Howdy!
Have a pretty little nasty! Looks like a Redirect/Rootkit virus. Have included all the proper "pastes". Would love to have some help.
Thanks a bunch,
pkbrooks
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Database version: 4715
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
1/12/2011 8:09:20 AM
mbam-log-2011-01-12 (08-09-20).txt
Scan type: Quick scan
Objects scanned: 254507
Time elapsed: 17 minute(s), 0 second(s)
Memory Processes Infected: 30
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 67
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 26
Memory Processes Infected:
C:\WINDOWS\spoolsv.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\win.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\winamp.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\avp32.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\nvsvc32.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\mdm.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\hexdump.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\drweb.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\user.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\win16.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\avp.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\wininst.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\gdi32.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\winamp.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\spoolsv.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\win.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\winamp.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\wininst.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\avp32.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\nvsvc32.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\mdm.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\hexdump.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\drweb.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\user.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\win16.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\avp.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\wininst.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\gdi32.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\winamp.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\taskmgr.exe (Worm.Saphira) -> Unloaded process successfully.
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkeuf (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkeuf (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkfa (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkfa (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkfpe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkfpe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkzsc (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkzsc (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkdw+ (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkdw+ (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkcz (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkcz (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkbtc (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkbtc (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkasc (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkasc (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkee (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkee (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkfpc (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkfpc (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkze (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkze (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrsre (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrsre (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxromc (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxromc (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrspe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrspe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkfre (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkfre (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrpuc (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrpuc (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrrrb (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrrrb (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrssc (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrssc (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkerb (Worm.Saphira) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkerb (Worm.Saphira) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\nofolderoptions (Hijack.FolderOptions) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugtoxrnoc (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrruf (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrnsc (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugtoxrprc (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugtoxrspk (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugtoxrspi (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugtoxrpuk (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugtoxrptk (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugtoxrmn (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrota (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrmsc (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrrxe (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrsa (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrme (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugtoxrnoc (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrruf (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrnsc (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugtoxrprc (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugtoxrpuk (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugtoxrspk (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugtoxrspi (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugtoxrptk (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugtoxrmn (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrota (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrmsc (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrrxe (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrsa (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrme (Trojan.Downloader.Gen) -> Delete on reboot.
Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
C:\WINDOWS\spoolsv.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\win.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\winamp.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\avp32.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\nvsvc32.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\mdm.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\hexdump.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\drweb.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\user.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\win16.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\avp.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\wininst.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\gdi32.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\winamp.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\wininst.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\1061093108.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Break Time\Local Settings\Application Data\rfslia.dll (Trojan.Hiloti.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\iExplorer.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\lsass.exe (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\taskmgr.exe (Trojan.Downloader) -> Delete on reboot.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\winlogon.exe (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\taskmgr.exe (Worm.Saphira) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\drweb.exe (Trojan.Downloader.Gen) -> Delete on reboot.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\system.exe (Trojan.Downloader.Gen) -> Delete on reboot.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\win.exe (Trojan.Downloader.Gen) -> Delete on reboot.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\avp.exe (Trojan.Downloader.Gen) -> Delete on reboot.
GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2011-01-12 11:44:49
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\iaStor0 Intel___ rev.0.1.
Running: ltmh01wy.exe; Driver: C:\DOCUME~1\ADMINI~1.MCC\LOCALS~1\Temp\uwtdypod.sys
---- System - GMER 1.0.15 ----
SSDT \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0xBA511620]
---- User code sections - GMER 1.0.15 ----
.text C:\WINDOWS\System32\svchost.exe[1108] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00EF000A
.text C:\WINDOWS\System32\svchost.exe[1108] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00F0000A
.text C:\WINDOWS\System32\svchost.exe[1108] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00EE000C
.text C:\WINDOWS\System32\svchost.exe[1108] USER32.dll!GetCursorPos 7E42974E 5 Bytes JMP 008A000A
.text C:\WINDOWS\System32\svchost.exe[1108] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 0105000A
.text C:\WINDOWS\Explorer.EXE[3640] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00D4000A
.text C:\WINDOWS\Explorer.EXE[3640] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00D5000A
.text C:\WINDOWS\Explorer.EXE[3640] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00C2000C
---- Devices - GMER 1.0.15 ----
Device \Driver\iaStor -> DriverStartIo \Device\Ide\iaStor0 86A7FA9F
Device \Device\Ide\IAAStorageDevice-0 -> \??\IDE#DiskRAID_Volume00.1.12_U#4&244ba08&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
---- Registry - GMER 1.0.15 ----
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL@Installed 1
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI@Installed 1
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI@NoChange 1
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS@Installed 1
Reg HKLM\SOFTWARE\Classes\CLSID\{16B0E0C0-F695-559D-5E9C-9936C190ABA1}\InprocHandler32@ ole32.dll
Reg HKLM\SOFTWARE\Classes\CLSID\{16B0E0C0-F695-559D-5E9C-9936C190ABA1}\LocalServer32@ C:\PROGRA~1\MICROS~2\Office\OUTLOOK.EXE
Reg HKLM\SOFTWARE\Classes\CLSID\{16B0E0C0-F695-559D-5E9C-9936C190ABA1}\LocalServer32@LocalServer32 10!!!gxsf(Ng]qF`H{LsOUTLOOKFiles>ToT]jI{jf(=1&L[-81-]?
Reg HKLM\SOFTWARE\Classes\CLSID\{1FAA1C40-BEBE-E22A-4256-3A28C943A807}\InprocServer32@ C:\Program Files\Common Files\Microsoft Shared\Picture It!\DigWebX.dll
Reg HKLM\SOFTWARE\Classes\CLSID\{1FAA1C40-BEBE-E22A-4256-3A28C943A807}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{1FAA1C40-BEBE-E22A-4256-3A28C943A807}\MiscStatus@ 0
Reg HKLM\SOFTWARE\Classes\CLSID\{1FAA1C40-BEBE-E22A-4256-3A28C943A807}\MiscStatus\1
Reg HKLM\SOFTWARE\Classes\CLSID\{1FAA1C40-BEBE-E22A-4256-3A28C943A807}\MiscStatus\1@ 131473
Reg HKLM\SOFTWARE\Classes\CLSID\{1FAA1C40-BEBE-E22A-4256-3A28C943A807}\ProgID@ DigWebX2.BatchDownloader.1
Reg HKLM\SOFTWARE\Classes\CLSID\{1FAA1C40-BEBE-E22A-4256-3A28C943A807}\ToolboxBitmap32@ C:\Program Files\Common Files\Microsoft Shared\Picture It!\DigWebX.dll, 105
Reg HKLM\SOFTWARE\Classes\CLSID\{1FAA1C40-BEBE-E22A-4256-3A28C943A807}\TypeLib@ {13FA0C3E-6B1C-4d8b-88CD-6DA8E1CA7653}
Reg HKLM\SOFTWARE\Classes\CLSID\{1FAA1C40-BEBE-E22A-4256-3A28C943A807}\Version@ 1.0
Reg HKLM\SOFTWARE\Classes\CLSID\{1FAA1C40-BEBE-E22A-4256-3A28C943A807}\VersionIndependentProgID@ DigWebX2.BatchDownloader
---- Disk sectors - GMER 1.0.15 ----
Disk \Device\Harddisk0\DR0 sector 00 (MBR): rootkit-like behavior; TDL4 <-- ROOTKIT !!!
Disk \Device\Harddisk0\DR0 sector 32: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 33: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 63: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sectors 312498944 (+255): rootkit-like behavior;
---- EOF - GMER 1.0.15 ----
Have a pretty little nasty! Looks like a Redirect/Rootkit virus. Have included all the proper "pastes". Would love to have some help.
Thanks a bunch,
pkbrooks
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Database version: 4715
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
1/12/2011 8:09:20 AM
mbam-log-2011-01-12 (08-09-20).txt
Scan type: Quick scan
Objects scanned: 254507
Time elapsed: 17 minute(s), 0 second(s)
Memory Processes Infected: 30
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 67
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 26
Memory Processes Infected:
C:\WINDOWS\spoolsv.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\win.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\winamp.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\avp32.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\nvsvc32.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\mdm.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\hexdump.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\drweb.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\user.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\win16.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\avp.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\wininst.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\gdi32.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\winamp.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\spoolsv.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\win.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\winamp.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\wininst.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\avp32.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\nvsvc32.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\mdm.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\hexdump.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\drweb.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\user.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\win16.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\avp.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\wininst.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\gdi32.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\winamp.exe (Malware.Packer.Gen) -> Unloaded process successfully.
C:\WINDOWS\taskmgr.exe (Worm.Saphira) -> Unloaded process successfully.
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkeuf (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkeuf (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkfa (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkfa (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkfpe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkfpe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkzsc (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkzsc (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkdw+ (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkdw+ (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkcz (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkcz (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkbtc (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkbtc (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkasc (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkasc (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkee (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkee (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkfpc (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkfpc (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkze (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkze (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrsre (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrsre (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxromc (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxromc (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrspe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrspe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkfre (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkfre (Malware.Packer.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrpuc (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrpuc (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrrrb (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrrrb (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrssc (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrssc (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkerb (Worm.Saphira) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mkerb (Worm.Saphira) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\nofolderoptions (Hijack.FolderOptions) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugtoxrnoc (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrruf (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrnsc (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugtoxrprc (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugtoxrspk (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugtoxrspi (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugtoxrpuk (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugtoxrptk (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugtoxrmn (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrota (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrmsc (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrrxe (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrsa (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrme (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugtoxrnoc (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrruf (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrnsc (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugtoxrprc (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugtoxrpuk (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugtoxrspk (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugtoxrspi (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugtoxrptk (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugtoxrmn (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrota (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrmsc (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrrxe (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrsa (Trojan.Downloader.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hnugraoxrme (Trojan.Downloader.Gen) -> Delete on reboot.
Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
C:\WINDOWS\spoolsv.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\win.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\winamp.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\avp32.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\nvsvc32.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\mdm.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\hexdump.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\drweb.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\user.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\win16.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\avp.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\wininst.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\gdi32.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\winamp.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\WINDOWS\wininst.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\1061093108.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Break Time\Local Settings\Application Data\rfslia.dll (Trojan.Hiloti.Gen) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\iExplorer.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\lsass.exe (Trojan.Agent) -> Delete on reboot.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\taskmgr.exe (Trojan.Downloader) -> Delete on reboot.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\winlogon.exe (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\taskmgr.exe (Worm.Saphira) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\drweb.exe (Trojan.Downloader.Gen) -> Delete on reboot.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\system.exe (Trojan.Downloader.Gen) -> Delete on reboot.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\win.exe (Trojan.Downloader.Gen) -> Delete on reboot.
C:\Documents and Settings\Administrator.MCC\Local Settings\Temp\avp.exe (Trojan.Downloader.Gen) -> Delete on reboot.
GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2011-01-12 11:44:49
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\iaStor0 Intel___ rev.0.1.
Running: ltmh01wy.exe; Driver: C:\DOCUME~1\ADMINI~1.MCC\LOCALS~1\Temp\uwtdypod.sys
---- System - GMER 1.0.15 ----
SSDT \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0xBA511620]
---- User code sections - GMER 1.0.15 ----
.text C:\WINDOWS\System32\svchost.exe[1108] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00EF000A
.text C:\WINDOWS\System32\svchost.exe[1108] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00F0000A
.text C:\WINDOWS\System32\svchost.exe[1108] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00EE000C
.text C:\WINDOWS\System32\svchost.exe[1108] USER32.dll!GetCursorPos 7E42974E 5 Bytes JMP 008A000A
.text C:\WINDOWS\System32\svchost.exe[1108] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 0105000A
.text C:\WINDOWS\Explorer.EXE[3640] ntdll.dll!NtProtectVirtualMemory 7C90D6EE 5 Bytes JMP 00D4000A
.text C:\WINDOWS\Explorer.EXE[3640] ntdll.dll!NtWriteVirtualMemory 7C90DFAE 5 Bytes JMP 00D5000A
.text C:\WINDOWS\Explorer.EXE[3640] ntdll.dll!KiUserExceptionDispatcher 7C90E47C 5 Bytes JMP 00C2000C
---- Devices - GMER 1.0.15 ----
Device \Driver\iaStor -> DriverStartIo \Device\Ide\iaStor0 86A7FA9F
Device \Device\Ide\IAAStorageDevice-0 -> \??\IDE#DiskRAID_Volume00.1.12_U#4&244ba08&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found
---- Registry - GMER 1.0.15 ----
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL@Installed 1
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI@Installed 1
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI@NoChange 1
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS@Installed 1
Reg HKLM\SOFTWARE\Classes\CLSID\{16B0E0C0-F695-559D-5E9C-9936C190ABA1}\InprocHandler32@ ole32.dll
Reg HKLM\SOFTWARE\Classes\CLSID\{16B0E0C0-F695-559D-5E9C-9936C190ABA1}\LocalServer32@ C:\PROGRA~1\MICROS~2\Office\OUTLOOK.EXE
Reg HKLM\SOFTWARE\Classes\CLSID\{16B0E0C0-F695-559D-5E9C-9936C190ABA1}\LocalServer32@LocalServer32 10!!!gxsf(Ng]qF`H{LsOUTLOOKFiles>ToT]jI{jf(=1&L[-81-]?
Reg HKLM\SOFTWARE\Classes\CLSID\{1FAA1C40-BEBE-E22A-4256-3A28C943A807}\InprocServer32@ C:\Program Files\Common Files\Microsoft Shared\Picture It!\DigWebX.dll
Reg HKLM\SOFTWARE\Classes\CLSID\{1FAA1C40-BEBE-E22A-4256-3A28C943A807}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{1FAA1C40-BEBE-E22A-4256-3A28C943A807}\MiscStatus@ 0
Reg HKLM\SOFTWARE\Classes\CLSID\{1FAA1C40-BEBE-E22A-4256-3A28C943A807}\MiscStatus\1
Reg HKLM\SOFTWARE\Classes\CLSID\{1FAA1C40-BEBE-E22A-4256-3A28C943A807}\MiscStatus\1@ 131473
Reg HKLM\SOFTWARE\Classes\CLSID\{1FAA1C40-BEBE-E22A-4256-3A28C943A807}\ProgID@ DigWebX2.BatchDownloader.1
Reg HKLM\SOFTWARE\Classes\CLSID\{1FAA1C40-BEBE-E22A-4256-3A28C943A807}\ToolboxBitmap32@ C:\Program Files\Common Files\Microsoft Shared\Picture It!\DigWebX.dll, 105
Reg HKLM\SOFTWARE\Classes\CLSID\{1FAA1C40-BEBE-E22A-4256-3A28C943A807}\TypeLib@ {13FA0C3E-6B1C-4d8b-88CD-6DA8E1CA7653}
Reg HKLM\SOFTWARE\Classes\CLSID\{1FAA1C40-BEBE-E22A-4256-3A28C943A807}\Version@ 1.0
Reg HKLM\SOFTWARE\Classes\CLSID\{1FAA1C40-BEBE-E22A-4256-3A28C943A807}\VersionIndependentProgID@ DigWebX2.BatchDownloader
---- Disk sectors - GMER 1.0.15 ----
Disk \Device\Harddisk0\DR0 sector 00 (MBR): rootkit-like behavior; TDL4 <-- ROOTKIT !!!
Disk \Device\Harddisk0\DR0 sector 32: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 33: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sector 63: rootkit-like behavior;
Disk \Device\Harddisk0\DR0 sectors 312498944 (+255): rootkit-like behavior;
---- EOF - GMER 1.0.15 ----