Skip to main content
Start a Conversation

Unsolved

This post is more than 5 years old

jefraz2003

29 Posts

2508

September 8th, 2007 22:00

virus killed my computer

my computer is really messed up.  i have no run commmand, my task manager has been disabled by administrator, and my system registry is not working.  i tried to recover it through my xp cd and it asks for an admin password.  when i put in my password it does not work.  i ran hijack this and this is what came up.
 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:44:41 PM, on 9/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\txumdvuw.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\wwSecure.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\SymCuw.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CheckIt\86\CheckIt86.exe
C:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe
C:\Palm\HOTSYNC.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://channels.aimtoday.com/search/aimtoolbar.jsp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://winsafesurf.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://channels.aimtoday.com/search/aimtoolbar.jsp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.0.1:80
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - (no file)
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O3 - Toolbar: Show Norton Toolbar

jefraz2003

29 Posts

September 14th, 2007 21:00

so now i think i might be in trouble.  the computer wont come on now.  it goes to the windows screen and then goes blank.  i tried to start it up in safe mode but i get a blue screen saying:  A problem has been detected and windows has been shut down to prevent damage to your computer.  If this is the first time you seen this stop error screen, restart your computer.  If this screen appears again, follow these steps:
Check to be sure you have adequate disk space.  If a driver is identified in the stop message, disable the driver or check with the manufacturer for driver updates.  Try changing video adapters.
 
Check with you harware vendor for any DIOS updates.  Disable BIOS memory options such as cacging or shadowing.  If you need to use Safe Mode to remove or disable components, restart your computer, press F8 to select Advanced Startup Options, and then select Safe Mode.
 
Technical information:
 
***STOP:  0x0000008E (0xC0000005, 0xF8630AD4, 0xF84A6984, 0x00000000)
***                   sr.sys - Address F8630AD4 base at F862D000, DateStamp 41107cde

1972vet

3.3K Posts

September 14th, 2007 23:00

The stop error was of course the result of removing the rootkit. The error code that was displayed is accusing the System Restore driver as the culprit. Obviously, there are infected restore points causing a problem since the rootkit driver was removed. Let's see if we can repair the system restore...

Since you obviously have access to another computer, copy the data below in Bold to a blank notepad and save it as fixsr.reg
Set File type to "all files"...now insert a blank floppy or CD and copy the .reg file to the removable media:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sr]
"Type"=dword:00000002
"Start"=dword:00000000
"ErrorControl"=dword:00000001
"Tag"=dword:00000004
"ImagePath"=hex(2):53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,44,00,\
52,00,49,00,56,00,45,00,52,00,53,00,5c,00,73,00,72,00,2e,00,73,00,79,00,73,\
00,00,00
"DisplayName"="System Restore Filter Driver"
"Group"="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sr\Parameters]
"FirstRun"=dword:00000000
"DontBackup"=dword:00000000
"MachineGuid"="{EAAFAEEC-4AFE-42BE-83D9-C12FDD4942A6}"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sr\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,\
00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\
00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sr\Enum]
"0"="Root\\LEGACY_SR\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

Return to the disabled computer and try again to boot to safe mode. Make sure you select Safe Mode...not safe mode with networking. Once in safe mode, log on with your user account that has administrative rights.

Insert the media you used to copy the .reg file into the disabled computer.
Double-click that file and confirm you want to merge it with the registry.

Reboot the computer. If it boots up ok, delete the .reg file from the Desktop of the other computer you used to copy this file. Post back your results.

jefraz2003

29 Posts

September 15th, 2007 14:00

it will not let me boot in safe mode.  it keeps sending me to the blue screen that i discribed earlier.

jefraz2003

29 Posts

September 15th, 2007 15:00

SDFix: Version 1.103
Run by Joe Frazier on Sat 09/15/2007 at 11:35 AM
Microsoft Windows XP [Version 5.1.2600]
Running From: C:\DOCUME~1\JOEFRA~1\MYDOCU~1\SDFix
Safe Mode:
Checking Services:

Infected mswsock.dll Found!
mswsock.dll File Locations:
C:\WINDOWS\$NtServicePackUninstall$\mswsock.dll
C:\WINDOWS\ServicePackFiles\i386\mswsock.dll
C:\WINDOWS\system32\mswsock.dll
C:\WINDOWS\system32\dllcache\mswsock.dll
Modified Files Are Listed Below:
C:\WINDOWS\ServicePackFiles\i386\mswsock.dll
C:\WINDOWS\system32\mswsock.dll
C:\WINDOWS\system32\dllcache\mswsock.dll
Note: SDFix Does Not Repair This File!
 
Infected tcpip.sys Found!
tcpip.sys File Locations:
"C:\WINDOWS\$hf_mig$\KB893066\SP2QFE\tcpip.sys" 359936 05/25/2005 03:07 PM
"C:\WINDOWS\$hf_mig$\KB913446\SP2QFE\tcpip.sys" 360448 01/13/2006 01:07 PM
"C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys" 360576 04/20/2006 08:18 AM
"C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys" 332928 09/03/2002 01:06 PM
"C:\WINDOWS\$NtUninstallKB893066$\tcpip.sys" 359040 08/04/2004 02:14 AM
"C:\WINDOWS\$NtUninstallKB913446$\tcpip.sys" 359808 05/25/2005 03:04 PM
"C:\WINDOWS\$NtUninstallKB917953$\tcpip.sys" 359808 01/12/2006 10:28 PM
"C:\WINDOWS\ServicePackFiles\i386\tcpip.sys" 359040 08/04/2004 02:14 AM
"C:\WINDOWS\system32\dllcache\tcpip.sys" 375296 08/11/2007 04:14 PM
"C:\WINDOWS\system32\drivers\tcpip.sys" 375296 08/11/2007 04:14 PM
Detected Patched Files Are Listed Below:
C:\WINDOWS\system32\dllcache\tcpip.sys
C:\WINDOWS\system32\drivers\tcpip.sys
Note: SDFix Does Not Repair This File!
If No Clean Copies Are Found Download The Below Update To Restore Original Files:
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting...

Normal Mode:
Checking Files:
Trojan Files Found:
C:\Documents and Settings\Joe Frazier\Application Data\Install.dat  - Deleted
C:\Documents and Settings\Joe Frazier\Application Data\.rdr.ini  - Deleted
C:\Documents and Settings\Joe Frazier\spooldr.ini  - Deleted
 
Removing Temp Files...
ADS Check:
C:\WINDOWS
No streams found.
C:\WINDOWS\system32
No streams found.
C:\WINDOWS\system32\svchost.exe
No streams found.
 
C:\WINDOWS\system32\ntoskrnl.exe
No streams found.
 

                                 Final Check:
Remaining Services:
------------------

Rootkit Srizbi/Agent.EA Registry Value Detected, Use a Rootkit scanner !
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\KODAK\\Kodak EasyShare software\\bin\\EasyShare.exe"="C:\\Program Files\\KODAK\\Kodak EasyShare software\\bin\\EasyShare.exe:*:Enabled:EasyShare"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
Remaining Files:
---------------
File Backups: - C:\DOCUME~1\JOEFRA~1\MYDOCU~1\SDFix\backups\backups.zip
Files with Hidden Attributes:
C:\WINDOWS\system32\dlinst0.dll
C:\WINDOWS\system32\dlinsth.dll
C:\WINDOWS\system32\gebya.dll
C:\WINDOWS\system32\jkkli.dll
C:\WINDOWS\system32\mlljj.dll
C:\WINDOWS\system32\sstqo.dll
C:\WINDOWS\system32\sstqp.dll
C:\Documents and Settings\Joe Frazier\Application Data\U3\temp\Launchpad Removal.exe
C:\Program Files\Common Files\Yazzle1162OinUninstaller.exe
C:\WINDOWS\system32\msgnmsger.exe
C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp
C:\Documents and Settings\LocalService\Local Settings\Temp\par60BF.tmp
C:\Documents and Settings\NetworkService\Local Settings\Temp\BIT21.tmp
C:\Documents and Settings\NetworkService\Local Settings\Temp\par60AB.tmp
C:\Documents and Settings\NetworkService\Local Settings\Temp\par6BAF.tmp
C:\Program Files\InterActual\InterActual Player\itiA.tmp
C:\WINDOWS\SoftwareDistribution\Download\02bf78654a17f7da57a4be756b6657c6\BIT156.tmp
C:\WINDOWS\SoftwareDistribution\Download\0bf48c56e2f3f29bfbf4f4fd00ad98dd\BIT159.tmp
C:\WINDOWS\SoftwareDistribution\Download\1ba295bef2d06eaaa6232f30382de26b\BIT153.tmp
C:\WINDOWS\SoftwareDistribution\Download\2a2715f6180c3bfa2a58178525f24c67\BIT158.tmp
C:\WINDOWS\SoftwareDistribution\Download\30e59c18bd4207d3aa8ebf77e5b45caa\BIT150.tmp
C:\WINDOWS\SoftwareDistribution\Download\4982a61e2216973813f44f56425bf3d9\BIT151.tmp
C:\WINDOWS\SoftwareDistribution\Download\723d12ccbc22f288fb53cd47a25782f9\BIT15B.tmp
C:\WINDOWS\SoftwareDistribution\Download\a0fe7704776ce2219611aa89e7b4dfca\BIT15A.tmp
C:\WINDOWS\SoftwareDistribution\Download\ae9bc65d0f581db8e80ca74b7951e935\BIT154.tmp
C:\WINDOWS\SoftwareDistribution\Download\dc6733dab87a46fa9320681df7d8d3c5\BIT152.tmp
C:\WINDOWS\SoftwareDistribution\Download\e7e98304794d11e8128641bb5cbd922c\BIT157.tmp
C:\WINDOWS\SoftwareDistribution\Download\f54d9f16cafb3a043d81262b001f62f8\BIT155.tmp
C:\WINDOWS\ServicePackFiles\8\livetri.zip
C:\WINDOWS\ServicePackFiles\8\norton$20antivirus_14.2_english_livetri.zip
Finished!

1972vet

3.3K Posts

September 15th, 2007 16:00

OK Joe, thanks for the sdfix scan log. As you can see, we still have problems. Let's try to find these hidden rootkit protected files using a different utility. From what we have done so far, I'm assuming now that your computer will boot normally into windows. To use this utility, it has to run in normal mode. Let's give it a try:

1. Please download the command line version of F-Secure Blacklight (fsblc.exe) and save to your C:\ drive.
2. Open a command window by going to Start > Run and typing: cmd
3. Copy/paste or type the following in the command window:

C:\fsblc --expert

4. Hit Enter to start the program.
5. Read the license agreement while hitting the space bar to scroll thru it, as required.
6. Type Y to accept the user agreement and the BlackLight scan will automatically begin.
7. Leave your system idle while Blackilight is scanning, but keep the command window open so you can see when the scan is finished (scan time is about 30 minutes).
8. BlackLight will create a log in C:\ drive named " fsbl-xxxxxxx.log" (the xxxxxxx will be the date and time of the scan).
9. The log will have a list of all hidden items found. Do not choose to rename any yet! I want to see the log first because legitimate items can also be present.
10. Exit Blacklight and post the contents of the log in your next reply.

Note: If you download Blacklight to your desktop, just double-click to run from there and it will create the "fsbl-xxxxxxx.log" on your desktop.

jefraz2003

29 Posts

September 16th, 2007 18:00

this is the log that was written before i shut it off
 
09/16/07 00:25:20 [Info]: BlackLight Engine 1.0.64 initialized
09/16/07 00:25:20 [Info]: OS: 5.1 build 2600 (Service Pack 2)
09/16/07 00:25:20 [Note]: 7019 4
09/16/07 00:25:20 [Note]: 7005 0
09/16/07 00:25:21 [Note]: 7006 0
09/16/07 00:25:21 [Note]: 7022 0
09/16/07 00:25:21 [Note]: 7011 188
09/16/07 00:25:21 [Note]: 7026 0
09/16/07 00:25:21 [Note]: 7026 0
09/16/07 00:25:26 [Note]: FSRAW library version 1.7.1022
09/16/07 00:38:33 [Info]: Hidden file: c:\WINDOWS\system32\drivers\Wpe29.sys

jefraz2003

29 Posts

September 16th, 2007 18:00

this program seems to take an extremely long time.  the first time i started it i waited for about an hour and nothing happened so i turned it off and started it again right before i went to bed.  it ran all night and while i was at work and when i came home it was still going.  i tried to run it in safe mode but it won't run in safe mode.

1972vet

3.3K Posts

September 18th, 2007 00:00

Now use Blacklight in exactly the same way as before, but when it shows the list of the items found, select the "Hidden file" entry Wpe29.sys and choose to let Blacklite rename it by clicking the Rename button.

1. Next to the entry, " rename" should appear.
2. Click " Next".
3. Blacklight will give you a warning if you are sure. Click " Yes".
4. Then it will tell you: " Your computer will reboot now"
5. Click " Yes".

Post back your results. Thanks!

jefraz2003

29 Posts

September 18th, 2007 21:00

i don't get that far.  the only way i can see the hidden files is through notepad.  the run screen just looks like Scanning for hidden items . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . .
and it just keeps going.  it never stops.  Ctrl-C won't even let me abort.

1972vet

3.3K Posts

September 19th, 2007 02:00

We started the rootkit scanning using gmer and found evidence of a rootkit. It's always prudent to use more than one scanner to confirm the findings. We used Panda next but you were unable to boot up when we removed it using that software so we went on to Blacklight.

Blacklight isn't working well for your situation either but since gmer is the only one of the rootkit scanners that works in safe mode, let's boot to safe mode and run gmer again.

Since we now know that the rootkit entries it found are valid, then when the scan completes and you are presented with the hidden service, click "Delete the service" and answer yes to all the questions.

Post back your results. Good Luck!

jefraz2003

29 Posts

September 19th, 2007 16:00

it doesn't give me any options once the scan is completed
at the top it says type, name, and value
for each one when i right click on the name i see:  Restore SSDT, Restore Code, Delete the Service, Delete File, Kill Process, Dump module
For Type: Code,Reg, and Device it won't give many any options
For Type:  PAGE allows me to Restore Code
For Type: ADS and File it will let me delete file
 
I haven't performed any of the tasks yet
 

1972vet

3.3K Posts

September 19th, 2007 19:00

From the first gmer scan log you posted, these are the ads and the driver that you want to delete:

---- Files - GMER 1.0.13 ----

ADS C:\System Volume Information\_restore{1F0DC798-E797-4DEA-801A-E0B5F9D68924}\RP1169\A0111957.exe:exe.exe
ADS C:\System Volume Information\_restore{1F0DC798-E797-4DEA-801A-E0B5F9D68924}\RP1187\A0162908.exe:exe.exe
File C:\WINDOWS\system32\drivers\Wpe29.sys

---- EOF - GMER 1.0.13 ----

jefraz2003

29 Posts

September 20th, 2007 14:00

---- Registry - GMER 1.0.13 ----
Reg     \Registry\MACHINE\SYSTEM\ControlSet002\Control\GroupOrderList@System Reserved?Boot Bus Extender?System Bus Extender?SCSI miniport?Port?Primary Disk?SCSI Class?SCSI CDROM Class?FSFilter Infrastructure?FSFilter System?FSFilter Bottom?FSFilter Copy Protection?FSFilter Security Enhancer?FSFilter Open File?FSFilter Physical Quota Management?FSFilter Encryption?FSFilter Compression?FSFilter HSM?FSFilter Cluster File System?FSFilter System Recovery?FSFilter Quota Management?FSFilter Content Screener?FSFilter Continuous Backup?FSFilter Replication?FSFilter Anti-Virus?FSFilter Undelete?FSFilter Activity Monitor?FSFilter Top?Filter?Boot File System?Base?Pointer Port?Keyboard Port?Pointer Class?Keyboard Class?Video Init?Video?Video Save?File System?Event Log?Streams Drivers?NDIS Wrapper?COM Infrastructure?UIGroup?LocalValidation?PlugPlay?PNP_TDI?NDIS?TDI?NetBIOSGroup?ShellSvcGroup?SchedulerGroup?SpoolerGroup?AudioGroup?SmartCardGroup?NetworkProvider?RemoteValidation?NetDDEGroup?Parallel arbitrator?Extended Base?PCI Con  0x02 0x00 0x00 0x00 ...
Reg     \Registry\MACHINE\SYSTEM\ControlSet003\Control\GroupOrderList@System Reserved?Boot Bus Extender?System Bus Extender?SCSI miniport?Port?Primary Disk?SCSI Class?SCSI CDROM Class?FSFilter Infrastructure?FSFilter System?FSFilter Bottom?FSFilter Copy Protection?FSFilter Security Enhancer?FSFilter Open File?FSFilter Physical Quota Management?FSFilter Encryption?FSFilter Compression?FSFilter HSM?FSFilter Cluster File System?FSFilter System Recovery?FSFilter Quota Management?FSFilter Content Screener?FSFilter Continuous Backup?FSFilter Replication?FSFilter Anti-Virus?FSFilter Undelete?FSFilter Activity Monitor?FSFilter Top?Filter?Boot File System?Base?Pointer Port?Keyboard Port?Pointer Class?Keyboard Class?Video Init?Video?Video Save?File System?Event Log?Streams Drivers?NDIS Wrapper?COM Infrastructure?UIGroup?LocalValidation?PlugPlay?PNP_TDI?NDIS?TDI?NetBIOSGroup?ShellSvcGroup?SchedulerGroup?SpoolerGroup?AudioGroup?SmartCardGroup?NetworkProvider?RemoteValidation?NetDDEGroup?Parallel arbitrator?Extended Base?PCI Con  0x02 0x00 0x00 0x00 ...
Reg     \Registry\MACHINE\SYSTEM\ControlSet004\Control\GroupOrderList@System Reserved?Boot Bus Extender?System Bus Extender?SCSI miniport?Port?Primary Disk?SCSI Class?SCSI CDROM Class?FSFilter Infrastructure?FSFilter System?FSFilter Bottom?FSFilter Copy Protection?FSFilter Security Enhancer?FSFilter Open File?FSFilter Physical Quota Management?FSFilter Encryption?FSFilter Compression?FSFilter HSM?FSFilter Cluster File System?FSFilter System Recovery?FSFilter Quota Management?FSFilter Content Screener?FSFilter Continuous Backup?FSFilter Replication?FSFilter Anti-Virus?FSFilter Undelete?FSFilter Activity Monitor?FSFilter Top?Filter?Boot File System?Base?Pointer Port?Keyboard Port?Pointer Class?Keyboard Class?Video Init?Video?Video Save?File System?Event Log?Streams Drivers?NDIS Wrapper?COM Infrastructure?UIGroup?LocalValidation?PlugPlay?PNP_TDI?NDIS?TDI?NetBIOSGroup?ShellSvcGroup?SchedulerGroup?SpoolerGroup?AudioGroup?SmartCardGroup?NetworkProvider?RemoteValidation?NetDDEGroup?Parallel arbitrator?Extended Base?PCI Con  0x02 0x00 0x00 0x00 ...
Reg     \Registry\MACHINE\SYSTEM\CurrentControlSet\Control\GroupOrderList@System Reserved?Boot Bus Extender?System Bus Extender?SCSI miniport?Port?Primary Disk?SCSI Class?SCSI CDROM Class?FSFilter Infrastructure?FSFilter System?FSFilter Bottom?FSFilter Copy Protection?FSFilter Security Enhancer?FSFilter Open File?FSFilter Physical Quota Management?FSFilter Encryption?FSFilter Compression?FSFilter HSM?FSFilter Cluster File System?FSFilter System Recovery?FSFilter Quota Management?FSFilter Content Screener?FSFilter Continuous Backup?FSFilter Replication?FSFilter Anti-Virus?FSFilter Undelete?FSFilter Activity Monitor?FSFilter Top?Filter?Boot File System?Base?Pointer Port?Keyboard Port?Pointer Class?Keyboard Class?Video Init?Video?Video Save?File System?Event Log?Streams Drivers?NDIS Wrapper?COM Infrastructure?UIGroup?LocalValidation?PlugPlay?PNP_TDI?NDIS?TDI?NetBIOSGroup?ShellSvcGroup?SchedulerGroup?SpoolerGroup?AudioGroup?SmartCardGroup?NetworkProvider?RemoteValidation?NetDDEGroup?Parallel arbitrator?Extended Base?PCI  0x02 0x00 0x00 0x00 ...
---- Files - GMER 1.0.13 ----
File    C:\WINDOWS\system32\drivers\Wpe29.sys

jefraz2003

29 Posts

September 20th, 2007 14:00

GMER 1.0.13.12551 - http://www.gmer.net
Rootkit scan 2007-09-20 11:14:20
Windows 5.1.2600 Service Pack 2

---- System - GMER 1.0.13 ----
Code    Wpe29.sys                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ZwEnumerateKey
Code    Wpe29.sys                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        ZwOpenKey

jefraz2003

29 Posts

September 20th, 2007 14:00

here is the gmer that i ran after i deleted the file and 2 ads.  it seemed to get rid of the ads but the file keeps coming back.  i have deleted it and reran the program 3 times.
 
 

Was this post helpful?

View All

No Events found!

Top