TechSpot

[A] Hard Drive clusters partly damaged

By novamtnbkr
Mar 27, 2012
  1. Ok i went through the process and here are my logs
    Malwarebytes Anti-Malware 1.60.1.1000
    www.malwarebytes.org

    Database version: v2012.03.27.08

    Windows Vista Service Pack 2 x86 NTFS
    Internet Explorer 9.0.8112.16421
    novamtnbkr :: NOVAMTNBKR-PC [limited]

    3/27/2012 8:41:48 PM
    mbam-log-2012-03-27 (20-41-48).txt

    Scan type: Quick scan
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 233198
    Time elapsed: 14 minute(s), 4 second(s)

    Memory Processes Detected: 1
    C:\Users\novamtnbkr\AppData\Local\dplaysvr.exe (Trojan.Agent.WQGen) -> 5164 -> Delete on reboot.

    Memory Modules Detected: 1
    C:\Users\novamtnbkr\AppData\Local\dplayx.dll (Trojan.Agent) -> Delete on reboot.

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 1
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|dplaysvr (Trojan.Agent.WQGen) -> Data: C:\Users\novamtnbkr\AppData\Local\dplaysvr.exe -> Quarantined and deleted successfully.

    Registry Data Items Detected: 2
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowSearch (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and repaired successfully.

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 16
    C:\Users\novamtnbkr\AppData\Local\dplayx.dll (Trojan.Agent) -> Delete on reboot.
    C:\Users\novamtnbkr\AppData\Local\dplaysvr.exe (Trojan.Agent.WQGen) -> Delete on reboot.
    C:\Users\novamtnbkr\AppData\Local\Temp\jXX4KT81GrcboT.exe.tmp (Rogue.FakeHDD) -> Quarantined and deleted successfully.
    C:\Users\novamtnbkr\AppData\Local\Temp\606F.tmp (Rogue.PrivacyProtection) -> Quarantined and deleted successfully.
    C:\Users\novamtnbkr\AppData\Local\Temp\AD3F.tmp (Trojan.FakeAlert.FS) -> Quarantined and deleted successfully.
    C:\Users\novamtnbkr\AppData\Local\Temp\jar_cache9074373002225627383.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Users\novamtnbkr\AppData\Local\Temp\jar_cache9210191329353689928.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Users\novamtnbkr\AppData\Local\Temp\44E1.tmp (Trojan.FakeAlert.FS) -> Quarantined and deleted successfully.
    C:\Users\novamtnbkr\AppData\Local\Temp\5316.tmp (Rogue.PrivacyProtection) -> Quarantined and deleted successfully.
    C:\Users\novamtnbkr\AppData\Local\Temp\A85F.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Users\novamtnbkr\AppData\Local\Temp\27EA.tmp (Trojan.FakeAlert.FS) -> Quarantined and deleted successfully.
    C:\Users\novamtnbkr\AppData\Local\Temp\GMSZsGsegxogrT.exe.tmp (Rogue.FakeHDD) -> Quarantined and deleted successfully.
    C:\Windows\Temp\_ex-08.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Users\novamtnbkr\Local Settings\Application Data\dplaysvr.exe (Trojan.Agent.WQGen) -> Delete on reboot.
    C:\Users\novamtnbkr\Local Settings\Application Data\dplayx.dll (Trojan.Agent) -> Delete on reboot.
    C:\Users\novamtnbkr\AppData\Local\Temp\0.5286387680757673.exe (Exploit.Drop.2) -> Quarantined and deleted successfully.

    (end)
     
  2. novamtnbkr

    novamtnbkr TS Rookie Topic Starter

    the other logs

    MER 1.0.15.15641 - http://www.gmer.net
    Rootkit scan 2012-03-27 22:21:08
    Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-2 rev.
    Running: 42iv5dir.exe; Driver: C:\Users\NOVAMT~1\AppData\Local\Temp\pgdiyuob.sys


    ---- System - GMER 1.0.15 ----

    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwAddBootEntry [0x8F647DF8]
    SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwAllocateVirtualMemory [0x8FAD4A5A]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwAssignProcessToJobObject [0x8F64885E]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateEvent [0x8F64D2E4]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateEventPair [0x8F64D330]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateIoCompletion [0x8F64D422]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateMutant [0x8F64D252]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateSection [0x8F64D374]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateSemaphore [0x8F64D29A]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateTimer [0x8F64D3DC]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDeleteBootEntry [0x8F647E44]
    SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwFreeVirtualMemory [0x8FAD4B34]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwLoadDriver [0x8F647AD6]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwModifyBootEntry [0x8F647E90]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwNotifyChangeKey [0x8F64AD1C]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwNotifyChangeMultipleKeys [0x8F648B02]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenEvent [0x8F64D30E]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenEventPair [0x8F64D352]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenIoCompletion [0x8F64D446]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenMutant [0x8F64D278]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenSection [0x8F64D3AE]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenSemaphore [0x8F64D2C2]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenTimer [0x8F64D400]
    SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwProtectVirtualMemory [0x8FAD4CA0]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwQueryObject [0x8F6489CE]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetBootEntryOrder [0x8F647EDC]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetBootOptions [0x8F647F28]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetSystemInformation [0x8F647B46]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetSystemPowerState [0x8F647CEA]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwShutdownSystem [0x8F647C92]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSystemDebugControl [0x8F647D5A]
    SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwTerminateProcess [0x8FAD4D60]
    SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwVdmControl [0x8F647F74]
    SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwWriteVirtualMemory [0x8FAD4BE0]

    Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateProcessEx [0x8FAEAD92]
    Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObInsertObject
    Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObMakeTemporaryObject
     
  3. novamtnbkr

    novamtnbkr TS Rookie Topic Starter

    Logs

    -- Everytime i try to post logs it says they are too many characters how do i paste the logs in here
     
  4. Broni

    Broni Malware Annihilator Posts: 52,899   +344

    Welcome aboard [​IMG]

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ===========================================================

    Split any excessive log between couple of replies.
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...