Broni,
The RKreport and aswMBR logs are posted. Thanks again for the help.
RogueKiller V7.6.4 [07/17/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback:
https://www.techspot.com/downloads/5562-roguekiller.html
Blog:
http://tigzyrk.blogspot.com
Operating System: Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Started in : Normal mode
User: Administrator [Admin rights]
Mode: Scan -- Date: 08/02/2012 14:32:38
¤¤¤ Bad processes: 0 ¤¤¤
¤¤¤ Registry Entries: 3 ¤¤¤
[HJ] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND
[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
¤¤¤ Particular Files / Folders: ¤¤¤
¤¤¤ Driver: [LOADED] ¤¤¤
SSDT[13] : NtAlertResumeThread @ 0x826A25C3 -> HOOKED (Unknown @ 0x879E47F0)
SSDT[14] : NtAlertThread @ 0x8261B255 -> HOOKED (Unknown @ 0x87F012F8)
SSDT[18] : NtAllocateVirtualMemory @ 0x826574FB -> HOOKED (Unknown @ 0x879DF318)
SSDT[21] : NtAlpcConnectPort @ 0x825F9887 -> HOOKED (Unknown @ 0x878FE3F0)
SSDT[42] : NtAssignProcessToJobObject @ 0x825CCB43 -> HOOKED (Unknown @ 0x879DF640)
SSDT[67] : NtCreateMutant @ 0x8262F812 -> HOOKED (Unknown @ 0x87A44008)
SSDT[77] : NtCreateSymbolicLinkObject @ 0x825CF35A -> HOOKED (Unknown @ 0x87A30508)
SSDT[78] : NtCreateThread @ 0x826A0BE0 -> HOOKED (Unknown @ 0x879E41E0)
SSDT[116] : NtDebugActiveProcess @ 0x82673D22 -> HOOKED (Unknown @ 0x879DF700)
SSDT[129] : NtDuplicateObject @ 0x82607551 -> HOOKED (Unknown @ 0x879DF4A8)
SSDT[147] : NtFreeVirtualMemory @ 0x82493F1D -> HOOKED (Unknown @ 0x879DF178)
SSDT[156] : NtImpersonateAnonymousToken @ 0x825C9F12 -> HOOKED (Unknown @ 0x879E4910)
SSDT[158] : NtImpersonateThread @ 0x825DF54F -> HOOKED (Unknown @ 0x87A3D9D0)
SSDT[165] : NtLoadDriver @ 0x8257ADEE -> HOOKED (Unknown @ 0x878AF2B8)
SSDT[177] : NtMapViewOfSection @ 0x8261F89A -> HOOKED (Unknown @ 0x879DF098)
SSDT[184] : NtOpenEvent @ 0x82608DCF -> HOOKED (Unknown @ 0x87A44150)
SSDT[194] : NtOpenProcess @ 0x8262FFAE -> HOOKED (Unknown @ 0x879E40C8)
SSDT[195] : NtOpenProcessToken @ 0x82610A2E -> HOOKED (Unknown @ 0x879DF3E8)
SSDT[197] : NtOpenSection @ 0x8262066D -> HOOKED (Unknown @ 0x87999868)
SSDT[201] : NtOpenThread @ 0x8262B4FF -> HOOKED (Unknown @ 0x879DF008)
SSDT[210] : NtProtectVirtualMemory @ 0x826292E2 -> HOOKED (Unknown @ 0x87A306D8)
SSDT[282] : NtResumeThread @ 0x8262AB4A -> HOOKED (Unknown @ 0x879E4FD0)
SSDT[289] : NtSetContextThread @ 0x826A206F -> HOOKED (Unknown @ 0x87A2AB60)
SSDT[305] : NtSetInformationProcess @ 0x826238C8 -> HOOKED (Unknown @ 0x87A2AC40)
SSDT[317] : NtSetSystemInformation @ 0x825F5EEB -> HOOKED (Unknown @ 0x87999720)
SSDT[330] : NtSuspendProcess @ 0x826A24FF -> HOOKED (Unknown @ 0x87A44090)
SSDT[331] : NtSuspendThread @ 0x825A992B -> HOOKED (Unknown @ 0x87A30398)
SSDT[334] : NtTerminateProcess @ 0x82600143 -> HOOKED (Unknown @ 0x879E42C0)
SSDT[335] : NtTerminateThread @ 0x8262B534 -> HOOKED (Unknown @ 0x87A2A9E0)
SSDT[348] : NtUnmapViewOfSection @ 0x8261FB5D -> HOOKED (Unknown @ 0x87A2AD30)
SSDT[358] : NtWriteVirtualMemory @ 0x8261C92D -> HOOKED (Unknown @ 0x879DF248)
SSDT[382] : NtCreateThreadEx @ 0x8262AFE9 -> HOOKED (Unknown @ 0x87A305F8)
S_SSDT[317] : Unknown -> HOOKED (Unknown @ 0x961FCEC0)
S_SSDT[397] : Unknown -> HOOKED (Unknown @ 0x974A28F8)
S_SSDT[428] : Unknown -> HOOKED (Unknown @ 0x961FFC80)
S_SSDT[430] : Unknown -> HOOKED (Unknown @ 0x8782B098)
S_SSDT[442] : Unknown -> HOOKED (Unknown @ 0x961FA540)
S_SSDT[479] : Unknown -> HOOKED (Unknown @ 0x961FF958)
S_SSDT[497] : Unknown -> HOOKED (Unknown @ 0x961FFBB0)
S_SSDT[498] : Unknown -> HOOKED (Unknown @ 0x961FFA28)
S_SSDT[573] : Unknown -> HOOKED (Unknown @ 0x974A3CA0)
S_SSDT[576] : Unknown -> HOOKED (Unknown @ 0x881DFB88)
¤¤¤ Infection : ¤¤¤
¤¤¤ HOSTS File: ¤¤¤
127.0.0.1 localhost
::1 localhost
¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: HITACHI HTS542516K9SA00 +++++
--- User ---
[MBR] 0f8ac52cbb51bc118affb4b741b5a8f1
[BSP] b49e413f441beb7cb468d752f53dab9c : Lenovo tatooed MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 6438 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 13187072 | Size: 146187 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Finished : << RKreport[1].txt >>
RKreport[1].txt
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-08-02 14:34:18
-----------------------------
14:34:18.809 OS Version: Windows 6.0.6002 Service Pack 2
14:34:18.809 Number of processors: 2 586 0x1706
14:34:18.809 ComputerName: WISAVISTALAPTOP UserName: Administrator
14:34:19.994 Initialize success
14:35:22.569 AVAST engine defs: 12080200
14:35:35.439 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
14:35:35.439 Disk 0 Vendor: HITACHI_ BBCZ Size: 152627MB BusType: 3
14:35:35.470 Disk 0 MBR read successfully
14:35:35.470 Disk 0 MBR scan
14:35:35.470 Disk 0 unknown MBR code
14:35:35.485 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 6438 MB offset 2048
14:35:35.501 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 146187 MB offset 13187072
14:35:35.532 Disk 0 scanning sectors +312578048
14:35:35.641 Disk 0 scanning C:\Windows\system32\drivers
14:35:52.630 Service scanning
14:36:27.823 Modules scanning
14:36:39.321 Disk 0 trace - called modules:
14:36:39.352 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys
14:36:39.352 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85f80ac8]
14:36:39.352 3 CLASSPNP.SYS[889ca8b3] -> nt!IofCallDriver -> [0x854533f0]
14:36:39.367 5 acpi.sys[8068c6bc] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x85408028]
14:36:40.179 AVAST engine scan C:\Windows
14:36:44.375 AVAST engine scan C:\Windows\system32
14:40:16.129 AVAST engine scan C:\Windows\system32\drivers
14:40:30.029 AVAST engine scan C:\Users\Administrator
14:41:21.150 AVAST engine scan C:\ProgramData
14:42:57.683 Scan finished successfully
14:44:23.202 Disk 0 MBR has been saved successfully to "C:\Users\Administrator\Desktop\MBR.dat"
14:44:23.202 The log file has been saved successfully to "C:\Users\Administrator\Desktop\aswMBR.txt"