[trampas]

Hey guys

I've had a virus on my PC for some time, acquired from a drive-by install at a particular, seemingly friendly, web site (name available on request). That was when I was using IE as the browser and windows firewall. (I believed I was protected !) The web site owner is a hacker who likes to remote control the PC, doing silly things to it, sometimes not-so-silly e.g. deleting files. In the past my email passwords have been logged and then changed by the hacker. (This is the short version.) I've rebuilt the PC a couple of times but never been certain that the virus was eliminated - it was never detectable by Avast or Avira. The virus was still present after the first rebuild. All things considered I suspect there's a rootkit on the PC as well.

Since the last rebuild I've been trying not to connect that PC to the internet as the virus cannot be remote-controlled unless there's an internet connection. I recently connected it, as a test, and downloaded some files. The next day the Downloads folder and the files had disappeared. Those files are not in the recycle bin and they're not visible when I run an undelete utility program. So I suspect more silly games but, until more weird things happen, it's going to be difficult to be certain that a virus is still present. However, I'd rather not wait until more data is deleted so I recently started running rootkit detection programs.

I ran Rootkit Unhooker LE v3.7.300.505 and requested a report/scan on all 6 tabs. At the end of the long log was the caution : '!!POSSIBLE ROOTKIT ACTIVITY DETECTED!! =)'. I suspect that this derives from one of these tabs : SSDT State, Files, Hooks as those were the only ones that had specific comments in the log. None of the comments was highlighted in red.

Just for info, I ran a separate scan on Drivers and Stealth and got the response: 'Nothing detected :('.

I have also run TDSSkiller - about 180 objects were examined, of which 125 were unsigned and flagged as a medium risk. But there was no detection of a rootkit.

Using IceSword I scanned for rootkits and received this comment during step 2 :
HKEY_CLASSES_ROOT\htafile\shell\open\command : C:\WINDOWS\system32\mshta.exe "%1" %*

I'm not sure what to do with that comment, or with the warning from Rootkit Unhooker. I've attached an OTL log for you guys to look at.

As I say, it feels as though someone is giving the virus instructions whenever the PC is connected to the internet, so I try to limit this. The PC is currently loaded with XP SP3, which comes from a setup CD, but I haven't downloaded the latest MS updates as that would require a long internet connection.

trampas


OTL logfile created on: 4/02/2012 9:05:37 AM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Owner\My Documents
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

510.73 Mb Total Physical Memory | 152.12 Mb Available Physical Memory | 29.78% Memory free
1.22 Gb Paging File | 0.82 Gb Available in Paging File | 67.52% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.52 Gb Total Space | 53.37 Gb Free Space | 71.62% Space Free | Partition Type: NTFS
Drive E: | 3.72 Gb Total Space | 3.72 Gb Free Space | 99.88% Space Free | Partition Type: FAT32

Computer Name: ZTT-VANILLA | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/02/04 08:53:10 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\My Documents\OTL.exe
PRC - [2011/10/05 10:18:37 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011/10/05 10:18:29 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2011/10/05 10:18:17 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011/10/05 10:18:17 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2011/03/18 01:26:14 | 002,435,592 | ---- | M] (Check Point Software Technologies LTD) -- C:\WINDOWS\system32\ZoneLabs\vsmon.exe
PRC - [2011/03/18 01:24:50 | 001,043,968 | ---- | M] (Check Point Software Technologies LTD) -- C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
PRC - [2010/01/14 16:08:16 | 000,378,128 | ---- | M] (PC Tools) -- C:\Program Files\ThreatFire\TFTray.exe
PRC - [2010/01/14 16:08:12 | 000,070,928 | ---- | M] (PC Tools) -- C:\Program Files\ThreatFire\TFService.exe
PRC - [2008/04/14 05:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2003/04/04 13:38:52 | 000,774,144 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
PRC - [2003/02/12 19:55:52 | 001,334,784 | ---- | M] () -- C:\WINDOWS\system32\TCAUDIAG.EXE
PRC - [2002/09/20 15:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe


========== Modules (No Company Name) ==========

MOD - [2011/10/05 10:18:31 | 000,398,288 | ---- | M] () -- C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll
MOD - [2003/02/12 19:55:52 | 001,334,784 | ---- | M] () -- C:\WINDOWS\system32\TCAUDIAG.EXE


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2012/02/03 14:30:36 | 000,392,064 | ---- | M] (Sysinternals - www.sysinternals.com) [On_Demand | Stopped] -- C:\Documents and Settings\Owner\Local Settings\Temp\AXHSXR.exe -- (AXHSXR)
SRV - [2011/10/05 10:18:29 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011/10/05 10:18:17 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/03/18 01:26:14 | 002,435,592 | ---- | M] (Check Point Software Technologies LTD) [Auto | Running] -- C:\WINDOWS\System32\ZoneLabs\vsmon.exe -- (vsmon)
SRV - [2010/01/14 16:08:12 | 000,070,928 | ---- | M] (PC Tools) [Auto | Running] -- C:\Program Files\ThreatFire\TFService.exe -- (ThreatFire)
SRV - [2002/09/20 15:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) [Auto | Running] -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default))


========== Driver Services (SafeList) ==========

DRV - [2011/09/18 08:39:27 | 000,134,344 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2011/09/15 23:55:04 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011/09/15 23:55:03 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010/06/17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010/05/13 10:02:32 | 000,532,224 | ---- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] -- C:\WINDOWS\system32\vsdatant.sys -- (vsdatant)
DRV - [2010/01/14 16:08:30 | 000,059,664 | ---- | M] (PC Tools) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\TfSysMon.sys -- (TfSysMon)
DRV - [2010/01/14 16:08:28 | 000,051,984 | ---- | M] (PC Tools) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\TfFsMon.sys -- (TfFsMon)
DRV - [2010/01/14 16:08:28 | 000,033,552 | ---- | M] (PC Tools) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\TfNetMon.sys -- (TfNetMon)
DRV - [2008/03/17 11:03:46 | 000,101,376 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2003/04/18 03:12:00 | 000,073,856 | R--- | M] (VIA Technologies inc,.ltd) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\viaraid.sys -- (viaraid)
DRV - [2003/04/17 18:15:22 | 000,147,328 | ---- | M] (3Com Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\EL2K_XP.sys -- (EL2000)
DRV - [2002/09/20 12:53:34 | 000,235,100 | ---- | M] (Analog Devices Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\MidiSyn.sys -- (MidiSyn)
DRV - [2001/09/04 21:22:52 | 000,019,534 | ---- | M] (3Com Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\TCAITDI.SYS -- (TCAITDI)
DRV - [2000/06/07 04:08:04 | 000,021,233 | ---- | M] (3Com Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\TCAICCHG.SYS -- (tcaicchg)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0




O1 HOSTS File: ([2003/03/31 22:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NVCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [TCASUTIEXE] C:\WINDOWS\System32\TCAUDIAG.EXE ()
O4 - HKLM..\Run: [ThreatFire] C:\Program Files\ThreatFire\TFTray.exe (PC Tools)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [Mobile Partner] C:\Program Files\3 MobileBroadband\3 MobileBroadband.exe ()
O4 - HKCU..\Run: [NvMediaCenter] C:\WINDOWS\System32\NVMCTRAY.DLL (NVIDIA Corporation)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011/11/01 18:55:18 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{e00f4602-04ea-11e1-ad50-000c6e64e9a1}\Shell - "" = AutoRun
O33 - MountPoints2\{e00f4602-04ea-11e1-ad50-000c6e64e9a1}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e00f4602-04ea-11e1-ad50-000c6e64e9a1}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{e00f4604-04ea-11e1-ad50-000c6e64e9a1}\Shell - "" = AutoRun
O33 - MountPoints2\{e00f4604-04ea-11e1-ad50-000c6e64e9a1}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e00f4604-04ea-11e1-ad50-000c6e64e9a1}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/02/04 09:05:19 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Owner\My Documents\OTL.exe
[2012/02/04 08:21:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\eSupport.com
[2012/02/04 08:21:13 | 000,000,000 | ---D | C] -- C:\Program Files\eSupport.com
[2012/02/03 19:34:51 | 000,000,000 | -H-D | C] -- C:\WINDOWS\PIF
[2012/02/03 19:01:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Start Menu\Programs\Rootkit Unhooker
[2012/02/03 19:01:19 | 000,000,000 | ---D | C] -- C:\Program Files\RkUnhooker
[2012/02/03 19:00:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\My Documents\RkU37300505
[2012/02/03 17:15:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\My Documents\IceSword122en
[2012/02/03 14:29:38 | 000,334,720 | ---- | C] (Sysinternals - www.sysinternals.com) -- C:\Documents and Settings\Owner\My Documents\RootesttkitRevealer.exe
[2012/02/02 06:24:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\ThreatFire
[2012/02/02 06:24:00 | 000,059,664 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\TfSysMon.sys
[2012/02/02 06:24:00 | 000,051,984 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\TfFsMon.sys
[2012/02/02 06:24:00 | 000,033,552 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\TfNetMon.sys
[2012/02/02 06:23:58 | 000,000,000 | ---D | C] -- C:\Program Files\ThreatFire
[2012/02/02 06:23:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\PC Tools
[2012/01/13 11:17:52 | 000,000,000 | -HSD | C] -- C:\found.001
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/02/04 08:53:10 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\My Documents\OTL.exe
[2012/02/04 08:21:15 | 000,000,790 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\NTFS Undelete.lnk
[2012/02/03 18:57:41 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/02/03 18:57:40 | 535,613,440 | -HS- | M] () -- C:\hiberfil.sys
[2012/02/02 06:24:03 | 000,000,621 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\ThreatFire.lnk
[2012/02/01 09:25:25 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/02/04 08:21:15 | 000,000,790 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\NTFS Undelete.lnk
[2012/02/03 14:29:34 | 000,102,160 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\RootesttkitRevealer.chm
[2012/02/03 12:45:02 | 000,302,592 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\gtestmer.exe
[2012/02/02 06:24:03 | 000,000,621 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\ThreatFire.lnk
[2012/02/02 06:08:20 | 535,613,440 | -HS- | C] () -- C:\hiberfil.sys
[2011/11/22 07:53:02 | 000,000,693 | ---- | C] () -- C:\Program Files\Shortcut to CoolPDFReader.exe.lnk
[2011/11/04 07:20:19 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2011/11/02 08:56:40 | 000,004,212 | -H-- | C] () -- C:\WINDOWS\System32\zllictbl.dat
[2011/11/02 04:43:02 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2011/11/02 04:42:06 | 000,254,272 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/11/01 19:22:27 | 000,025,853 | R--- | C] () -- C:\WINDOWS\System32\sk98nt4.ini
[2011/11/01 19:22:27 | 000,025,853 | R--- | C] () -- C:\WINDOWS\System32\InstInfo.ini
[2011/11/01 19:19:59 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2011/11/01 19:19:59 | 000,003,366 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2011/11/01 19:03:19 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\INFSETUP.exe
[2011/11/01 18:57:00 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2011/11/01 18:53:03 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2008/04/14 05:55:28 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2006/12/31 07:57:08 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2003/03/31 22:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2003/03/31 22:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2003/03/31 22:00:00 | 000,311,604 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2003/03/31 22:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2003/03/31 22:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2003/03/31 22:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2003/03/31 22:00:00 | 000,039,992 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2003/03/31 22:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2003/03/31 22:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2003/03/31 22:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2003/02/12 19:55:52 | 001,334,784 | ---- | C] () -- C:\WINDOWS\System32\TCAUDIAG.EXE

========== LOP Check ==========

[2011/11/22 11:19:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\SumatraPDF
[2011/11/22 11:12:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\YcanPDF

========== Purity Check ==========



< End of report >

[Advertisements]

Hello trampas and sorry about the delay.

If you're certain that the computer is compromised then this PC can't be trusted again and the best course of action here is to change all your passwords using a clean PC and then wipe everything, reinstall the OS and start from scratch again.

Please let me know your thoughts.

[sempai]

Hello trampas and sorry about the delay.

If you're certain that the computer is compromised then this PC can't be trusted again and the best course of action here is to change all your passwords using a clean PC and then wipe everything, reinstall the OS and start from scratch again.

Please let me know your thoughts.

[trampas]

Hi sempai

Thanks very much for picking up my case ! I will send you a PM with some further information which (hopefully) explains why I would prefer to identify and remove the virus and rootkit from my desktop PC.

I'm sending this message from a laptop PC which, as far as I can tell, is clean.

Regards,
trampas

[sempai]

Please do the following:


1. Please run OTL again and post the new report for my review.



2. Download GMER Rootkit Scanner from here.

• Extract the contents of the zipped file to the desktop.
• Double click GMER.exe and if you are asked if you want to allow gmer.sys driver to load, please allow it to do so.
• If it gives you a warning about rootkit activity and asks if you want to run scan, please click on NO.
• In the right panel you will see several boxes that have been checked. Unchecked the following checkboxes:
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
• Now click on the Scan button and wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in ark.txt and save it to your desktop.
• Post the contents of that report when you reply.

[trampas]

Hi sempai

I already have a copy of GMER (v1.0.15.15641, 3 Feb 2012) on the PC, though the exe is in a folder rather than on the desktop. I just wanted to check whether that would make a difference.

When I run OTL do you want EXTRAS.TXT as well or just OTL.TXT ?

For info, I ran GMER with the settings that you requested and after about 30 seconds the PC gave me a BSOD (see below). The PC had just been rebooted and nothing else was running. I was logged in as an administrator. When the PC was rebooted I was given the option to view a log of the error. That option is still on the screen.

trampas

"A problem has been detected and windows has been shut down to prevent damage to your computer.

DRIVER_IRQL_NOT_LESS_OR_EQUAL

If this is the first time .....

Technical information:
*** STOP: 0x000000D1 (0x007500BC, 0x00000002, 0x00000001, 0xF8476DB8)

*** SCSIPORT.SYS - Address F8476DB8 base at F8475000, Datestamp 4802539d"

[sempai]

Hi,

Just run OTL for now and post the contents of OTL.TXT, EXTRAS.TXT is only available on the first OTL run.

[trampas]

OTL logfile created on: 15/02/2012 6:31:34 AM - Run 2
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Owner\My Documents
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

510.73 Mb Total Physical Memory | 235.06 Mb Available Physical Memory | 46.02% Memory free
1.22 Gb Paging File | 0.86 Gb Available in Paging File | 70.12% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.52 Gb Total Space | 53.17 Gb Free Space | 71.35% Space Free | Partition Type: NTFS

Computer Name: ZTT-VANILLA | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/02/04 08:53:10 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\My Documents\OTL.exe
PRC - [2011/10/05 10:18:37 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011/10/05 10:18:29 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2011/10/05 10:18:17 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011/10/05 10:18:17 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2011/03/18 01:26:14 | 002,435,592 | ---- | M] (Check Point Software Technologies LTD) -- C:\WINDOWS\system32\ZoneLabs\vsmon.exe
PRC - [2011/03/18 01:24:50 | 001,043,968 | ---- | M] (Check Point Software Technologies LTD) -- C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
PRC - [2010/01/14 16:08:16 | 000,378,128 | ---- | M] (PC Tools) -- C:\Program Files\ThreatFire\TFTray.exe
PRC - [2010/01/14 16:08:12 | 000,070,928 | ---- | M] (PC Tools) -- C:\Program Files\ThreatFire\TFService.exe
PRC - [2008/04/14 05:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2003/04/04 13:38:52 | 000,774,144 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
PRC - [2003/02/12 19:55:52 | 001,334,784 | ---- | M] () -- C:\WINDOWS\system32\TCAUDIAG.EXE
PRC - [2002/09/20 15:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe


========== Modules (No Company Name) ==========

MOD - [2011/10/05 10:18:31 | 000,398,288 | ---- | M] () -- C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll
MOD - [2003/02/12 19:55:52 | 001,334,784 | ---- | M] () -- C:\WINDOWS\system32\TCAUDIAG.EXE


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2012/02/03 14:30:36 | 000,392,064 | ---- | M] (Sysinternals - www.sysinternals.com) [On_Demand | Stopped] -- C:\Documents and Settings\Owner\Local Settings\Temp\AXHSXR.exe -- (AXHSXR)
SRV - [2011/10/05 10:18:29 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011/10/05 10:18:17 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/03/18 01:26:14 | 002,435,592 | ---- | M] (Check Point Software Technologies LTD) [Auto | Running] -- C:\WINDOWS\System32\ZoneLabs\vsmon.exe -- (vsmon)
SRV - [2010/01/14 16:08:12 | 000,070,928 | ---- | M] (PC Tools) [Auto | Running] -- C:\Program Files\ThreatFire\TFService.exe -- (ThreatFire)
SRV - [2002/09/20 15:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) [Auto | Running] -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default))


========== Driver Services (SafeList) ==========

DRV - [2011/09/18 08:39:27 | 000,134,344 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2011/09/15 23:55:04 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011/09/15 23:55:03 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010/06/17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010/05/13 10:02:32 | 000,532,224 | ---- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] -- C:\WINDOWS\system32\vsdatant.sys -- (vsdatant)
DRV - [2010/01/14 16:08:30 | 000,059,664 | ---- | M] (PC Tools) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\TfSysMon.sys -- (TfSysMon)
DRV - [2010/01/14 16:08:28 | 000,051,984 | ---- | M] (PC Tools) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\TfFsMon.sys -- (TfFsMon)
DRV - [2010/01/14 16:08:28 | 000,033,552 | ---- | M] (PC Tools) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\TfNetMon.sys -- (TfNetMon)
DRV - [2008/03/17 11:03:46 | 000,101,376 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2003/04/18 03:12:00 | 000,073,856 | R--- | M] (VIA Technologies inc,.ltd) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\viaraid.sys -- (viaraid)
DRV - [2003/04/17 18:15:22 | 000,147,328 | ---- | M] (3Com Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\EL2K_XP.sys -- (EL2000)
DRV - [2002/09/20 12:53:34 | 000,235,100 | ---- | M] (Analog Devices Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\MidiSyn.sys -- (MidiSyn)
DRV - [2001/09/04 21:22:52 | 000,019,534 | ---- | M] (3Com Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\TCAITDI.SYS -- (TCAITDI)
DRV - [2000/06/07 04:08:04 | 000,021,233 | ---- | M] (3Com Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\TCAICCHG.SYS -- (tcaicchg)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0




O1 HOSTS File: ([2003/03/31 22:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NVCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [TCASUTIEXE] C:\WINDOWS\System32\TCAUDIAG.EXE ()
O4 - HKLM..\Run: [ThreatFire] C:\Program Files\ThreatFire\TFTray.exe (PC Tools)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [Mobile Partner] C:\Program Files\3 MobileBroadband\3 MobileBroadband.exe ()
O4 - HKCU..\Run: [NvMediaCenter] C:\WINDOWS\System32\NVMCTRAY.DLL (NVIDIA Corporation)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011/11/01 18:55:18 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{e00f4602-04ea-11e1-ad50-000c6e64e9a1}\Shell - "" = AutoRun
O33 - MountPoints2\{e00f4602-04ea-11e1-ad50-000c6e64e9a1}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e00f4602-04ea-11e1-ad50-000c6e64e9a1}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{e00f4604-04ea-11e1-ad50-000c6e64e9a1}\Shell - "" = AutoRun
O33 - MountPoints2\{e00f4604-04ea-11e1-ad50-000c6e64e9a1}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e00f4604-04ea-11e1-ad50-000c6e64e9a1}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/02/14 07:19:57 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump
[2012/02/04 09:05:19 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Owner\My Documents\OTL.exe
[2012/02/04 08:21:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\eSupport.com
[2012/02/04 08:21:13 | 000,000,000 | ---D | C] -- C:\Program Files\eSupport.com
[2012/02/03 19:34:51 | 000,000,000 | -H-D | C] -- C:\WINDOWS\PIF
[2012/02/03 19:01:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Start Menu\Programs\Rootkit Unhooker
[2012/02/03 19:01:19 | 000,000,000 | ---D | C] -- C:\Program Files\RkUnhooker
[2012/02/03 19:00:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\My Documents\RkU37300505
[2012/02/03 17:15:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\My Documents\IceSword122en
[2012/02/03 14:29:38 | 000,334,720 | ---- | C] (Sysinternals - www.sysinternals.com) -- C:\Documents and Settings\Owner\My Documents\RootesttkitRevealer.exe
[2012/02/02 06:24:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\ThreatFire
[2012/02/02 06:24:00 | 000,059,664 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\TfSysMon.sys
[2012/02/02 06:24:00 | 000,051,984 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\TfFsMon.sys
[2012/02/02 06:24:00 | 000,033,552 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\TfNetMon.sys
[2012/02/02 06:23:58 | 000,000,000 | ---D | C] -- C:\Program Files\ThreatFire
[2012/02/02 06:23:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\PC Tools
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/02/15 06:24:14 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/02/15 06:24:13 | 535,613,440 | -HS- | M] () -- C:\hiberfil.sys
[2012/02/12 08:45:47 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012/02/04 08:53:10 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\My Documents\OTL.exe
[2012/02/04 08:21:15 | 000,000,790 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\NTFS Undelete.lnk
[2012/02/02 06:24:03 | 000,000,621 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\ThreatFire.lnk
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/02/04 08:21:15 | 000,000,790 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\NTFS Undelete.lnk
[2012/02/03 14:29:34 | 000,102,160 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\RootesttkitRevealer.chm
[2012/02/03 12:45:02 | 000,302,592 | ---- | C] () -- C:\Documents and Settings\Owner\My Documents\gtestmer.exe
[2012/02/02 06:24:03 | 000,000,621 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\ThreatFire.lnk
[2012/02/02 06:08:20 | 535,613,440 | -HS- | C] () -- C:\hiberfil.sys
[2011/11/22 07:53:02 | 000,000,693 | ---- | C] () -- C:\Program Files\Shortcut to CoolPDFReader.exe.lnk
[2011/11/04 07:20:19 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2011/11/02 08:56:40 | 000,004,212 | -H-- | C] () -- C:\WINDOWS\System32\zllictbl.dat
[2011/11/02 04:43:02 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2011/11/02 04:42:06 | 000,254,272 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/11/01 19:22:27 | 000,025,853 | R--- | C] () -- C:\WINDOWS\System32\sk98nt4.ini
[2011/11/01 19:22:27 | 000,025,853 | R--- | C] () -- C:\WINDOWS\System32\InstInfo.ini
[2011/11/01 19:19:59 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2011/11/01 19:19:59 | 000,003,366 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2011/11/01 19:03:19 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\INFSETUP.exe
[2011/11/01 18:57:00 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2011/11/01 18:53:03 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2008/04/14 05:55:28 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2006/12/31 07:57:08 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2003/03/31 22:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2003/03/31 22:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2003/03/31 22:00:00 | 000,311,604 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2003/03/31 22:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2003/03/31 22:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2003/03/31 22:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2003/03/31 22:00:00 | 000,039,992 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2003/03/31 22:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2003/03/31 22:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2003/03/31 22:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2003/02/12 19:55:52 | 001,334,784 | ---- | C] () -- C:\WINDOWS\System32\TCAUDIAG.EXE

< End of report >

[sempai]

I do not recommend that you have more than one anti virus product installed and running on your computer at a time. The following anti virus products are installed on your system:

• AntiVir Desktop
• ThreatFire

The reason for this is that if both products have their automatic (Real-Time) protection switched on, then those products which do not encrypt the virus strings within them can cause other anti virus products to cause "false alarms". It can also lead to a clash as both products fight for access to files which are opened again this is the resident/automatic protection. In general terms, the two programs may conflict and cause:

1) False Alarms: When the anti virus software tells you that your PC has a virus when it actually doesn't.
2) System Performance Problems: Your system may lock up due to both products attempting to access the same file at the same time.

Therefore please uninstall either AntiVir Desktop or ThreatFire.


======================


1. Please go to http://virscan.org/

• Navigate the following file path into the "Suspicious files to scan" box on the top of the page:
  
  

  C:\Documents and Settings\Owner\My Documents\gtestmer.exe

• Click on the Upload button
• If a pop-up appears saying the file has been scanned already, please select the ReScan button.
• Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
• Paste the contents of the Clipboard in your next reply.

2. Please download MiniToolBox, save it to your desktop and run it.

• Put a check mark on the following check boxes:
  
  
  • List Installed Programs
• Click Go and post the result.

[trampas]

Hi Sempai

Thanks for the latest instructions. I removed ThreatFire and rebooted the PC.

Before going to the next step of your last post I thought I'd check to see if gmer would run. It ran for a while, then locked up the PC. Only the mouse seemed to be working. Rebooted, ran gmer again and it got killed immediately. Changed the name (back to gtestmer.exe) and ran it again. This time it completed, so I've attached ark.txt.

I don't know if this log will be useful and I'm not suggesting that gmer is clean. I thought I ought to give you the chance to have a look, since it's available. I'll press on with the other instructions next.

I see a couple of ! in the txt file ...

Cheers

trampas


GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-02-16 06:44:41
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Scsi\viaraid1Port2Path0Target0Lun0 VIA_6410 rev.____
Running: gtestmer.exe; Driver: C:\DOCUME~1\Owner\LOCALS~1\Temp\pwliyuow.sys


---- System - GMER 1.0.15 ----

SSDT F8B5C4DC ZwClose
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwConnectPort [0xEF322534]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateFile [0xEF31C782]
SSDT F8B5C496 ZwCreateKey
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreatePort [0xEF322CC0]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateProcess [0xEF335EB4]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateProcessEx [0xEF3362A2]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateSection [0xEF33F916]
SSDT F8B5C48C ZwCreateThread
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateWaitablePort [0xEF322DF6]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDeleteFile [0xEF31D398]
SSDT F8B5C49B ZwDeleteKey
SSDT F8B5C4A5 ZwDeleteValueKey
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDuplicateObject [0xEF334DF0]
SSDT F8B5C4AA ZwLoadKey
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwLoadKey2 [0xEF33DB44]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwOpenFile [0xEF31CFAA]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwOpenProcess [0xEF3381CE]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwOpenThread [0xEF337DF8]
SSDT F8B5C4FF ZwQueryValueKey
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRenameKey [0xEF33E8D2]
SSDT F8B5C4B4 ZwReplaceKey
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRequestWaitReplyPort [0xEF3220F4]
SSDT F8B5C4AF ZwRestoreKey
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSecureConnectPort [0xEF3227DC]
SSDT F8B5C4EB ZwSetContextThread
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetInformationFile [0xEF31D75C]
SSDT F8B5C4F5 ZwSetSecurityObject
SSDT F8B5C4A0 ZwSetValueKey
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSystemDebugControl [0xEF336F0A]
SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwTerminateProcess [0xEF336C86]

---- Kernel code sections - GMER 1.0.15 ----

.text ntoskrnl.exe!ZwYieldExecution + 12E 804E4958 12 Bytes [C0, 2C, 32, EF, B4, 5E, 33, ...]
.text ntoskrnl.exe!ZwYieldExecution + 376 804E4BA0 8 Bytes [D2, E8, 33, EF, B4, C4, B5, ...] {SHR AL, CL; XOR EBP, EDI; MOV AH, 0xc4; MOV CH, 0xf8}

---- Devices - GMER 1.0.15 ----

Device \Driver\Tcpip \Device\Ip vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\Tcp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\Udp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\RawIp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
Device \Driver\Tcpip \Device\IPMULTICAST vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)

---- EOF - GMER 1.0.15 ----

[trampas]

... cont
Using my laptop I navigated to virscan.org and initiated an upload of gtestmer.exe. Nothing seems to be happening at the moment. The site doesn't seem to provide much feedback once UPLOAD has been clicked. It definitely clicked though. My modem shows no upload either.

I downloaded minitoolbar and the output is attached.

Cheers

trampas


MiniToolBox by Farbar Version: 18-01-2012
Ran by Owner (administrator) on 16-02-2012 at 07:10:07
Microsoft Windows XP Home Edition Service Pack 3 (X86)
Boot Mode: Normal
***************************************************************************

=========================== Installed Programs ============================

3 MobileBroadband (Version: 11.002.03.14.100)
3Com NIC Diagnostics
Avira Free Antivirus (Version: 12.0.0.851)
Microsoft Office PowerPoint Viewer 2007 (English) (Version: 12.0.4518.1014)
Microsoft Office XP Small Business (Version: 10.0.2627.01)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
NTFS Undelete 3.0.2.1214
Rootkit Unhooker Uninstall
SoundMAX
SumatraPDF (Version: 1.8)
Update for Windows XP (KB971029) (Version: 1)
VC 9.0 Runtime (Version: 1.0.0)
VIA RAID Driver Setup Wizard (Version: 0.93)
VIA VT6410 RAID Driver(Remove)
Visual C++ 8.0 CRT (x86) WinSXS MSM (Version: 8.0.50727.762)
Visual C++ 8.0 CRT.Policy (x86) WinSXS MSM (Version: 8.0.50727.762)
WebFldrs XP (Version: 9.50.7523)
WinFast® Display Driver
ZoneAlarm (Version: 9.2.106.000)

**** End of log ****

[trampas]

OK sempai, here is the result of the virusorg scan. Possible ID on the trojan....

That site runs scripts which is why I had a problem initially.

cheers

trampas


Scanner results : 6% Scanner(s) (2/36) found malware!
Time : 2012/02/02 18:44:37 (EST)
Scanner Engine Ver Sig Ver Sig Date Scan result Time
a-squared 5.1.0.4 20120202161640 2012-02-02 - 0.280
AhnLab V3 2012.02.02.00 2012.02.02 2012-02-02 - 3.093
AntiVir 8.2.8.44 7.11.22.14 2012-02-01 - 0.284
Antiy 2.0.18 20120126.15937943 2012-01-26 - 0.018
Arcavir 2011 201202011200 2012-02-01 - 3.623
Authentium 5.1.1 201202011405 2012-02-01 - 3.051
AVAST! 4.7.4 120201-1 2012-02-01 - 0.114
AVG 10.0.1405 2090/4780 2012-02-01 - 1.755
BitDefender 7.90123.7710045 7.40842 2012-02-02 - 4.045
ClamAV 0.97.1 14386 2012-02-02 - 0.240
Comodo 5.1 11403 2012-02-02 - 2.116
CP Secure 1.3.0.5 2012.02.02 2012-02-02 - 0.192
Dr.Web 7.0.0.11250 2012.02.02 2012-02-02 - 11.905
F-Prot 4.6.2.117 20120201 2012-02-01 - 0.902
F-Secure 7.02.73807 2012.01.10.04 2012-01-10 - 0.102
Fortinet 4.2.257 15.160 2012-02-01 - 0.103
GData 22.3723 20120202 2012-02-02 - 4.834
Ikarus T3.1.32.20.0 2012.02.02.80388 2012-02-02 - 5.244
JiangMin 13.0.900 2012.01.31 2012-01-31 Trojan/JmGenGeneric.aic 2.017
Kaspersky 5.5.10 2012.02.02 2012-02-02 - 0.361
KingSoft 2009.2.5.15 2012.2.2.14 2012-02-02 - 0.899
McAfee 5400.1158 6607 2012-02-01 - 11.865
Microsoft 1.8001 2012.02.02 2012-02-02 - 5.764
NOD32 3.0.21 6840 2012-01-30 - 0.003
nProtect 20120201.01 11654706 2012-02-01 - 1.695
Panda 9.05.01 2012.02.01 2012-02-01 - 2.392
Quick Heal 11.00 2012.01.31 2012-01-31 - 2.378
Rising 20.0 23.93.02.01 2012-01-18 [Suspicious] 3.381
Sophos 3.28.1 4.74 2012-02-02 - 4.947
Sunbelt 3.9.2526.2 11490 2012-02-01 - 0.674
Symantec 1.3.0.24 20120201.003 2012-02-01 - 0.145
The Hacker 6.7.0.1 v00389 2012-02-01 - 0.751
Trend Micro 9.500-1005 8.750.04 2012-02-01 - 0.128
VBA32 3.12.16.4 20120131.1010 2012-01-31 - 4.640
ViRobot 20120201 2012.02.01 2012-02-01 - 0.366
VirusBuster 5.4.1.7 14.1.196.0/7622456 2012-02-02 - 0.132

File Name : gmer.exe
File Size : 302592 byte
File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 : ff72056739c31e4cc920fbdff4f9a8e5
SHA1 : bca23ce5d074b45038076bcd19e5beea2d55fbef

[trampas]

Just to get more information I submitted that gtestmer.exe file to Avira for testing. They found no malicious code.

trampas

[sempai]

gtestmer.exe is the renamed GMER, I only see it when you post the GMER log so nothing to worry about that file.



ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista/Windows 7 users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

• Please go here to run the scan.
  

  Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
  All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

• Select the option YES, I accept the Terms of Use then click on:
• When prompted allow the Add-On/Active X to install.
• Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
• Now click on Advanced Settings and select the following:

• • Scan for potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth Technology
• Now click on:
• The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed the Online Scan will begin automatically.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• When completed select Uninstall application on close, but make sure you copy the logfile first.
• Now click on:
• Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
• Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

[trampas]

Hi semp, here it is :

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# IEXPLORE.EXE=6.00.2900.5512 (xpsp.080413-2105)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=d49a8d3017c07b4ba7d6aabe44a123f3
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2012-02-16 10:44:02
# local_time=2012-02-17 08:44:02 (+1000, E. Australia Standard Time)
# country="Australia"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=1792 16777195 100 0 8377529 8377529 0 0
# compatibility_mode=8192 67108863 100 0 478 478 0 0
# compatibility_mode=9217 16777214 75 70 9242884 29057264 0 0
# scanned=45778
# found=0
# cleaned=0
# scan_time=1091

[sempai]

Logs seems OK, do you experience any issues?