Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected with Sirefef.B, Y


  • This topic is locked This topic is locked
15 replies to this topic

#1 RandomSkratch

RandomSkratch

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:30 PM

Posted 10 July 2012 - 10:24 AM

Trying to clean up a coworkers computer. After removing a bunch of malicious files while it was removed and mounted externally to a different computer, some other bugs have reared their heads. Couldn't start Windows Firewall as the service isn't found. He has Norton (which says everything is golden) and I managed to run MBAM successfully, along with MSE however now as soon as the computer boots, MSE starts to clean something and suspends the following things: Virus: Win64/Sirefef.B and Trojan: Win64/Sirefef.Y.

At this point another box appears and says, "Windows has encountered a critical problem and will restart automatically." There's about 1-2 minute window of being able to do anything on the machine now.

Was able to work quickly and get a DDS report however it's a 64bit machine so no GMER report.

Appreciate the help!

--Marc

------------------------------
.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.5.1
Run by family at 11:16:09 on 2012-07-10
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3959.2623 [GMT -4:00]
.
AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Norton Internet Security\Engine\19.7.1.5\ccSvcHst.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\taskhost.exe
C:\Program Files (x86)\Norton Internet Security\Engine\19.7.1.5\ccSvcHst.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\userinit.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
c:\Program Files\Microsoft Security Client\MpCmdRun.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.yahoo.com/
mWinlogon: Userinit=userinit.exe
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Norton Identity Protection: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - C:\Program Files (x86)\Norton Internet Security\Engine\19.7.1.5\coIEPlg.dll
BHO: Norton Vulnerability Protection: {6d53ec84-6aae-4787-aeee-f4628f01010c} - C:\Program Files (x86)\Norton Internet Security\Engine\19.7.1.5\IPS\IPSBHO.DLL
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - C:\Program Files (x86)\Norton Internet Security\Engine\19.7.1.5\coIEPlg.dll
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
TB: {BB45EF8E-1E36-4535-A017-EC908FB1E335} - No File
TB: {BB3F7563-E9A4-43BC-9A7C-94A642DD1FFA} - No File
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2iexp.dll
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://javadl-esd.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
TCP: DhcpNameServer = 207.181.101.4 207.181.101.5 4.2.2.2
TCP: Interfaces\{09FA38AD-203C-4070-9A61-0B7FCEF7B7EB} : DhcpNameServer = 207.181.101.4 207.181.101.5 4.2.2.2
Handler: intu-tt2011 - {B3B5DAD9-E96D-45b4-B636-B6CF2F773DE1} - C:\Program Files (x86)\TurboTax 2011\ic2011pp.dll
BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO-X64: AcroIEHelperStub - No File
BHO-X64: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\19.7.1.5\coIEPlg.dll
BHO-X64: Norton Identity Protection - No File
BHO-X64: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\19.7.1.5\IPS\IPSBHO.DLL
BHO-X64: Norton Vulnerability Protection - No File
BHO-X64: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll
BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll
TB-X64: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\19.7.1.5\coIEPlg.dll
TB-X64: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
TB-X64: {BB45EF8E-1E36-4535-A017-EC908FB1E335} - No File
TB-X64: {BB3F7563-E9A4-43BC-9A7C-94A642DD1FFA} - No File
mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
.
============= SERVICES / DRIVERS ===============
.
R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys --> C:\Windows\system32\DRIVERS\MpFilter.sys [?]
R0 SymDS;Symantec Data Store;C:\Windows\system32\drivers\NISx64\1307010.005\SYMDS64.SYS --> C:\Windows\system32\drivers\NISx64\1307010.005\SYMDS64.SYS [?]
R0 SymEFA;Symantec Extended File Attributes;C:\Windows\system32\drivers\NISx64\1307010.005\SYMEFA64.SYS --> C:\Windows\system32\drivers\NISx64\1307010.005\SYMEFA64.SYS [?]
R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\BASHDefs\20120619.001\BHDrvx64.sys [2012-6-19 1161376]
R1 ccSet_NIS;Norton Internet Security Settings Manager;C:\Windows\system32\drivers\NISx64\1307010.005\ccSetx64.sys --> C:\Windows\system32\drivers\NISx64\1307010.005\ccSetx64.sys [?]
R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\IPSDefs\20120705.001\IDSviA64.sys [2012-7-5 509088]
R1 SymIRON;Symantec Iron Driver;C:\Windows\system32\drivers\NISx64\1307010.005\Ironx64.SYS --> C:\Windows\system32\drivers\NISx64\1307010.005\Ironx64.SYS [?]
R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\system32\Drivers\NISx64\1307010.005\SYMNETS.SYS --> C:\Windows\system32\Drivers\NISx64\1307010.005\SYMNETS.SYS [?]
R2 NIS;Norton Internet Security;C:\Program Files (x86)\Norton Internet Security\Engine\19.7.1.5\ccsvchst.exe [2012-6-21 138232]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-6-21 138912]
R3 IntcDAud;Intel® Display Audio;C:\Windows\system32\DRIVERS\IntcDAud.sys --> C:\Windows\system32\DRIVERS\IntcDAud.sys [?]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-2-3 136176]
S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-2-3 136176]
S3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys --> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?]
S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2012-3-26 291696]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
.
=============== Created Last 30 ================
.
2012-07-10 15:02:35 328704 ----a-w- C:\Windows\System32\services.exe.B60FD15A9C322B69
2012-07-10 15:00:25 328704 ----a-w- C:\Windows\System32\services.exe.B8B9B20BCFB1DB68
2012-07-10 15:00:03 328704 ----a-w- C:\Windows\System32\services.exe.E15DBBBE714E872A
2012-07-10 14:59:56 69000 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{4E5C7749-C514-4644-9FF3-8AF09012C0A6}\offreg.dll
2012-07-10 14:59:04 9013136 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{4E5C7749-C514-4644-9FF3-8AF09012C0A6}\mpengine.dll
2012-07-10 14:50:31 927800 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2012-07-10 14:50:31 927800 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{D2F2DE88-C4E8-41F4-B38B-D7C2F9A11B5B}\gapaengine.dll
2012-07-10 14:45:21 -------- d-----w- C:\Program Files (x86)\Microsoft Security Client
2012-07-10 14:45:18 -------- d-----w- C:\Program Files\Microsoft Security Client
2012-07-10 13:30:43 -------- d-----w- C:\Program Files\CCleaner
2012-07-10 13:30:29 -------- d-----w- C:\Users\family\AppData\Roaming\Malwarebytes
2012-07-10 13:30:13 -------- d-----w- C:\ProgramData\Malwarebytes
2012-07-10 13:30:12 24904 ----a-w- C:\Windows\System32\drivers\mbam.sys
2012-07-10 13:30:12 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-07-06 22:48:03 -------- d-----w- C:\Users\family\AppData\Roaming\ApplicationData
2012-07-04 18:02:43 -------- d-----w- C:\Users\family\AppData\Local\NPE
2012-07-04 17:00:56 27256 ----a-w- C:\Windows\System32\drivers\FixZeroAccess.sys
2012-07-03 20:48:18 -------- d-----w- C:\Users\family\jagexcache
2012-07-03 20:46:18 -------- d-----w- C:\ProgramData\Ask
2012-07-03 20:45:21 -------- d-----w- C:\Program Files (x86)\Oracle
2012-07-03 20:44:30 687504 ----a-w- C:\Windows\SysWow64\deployJava1.dll
2012-07-03 20:44:29 772504 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll
2012-06-28 00:25:12 -------- d-----w- C:\Users\family\AppData\Local\CrashDumps
2012-06-22 13:34:44 2622464 ----a-w- C:\Windows\System32\wucltux.dll
2012-06-22 13:34:23 99840 ----a-w- C:\Windows\System32\wudriver.dll
2012-06-22 13:34:01 36864 ----a-w- C:\Windows\System32\wuapp.exe
2012-06-22 13:34:01 186752 ----a-w- C:\Windows\System32\wuwebv.dll
2012-06-22 01:07:17 737912 ----a-w- C:\Windows\System32\drivers\NISx64\1307010.005\srtsp64.sys
2012-06-22 01:07:17 451192 ----a-r- C:\Windows\System32\drivers\NISx64\1307010.005\symds64.sys
2012-06-22 01:07:17 405624 ----a-w- C:\Windows\System32\drivers\NISx64\1307010.005\symnets.sys
2012-06-22 01:07:17 37496 ----a-w- C:\Windows\System32\drivers\NISx64\1307010.005\srtspx64.sys
2012-06-22 01:07:17 190072 ----a-w- C:\Windows\System32\drivers\NISx64\1307010.005\ironx64.sys
2012-06-22 01:07:17 1092728 ----a-w- C:\Windows\System32\drivers\NISx64\1307010.005\symefa64.sys
2012-06-22 01:07:16 167048 ----a-w- C:\Windows\System32\drivers\NISx64\1307010.005\ccsetx64.sys
2012-06-22 01:07:07 -------- d-----w- C:\Windows\System32\drivers\NISx64\1307010.005
2012-06-21 00:29:13 -------- d-----w- C:\Program Files (x86)\Common Files\Symantec Shared
2012-06-21 00:05:15 175736 ----a-w- C:\Windows\System32\drivers\SYMEVENT64x86.SYS
2012-06-21 00:05:15 -------- d-----w- C:\Program Files\Symantec
2012-06-21 00:05:15 -------- d-----w- C:\Program Files\Common Files\Symantec Shared
2012-06-21 00:04:13 -------- d-----w- C:\Windows\System32\drivers\NISx64
2012-06-21 00:04:11 -------- d-----w- C:\ProgramData\Norton
2012-06-21 00:04:11 -------- d-----w- C:\Program Files (x86)\Norton Internet Security
2012-06-21 00:03:21 -------- d-----w- C:\ProgramData\NortonInstaller
2012-06-21 00:03:21 -------- d-----w- C:\Program Files (x86)\NortonInstaller
2012-06-20 19:00:02 -------- d-sh--w- C:\Windows\System32\%APPDATA%
2012-06-13 21:11:39 9216 ----a-w- C:\Windows\System32\rdrmemptylst.exe
2012-06-12 00:22:59 1135104 ----a-w- C:\Windows\System32\FntCache.dll
.
==================== Find3M ====================
.
2012-05-18 02:06:48 2311680 ----a-w- C:\Windows\System32\jscript9.dll
2012-05-18 01:59:14 1392128 ----a-w- C:\Windows\System32\wininet.dll
2012-05-18 01:58:39 1494528 ----a-w- C:\Windows\System32\inetcpl.cpl
2012-05-18 01:55:22 173056 ----a-w- C:\Windows\System32\ieUnatt.exe
2012-05-18 01:51:30 2382848 ----a-w- C:\Windows\System32\mshtml.tlb
2012-05-17 22:45:37 1800192 ----a-w- C:\Windows\SysWow64\jscript9.dll
2012-05-17 22:35:47 1129472 ----a-w- C:\Windows\SysWow64\wininet.dll
2012-05-17 22:35:39 1427968 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2012-05-17 22:29:45 142848 ----a-w- C:\Windows\SysWow64\ieUnatt.exe
2012-05-17 22:24:45 2382848 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2012-05-15 01:32:20 3144192 ----a-w- C:\Windows\System32\win32k.sys
2012-05-04 10:52:22 5505392 ----a-w- C:\Windows\System32\ntoskrnl.exe
2012-05-04 10:08:16 3958128 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2012-05-04 10:08:15 3902320 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2012-05-02 05:32:43 208896 ----a-w- C:\Windows\System32\profsvc.dll
2012-04-28 03:50:40 204800 ----a-w- C:\Windows\System32\drivers\rdpwd.sys
2012-04-26 05:34:38 76288 ----a-w- C:\Windows\System32\rdpwsx.dll
2012-04-26 05:34:37 149504 ----a-w- C:\Windows\System32\rdpcorekmts.dll
2012-04-24 05:59:45 182272 ----a-w- C:\Windows\System32\cryptsvc.dll
2012-04-24 05:59:45 1460224 ----a-w- C:\Windows\System32\crypt32.dll
2012-04-24 05:59:45 140288 ----a-w- C:\Windows\System32\cryptnet.dll
2012-04-24 04:47:04 139264 ----a-w- C:\Windows\SysWow64\cryptsvc.dll
2012-04-24 04:47:04 103936 ----a-w- C:\Windows\SysWow64\cryptnet.dll
2012-04-24 04:47:03 1156608 ----a-w- C:\Windows\SysWow64\crypt32.dll
.
============= FINISH: 11:16:52.54 ===============

BC AdBot (Login to Remove)

 


#2 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:06:30 PM

Posted 10 July 2012 - 11:44 AM

Hi,

Please do the following:

download Farbar Recovery Scan Tool and save it to a flash drive.
(you need the 64bit version)
Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:
  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  • Use the arrow keys to select the Repair your computer menu item.
  • Choose your language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account and click Next.
To enter System Recovery Options by using Windows installation disc:
  • Insert the installation disc.
  • Restart your computer.
  • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  • Click Repair your computer.
  • Choose your language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account an click Next.
On the System Recovery Options menu you will get the following options:
Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt
[*]Select Command Prompt
[*]In the command window type in notepad and press Enter.
[*]The notepad opens. Under File menu select Open.
[*]Select "Computer" and find your flash drive letter and close the notepad.
[*]In the command window type e:\frst64 and press Enter
Note: Replace letter e with the drive letter of your flash drive.
[*]The tool will start to run.
[*]When the tool opens click Yes to the disclaimer.
[*]Place a check next to List Drivers MD5 as well as the default check marks that are already there
[*]Press Scan button.
[*]FRST will let you know when the scan is complete and has written the FRST.txt to file, close out this message, then type the following into the search box:
services.exe
[*]now press the search button
[*]when the search is complete, search.txt will also be written to your USB
[*]type exit and reboot the computer normally
[*]please copy and paste both logs in your reply.(FRST.txt and Search.txt)[/list]

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#3 RandomSkratch

RandomSkratch
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:30 PM

Posted 10 July 2012 - 12:29 PM

Thank you CatByte, below are the logs as requested.


Scan result of Farbar Recovery Scan Tool Version: 09-07-2012
Ran by SYSTEM at 10-07-2012 13:13:20
Running from G:\
Windows 7 Home Premium (X64) OS Language: English(US)
The current controlset is ControlSet001

========================== Registry (Whitelisted) =============

HKLM\...\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe [166424 2010-03-03] (Intel Corporation)
HKLM\...\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe [391192 2010-03-03] (Intel Corporation)
HKLM\...\Run: [Persistence] C:\Windows\system32\igfxpers.exe [410648 2010-03-03] (Intel Corporation)
HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [10081312 2010-02-22] (Realtek Semiconductor)
HKLM\...\Run: [EKIJ5000StatusMonitor] C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe [2045440 2010-09-02] (Eastman Kodak Company)
HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [1271168 2012-03-26] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [35696 2009-10-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [935288 2009-09-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [252296 2012-01-17] (Sun Microsystems, Inc.)
HKU\Alex Work File\...\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [x]
Winlogon\Notify\igfxcui: igfxdev.dll (Intel Corporation)
Tcpip\Parameters: [DhcpNameServer] 207.181.101.4 207.181.101.5 4.2.2.2

==================== Services (Whitelisted) ======

2 MsMpSvc; "C:\Program Files\Microsoft Security Client\MsMpEng.exe" [12600 2012-03-26] (Microsoft Corporation)
2 NIS; "C:\Program Files (x86)\Norton Internet Security\Engine\19.7.1.5\ccSvcHst.exe" /s "NIS" /m "C:\Program Files (x86)\Norton Internet Security\Engine\19.7.1.5\diMaster.dll" /prefetch:1 [309688 2012-04-12] (Symantec Corporation)
3 NisSrv; "C:\Program Files\Microsoft Security Client\NisSrv.exe" [291696 2012-03-26] (Microsoft Corporation)

========================== Drivers (Whitelisted) =============

1 BHDrvx64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\BASHDefs\20120619.001\BHDrvx64.sys [1161376 2012-06-18] (Symantec Corporation)
1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1307010.005\ccSetx64.sys [167048 2011-11-29] (Symantec Corporation)
1 eeCtrl; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2012-06-20] (Symantec Corporation)
3 EraserUtilRebootDrv; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [138912 2012-06-21] (Symantec Corporation)
1 IDSVia64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\IPSDefs\20120705.001\IDSvia64.sys [509088 2012-06-14] (Symantec Corporation)
3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\VirusDefs\20120706.036\ENG64.SYS [120440 2012-07-07] (Symantec Corporation)
3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\VirusDefs\20120706.036\EX64.SYS [2068600 2012-07-07] (Symantec Corporation)
3 SRTSP; C:\Windows\System32\Drivers\NISx64\1307010.005\SRTSP64.SYS [737912 2012-03-28] (Symantec Corporation)
1 SRTSPX; C:\Windows\system32\drivers\NISx64\1307010.005\SRTSPX64.SYS [37496 2012-03-28] (Symantec Corporation)
0 SymDS; C:\Windows\System32\drivers\NISx64\1307010.005\SYMDS64.SYS [451192 2011-07-25] (Symantec Corporation)
0 SymEFA; C:\Windows\System32\drivers\NISx64\1307010.005\SYMEFA64.SYS [1092728 2012-03-28] (Symantec Corporation)
3 SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [175736 2012-06-21] (Symantec Corporation)
1 SymIRON; C:\Windows\system32\drivers\NISx64\1307010.005\Ironx64.SYS [190072 2012-03-28] (Symantec Corporation)
1 SymNetS; C:\Windows\System32\Drivers\NISx64\1307010.005\SYMNETS.SYS [405624 2012-03-28] (Symantec Corporation)

========================== NetSvcs (Whitelisted) ===========


============ One Month Created Files and Folders ==============

2012-07-10 07:16 - 2012-07-10 07:14 - 00607260 ____R (Swearware) C:\Users\family\Desktop\dds.scr
2012-07-10 07:02 - 2012-07-10 07:02 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.B60FD15A9C322B69
2012-07-10 07:00 - 2012-07-10 07:00 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.E15DBBBE714E872A
2012-07-10 07:00 - 2012-07-10 07:00 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.B8B9B20BCFB1DB68
2012-07-10 06:53 - 2012-07-10 06:54 - 72229408 ____A (Microsoft Corporation) C:\Users\family\Downloads\msert.exe
2012-07-10 06:45 - 2012-07-10 06:53 - 00004549 ____A C:\Windows\WindowsUpdate.log
2012-07-10 06:45 - 2012-07-10 06:45 - 00000000 ____D C:\Program Files\Microsoft Security Client
2012-07-10 06:45 - 2012-07-10 06:45 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2012-07-10 06:43 - 2012-07-10 06:43 - 12621696 ____A (Microsoft Corporation) C:\Users\family\Downloads\mseinstall (1).exe
2012-07-10 06:41 - 2012-07-10 07:15 - 00000336 ____A C:\Windows\setupact.log
2012-07-10 06:41 - 2012-07-10 06:41 - 00000000 ____A C:\Windows\setuperr.log
2012-07-10 06:40 - 2012-07-10 06:40 - 00001622 ____A C:\Windows\PFRO.log
2012-07-10 05:30 - 2012-07-10 05:30 - 00001113 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-07-10 05:30 - 2012-07-10 05:30 - 00000822 ____A C:\Users\Public\Desktop\CCleaner.lnk
2012-07-10 05:30 - 2012-07-10 05:30 - 00000000 ____D C:\Users\family\AppData\Roaming\Malwarebytes
2012-07-10 05:30 - 2012-07-10 05:30 - 00000000 ____D C:\Users\All Users\Malwarebytes
2012-07-10 05:30 - 2012-07-10 05:30 - 00000000 ____D C:\Program Files\CCleaner
2012-07-10 05:30 - 2012-07-10 05:30 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-07-10 05:30 - 2012-04-04 11:56 - 00024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2012-07-10 05:29 - 2012-07-10 06:41 - 00000000 ____D C:\Users\family\Desktop\New folder
2012-07-06 14:48 - 2012-07-06 15:00 - 00000000 ____D C:\Users\family\AppData\Roaming\ApplicationData
2012-07-04 10:33 - 2012-07-04 10:33 - 00001389 ____A C:\Windows\System32\Drivers\etc\hosts.bak
2012-07-04 10:02 - 2012-07-04 18:16 - 00000000 ____D C:\Users\family\AppData\Local\NPE
2012-07-04 09:58 - 2012-07-04 09:58 - 00371097 ____A C:\Users\family\Desktop\bfe.reg.reg
2012-07-04 09:00 - 2012-07-04 09:00 - 01805736 ____A (Symantec Corporation) C:\Users\Alex Work File\Downloads\FixZeroAccess.exe
2012-07-04 09:00 - 2012-07-04 09:00 - 00027256 ____A (Symantec Corporation) C:\Windows\System32\Drivers\FixZeroAccess.sys
2012-07-04 08:33 - 2012-07-04 08:49 - 00000000 ____D C:\Users\Alex Work File\AppData\Local\NPE
2012-07-04 08:33 - 2012-07-04 08:33 - 02841104 ____A (Symantec Corporation) C:\Users\Alex Work File\Downloads\NPE.exe
2012-07-03 12:48 - 2012-07-03 18:00 - 00000024 ____A C:\Users\family\random.dat
2012-07-03 12:48 - 2012-07-03 17:54 - 00000045 ____A C:\Users\family\jagex_cl_runescape_LIVE.dat
2012-07-03 12:48 - 2012-07-03 12:48 - 00000000 ____D C:\Users\family\jagexcache
2012-07-03 12:46 - 2012-07-03 12:46 - 00000000 ____D C:\Users\All Users\Sun
2012-07-03 12:46 - 2012-07-03 12:46 - 00000000 ____D C:\Users\All Users\Ask
2012-07-03 12:45 - 2012-07-03 12:45 - 00000000 ____D C:\Program Files (x86)\Oracle
2012-07-03 12:44 - 2012-05-04 15:29 - 00772504 ____A (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2012-07-03 12:44 - 2012-05-04 15:29 - 00687504 ____A (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2012-07-03 12:44 - 2012-05-04 15:29 - 00227720 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2012-07-03 12:39 - 2012-07-03 12:39 - 00000312 ____A C:\Windows\SysWOW64\msexcr.ini
2012-07-03 12:21 - 2012-07-03 12:21 - 00000538 ____A C:\Users\family\Documents\budget1.rtf
2012-06-29 04:04 - 2012-06-29 04:04 - 00003784 ____A C:\{3411DC0B-BC33-4AAD-997B-290F63DB2AEE}
2012-06-27 16:25 - 2012-07-10 05:36 - 00000000 ____D C:\Users\family\AppData\Local\CrashDumps
2012-06-22 12:47 - 2012-06-22 12:47 - 00002664 ____A C:\{7DE08906-0542-4CB1-A12E-5E5B3777E46E}
2012-06-22 05:34 - 2012-06-02 14:19 - 02428952 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
2012-06-22 05:34 - 2012-06-02 14:19 - 00701976 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll
2012-06-22 05:34 - 2012-06-02 14:19 - 00057880 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
2012-06-22 05:34 - 2012-06-02 14:19 - 00044056 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll
2012-06-22 05:34 - 2012-06-02 14:19 - 00038424 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll
2012-06-22 05:34 - 2012-06-02 14:15 - 02622464 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll
2012-06-22 05:34 - 2012-06-02 14:15 - 00099840 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll
2012-06-22 05:34 - 2012-06-02 11:19 - 00186752 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
2012-06-22 05:34 - 2012-06-02 11:15 - 00036864 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe
2012-06-20 16:05 - 2012-06-22 12:43 - 00002492 ____A C:\Users\Public\Desktop\Norton Internet Security.lnk
2012-06-20 16:05 - 2012-06-21 17:07 - 00175736 ____A (Symantec Corporation) C:\Windows\System32\Drivers\SYMEVENT64x86.SYS
2012-06-20 16:05 - 2012-06-21 17:07 - 00007488 ____A C:\Windows\System32\Drivers\SYMEVENT64x86.CAT
2012-06-20 16:05 - 2012-06-21 17:07 - 00000000 ____D C:\Program Files\Symantec
2012-06-20 16:05 - 2012-06-20 16:05 - 00000000 ____D C:\Program Files\Common Files\Symantec Shared
2012-06-20 16:04 - 2012-07-04 08:33 - 00000000 ____D C:\Users\All Users\Norton
2012-06-20 16:04 - 2012-06-22 12:43 - 00000000 ____D C:\Windows\System32\Drivers\NISx64
2012-06-20 16:04 - 2012-06-20 16:04 - 00000000 ____D C:\Program Files (x86)\Norton Internet Security
2012-06-20 11:00 - 2012-06-20 11:00 - 00000000 __SHD C:\Windows\System32\%APPDATA%
2012-06-13 23:00 - 2012-05-17 18:47 - 17807360 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-06-13 23:00 - 2012-05-17 18:16 - 10924032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-06-13 23:00 - 2012-05-17 18:06 - 02311680 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-06-13 23:00 - 2012-05-17 17:59 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-06-13 23:00 - 2012-05-17 17:59 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-06-13 23:00 - 2012-05-17 17:58 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-06-13 23:00 - 2012-05-17 17:58 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-06-13 23:00 - 2012-05-17 17:56 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-06-13 23:00 - 2012-05-17 17:55 - 00818688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-06-13 23:00 - 2012-05-17 17:55 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-06-13 23:00 - 2012-05-17 17:54 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-06-13 23:00 - 2012-05-17 17:51 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-06-13 23:00 - 2012-05-17 17:51 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-06-13 23:00 - 2012-05-17 17:47 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-06-13 23:00 - 2012-05-17 15:11 - 12314624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2012-06-13 23:00 - 2012-05-17 14:48 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2012-06-13 23:00 - 2012-05-17 14:45 - 01800192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2012-06-13 23:00 - 2012-05-17 14:36 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2012-06-13 23:00 - 2012-05-17 14:35 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2012-06-13 23:00 - 2012-05-17 14:35 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2012-06-13 23:00 - 2012-05-17 14:33 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2012-06-13 23:00 - 2012-05-17 14:31 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2012-06-13 23:00 - 2012-05-17 14:29 - 00716800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2012-06-13 23:00 - 2012-05-17 14:29 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2012-06-13 23:00 - 2012-05-17 14:27 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2012-06-13 23:00 - 2012-05-17 14:25 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2012-06-13 23:00 - 2012-05-17 14:24 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2012-06-13 23:00 - 2012-05-17 14:20 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2012-06-13 13:11 - 2012-05-14 17:32 - 03144192 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-06-13 13:11 - 2012-05-04 02:52 - 05505392 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2012-06-13 13:11 - 2012-05-04 02:08 - 03958128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2012-06-13 13:11 - 2012-05-04 02:08 - 03902320 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2012-06-13 13:11 - 2012-05-01 21:32 - 00208896 ____A (Microsoft Corporation) C:\Windows\System32\profsvc.dll
2012-06-13 13:11 - 2012-04-27 19:50 - 00204800 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2012-06-13 13:11 - 2012-04-25 21:34 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2012-06-13 13:11 - 2012-04-25 21:34 - 00076288 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll
2012-06-13 13:11 - 2012-04-25 21:28 - 00009216 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe
2012-06-13 13:11 - 2012-04-23 21:59 - 01460224 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2012-06-13 13:11 - 2012-04-23 21:59 - 00182272 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2012-06-13 13:11 - 2012-04-23 21:59 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2012-06-13 13:11 - 2012-04-23 20:47 - 01156608 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2012-06-13 13:11 - 2012-04-23 20:47 - 00139264 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2012-06-13 13:11 - 2012-04-23 20:47 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2012-06-13 13:11 - 2012-04-07 04:18 - 03213824 ____A (Microsoft Corporation) C:\Windows\System32\msi.dll
2012-06-13 13:11 - 2012-04-07 03:34 - 02342400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2012-06-11 16:22 - 2011-02-18 22:37 - 01135104 ____A (Microsoft Corporation) C:\Windows\System32\FntCache.dll


============ 3 Months Modified Files ========================

2012-07-10 07:15 - 2012-07-10 06:41 - 00000336 ____A C:\Windows\setupact.log
2012-07-10 07:15 - 2012-02-03 02:39 - 00000894 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2012-07-10 07:15 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2012-07-10 07:14 - 2012-07-10 07:16 - 00607260 ____R (Swearware) C:\Users\family\Desktop\dds.scr
2012-07-10 07:02 - 2012-07-10 07:02 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.B60FD15A9C322B69
2012-07-10 07:02 - 2012-02-03 02:39 - 00000898 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2012-07-10 07:00 - 2012-07-10 07:00 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.E15DBBBE714E872A
2012-07-10 07:00 - 2012-07-10 07:00 - 00328704 ____A (Microsoft Corporation) C:\Windows\System32\services.exe.B8B9B20BCFB1DB68
2012-07-10 06:54 - 2012-07-10 06:53 - 72229408 ____A (Microsoft Corporation) C:\Users\family\Downloads\msert.exe
2012-07-10 06:53 - 2012-07-10 06:45 - 00004549 ____A C:\Windows\WindowsUpdate.log
2012-07-10 06:49 - 2012-02-01 17:50 - 00001945 ____A C:\Windows\epplauncher.mif
2012-07-10 06:48 - 2009-07-13 20:45 - 00014832 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2012-07-10 06:48 - 2009-07-13 20:45 - 00014832 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2012-07-10 06:45 - 2012-02-01 17:50 - 00742892 ____A C:\Windows\SysWOW64\PerfStringBackup.INI
2012-07-10 06:45 - 2009-07-13 21:13 - 00729514 ____A C:\Windows\System32\PerfStringBackup.INI
2012-07-10 06:43 - 2012-07-10 06:43 - 12621696 ____A (Microsoft Corporation) C:\Users\family\Downloads\mseinstall (1).exe
2012-07-10 06:41 - 2012-07-10 06:41 - 00000000 ____A C:\Windows\setuperr.log
2012-07-10 06:40 - 2012-07-10 06:40 - 00001622 ____A C:\Windows\PFRO.log
2012-07-10 05:30 - 2012-07-10 05:30 - 00001113 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-07-10 05:30 - 2012-07-10 05:30 - 00000822 ____A C:\Users\Public\Desktop\CCleaner.lnk
2012-07-04 10:33 - 2012-07-04 10:33 - 00001389 ____A C:\Windows\System32\Drivers\etc\hosts.bak
2012-07-04 09:58 - 2012-07-04 09:58 - 00371097 ____A C:\Users\family\Desktop\bfe.reg.reg
2012-07-04 09:00 - 2012-07-04 09:00 - 01805736 ____A (Symantec Corporation) C:\Users\Alex Work File\Downloads\FixZeroAccess.exe
2012-07-04 09:00 - 2012-07-04 09:00 - 00027256 ____A (Symantec Corporation) C:\Windows\System32\Drivers\FixZeroAccess.sys
2012-07-04 08:33 - 2012-07-04 08:33 - 02841104 ____A (Symantec Corporation) C:\Users\Alex Work File\Downloads\NPE.exe
2012-07-03 18:00 - 2012-07-03 12:48 - 00000024 ____A C:\Users\family\random.dat
2012-07-03 17:54 - 2012-07-03 12:48 - 00000045 ____A C:\Users\family\jagex_cl_runescape_LIVE.dat
2012-07-03 12:44 - 2012-04-22 12:37 - 00174064 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2012-07-03 12:44 - 2012-04-22 12:37 - 00174064 ____A (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2012-07-03 12:39 - 2012-07-03 12:39 - 00000312 ____A C:\Windows\SysWOW64\msexcr.ini
2012-07-03 12:21 - 2012-07-03 12:21 - 00000538 ____A C:\Users\family\Documents\budget1.rtf
2012-06-29 04:04 - 2012-06-29 04:04 - 00003784 ____A C:\{3411DC0B-BC33-4AAD-997B-290F63DB2AEE}
2012-06-22 12:47 - 2012-06-22 12:47 - 00002664 ____A C:\{7DE08906-0542-4CB1-A12E-5E5B3777E46E}
2012-06-22 12:43 - 2012-06-20 16:05 - 00002492 ____A C:\Users\Public\Desktop\Norton Internet Security.lnk
2012-06-21 17:07 - 2012-06-20 16:05 - 00175736 ____A (Symantec Corporation) C:\Windows\System32\Drivers\SYMEVENT64x86.SYS
2012-06-21 17:07 - 2012-06-20 16:05 - 00007488 ____A C:\Windows\System32\Drivers\SYMEVENT64x86.CAT
2012-06-14 18:39 - 2009-07-13 20:45 - 00295792 ____A C:\Windows\System32\FNTCACHE.DAT
2012-06-05 13:30 - 2012-06-05 13:30 - 00039424 ____A C:\Users\family\Downloads\updated resume lex (1).wps
2012-06-05 13:29 - 2012-06-05 13:29 - 00039424 ____A C:\Users\family\Downloads\updated resume lex.wps
2012-06-02 14:19 - 2012-06-22 05:34 - 02428952 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
2012-06-02 14:19 - 2012-06-22 05:34 - 00701976 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll
2012-06-02 14:19 - 2012-06-22 05:34 - 00057880 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
2012-06-02 14:19 - 2012-06-22 05:34 - 00044056 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll
2012-06-02 14:19 - 2012-06-22 05:34 - 00038424 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll
2012-06-02 14:15 - 2012-06-22 05:34 - 02622464 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll
2012-06-02 14:15 - 2012-06-22 05:34 - 00099840 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll
2012-06-02 11:19 - 2012-06-22 05:34 - 00186752 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
2012-06-02 11:15 - 2012-06-22 05:34 - 00036864 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe
2012-05-22 17:31 - 2012-02-27 17:27 - 00065456 ____A C:\Users\Alex Work File\AppData\Local\GDIPFONTCACHEV1.DAT
2012-05-22 02:19 - 2012-02-01 17:50 - 00065456 ____A C:\Users\family\AppData\Local\GDIPFONTCACHEV1.DAT
2012-05-21 16:29 - 2012-05-21 16:29 - 00012837 ____A C:\Users\family\Documents\budget_21 May.ods
2012-05-21 16:29 - 2012-05-21 15:47 - 00001721 ____A C:\Users\family\Documents\New Database.odb
2012-05-21 15:46 - 2012-05-21 15:46 - 00001168 ____A C:\Users\Public\Desktop\OpenOffice.org 3.4.lnk
2012-05-17 18:47 - 2012-06-13 23:00 - 17807360 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-05-17 18:16 - 2012-06-13 23:00 - 10924032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-05-17 18:06 - 2012-06-13 23:00 - 02311680 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-05-17 17:59 - 2012-06-13 23:00 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-05-17 17:59 - 2012-06-13 23:00 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-05-17 17:58 - 2012-06-13 23:00 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-05-17 17:58 - 2012-06-13 23:00 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-05-17 17:56 - 2012-06-13 23:00 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-05-17 17:55 - 2012-06-13 23:00 - 00818688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-05-17 17:55 - 2012-06-13 23:00 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-05-17 17:54 - 2012-06-13 23:00 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-05-17 17:51 - 2012-06-13 23:00 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-05-17 17:51 - 2012-06-13 23:00 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-05-17 17:47 - 2012-06-13 23:00 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-05-17 15:11 - 2012-06-13 23:00 - 12314624 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2012-05-17 14:48 - 2012-06-13 23:00 - 09737728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2012-05-17 14:45 - 2012-06-13 23:00 - 01800192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2012-05-17 14:36 - 2012-06-13 23:00 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2012-05-17 14:35 - 2012-06-13 23:00 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2012-05-17 14:35 - 2012-06-13 23:00 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2012-05-17 14:33 - 2012-06-13 23:00 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2012-05-17 14:31 - 2012-06-13 23:00 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2012-05-17 14:29 - 2012-06-13 23:00 - 00716800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2012-05-17 14:29 - 2012-06-13 23:00 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2012-05-17 14:27 - 2012-06-13 23:00 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2012-05-17 14:25 - 2012-06-13 23:00 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2012-05-17 14:24 - 2012-06-13 23:00 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2012-05-17 14:20 - 2012-06-13 23:00 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2012-05-14 17:32 - 2012-06-13 13:11 - 03144192 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-05-04 15:29 - 2012-07-03 12:44 - 00772504 ____A (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2012-05-04 15:29 - 2012-07-03 12:44 - 00687504 ____A (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2012-05-04 15:29 - 2012-07-03 12:44 - 00227720 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2012-05-04 02:52 - 2012-06-13 13:11 - 05505392 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2012-05-04 02:08 - 2012-06-13 13:11 - 03958128 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2012-05-04 02:08 - 2012-06-13 13:11 - 03902320 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2012-05-01 21:32 - 2012-06-13 13:11 - 00208896 ____A (Microsoft Corporation) C:\Windows\System32\profsvc.dll
2012-04-27 19:50 - 2012-06-13 13:11 - 00204800 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2012-04-25 21:34 - 2012-06-13 13:11 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2012-04-25 21:34 - 2012-06-13 13:11 - 00076288 ____A (Microsoft Corporation) C:\Windows\System32\rdpwsx.dll
2012-04-25 21:28 - 2012-06-13 13:11 - 00009216 ____A (Microsoft Corporation) C:\Windows\System32\rdrmemptylst.exe
2012-04-23 21:59 - 2012-06-13 13:11 - 01460224 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2012-04-23 21:59 - 2012-06-13 13:11 - 00182272 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2012-04-23 21:59 - 2012-06-13 13:11 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2012-04-23 20:47 - 2012-06-13 13:11 - 01156608 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2012-04-23 20:47 - 2012-06-13 13:11 - 00139264 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2012-04-23 20:47 - 2012-06-13 13:11 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2012-04-18 08:14 - 2012-04-18 08:14 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf


ZeroAccess:
C:\Windows\Installer\{7f83a9d7-ce2a-253d-5865-027abdaf66a0}
C:\Windows\Installer\{7f83a9d7-ce2a-253d-5865-027abdaf66a0}\@
C:\Windows\Installer\{7f83a9d7-ce2a-253d-5865-027abdaf66a0}\L
C:\Windows\Installer\{7f83a9d7-ce2a-253d-5865-027abdaf66a0}\U

ZeroAccess:
C:\Users\family\AppData\Local\{7f83a9d7-ce2a-253d-5865-027abdaf66a0}
C:\Users\family\AppData\Local\{7f83a9d7-ce2a-253d-5865-027abdaf66a0}\@
C:\Users\family\AppData\Local\{7f83a9d7-ce2a-253d-5865-027abdaf66a0}\L
C:\Users\family\AppData\Local\{7f83a9d7-ce2a-253d-5865-027abdaf66a0}\U

========================= Known DLLs (Whitelisted) ============


========================= Bamital & volsnap Check ============

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe
[2009-07-13 15:19] - [2009-07-13 17:39] - 0331776 ____A (Microsoft Corporation) BA959DEFA616F9BE21438F427494EA7E

C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

========================= Memory info ======================

Percentage of memory in use: 14%
Total physical RAM: 3959.12 MB
Available physical RAM: 3375.5 MB
Total Pagefile: 3957.27 MB
Available Pagefile: 3358.23 MB
Total Virtual: 8192 MB
Available Virtual: 8191.9 MB

======================= Partitions =========================

1 Drive c: () (Fixed) (Total:931.23 GB) (Free:852.71 GB) NTFS
4 Drive g: () (Removable) (Total:0.94 GB) (Free:0.91 GB) FAT
5 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
6 Drive y: (System Reserved) (Fixed) (Total:0.28 GB) (Free:0.22 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 931 GB 0 B
Disk 1 No Media 0 B 0 B
Disk 2 Online 962 MB 0 B

Partitions of Disk 0:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 283 MB 1024 KB
Partition 2 Primary 931 GB 284 MB

==================================================================================

Disk: 0
Partition 1
Type : 07
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 Y System Rese NTFS Partition 283 MB Healthy

==================================================================================

Disk: 0
Partition 2
Type : 07
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 C NTFS Partition 931 GB Healthy

==================================================================================

Partitions of Disk 2:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 961 MB 764 KB

==================================================================================

Disk: 2
Partition 1
Type : 06
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 4 G FAT Removable 961 MB Healthy

==================================================================================

==========================================================

Last Boot: 2012-07-07 21:10

======================= End Of Log ==========================


Farbar Recovery Scan Tool Version: 09-07-2012
Ran by SYSTEM at 2012-07-10 13:14:25
Running from G:\

================== Search: "services.exe" ===================

C:\Windows.old.000\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe
[2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

C:\Windows.old.000\Windows\System32\services.exe
[2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

C:\Windows.old\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe
[2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

C:\Windows.old\Windows\System32\services.exe
[2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe
[2009-07-13 15:19] - [2009-07-13 17:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

C:\Windows\System32\services.exe
[2009-07-13 15:19] - [2009-07-13 17:39] - 0331776 ____A (Microsoft Corporation) BA959DEFA616F9BE21438F427494EA7E

====== End Of Search ======

#4 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:06:30 PM

Posted 10 July 2012 - 12:48 PM

Hi

Please do the following:


Open notepad (Start =>All Programs => Accessories => Notepad). Please copy the entire contents of the code box below. (To do this highlight the contents of the box, right click on it and select copy. Right-click in the open notepad and select Paste). Save it on the flashdrive as fixlist.txt

start
SubSystems: [Windows] ==> ZeroAccess
C:\Windows\Installer\{7f83a9d7-ce2a-253d-5865-027abdaf66a0}
C:\Users\family\AppData\Local\{7f83a9d7-ce2a-253d-5865-027abdaf66a0}
replace: C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe C:\Windows\System32\services.exe
end

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system

Now please enter System Recovery Options then select Command Prompt

Run FRST (or FRST64 if you have the 64bit version) and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

Reboot Normally.


NEXT


Refer to the ComboFix User's Guide

  • Download ComboFix from the following location:

    Link

    * IMPORTANT !!! Place ComboFix.exe on your Desktop
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
    You can get help on disabling your protection programs here
  • Double click on ComboFix.exe & follow the prompts.
  • Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
  • When finished, it shall produce a log for you. Post that log in your next reply

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


    ---------------------------------------------------------------------------------------------
  • Ensure your AntiVirus and AntiSpyware applications are re-enabled.

    ---------------------------------------------------------------------------------------------

NOTE: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#5 RandomSkratch

RandomSkratch
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:30 PM

Posted 10 July 2012 - 01:10 PM

Thanks again CatByte.

Below are FRST and ComboFix logs.

Fix result of Farbar Recovery Tool (FRST written by Farbar) Version: 09-07-2012
Ran by SYSTEM at 2012-07-10 13:53:50 Run:1
Running from G:\

==============================================

HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Session Manager\SubSystems\\Windows No ZeroAccess entry found.
C:\Windows\Installer\{7f83a9d7-ce2a-253d-5865-027abdaf66a0} moved successfully.
C:\Users\family\AppData\Local\{7f83a9d7-ce2a-253d-5865-027abdaf66a0} moved successfully.
C:\Windows\System32\services.exe moved successfully.
C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe copied successfully to C:\Windows\System32\services.exe

==== End of Fixlog ====


ComboFix 12-07-10.01 - family 07/10/2012 13:59:06.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3959.2812 [GMT -4:00]
Running from: c:\users\family\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\system32\drivers\etc\hosts.txt
.
.
((((((((((((((((((((((((( Files Created from 2012-06-10 to 2012-07-10 )))))))))))))))))))))))))))))))
.
.
2012-07-10 21:13 . 2012-07-10 21:13 -------- d-----w- C:\FRST
2012-07-10 18:04 . 2012-07-10 18:04 69000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4E5C7749-C514-4644-9FF3-8AF09012C0A6}\offreg.dll
2012-07-10 15:02 . 2012-07-10 15:02 328704 ----a-w- c:\windows\system32\services.exe.B60FD15A9C322B69
2012-07-10 15:00 . 2012-07-10 15:00 328704 ----a-w- c:\windows\system32\services.exe.B8B9B20BCFB1DB68
2012-07-10 15:00 . 2012-07-10 15:00 328704 ----a-w- c:\windows\system32\services.exe.E15DBBBE714E872A
2012-07-10 14:59 . 2012-06-18 07:12 9013136 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4E5C7749-C514-4644-9FF3-8AF09012C0A6}\mpengine.dll
2012-07-10 14:50 . 2012-02-09 18:17 927800 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2012-07-10 14:50 . 2012-02-09 18:17 927800 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D2F2DE88-C4E8-41F4-B38B-D7C2F9A11B5B}\gapaengine.dll
2012-07-10 14:45 . 2012-07-10 14:45 -------- d-----w- c:\program files (x86)\Microsoft Security Client
2012-07-10 14:45 . 2012-07-10 14:45 -------- d-----w- c:\program files\Microsoft Security Client
2012-07-10 13:30 . 2012-07-10 13:30 -------- d-----w- c:\program files\CCleaner
2012-07-10 13:30 . 2012-07-10 13:30 -------- d-----w- c:\users\family\AppData\Roaming\Malwarebytes
2012-07-10 13:30 . 2012-07-10 13:30 -------- d-----w- c:\programdata\Malwarebytes
2012-07-10 13:30 . 2012-07-10 13:30 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-07-10 13:30 . 2012-04-04 19:56 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-07-06 22:48 . 2012-07-06 23:00 -------- d-----w- c:\users\family\AppData\Roaming\ApplicationData
2012-07-04 18:02 . 2012-07-05 02:16 -------- d-----w- c:\users\family\AppData\Local\NPE
2012-07-04 17:00 . 2012-07-04 17:00 27256 ----a-w- c:\windows\system32\drivers\FixZeroAccess.sys
2012-07-04 16:33 . 2012-07-04 16:49 -------- d-----w- c:\users\Alex Work File\AppData\Local\NPE
2012-07-03 20:48 . 2012-07-03 20:48 -------- d-----w- c:\users\family\jagexcache
2012-07-03 20:46 . 2012-07-03 20:46 -------- d-----w- c:\programdata\Ask
2012-07-03 20:45 . 2012-07-03 20:45 -------- d-----w- c:\program files (x86)\Oracle
2012-07-03 20:44 . 2012-05-04 23:29 687504 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-07-03 20:44 . 2012-05-04 23:29 772504 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2012-06-28 00:25 . 2012-07-10 13:36 -------- d-----w- c:\users\family\AppData\Local\CrashDumps
2012-06-22 13:34 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
2012-06-22 13:34 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-22 13:34 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-22 13:34 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
2012-06-22 13:34 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
2012-06-22 13:34 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
2012-06-22 13:34 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
2012-06-22 13:34 . 2012-06-02 19:19 186752 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-22 13:34 . 2012-06-02 19:15 36864 ----a-w- c:\windows\system32\wuapp.exe
2012-06-21 00:29 . 2012-06-21 00:29 -------- d-----w- c:\program files (x86)\Common Files\Symantec Shared
2012-06-21 00:05 . 2012-06-22 01:07 -------- d-----w- c:\program files\Symantec
2012-06-21 00:05 . 2012-06-22 01:07 175736 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS
2012-06-21 00:05 . 2012-06-21 00:05 -------- d-----w- c:\program files\Common Files\Symantec Shared
2012-06-21 00:04 . 2012-06-22 20:43 -------- d-----w- c:\windows\system32\drivers\NISx64
2012-06-21 00:04 . 2012-07-04 16:33 -------- d-----w- c:\programdata\Norton
2012-06-21 00:04 . 2012-06-21 00:04 -------- d-----w- c:\program files (x86)\Norton Internet Security
2012-06-21 00:03 . 2012-06-21 00:03 -------- d-----w- c:\program files (x86)\NortonInstaller
2012-06-20 19:00 . 2012-06-20 19:00 -------- d-sh--w- c:\windows\system32\%APPDATA%
2012-06-13 21:11 . 2012-04-26 05:34 76288 ----a-w- c:\windows\system32\rdpwsx.dll
2012-06-12 00:22 . 2011-02-19 06:37 1135104 ----a-w- c:\windows\system32\FntCache.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-27 19:03 . 2012-05-27 19:03 163048 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10141.bin
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-03 136176]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-03 136176]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-21 98688]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 291696]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-02-03 1255736]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1307010.005\SYMDS64.SYS [2011-07-25 451192]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1307010.005\SYMEFA64.SYS [2012-03-29 1092728]
S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\BASHDefs\20120619.001\BHDrvx64.sys [2012-06-19 1161376]
S1 ccSet_NIS;Norton Internet Security Settings Manager;c:\windows\system32\drivers\NISx64\1307010.005\ccSetx64.sys [2011-11-29 167048]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\IPSDefs\20120705.001\IDSvia64.sys [2012-06-14 509088]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1307010.005\Ironx64.SYS [2012-03-29 190072]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1307010.005\SYMNETS.SYS [2012-03-29 405624]
S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\19.7.1.5\ccSvcHst.exe [2012-03-27 138232]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-06-21 138912]
S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-02-02 271872]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-12-19 314400]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
.
Contents of the 'Scheduled Tasks' folder
.
2012-07-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-03 10:39]
.
2012-07-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-03 10:39]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-03-04 166424]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-03-04 391192]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-03-04 410648]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-02-22 10081312]
"EKIJ5000StatusMonitor"="c:\windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe" [2010-09-02 2045440]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 1271168]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.yahoo.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 207.181.101.4 207.181.101.5 4.2.2.2
Handler: intu-tt2011 - {B3B5DAD9-E96D-45b4-B636-B6CF2F773DE1} - c:\program files (x86)\TurboTax 2011\ic2011pp.dll
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{BB45EF8E-1E36-4535-A017-EC908FB1E335} - (no file)
WebBrowser-{BB3F7563-E9A4-43BC-9A7C-94A642DD1FFA} - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\19.7.1.5\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\19.7.1.5\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-07-10 14:08:10 - machine was rebooted
ComboFix-quarantined-files.txt 2012-07-10 18:08
.
Pre-Run: 915,313,856,512 bytes free
Post-Run: 914,829,352,960 bytes free
.
- - End Of File - - 8AD0AC3583879125FD2D258CECC0CD48

#6 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:06:30 PM

Posted 10 July 2012 - 01:16 PM

Hi,

Please do the following:

  • Please open your MalwareBytes AntiMalware Program
  • Click the Update Tab and search for updates
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <-- very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT


Go here to run an online scanner from ESET.
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activeX control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • When the scan completes, press the LIST OF THREATS FOUND button
  • Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop
  • Include the contents of this report in your next reply.
  • Press the BACK button.
  • Press Finish

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#7 RandomSkratch

RandomSkratch
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:30 PM

Posted 10 July 2012 - 03:18 PM

Hello again,

Malwarebytes didn't find anything and ESET found a bunch. Here is the ESET log.

C:\FRST\Quarantine\services.exe Win64/Patched.B.Gen trojan
C:\Users\Alex Work File\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized\C\Users\Alex Work File\AppData\Roaming\Sun\Java\Deployment\cache\javapi\v1.0\jar\getfile.php-549756cc-207961de.zip Java/Exploit.CVE-2012-0507.CI trojan
C:\Windows.old\Documents and Settings\alani\AppData\Local\Application Data\Temp\PageRage-SilentInstaller.exe probably a variant of Win32/Adware.CXFGDII application
C:\Windows.old\Documents and Settings\alani\AppData\Local\Temp\PageRage-SilentInstaller.exe probably a variant of Win32/Adware.CXFGDII application
C:\Windows.old\Documents and Settings\alani\Local Settings\Temp\PageRage-SilentInstaller.exe probably a variant of Win32/Adware.CXFGDII application
C:\Windows.old\Documents and Settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application
C:\Windows.old\Documents and Settings\All Users\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application
C:\Windows.old\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application
C:\Windows.old\Users\alani\AppData\Local\Temp\PageRage-SilentInstaller.exe probably a variant of Win32/Adware.CXFGDII application
C:\Windows.old\Users\alani\Local Settings\Temp\PageRage-SilentInstaller.exe probably a variant of Win32/Adware.CXFGDII application
C:\Windows.old\Users\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application
C:\Windows.old\Users\All Users\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application
C:\Windows.old.000\Documents and Settings\Meldrum Family\AppData\Local\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm JS/Agent.NEG trojan
C:\Windows.old.000\Documents and Settings\Meldrum Family\AppData\Local\Application Data\Temp\jar_cache7901518172925179484.tmp Win32/Agent.STT trojan
C:\Windows.old.000\Documents and Settings\Meldrum Family\AppData\Local\Application Data\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm JS/Agent.NEG trojan
C:\Windows.old.000\Documents and Settings\Meldrum Family\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm JS/Agent.NEG trojan
C:\Windows.old.000\Documents and Settings\Meldrum Family\AppData\Local\Temp\jar_cache7901518172925179484.tmp Win32/Agent.STT trojan
C:\Windows.old.000\Documents and Settings\Meldrum Family\AppData\Local\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm JS/Agent.NEG trojan
C:\Windows.old.000\Documents and Settings\Meldrum Family\Local Settings\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm JS/Agent.NEG trojan
C:\Windows.old.000\Documents and Settings\Meldrum Family\Local Settings\Temp\jar_cache7901518172925179484.tmp Win32/Agent.STT trojan
C:\Windows.old.000\Documents and Settings\Meldrum Family\Local Settings\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm JS/Agent.NEG trojan
C:\Windows.old.000\Users\Meldrum Family\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm JS/Agent.NEG trojan
C:\Windows.old.000\Users\Meldrum Family\AppData\Local\Temp\jar_cache7901518172925179484.tmp Win32/Agent.STT trojan
C:\Windows.old.000\Users\Meldrum Family\AppData\Local\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm JS/Agent.NEG trojan
C:\Windows.old.000\Users\Meldrum Family\Local Settings\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm JS/Agent.NEG trojan
C:\Windows.old.000\Users\Meldrum Family\Local Settings\Temp\jar_cache7901518172925179484.tmp Win32/Agent.STT trojan
C:\Windows.old.000\Users\Meldrum Family\Local Settings\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm JS/Agent.NEG trojan

#8 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:06:30 PM

Posted 10 July 2012 - 03:27 PM

Hi,

those detections are all in the old installation, but we'll clean them up anyway.

Please do the following:

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

File::

C:\Users\Alex Work File\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized\C\Users\Alex Work File\AppData\Roaming\Sun\Java\Deployment\cache\javapi\v1.0\jar\getfile.php-549756cc-207961de.zip 
C:\Windows.old\Documents and Settings\alani\AppData\Local\Application Data\Temp\PageRage-SilentInstaller.exe 
C:\Windows.old\Documents and Settings\alani\AppData\Local\Temp\PageRage-SilentInstaller.exe 
C:\Windows.old\Documents and Settings\alani\Local Settings\Temp\PageRage-SilentInstaller.exe 
C:\Windows.old\Documents and Settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll 
C:\Windows.old\Documents and Settings\All Users\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll 
C:\Windows.old\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll 
C:\Windows.old\Users\alani\AppData\Local\Temp\PageRage-SilentInstaller.exe probably 
C:\Windows.old\Users\alani\Local Settings\Temp\PageRage-SilentInstaller.exe probably 
C:\Windows.old\Users\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll 
C:\Windows.old\Users\All Users\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll 
C:\Windows.old.000\Documents and Settings\Meldrum Family\AppData\Local\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm 
C:\Windows.old.000\Documents and Settings\Meldrum Family\AppData\Local\Application Data\Temp\jar_cache7901518172925179484.tmp 
C:\Windows.old.000\Documents and Settings\Meldrum Family\AppData\Local\Application Data\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm 
C:\Windows.old.000\Documents and Settings\Meldrum Family\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm 
C:\Windows.old.000\Documents and Settings\Meldrum Family\AppData\Local\Temp\jar_cache7901518172925179484.tmp Win32/Agent.STT trojan
C:\Windows.old.000\Documents and Settings\Meldrum Family\AppData\Local\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm JS/Agent.NEG trojan
C:\Windows.old.000\Documents and Settings\Meldrum Family\Local Settings\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm 
C:\Windows.old.000\Documents and Settings\Meldrum Family\Local Settings\Temp\jar_cache7901518172925179484.tmp 
C:\Windows.old.000\Documents and Settings\Meldrum Family\Local Settings\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm 
C:\Windows.old.000\Users\Meldrum Family\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm 
C:\Windows.old.000\Users\Meldrum Family\AppData\Local\Temp\jar_cache7901518172925179484.tmp 
C:\Windows.old.000\Users\Meldrum Family\AppData\Local\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm 
C:\Windows.old.000\Users\Meldrum Family\Local Settings\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm 
C:\Windows.old.000\Users\Meldrum Family\Local Settings\Temp\jar_cache7901518172925179484.tmp 
C:\Windows.old.000\Users\Meldrum Family\Local Settings\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm 
 
ClearJavaCache::

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"


Here's how to do that:

1.Click File;
2.Click Save As... Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save ...

Posted Image
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix may request an update; please allow it.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you.
  • Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.


NEXT

Visit ADOBE and download the latest version of Acrobat Reader (version X)
Having the latest updates ensures there are no security vulnerabilities in your system.


NEXT



Your Java is out of date, so go to Start > Control Panel > Programs and Features > scroll down to the Java installation and Remove it, now download the latest Java version 7 update 5 and install it: http://java.com/en/download/index.jsp


NEXT

Please advise how the computer is running now and if there are any outstanding issues

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#9 RandomSkratch

RandomSkratch
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:30 PM

Posted 11 July 2012 - 08:29 AM

Good morning. CFScript log is below. I've updated Windows and patched all software. System appears to be running great now. I will be configuring additional users that aren't Administrators for his family to use so hopefully that will help prevent this in the future!


ComboFix 12-07-11.03 - family 07/11/2012 9:09.2.4 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.3959.2512 [GMT -4:00]
Running from: c:\users\family\Desktop\ComboFix.exe
Command switches used :: c:\users\family\Desktop\CFScript.txt
AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\users\Alex Work File\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized\C\Users\Alex Work File\AppData\Roaming\Sun\Java\Deployment\cache\javapi\v1.0\jar\getfile.php-549756cc-207961de.zip"
"c:\windows.old.000\Documents and Settings\Meldrum Family\AppData\Local\Application Data\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm"
"c:\windows.old.000\Documents and Settings\Meldrum Family\AppData\Local\Application Data\Temp\jar_cache7901518172925179484.tmp"
"c:\windows.old.000\Documents and Settings\Meldrum Family\AppData\Local\Application Data\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm"
"c:\windows.old.000\Documents and Settings\Meldrum Family\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm"
"c:\windows.old.000\Documents and Settings\Meldrum Family\AppData\Local\Temp\jar_cache7901518172925179484.tmp Win32/Agent.STT trojan"
"c:\windows.old.000\Documents and Settings\Meldrum Family\AppData\Local\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm JS/Agent.NEG trojan"
"c:\windows.old.000\Documents and Settings\Meldrum Family\Local Settings\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm"
"c:\windows.old.000\Documents and Settings\Meldrum Family\Local Settings\Temp\jar_cache7901518172925179484.tmp"
"c:\windows.old.000\Documents and Settings\Meldrum Family\Local Settings\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm"
"c:\windows.old.000\Users\Meldrum Family\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm"
"c:\windows.old.000\Users\Meldrum Family\AppData\Local\Temp\jar_cache7901518172925179484.tmp"
"c:\windows.old.000\Users\Meldrum Family\AppData\Local\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm"
"c:\windows.old.000\Users\Meldrum Family\Local Settings\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm"
"c:\windows.old.000\Users\Meldrum Family\Local Settings\Temp\jar_cache7901518172925179484.tmp"
"c:\windows.old.000\Users\Meldrum Family\Local Settings\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm"
"c:\windows.old\Documents and Settings\alani\AppData\Local\Application Data\Temp\PageRage-SilentInstaller.exe"
"c:\windows.old\Documents and Settings\alani\AppData\Local\Temp\PageRage-SilentInstaller.exe"
"c:\windows.old\Documents and Settings\alani\Local Settings\Temp\PageRage-SilentInstaller.exe"
"c:\windows.old\Documents and Settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll"
"c:\windows.old\Documents and Settings\All Users\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll"
"c:\windows.old\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll"
"c:\windows.old\Users\alani\AppData\Local\Temp\PageRage-SilentInstaller.exe probably"
"c:\windows.old\Users\alani\Local Settings\Temp\PageRage-SilentInstaller.exe probably"
"c:\windows.old\Users\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll"
"c:\windows.old\Users\All Users\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Alex Work File\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized\C\Users\Alex Work File\AppData\Roaming\Sun\Java\Deployment\cache\javapi\v1.0\jar\getfile.php-549756cc-207961de.zip
c:\windows.old.000\Users\Meldrum Family\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm
c:\windows.old.000\Users\Meldrum Family\AppData\Local\Temp\jar_cache7901518172925179484.tmp
c:\windows.old.000\Users\Meldrum Family\AppData\Local\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm
c:\windows.old.000\Users\Meldrum Family\Local Settings\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm
c:\windows.old.000\Users\Meldrum Family\Local Settings\Temp\jar_cache7901518172925179484.tmp
c:\windows.old.000\Users\Meldrum Family\Local Settings\Temporary Internet Files\Low\Content.IE5\GRCQ0649\bigtree[1].htm
c:\windows.old\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll
c:\windows.old\Users\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll
c:\windows.old\Users\All Users\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll
.
.
((((((((((((((((((((((((( Files Created from 2012-06-11 to 2012-07-11 )))))))))))))))))))))))))))))))
.
.
2012-07-11 13:14 . 2012-07-11 13:14 69000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{788B1BEE-E12A-4A72-966E-9FC65EB97504}\offreg.dll
2012-07-11 13:13 . 2012-07-11 13:13 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-07-11 13:13 . 2012-07-11 13:13 -------- d-----w- c:\users\Alex Work File\AppData\Local\temp
2012-07-10 21:13 . 2012-07-10 21:13 -------- d-----w- C:\FRST
2012-07-10 18:27 . 2012-07-10 18:27 -------- d-----w- c:\program files (x86)\ESET
2012-07-10 18:10 . 2012-06-18 07:12 9013136 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{788B1BEE-E12A-4A72-966E-9FC65EB97504}\mpengine.dll
2012-07-10 15:02 . 2012-07-10 15:02 328704 ----a-w- c:\windows\system32\services.exe.B60FD15A9C322B69
2012-07-10 15:00 . 2012-07-10 15:00 328704 ----a-w- c:\windows\system32\services.exe.B8B9B20BCFB1DB68
2012-07-10 15:00 . 2012-07-10 15:00 328704 ----a-w- c:\windows\system32\services.exe.E15DBBBE714E872A
2012-07-10 14:50 . 2012-02-09 18:17 927800 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2012-07-10 14:50 . 2012-02-09 18:17 927800 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D2F2DE88-C4E8-41F4-B38B-D7C2F9A11B5B}\gapaengine.dll
2012-07-10 14:45 . 2012-07-10 14:45 -------- d-----w- c:\program files (x86)\Microsoft Security Client
2012-07-10 14:45 . 2012-07-10 14:45 -------- d-----w- c:\program files\Microsoft Security Client
2012-07-10 13:30 . 2012-07-10 13:30 -------- d-----w- c:\program files\CCleaner
2012-07-10 13:30 . 2012-07-10 13:30 -------- d-----w- c:\users\family\AppData\Roaming\Malwarebytes
2012-07-10 13:30 . 2012-07-10 13:30 -------- d-----w- c:\programdata\Malwarebytes
2012-07-10 13:30 . 2012-07-10 13:30 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-07-10 13:30 . 2012-04-04 19:56 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-07-06 22:48 . 2012-07-06 23:00 -------- d-----w- c:\users\family\AppData\Roaming\ApplicationData
2012-07-04 18:02 . 2012-07-05 02:16 -------- d-----w- c:\users\family\AppData\Local\NPE
2012-07-04 17:00 . 2012-07-04 17:00 27256 ----a-w- c:\windows\system32\drivers\FixZeroAccess.sys
2012-07-04 16:33 . 2012-07-04 16:49 -------- d-----w- c:\users\Alex Work File\AppData\Local\NPE
2012-07-03 20:48 . 2012-07-03 20:48 -------- d-----w- c:\users\family\jagexcache
2012-07-03 20:46 . 2012-07-03 20:46 -------- d-----w- c:\programdata\Ask
2012-07-03 20:45 . 2012-07-03 20:45 -------- d-----w- c:\program files (x86)\Oracle
2012-07-03 20:44 . 2012-05-04 23:29 687504 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-07-03 20:44 . 2012-05-04 23:29 772504 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2012-06-28 00:25 . 2012-07-10 13:36 -------- d-----w- c:\users\family\AppData\Local\CrashDumps
2012-06-22 13:34 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
2012-06-22 13:34 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-22 13:34 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-22 13:34 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
2012-06-22 13:34 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
2012-06-22 13:34 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
2012-06-22 13:34 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
2012-06-22 13:34 . 2012-06-02 19:19 186752 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-22 13:34 . 2012-06-02 19:15 36864 ----a-w- c:\windows\system32\wuapp.exe
2012-06-21 00:29 . 2012-06-21 00:29 -------- d-----w- c:\program files (x86)\Common Files\Symantec Shared
2012-06-21 00:05 . 2012-06-22 01:07 -------- d-----w- c:\program files\Symantec
2012-06-21 00:05 . 2012-06-22 01:07 175736 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS
2012-06-21 00:05 . 2012-06-21 00:05 -------- d-----w- c:\program files\Common Files\Symantec Shared
2012-06-21 00:04 . 2012-06-22 20:43 -------- d-----w- c:\windows\system32\drivers\NISx64
2012-06-21 00:04 . 2012-07-04 16:33 -------- d-----w- c:\programdata\Norton
2012-06-21 00:04 . 2012-06-21 00:04 -------- d-----w- c:\program files (x86)\Norton Internet Security
2012-06-21 00:03 . 2012-06-21 00:03 -------- d-----w- c:\program files (x86)\NortonInstaller
2012-06-20 19:00 . 2012-06-20 19:00 -------- d-sh--w- c:\windows\system32\%APPDATA%
2012-06-13 21:11 . 2012-04-26 05:34 76288 ----a-w- c:\windows\system32\rdpwsx.dll
2012-06-12 00:22 . 2011-02-19 06:37 1135104 ----a-w- c:\windows\system32\FntCache.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-27 19:03 . 2012-05-27 19:03 163048 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10141.bin
.
.
((((((((((((((((((((((((((((( SnapShot@2012-07-10_18.05.22 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-02-02 01:53 . 2012-07-11 13:06 21476 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-07-11 13:06 27274 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2012-04-23 22:37 . 2012-07-10 20:19 3032 c:\windows\system32\wdi\ERCQueuedResolutions.dat
+ 2012-02-01 21:07 . 2012-07-11 13:06 6608 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3551539585-2122734304-1194074903-1000_UserData.bin
+ 2012-07-11 13:14 . 2012-07-11 13:14 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-07-10 18:04 . 2012-07-10 18:04 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-07-10 18:04 . 2012-07-10 18:04 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2012-07-11 13:14 . 2012-07-11 13:14 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-07-14 02:36 . 2012-07-10 18:00 626040 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2012-07-11 13:10 626040 c:\windows\system32\perfh009.dat
- 2009-07-14 02:36 . 2012-07-10 18:00 107316 c:\windows\system32\perfc009.dat
+ 2009-07-14 02:36 . 2012-07-11 13:10 107316 c:\windows\system32\perfc009.dat
+ 2012-02-01 17:35 . 2012-07-10 18:24 409600 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2012-02-01 17:35 . 2012-07-10 17:58 409600 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 05:01 . 2012-07-11 13:14 281708 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01 . 2012-07-10 18:03 281708 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2012-02-01 17:35 . 2012-07-10 17:58 3932160 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2012-02-01 17:35 . 2012-07-10 18:24 3932160 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2012-05-13 07:25 . 2012-07-10 20:19 1425684 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3551539585-2122734304-1194074903-1000-8192.dat
+ 2009-07-14 02:34 . 2012-07-10 18:18 10485760 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
- 2009-07-14 02:34 . 2012-07-10 14:55 10485760 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT
- 2009-07-14 04:54 . 2012-07-10 17:58 16187392 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2012-07-10 18:24 16187392 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-03 136176]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-03 136176]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-21 98688]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 291696]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-02-03 1255736]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1307010.005\SYMDS64.SYS [2011-07-25 451192]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1307010.005\SYMEFA64.SYS [2012-03-29 1092728]
S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\BASHDefs\20120619.001\BHDrvx64.sys [2012-06-19 1161376]
S1 ccSet_NIS;Norton Internet Security Settings Manager;c:\windows\system32\drivers\NISx64\1307010.005\ccSetx64.sys [2011-11-29 167048]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\IPSDefs\20120707.001\IDSvia64.sys [2012-06-14 509088]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1307010.005\Ironx64.SYS [2012-03-29 190072]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1307010.005\SYMNETS.SYS [2012-03-29 405624]
S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\19.7.1.5\ccSvcHst.exe [2012-03-27 138232]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-06-21 138912]
S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-02-02 271872]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-12-19 314400]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-07-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-03 10:39]
.
2012-07-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-03 10:39]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-03-04 166424]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-03-04 391192]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-03-04 410648]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-02-22 10081312]
"EKIJ5000StatusMonitor"="c:\windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe" [2010-09-02 2045440]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 1271168]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.yahoo.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 207.181.101.4 207.181.101.5 4.2.2.2
Handler: intu-tt2011 - {B3B5DAD9-E96D-45b4-B636-B6CF2F773DE1} - c:\program files (x86)\TurboTax 2011\ic2011pp.dll
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{BB45EF8E-1E36-4535-A017-EC908FB1E335} - (no file)
WebBrowser-{BB3F7563-E9A4-43BC-9A7C-94A642DD1FFA} - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\19.7.1.5\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\19.7.1.5\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-07-11 09:19:50 - machine was rebooted
ComboFix-quarantined-files.txt 2012-07-11 13:19
ComboFix2.txt 2012-07-10 18:08
.
Pre-Run: 914,431,991,808 bytes free
Post-Run: 914,331,033,600 bytes free
.
- - End Of File - - F6478E11D29A1D873EC3D8CB64B6D8AD

#10 RandomSkratch

RandomSkratch
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:30 PM

Posted 11 July 2012 - 09:24 AM

Additional info:

After updating Windows to SP1, subsequent updates now fail. I checked a few things and noticed that the BITS service was gone. I ran a Microsoft Fix-It for repairing Windows Update components but that did not work. Any suggestions?

---------
UPDATE
---------

Through additional troubleshooting I was able to restore BITS and Microsoft Update now works.

Edited by RandomSkratch, 11 July 2012 - 09:37 AM.


#11 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:06:30 PM

Posted 11 July 2012 - 10:41 AM

Hi,

Glad you got that sorted out :)

the log is showing you have two antivirus products installed:

AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

using more than one can cause system slowdowns, conflicts and crashes

if you choose to uninstall Norton, use their uninstaller to get all the leftovers

  • Download the appropriate Norton Removal Tool from HERE and save it to your desktop.
  • Next Double click on Norton_Removal_Tool.exe to run the tool.
  • Follow the on-screen instructions.
  • Your computer may be restarted more than once, and you may be asked to repeat some steps after the computer restarts.

please advise if there are any outstanding issues

if not then we can clean up our tools

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#12 RandomSkratch

RandomSkratch
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:30 PM

Posted 11 July 2012 - 10:43 AM

I uninstalled MSE as he has purchased Norton.

No more issues seen, thanks very much CatByte.

#13 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:06:30 PM

Posted 11 July 2012 - 10:51 AM

Hi

Just some housekeeping to do now,

Please do the following:


You can delete the DDS and FRST logs and programs from your desktop.


NEXT


Follow these steps to uninstall Combofix

  • Make sure your security programs are totally disabled.
  • Click START then RUN
  • Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

Posted Image


If there are any logs/tools remaining on your desktop > right click and delete them.


NEXT


Below I have included a number of recommendations for how to protect your computer against malware infections.

  • It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
    Strong passwords: How to create and use them
    Then consider a password keeper, to keep all your passwords safe. KeePass is a small utility that allows you to manage all your passwords.

  • Keep Windows updated by regularly checking their website at :
    http://windowsupdate.microsoft.com/
    This will ensure your computer has always the latest security updates available installed on your computer.

  • Make Internet Explorer more secure
    • Click Start > Run
    • Type Inetcpl.cpl & click OK
    • Click on the Security tab
    • Click Reset all zones to default level
    • Make sure the Internet Zone is selected & Click Custom level
    • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    • Next Click OK, then Apply button and then OK to exit the Internet Properties page.

  • Download TFC to your desktop
    • Close any open windows.
    • Double click the TFC icon to run the program
    • TFC will close all open programs itself in order to run,
    • Click the Start button to begin the process.
    • Allow TFC to run uninterrupted.
    • The program should not take long to finish it's job
    • Once its finished it should automatically reboot your machine,
    • if it doesn't, manually reboot to ensure a complete clean
    It's normal after running TFC cleaner that the PC will be slower to boot the first time.

  • WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
    • Green to go
    • Yellow for caution
    • Red to stop
    WOT has an addon available for both Firefox and IE

  • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.

  • ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.

  • In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at this well written article:
    PC Safety and Security--What Do I Need?.


Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015


#14 RandomSkratch

RandomSkratch
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:05:30 PM

Posted 11 July 2012 - 10:58 AM

Thanks for all the help CatByte, you've been great!

I'll pass on all the useful info in your last post.

#15 CatByte

CatByte

    bleepin' tiger


  • Malware Response Team
  • 14,664 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Canada
  • Local time:06:30 PM

Posted 11 July 2012 - 02:18 PM

you are welcome

stay safe :hello:

~CB

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users