F5FA42]
SSDT \\SystemRoot\\System32\\DRIVERS\\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwMakeTemporaryObject [0xF3F5E0AC]
SSDT \\SystemRoot\\System32\\DRIVERS\\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwOpenFile [0xF3F5E6FA]
SSDT sptd.sys ZwOpenKey [0xF73C098E]
SSDT 8667E940 ZwOpenProcess
SSDT \\SystemRoot\\System32\\DRIVERS\\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwOpenSection [0xF3F5E33C]
SSDT 8667EAB8 ZwOpenThread
SSDT sptd.sys ZwQueryKey [0xF73C1064]
SSDT sptd.sys ZwQueryValueKey [0xF73C0EFC]
SSDT \\SystemRoot\\System32\\DRIVERS\\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwRenameKey [0xF3F5F496]
SSDT \\SystemRoot\\System32\\DRIVERS\\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwRequestWaitReplyPort [0xF3F5DCDE]
SSDT \\SystemRoot\\System32\\DRIVERS\\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwSecureConnectPort [0xF3F5F7FA]
SSDT \\SystemRoot\\System32\\DRIVERS\\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwSetSystemInformation [0xF3F5FBF0]
SSDT \\??\\C:\\Program Files\\Symantec\\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwSetValueKey [0xF3EF6020]
SSDT \\SystemRoot\\System32\\DRIVERS\\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwShutdownSystem [0xF3F5E046]
SSDT \\SystemRoot\\System32\\DRIVERS\\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwSystemDebugControl [0xF3F5E230]
SSDT \\SystemRoot\\System32\\DRIVERS\\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwTerminateProcess [0xF3F5DA8A]
SSDT \\SystemRoot\\System32\\DRIVERS\\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwTerminateThread [0xF3F5D958]

RPal129
Novice
Novice

Posts Posts : 18
Joined Joined : 2009-01-01
OS OS : Windows XP Professional
Points Points : 28950
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Troj/Rustok-N - Have read other posts and still need some he

Post by RPal129 on Sun Jan 04, 2009 9:39 pm

---- Kernel code sections - GMER 1.0.14 ----

? bsdjudyy.sys The
system cannot find the file specified. !
?
C:\\WINDOWS\\system32\\drivers\\sptd.sys The process cannot access the
file because it is being used by another process.
?
C:\\WINDOWS\\System32\\Drivers\\SPTD2605.SYS The process cannot access
the file because it is being used by another process.
.text
dtscsi.sys!A0DB34FC6FE35D429A28ADDE5467D4D7 F63D14F0 16 Bytes [ B8, 55,
95, BD, FC, CD, A2, ... ]
.text
dtscsi.sys!A0DB34FC6FE35D429A28ADDE5467D4D7 + 12 F63D1502 30 Bytes [
3D, F6, D8, 9A, 12, 9E, 68, ... ]
?
C:\\WINDOWS\\System32\\Drivers\\dtscsi.sys The process cannot access
the file because it is being used by another process.

---- Kernel IAT/EAT - GMER 1.0.14 ----

IAT
pci.sys[ntoskrnl.exe!IoDetachDevice] [F73C989E] sptd.sys
IAT
pci.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F73DFD86] sptd.sys
IAT
ftdisk.sys[ntoskrnl.exe!IoGetAttachedDeviceReference] [F73C9E24]
sptd.sys
IAT ftdisk.sys[ntoskrnl.exe!IoGetDeviceObjectPointer]
[F73C9D28] sptd.sys
IAT ftdisk.sys[ntoskrnl.exe!IofCallDriver]
[F73C9EF4] sptd.sys
IAT dmio.sys[ntoskrnl.exe!IofCallDriver]
[F73C9EF4] sptd.sys
IAT
dmio.sys[ntoskrnl.exe!IoGetAttachedDeviceReference] [F73C9E24] sptd.sys
IAT
dmio.sys[ntoskrnl.exe!IoGetDeviceObjectPointer] [F73C9D28] sptd.sys
IAT
PartMgr.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F73DF1AE]
sptd.sys
IAT PartMgr.sys[ntoskrnl.exe!IoDetachDevice] [F73C9A5A]
sptd.sys
IAT atapi.sys[ntoskrnl.exe!IofCompleteRequest] [F73DF04A]
sptd.sys
IAT atapi.sys[ntoskrnl.exe!IoConnectInterrupt] [F73C98F2]
sptd.sys
IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F73BCAD2] sptd.sys
IAT
atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F73BCC0E] sptd.sys
IAT
atapi.sys[HAL.dll!READ_PORT_USHORT] [F73BCB96] sptd.sys
IAT
atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F73BD76C] sptd.sys
IAT
atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F73BD642] sptd.sys
IAT
disk.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [F73DFE4A] sptd.sys
IAT
\\WINDOWS\\System32\\DRIVERS\\CLASSPNP.SYS[ntoskrnl.exe!IoDetachDevice]
[F73CE8C6] sptd.sys
IAT
\\SystemRoot\\System32\\DRIVERS\\USBPORT.SYS[ntoskrnl.exe!IofCompleteRequest]
[F73DF04A] sptd.sys
IAT
\\SystemRoot\\System32\\DRIVERS\\cdrom.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack]
[F73DFE4A] sptd.sys
IAT
\\SystemRoot\\System32\\DRIVERS\\ndiswan.sys[NDIS.SYS!NdisCloseAdapter]
[F7209710] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)
IAT
\\SystemRoot\\System32\\DRIVERS\\ndiswan.sys[NDIS.SYS!NdisOpenAdapter]
[F7209770] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)
IAT
\\SystemRoot\\System32\\DRIVERS\\ndiswan.sys[NDIS.SYS!NdisDeregisterProtocol]
[F7209990] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)
IAT
\\SystemRoot\\System32\\DRIVERS\\ndiswan.sys[NDIS.SYS!NdisRegisterProtocol]
[F7209950] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)
IAT
\\SystemRoot\\System32\\DRIVERS\\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol]
[F7209950] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)
IAT
\\SystemRoot\\System32\\DRIVERS\\raspppoe.sys[NDIS.SYS!NdisOpenAdapter]
[F7209770] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)
IAT
\\SystemRoot\\System32\\DRIVERS\\raspppoe.sys[NDIS.SYS!NdisCloseAdapter]
[F7209710] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)
IAT
\\SystemRoot\\System32\\DRIVERS\\raspppoe.sys[NDIS.SYS!NdisDeregisterProtocol]
[F7209990] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)
IAT
\\SystemRoot\\System32\\DRIVERS\\psched.sys[NDIS.SYS!NdisDeregisterProtocol]
[F7209990] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)
IAT
\\SystemRoot\\System32\\DRIVERS\\psched.sys[NDIS.SYS!NdisRegisterProtocol]
[F7209950] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)
IAT
\\SystemRoot\\System32\\DRIVERS\\psched.sys[NDIS.SYS!NdisOpenAdapter]
[F7209770] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)
IAT
\\SystemRoot\\System32\\DRIVERS\\psched.sys[NDIS.SYS!NdisCloseAdapter]
[F7209710] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)
IAT
\\SystemRoot\\System32\\Drivers\\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol]
[F7209950] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)
IAT
\\SystemRoot\\System32\\Drivers\\NDProxy.SYS[NDIS.SYS!NdisCloseAdapter]
[F7209710] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)
IAT
\\SystemRoot\\System32\\Drivers\\NDProxy.SYS[NDIS.SYS!NdisOpenAdapter]
[F7209770] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)
IAT
\\SystemRoot\\System32\\Drivers\\NDProxy.SYS[NDIS.SYS!NdisDeregisterProtocol]
[F7209990] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)
IAT
\\SystemRoot\\System32\\DRIVERS\\tcpip.sys[NDIS.SYS!NdisCloseAdapter]
[F7209710] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)
IAT
\\SystemRoot\\System32\\DRIVERS\\tcpip.sys[NDIS.SYS!NdisRegisterProtocol]
[F7209950] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)
IAT
\\SystemRoot\\System32\\DRIVERS\\tcpip.sys[NDIS.SYS!NdisOpenAdapter]
[F7209770] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)
IAT
\\SystemRoot\\System32\\DRIVERS\\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol]
[F7209990] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)
IAT
\\SystemRoot\\System32\\DRIVERS\\wanarp.sys[NDIS.SYS!NdisRegisterProtocol]
[F7209950] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)
IAT
\\SystemRoot\\System32\\DRIVERS\\wanarp.sys[NDIS.SYS!NdisOpenAdapter]
[F7209770] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)
IAT
\\SystemRoot\\System32\\DRIVERS\\wanarp.sys[NDIS.SYS!NdisCloseAdapter]
[F7209710] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)
IAT
\\SystemRoot\\System32\\DRIVERS\\rdbss.sys[ntoskrnl.exe!IofCallDriver]
[F73C9CC6] sptd.sys
IAT
\\SystemRoot\\System32\\DRIVERS\\mrxsmb.sys[ntoskrnl.exe!IofCallDriver]
[F73C9CC6] sptd.sys
IAT
\\SystemRoot\\System32\\DRIVERS\\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol]
[F7209950] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)
IAT
\\SystemRoot\\System32\\DRIVERS\\ndisuio.sys[NDIS.SYS!NdisDeregisterProtocol]
[F7209990] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)
IAT
\\SystemRoot\\System32\\DRIVERS\\ndisuio.sys[NDIS.SYS!NdisCloseAdapter]
[F7209710] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)
IAT
\\SystemRoot\\System32\\DRIVERS\\ndisuio.sys[NDIS.SYS!NdisOpenAdapter]
[F7209770] inspect.sys (COMODO Internet Security Firewall Driver/COMODO)

RPal129
Novice
Novice

Posts Posts : 18
Joined Joined : 2009-01-01
OS OS : Windows XP Professional
Points Points : 28950
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Troj/Rustok-N - Have read other posts and still need some he

Post by RPal129 on Sun Jan 04, 2009 9:40 pm

---- User IAT/EAT - GMER 1.0.14 ----

IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[2092] @
C:\\WINDOWS\\system32\\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW]
[6BFA9DE1] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)
IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[2092] @
C:\\WINDOWS\\system32\\ADVAPI32.dll
[KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\\Program
Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[2092] @
C:\\WINDOWS\\system32\\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW]
[6BFA9CCD] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)
IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[2092] @
C:\\WINDOWS\\system32\\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA]
[6BFA9C46] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)
IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[2092] @ C:\\WINDOWS\\system32\\RPCRT4.dll
[KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\\Program Files\\Common
Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[2092] @
C:\\WINDOWS\\system32\\RPCRT4.dll [KERNEL32.dll!LoadLibraryW]
[6BFA9CCD] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)
IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[2092] @ C:\\WINDOWS\\system32\\RPCRT4.dll
[KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\\Program
Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[2092] @
C:\\WINDOWS\\system32\\USER32.dll [KERNEL32.dll!LoadLibraryExW]
[6BFA9DE1] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)
IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[2092] @ C:\\WINDOWS\\system32\\USER32.dll
[KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\\Program Files\\Common
Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[2092] @
C:\\WINDOWS\\system32\\USER32.dll
[KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\\Program
Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[2092] @
C:\\WINDOWS\\system32\\USER32.dll [KERNEL32.dll!LoadLibraryW]
[6BFA9CCD] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)
IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[2092] @ C:\\WINDOWS\\system32\\GDI32.dll
[KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\\Program
Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[2092] @
C:\\WINDOWS\\system32\\GDI32.dll [KERNEL32.dll!LoadLibraryExW]
[6BFA9DE1] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)
IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[2092] @ C:\\WINDOWS\\system32\\GDI32.dll
[KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\\Program Files\\Common
Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[2092] @
C:\\WINDOWS\\system32\\GDI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD]
C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL
Diagnostics/AOL LLC)
IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[2092] @ C:\\WINDOWS\\system32\\ole32.dll
[KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\\Program Files\\Common
Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[2092] @
C:\\WINDOWS\\system32\\ole32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD]
C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL
Diagnostics/AOL LLC)
IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[2092] @ C:\\WINDOWS\\system32\\ole32.dll
[KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\\Program Files\\Common
Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[2092] @
C:\\WINDOWS\\system32\\ole32.dll [KERNEL32.dll!LoadLibraryExA]
[6BFA9D54] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)
IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[2092] @ C:\\WINDOWS\\system32\\ole32.dll
[KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\\Program
Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[2092] @
C:\\WINDOWS\\system32\\SHLWAPI.dll
[KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\\Program
Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[2092] @
C:\\WINDOWS\\system32\\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA]
[6BFA9D54] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)
IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[2092] @ C:\\WINDOWS\\system32\\SHLWAPI.dll
[KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\\Program Files\\Common
Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[2092] @
C:\\WINDOWS\\system32\\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW]
[6BFA9CCD] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)
IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[2092] @ C:\\WINDOWS\\system32\\SHLWAPI.dll
[KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\\Program Files\\Common
Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[2092] @
C:\\WINDOWS\\system32\\secur32.dll
[KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\\Program
Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[2092] @
C:\\WINDOWS\\system32\\secur32.dll [KERNEL32.dll!LoadLibraryA]
[6BFA9C46] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)
IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[2092] @ C:\\WINDOWS\\system32\\secur32.dll
[KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\\Program Files\\Common
Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT
C:\\Program Files\\AIM6\\aim6.exe[2384] @
C:\\WINDOWS\\system32\\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW]
[6BFA9DE1] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)
IAT C:\\Program
Files\\AIM6\\aim6.exe[2384] @ C:\\WINDOWS\\system32\\ADVAPI32.dll
[KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\\Program
Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT
C:\\Program Files\\AIM6\\aim6.exe[2384] @
C:\\WINDOWS\\system32\\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW]
[6BFA9CCD] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)
IAT C:\\Program
Files\\AIM6\\aim6.exe[2384] @ C:\\WINDOWS\\system32\\ADVAPI32.dll
[KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\\Program Files\\Common
Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT
C:\\Program Files\\AIM6\\aim6.exe[2384] @
C:\\WINDOWS\\system32\\RPCRT4.dll [KERNEL32.dll!LoadLibraryA]
[6BFA9C46] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)
IAT C:\\Program
Files\\AIM6\\aim6.exe[2384] @ C:\\WINDOWS\\system32\\RPCRT4.dll
[KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\\Program Files\\Common
Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT
C:\\Program Files\\AIM6\\aim6.exe[2384] @
C:\\WINDOWS\\system32\\RPCRT4.dll
[KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\\Program
Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT
C:\\Program Files\\AIM6\\aim6.exe[2384] @
C:\\WINDOWS\\system32\\USER32.dll [KERNEL32.dll!LoadLibraryExW]
[6BFA9DE1] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)
IAT C:\\Program
Files\\AIM6\\aim6.exe[2384] @ C:\\WINDOWS\\system32\\USER32.dll
[KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\\Program Files\\Common
Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT
C:\\Program Files\\AIM6\\aim6.exe[2384] @
C:\\WINDOWS\\system32\\USER32.dll
[KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\\Program
Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT
C:\\Program Files\\AIM6\\aim6.exe[2384] @
C:\\WINDOWS\\system32\\USER32.dll [KERNEL32.dll!LoadLibraryW]
[6BFA9CCD] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)
IAT C:\\Program
Files\\AIM6\\aim6.exe[2384] @ C:\\WINDOWS\\system32\\GDI32.dll
[KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\\Program
Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT
C:\\Program Files\\AIM6\\aim6.exe[2384] @
C:\\WINDOWS\\system32\\GDI32.dll [KERNEL32.dll!LoadLibraryExW]
[6BFA9DE1] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)
IAT C:\\Program
Files\\AIM6\\aim6.exe[2384] @ C:\\WINDOWS\\system32\\GDI32.dll
[KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\\Program Files\\Common
Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT
C:\\Program Files\\AIM6\\aim6.exe[2384] @
C:\\WINDOWS\\system32\\GDI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD]
C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL
Diagnostics/AOL LLC)
IAT C:\\Program Files\\AIM6\\aim6.exe[2384] @
C:\\WINDOWS\\system32\\ole32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9C46]
C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL
Diagnostics/AOL LLC)
IAT C:\\Program Files\\AIM6\\aim6.exe[2384] @
C:\\WINDOWS\\system32\\ole32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD]
C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL
Diagnostics/AOL LLC)
IAT C:\\Program Files\\AIM6\\aim6.exe[2384] @
C:\\WINDOWS\\system32\\ole32.dll [KERNEL32.dll!LoadLibraryExW]
[6BFA9DE1] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)
IAT C:\\Program
Files\\AIM6\\aim6.exe[2384] @ C:\\WINDOWS\\system32\\ole32.dll
[KERNEL32.dll!LoadLibraryExA] [6BFA9D54] C:\\Program Files\\Common
Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT
C:\\Program Files\\AIM6\\aim6.exe[2384] @
C:\\WINDOWS\\system32\\ole32.dll
[KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\\Program
Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT
C:\\Program Files\\AIM6\\aim6.exe[2384] @
C:\\WINDOWS\\system32\\SHLWAPI.dll
[KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\\Program
Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT
C:\\Program Files\\AIM6\\aim6.exe[2384] @
C:\\WINDOWS\\system32\\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA]
[6BFA9D54] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)
IAT C:\\Program
Files\\AIM6\\aim6.exe[2384] @ C:\\WINDOWS\\system32\\SHLWAPI.dll
[KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\\Program Files\\Common
Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT
C:\\Program Files\\AIM6\\aim6.exe[2384] @
C:\\WINDOWS\\system32\\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW]
[6BFA9CCD] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)
IAT C:\\Program
Files\\AIM6\\aim6.exe[2384] @ C:\\WINDOWS\\system32\\SHLWAPI.dll
[KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\\Program Files\\Common
Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT
C:\\Program Files\\AIM6\\aim6.exe[2384] @
C:\\WINDOWS\\system32\\WININET.dll [ADVAPI32.dll!RegQueryValueExA]
[0101E070] c:\\program
files\\aim6\\services\\imApp\\ver6_8_15_1\\imAppService.dll
(imAppService EE Application Service/AOL LLC)
IAT C:\\Program
Files\\AIM6\\aim6.exe[2384] @ C:\\WINDOWS\\system32\\WININET.dll
[KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\\Program Files\\Common
Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT
C:\\Program Files\\AIM6\\aim6.exe[2384] @
C:\\WINDOWS\\system32\\WININET.dll [KERNEL32.dll!LoadLibraryExW]
[6BFA9DE1] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)
IAT C:\\Program
Files\\AIM6\\aim6.exe[2384] @ C:\\WINDOWS\\system32\\WININET.dll
[KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\\Program
Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)
IAT
C:\\Program Files\\AIM6\\aim6.exe[2384] @
C:\\WINDOWS\\system32\\WININET.dll [KERNEL32.dll!LoadLibraryA]
[6BFA9C46] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)
IAT C:\\Program
Files\\AIM6\\aim6.exe[2384] @ C:\\WINDOWS\\system32\\SHELL32.dll
[KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\\Program
Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

RPal129
Novice
Novice

Posts Posts : 18
Joined Joined : 2009-01-01
OS OS : Windows XP Professional
Points Points : 28950
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Troj/Rustok-N - Have read other posts and still need some he

Post by RPal129 on Sun Jan 04, 2009 9:40 pm

IAT
C:\\Program Files\\AIM6\\aim6.exe[2384] @
C:\\WINDOWS\\system32\\SHELL32.dll [KERNEL32.dll!LoadLibraryA]
[6BFA9C46] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)

IAT C:\\Program
Files\\AIM6\\aim6.exe[2384] @ C:\\WINDOWS\\system32\\SHELL32.dll
[KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\\Program Files\\Common
Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

IAT
C:\\Program Files\\AIM6\\aim6.exe[2384] @
C:\\WINDOWS\\system32\\SHELL32.dll [KERNEL32.dll!LoadLibraryExW]
[6BFA9DE1] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)

IAT C:\\Program
Files\\AIM6\\aim6.exe[2384] @ C:\\WINDOWS\\system32\\SHELL32.dll
[KERNEL32.dll!LoadLibraryExA] [6BFA9D54] C:\\Program Files\\Common
Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

IAT
C:\\Program Files\\AIM6\\aim6.exe[2384] @
C:\\WINDOWS\\system32\\NETAPI32.dll [KERNEL32.dll!LoadLibraryW]
[6BFA9CCD] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)

IAT C:\\Program
Files\\AIM6\\aim6.exe[2384] @ C:\\WINDOWS\\system32\\NETAPI32.dll
[KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\\Program
Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

IAT
C:\\Program Files\\AIM6\\aim6.exe[2384] @
C:\\WINDOWS\\system32\\NETAPI32.dll [KERNEL32.dll!LoadLibraryA]
[6BFA9C46] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)

IAT C:\\Program
Files\\AIM6\\aim6.exe[2384] @ C:\\WINDOWS\\system32\\Secur32.dll
[KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\\Program
Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

IAT
C:\\Program Files\\AIM6\\aim6.exe[2384] @
C:\\WINDOWS\\system32\\Secur32.dll [KERNEL32.dll!LoadLibraryA]
[6BFA9C46] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)

IAT C:\\Program
Files\\AIM6\\aim6.exe[2384] @ C:\\WINDOWS\\system32\\Secur32.dll
[KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\\Program Files\\Common
Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

IAT
C:\\Program Files\\AIM6\\aim6.exe[2384] @
C:\\WINDOWS\\system32\\USERENV.dll [KERNEL32.dll!LoadLibraryW]
[6BFA9CCD] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)

IAT C:\\Program
Files\\AIM6\\aim6.exe[2384] @ C:\\WINDOWS\\system32\\USERENV.dll
[KERNEL32.dll!LoadLibraryExA] [6BFA9D54] C:\\Program Files\\Common
Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

IAT
C:\\Program Files\\AIM6\\aim6.exe[2384] @
C:\\WINDOWS\\system32\\USERENV.dll [KERNEL32.dll!LoadLibraryA]
[6BFA9C46] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)

IAT C:\\Program
Files\\AIM6\\aim6.exe[2384] @ C:\\WINDOWS\\system32\\USERENV.dll
[KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\\Program
Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

IAT
C:\\Program Files\\AIM6\\aim6.exe[2384] @
C:\\WINDOWS\\system32\\iphlpapi.dll
[KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\\Program
Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

IAT
C:\\Program Files\\AIM6\\aim6.exe[2384] @
C:\\WINDOWS\\system32\\iphlpapi.dll [KERNEL32.dll!LoadLibraryA]
[6BFA9C46] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)

IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[3132] @
C:\\WINDOWS\\system32\\ADVAPI32.dll [KERNEL32.dll!LoadLibraryExW]
[6BFA9DE1] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)

IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[3132] @
C:\\WINDOWS\\system32\\ADVAPI32.dll
[KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\\Program
Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[3132] @
C:\\WINDOWS\\system32\\ADVAPI32.dll [KERNEL32.dll!LoadLibraryW]
[6BFA9CCD] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)

IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[3132] @
C:\\WINDOWS\\system32\\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA]
[6BFA9C46] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)

IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[3132] @ C:\\WINDOWS\\system32\\RPCRT4.dll
[KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\\Program Files\\Common
Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[3132] @
C:\\WINDOWS\\system32\\RPCRT4.dll [KERNEL32.dll!LoadLibraryW]
[6BFA9CCD] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)

IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[3132] @ C:\\WINDOWS\\system32\\RPCRT4.dll
[KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\\Program
Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[3132] @
C:\\WINDOWS\\system32\\USER32.dll [KERNEL32.dll!LoadLibraryExW]
[6BFA9DE1] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)

IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[3132] @ C:\\WINDOWS\\system32\\USER32.dll
[KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\\Program Files\\Common
Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[3132] @
C:\\WINDOWS\\system32\\USER32.dll
[KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\\Program
Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[3132] @
C:\\WINDOWS\\system32\\USER32.dll [KERNEL32.dll!LoadLibraryW]
[6BFA9CCD] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)

IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[3132] @ C:\\WINDOWS\\system32\\GDI32.dll
[KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\\Program
Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[3132] @
C:\\WINDOWS\\system32\\GDI32.dll [KERNEL32.dll!LoadLibraryExW]
[6BFA9DE1] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)

IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[3132] @ C:\\WINDOWS\\system32\\GDI32.dll
[KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\\Program Files\\Common
Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[3132] @
C:\\WINDOWS\\system32\\GDI32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD]
C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL
Diagnostics/AOL LLC)

IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[3132] @ C:\\WINDOWS\\system32\\ole32.dll
[KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\\Program Files\\Common
Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[3132] @
C:\\WINDOWS\\system32\\ole32.dll [KERNEL32.dll!LoadLibraryW] [6BFA9CCD]
C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL
Diagnostics/AOL LLC)

IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[3132] @ C:\\WINDOWS\\system32\\ole32.dll
[KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\\Program Files\\Common
Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[3132] @
C:\\WINDOWS\\system32\\ole32.dll [KERNEL32.dll!LoadLibraryExA]
[6BFA9D54] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)

IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[3132] @ C:\\WINDOWS\\system32\\ole32.dll
[KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\\Program
Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[3132] @
C:\\WINDOWS\\system32\\SHLWAPI.dll
[KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\\Program
Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[3132] @
C:\\WINDOWS\\system32\\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA]
[6BFA9D54] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)

IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[3132] @ C:\\WINDOWS\\system32\\SHLWAPI.dll
[KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\\Program Files\\Common
Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[3132] @
C:\\WINDOWS\\system32\\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW]
[6BFA9CCD] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)

IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[3132] @ C:\\WINDOWS\\system32\\SHLWAPI.dll
[KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\\Program Files\\Common
Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[3132] @
C:\\WINDOWS\\system32\\WININET.dll [KERNEL32.dll!LoadLibraryW]
[6BFA9CCD] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)

IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[3132] @ C:\\WINDOWS\\system32\\WININET.dll
[KERNEL32.dll!LoadLibraryExW] [6BFA9DE1] C:\\Program Files\\Common
Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[3132] @
C:\\WINDOWS\\system32\\WININET.dll
[KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\\Program
Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[3132] @
C:\\WINDOWS\\system32\\WININET.dll [KERNEL32.dll!LoadLibraryA]
[6BFA9C46] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)

IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[3132] @ C:\\WINDOWS\\system32\\Secur32.dll
[KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\\Program
Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[3132] @
C:\\WINDOWS\\system32\\Secur32.dll [KERNEL32.dll!LoadLibraryA]
[6BFA9C46] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)

IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[3132] @ C:\\WINDOWS\\system32\\Secur32.dll
[KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\\Program Files\\Common
Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[3132] @
C:\\WINDOWS\\system32\\SHELL32.dll
[KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\\Program
Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[3132] @
C:\\WINDOWS\\system32\\SHELL32.dll [KERNEL32.dll!LoadLibraryA]
[6BFA9C46] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)

IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[3132] @ C:\\WINDOWS\\system32\\SHELL32.dll
[KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\\Program Files\\Common
Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[3132] @
C:\\WINDOWS\\system32\\SHELL32.dll [KERNEL32.dll!LoadLibraryExW]
[6BFA9DE1] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)

IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[3132] @ C:\\WINDOWS\\system32\\SHELL32.dll
[KERNEL32.dll!LoadLibraryExA] [6BFA9D54] C:\\Program Files\\Common
Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[3132] @
C:\\WINDOWS\\system32\\NETAPI32.dll [KERNEL32.dll!LoadLibraryW]
[6BFA9CCD] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)

IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[3132] @
C:\\WINDOWS\\system32\\NETAPI32.dll
[KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\\Program
Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[3132] @
C:\\WINDOWS\\system32\\NETAPI32.dll [KERNEL32.dll!LoadLibraryA]
[6BFA9C46] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)

IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[3132] @ C:\\WINDOWS\\system32\\USERENV.dll
[KERNEL32.dll!LoadLibraryW] [6BFA9CCD] C:\\Program Files\\Common
Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[3132] @
C:\\WINDOWS\\system32\\USERENV.dll [KERNEL32.dll!LoadLibraryExA]
[6BFA9D54] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)

IAT C:\\Program
Files\\AIM6\\aolsoftware.exe[3132] @ C:\\WINDOWS\\system32\\USERENV.dll
[KERNEL32.dll!LoadLibraryA] [6BFA9C46] C:\\Program Files\\Common
Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[3132] @
C:\\WINDOWS\\system32\\USERENV.dll
[KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\\Program
Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[3132] @
C:\\WINDOWS\\system32\\iphlpapi.dll
[KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9E6E] C:\\Program
Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll (AOL Diagnostics/AOL LLC)

IAT
C:\\Program Files\\AIM6\\aolsoftware.exe[3132] @
C:\\WINDOWS\\system32\\iphlpapi.dll [KERNEL32.dll!LoadLibraryA]
[6BFA9C46] C:\\Program Files\\Common Files\\AOL\\AOLDiag\\tbdiag.dll
(AOL Diagnostics/AOL LLC)

RPal129
Novice
Novice

Posts Posts : 18
Joined Joined : 2009-01-01
OS OS : Windows XP Professional
Points Points : 28950
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Troj/Rustok-N - Have read other posts and still need some he

Post by RPal129 on Sun Jan 04, 2009 9:40 pm

---- Devices - GMER 1.0.14 ----





Device
\\FileSystem\\Ntfs \\Ntfs 86FA3808





AttachedDevice
\\FileSystem\\Ntfs \\Ntfs hptpro.sys (Hptpro/HighPoint Technologies,
Inc.)


AttachedDevice \\FileSystem\\Ntfs \\Ntfs SYMEVENT.SYS
(Symantec Event Library/Symantec Corporation)


AttachedDevice
\\Driver\\Tcpip \\Device\\Ip cmdhlp.sys (COMODO Internet Security
Helper Driver/COMODO)


AttachedDevice \\Driver\\Tcpip \\Device\\Ip
SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)





Device
\\Driver\\dmio \\Device\\DmControl\\DmIoDaemon 86FA30E8


Device
\\Driver\\dmio \\Device\\DmControl\\DmConfig 86FA30E8


Device
\\Driver\\dmio \\Device\\DmControl\\DmPnP 86FA30E8


Device
\\Driver\\dmio \\Device\\DmControl\\DmInfo 86FA30E8


Device
\\Driver\\00000049 \\Device\\00000060 sptd.sys





AttachedDevice
\\Driver\\Tcpip \\Device\\Tcp cmdhlp.sys (COMODO Internet Security
Helper Driver/COMODO)


AttachedDevice \\Driver\\Tcpip \\Device\\Tcp
SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)





Device
\\Driver\\Ftdisk \\Device\\HarddiskVolume1 86FC73A0


Device
\\Driver\\Ftdisk \\Device\\HarddiskVolume2 86FC73A0


Device
\\Driver\\Cdrom \\Device\\CdRom0 8681DEB0


Device \\FileSystem\\Rdbss
\\Device\\FsWrap 86866BA8


Device \\Driver\\Cdrom \\Device\\CdRom1
8681DEB0


Device \\Driver\\Ftdisk \\Device\\HarddiskVolume3 86FC73A0


Device
\\Driver\\NetBT
\\Device\\NetBT_Tcpip_{44B95288-D6E8-4F01-83CA-41639AC64552} 865BE0E8


Device
\\Driver\\Cdrom \\Device\\CdRom2 8681DEB0


Device \\Driver\\NetBT
\\Device\\NetBt_Wins_Export 865BE0E8


Device \\Driver\\NetBT
\\Device\\NetbiosSmb 865BE0E8





AttachedDevice \\Driver\\Tcpip
\\Device\\Udp cmdhlp.sys (COMODO Internet Security Helper Driver/COMODO)


AttachedDevice
\\Driver\\Tcpip \\Device\\Udp SYMTDI.SYS (Network Dispatch
Driver/Symantec Corporation)





Device \\Driver\\Disk
\\Device\\Harddisk0\\DR0 86FA3A40





AttachedDevice \\Driver\\Tcpip
\\Device\\RawIp cmdhlp.sys (COMODO Internet Security Helper
Driver/COMODO)


AttachedDevice \\Driver\\Tcpip \\Device\\RawIp
SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)





Device
\\Driver\\Disk \\Device\\Harddisk1\\DR1 86FA3A40


Device
\\Driver\\Disk \\Device\\Harddisk2\\DR2 86FA3A40


Device
\\FileSystem\\MRxSmb \\Device\\LanmanDatagramReceiver 865D10E8


Device
\\FileSystem\\MRxSmb \\Device\\LanmanRedirector 865D10E8


Device
\\FileSystem\\Npfs \\Device\\NamedPipe 865D80E8


Device
\\Driver\\Ftdisk \\Device\\FtControl 86FC73A0


Device
\\FileSystem\\Msfs \\Device\\Mailslot 865DB0E8


Device
\\Driver\\HPT302 \\Device\\Scsi\\HPT3022Port2Path2Target0Lun0 86FA3C78


Device
\\Driver\\HPT302 \\Device\\Scsi\\HPT3022Port2Path1Target0Lun0 86FA3C78


Device
\\Driver\\HPT302 \\Device\\Scsi\\HPT3022 86FA3C78


Device
\\Driver\\dtscsi \\Device\\Scsi\\dtscsi1 8668F9C8


Device
\\Driver\\dtscsi \\Device\\Scsi\\dtscsi1Port3Path0Target0Lun0 8668F9C8


Device
\\FileSystem\\Cdfs \\Cdfs 8678E0E8





---- Registry - GMER 1.0.14 ----





Reg
HKLM\\SYSTEM\\CurrentControlSet\\Services\\sptd\\Cfg@s0 282485642


Reg
HKLM\\SYSTEM\\CurrentControlSet\\Services\\sptd\\Cfg@s1 807901256


Reg
HKLM\\SYSTEM\\CurrentControlSet\\Services\\sptd\\Cfg@s2 179151355


Reg
HKLM\\SYSTEM\\CurrentControlSet\\Services\\sptd\\Cfg@h0 1


Reg
HKLM\\SYSTEM\\CurrentControlSet\\Services\\sptd\\Cfg\\19659239224E364682FA4BAF72C53EA4



Reg
HKLM\\SYSTEM\\CurrentControlSet\\Services\\sptd\\Cfg\\19659239224E364682FA4BAF72C53EA4@p0
D:\\DAEMON Tools\\


Reg
HKLM\\SYSTEM\\CurrentControlSet\\Services\\sptd\\Cfg\\19659239224E364682FA4BAF72C53EA4@h0
0


Reg
HKLM\\SYSTEM\\CurrentControlSet\\Services\\sptd\\Cfg\\19659239224E364682FA4BAF72C53EA4@khjeh
0xF2 0xAC 0x45 0x44 ...


Reg
HKLM\\SYSTEM\\CurrentControlSet\\Services\\sptd\\Cfg\\19659239224E364682FA4BAF72C53EA4\\00000001



Reg
HKLM\\SYSTEM\\CurrentControlSet\\Services\\sptd\\Cfg\\19659239224E364682FA4BAF72C53EA4\\00000001@a0
0x20 0x01 0x00 0x00 ...


Reg
HKLM\\SYSTEM\\CurrentControlSet\\Services\\sptd\\Cfg\\19659239224E364682FA4BAF72C53EA4\\00000001@khjeh
0xD9 0x3A 0xDF 0x07 ...


Reg
HKLM\\SYSTEM\\CurrentControlSet\\Services\\sptd\\Cfg\\19659239224E364682FA4BAF72C53EA4\\00000001\\0Jf40



Reg
HKLM\\SYSTEM\\CurrentControlSet\\Services\\sptd\\Cfg\\19659239224E364682FA4BAF72C53EA4\\00000001\\0Jf40@khjeh
0x98 0xAB 0x77 0x9B ...


Reg
HKLM\\SYSTEM\\ControlSet002\\Services\\sptd\\Cfg\\19659239224E364682FA4BAF72C53EA4



Reg
HKLM\\SYSTEM\\ControlSet002\\Services\\sptd\\Cfg\\19659239224E364682FA4BAF72C53EA4@p0
D:\\DAEMON Tools\\


Reg
HKLM\\SYSTEM\\ControlSet002\\Services\\sptd\\Cfg\\19659239224E364682FA4BAF72C53EA4@h0
0


Reg
HKLM\\SYSTEM\\ControlSet002\\Services\\sptd\\Cfg\\19659239224E364682FA4BAF72C53EA4@khjeh
0xF2 0xAC 0x45 0x44 ...


Reg
HKLM\\SYSTEM\\ControlSet002\\Services\\sptd\\Cfg\\19659239224E364682FA4BAF72C53EA4\\00000001



Reg
HKLM\\SYSTEM\\ControlSet002\\Services\\sptd\\Cfg\\19659239224E364682FA4BAF72C53EA4\\00000001@a0
0x20 0x01 0x00 0x00 ...


Reg
HKLM\\SYSTEM\\ControlSet002\\Services\\sptd\\Cfg\\19659239224E364682FA4BAF72C53EA4\\00000001@khjeh
0xD9 0x3A 0xDF 0x07 ...


Reg
HKLM\\SYSTEM\\ControlSet002\\Services\\sptd\\Cfg\\19659239224E364682FA4BAF72C53EA4\\00000001\\0Jf40



Reg
HKLM\\SYSTEM\\ControlSet002\\Services\\sptd\\Cfg\\19659239224E364682FA4BAF72C53EA4\\00000001\\0Jf40@khjeh
0xB5 0x35 0x1B 0x60 ...


Reg
HKLM\\SYSTEM\\ControlSet003\\Services\\sptd\\Cfg\\19659239224E364682FA4BAF72C53EA4



Reg
HKLM\\SYSTEM\\ControlSet003\\Services\\sptd\\Cfg\\19659239224E364682FA4BAF72C53EA4@p0
D:\\DAEMON Tools\\


Reg
HKLM\\SYSTEM\\ControlSet003\\Services\\sptd\\Cfg\\19659239224E364682FA4BAF72C53EA4@h0
0


Reg
HKLM\\SYSTEM\\ControlSet003\\Services\\sptd\\Cfg\\19659239224E364682FA4BAF72C53EA4@khjeh
0xF2 0xAC 0x45 0x44 ...


Reg
HKLM\\SYSTEM\\ControlSet003\\Services\\sptd\\Cfg\\19659239224E364682FA4BAF72C53EA4\\00000001



Reg
HKLM\\SYSTEM\\ControlSet003\\Services\\sptd\\Cfg\\19659239224E364682FA4BAF72C53EA4\\00000001@a0
0x20 0x01 0x00 0x00 ...


Reg
HKLM\\SYSTEM\\ControlSet003\\Services\\sptd\\Cfg\\19659239224E364682FA4BAF72C53EA4\\00000001@khjeh
0xD9 0x3A 0xDF 0x07 ...


Reg
HKLM\\SYSTEM\\ControlSet003\\Services\\sptd\\Cfg\\19659239224E364682FA4BAF72C53EA4\\00000001\\0Jf40



Reg
HKLM\\SYSTEM\\ControlSet003\\Services\\sptd\\Cfg\\19659239224E364682FA4BAF72C53EA4\\00000001\\0Jf40@khjeh
0x98 0xAB 0x77 0x9B ...





---- EOF - GMER 1.0.14 ----

RPal129
Novice
Novice

Posts Posts : 18
Joined Joined : 2009-01-01
OS OS : Windows XP Professional
Points Points : 28950
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Troj/Rustok-N - Have read other posts and still need some he

Post by Belahzur on Sun Jan 04, 2009 10:29 pm

No rootkit there neither.
I think whatever website is telling you that, is just crap.
Lets try this though.

Start > Run
Type in:
ipconfig /flushdns
Press enter.

Download [You must be registered and logged in to see this link.]

  • Double-click ATF-Cleaner.exe to run the program.
  • Click Select All found at the bottom of the list.
  • Click the Empty Selected button.
If you use Firefox browser, do this also:

  • Click Firefox at the top and choose Select All from the list.
  • Click the Empty Selected button.
  • NOTE : If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browser, do this also:

  • Click Opera at the top and choose Select All from the list.
  • Click the Empty Selected button.
  • NOTE : If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245059
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Troj/Rustok-N - Have read other posts and still need some he

Post by RPal129 on Sun Jan 04, 2009 11:34 pm

Ok. Did all that. I assume its just total crap. Thanks a bunch for all your help.

RPal129
Novice
Novice

Posts Posts : 18
Joined Joined : 2009-01-01
OS OS : Windows XP Professional
Points Points : 28950
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: Troj/Rustok-N - Have read other posts and still need some he

Post by Belahzur on Sun Jan 04, 2009 11:46 pm

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers. Goofy

1) Please navigate to [You must be registered and logged in to see this link.] and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

[You must be registered and logged in to see this link.]
A tutorial on using Ad-Aware to remove spyware from your computer may be found [You must be registered and logged in to see this link.].

[You must be registered and logged in to see this link.]
A tutorial on using Spybot to remove spyware from your computer may be found [You must be registered and logged in to see this link.]. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

[You must be registered and logged in to see this link.]
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found [You must be registered and logged in to see this link.].

[You must be registered and logged in to see this link.]
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found [You must be registered and logged in to see this link.].

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
[You must be registered and logged in to see this link.]
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
[You must be registered and logged in to see this link.]

5) Finally, consider maintaining a firewall. Some good free firewalls are [You must be registered and logged in to see this link.], or
[You must be registered and logged in to see this link.]
A tutorial on understanding and using firewalls may be found [You must be registered and logged in to see this link.].

Please also read Tony Klein's excellent article: [You must be registered and logged in to see this link.]

Hopefully this should take care of your problems! Good luck. Big Grin


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245059
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: Troj/Rustok-N - Have read other posts and still need some he

Post by Doctor Inferno on Sat Feb 21, 2009 10:05 am

Since this issue is resolved, this topic is closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter.

Everyone else, please open a new topic for your questions.


Please be a GeekPolice fan on [You must be registered and logged in to see this link.]



Have we helped you? [You must be registered and logged in to see this link.] | Doctor by day, ninja by night.

Doctor Inferno
Administrator
Administrator

Posts Posts : 12017
Joined Joined : 2007-12-26
Gender Gender : Male
OS OS : Windows 7 Home Premium and Ultimate X64
Protection Protection : Kaspersky PURE and Malwarebytes' Anti-Malware
Points Points : 104594
# Likes # Likes : 0

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum