Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Trojan Fubar'd My PC


  • This topic is locked This topic is locked
3 replies to this topic

#1 icushman

icushman

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:11:08 PM

Posted 24 July 2012 - 05:00 PM

I recently contracted a virus on my pc and download malwarebytes and microsoft secuirty essentials. All was looking good but on reboot after the cleaning I continually got this bsod on boot "STOP: C0000135 The program can't start because %hs is missing". I checked the google and saw the reference to consrv and checked the affected registry keys. They looked like they should. I also looked into frst64 and ran it for a log but need some assistance with it. Thank you in advance.


Scan result of Farbar Recovery Scan Tool Version: 24-07-2012 01
Ran by SYSTEM at 24-07-2012 17:37:24
Running from G:\
Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
The current controlset is ControlSet001

========================== Registry (Whitelisted) =============

HKLM\...\Run: [EKIJ5000StatusMonitor] C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe [2045440 2010-09-02] (Eastman Kodak Company)
HKLM\...\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon [2114376 2009-07-06] (CANON INC.)
HKLM\...\Run: [CanonSolutionMenu] C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe /logon [722256 2008-12-11] (CANON INC.)
HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [1271168 2012-03-26] (Microsoft Corporation)
HKLM-x32\...\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [98304 2009-07-02] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [EKIJ5000StatusMonitor] C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe [2045440 2010-09-02] (Eastman Kodak Company)
HKLM-x32\...\Run: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin [611712 2008-08-14] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [47904 2010-12-14] (Apple Inc.)
HKLM-x32\...\Run: [] [x]
HKU\Owner\...\Run: [AdobeBridge] [x]
HKU\Owner\...\Run: [Akamai NetSession Interface] "C:\Users\Owner\AppData\Local\Akamai\netsession_win.exe" [4327744 2012-05-26] (Akamai Technologies, Inc)
HKU\Owner\...\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [4786048 2012-06-24] (SUPERAntiSpyware.com)
Tcpip\Parameters: [DhcpNameServer] 66.174.95.44 69.78.96.14
SubSystems: [Windows] ATTENTION! ====> ZeroAccess
Startup: C:\Users\Owner\Start Menu\Programs\Startup\AutorunsDisabled ()

==================== Services (Whitelisted) ======

4 !SASCORE; "C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE" [140672 2011-08-11] (SUPERAntiSpyware.com)
2 AdobeActiveFileMonitor7.0; C:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [169312 2008-09-16] (Adobe Systems Incorporated)
2 Akamai; C:\program files (x86)\common files\akamai/netsession_win_4f7fccd.dll [4419392 2012-07-11] (Akamai Technologies, Inc)
2 Amazon Download Agent; C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe [401920 2009-10-23] (Amazon.com)
4 AOL TopSpeedMonitor; C:\Program Files (x86)\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe [100016 2004-10-15] (America Online, Inc)
4 CarboniteService; "C:\Program Files (x86)\Carbonite\Carbonite Backup\carboniteservice.exe" [1980560 2009-09-18] (Carbonite, Inc. (www.carbonite.com))
2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [107912 2008-10-09] ()
4 KodakSvc; "C:\Program Files (x86)\Kodak\AiO\center\KodakSvc.exe" [28672 2008-12-01] (Eastman Kodak Company)
2 MsMpSvc; "C:\Program Files\Microsoft Security Client\MsMpEng.exe" [12600 2012-03-26] (Microsoft Corporation)
3 NisSrv; "C:\Program Files\Microsoft Security Client\NisSrv.exe" [291696 2012-03-26] (Microsoft Corporation)
4 NTI IScheduleSvc; C:\Program Files (x86)\NewTech Infosystems\Gateway MyBackup\IScheduleSvc.exe [62208 2009-08-12] (NewTech Infosystems, Inc.)
2 ptumlcmsvc; C:\Windows\system32\ptumlcmsvc64.exe [174592 2011-11-23] (DEVGURU Co., LTD)
2 vseamps; "C:\Program Files\Common Files\Authentium\AntiVirus5\vseamps.exe" [x]
2 vsedsps; "C:\Program Files\Common Files\Authentium\AntiVirus5\vsedsps.exe" [x]
2 vseqrts; "C:\Program Files\Common Files\Authentium\AntiVirus5\vseqrts.exe" [x]

========================== Drivers (Whitelisted) =============

4 ASCTRM; C:\Windows\SysWow64\Drivers\ASCTRM.sys [8552 2009-11-14] (Windows ® 2000 DDK provider)
3 BCMH43XX; C:\Windows\System32\DRIVERS\bcmwlhigh664.sys [838136 2009-11-06] (Broadcom Corporation)
3 cxpl_mhd; C:\Windows\System32\drivers\y_cx88x.sys [714752 2009-06-21] (Conexant Systems, Inc.)
3 PTUMLBUS; C:\Windows\System32\Drivers\PTUMLBUS.sys [105600 2011-10-16] (DEVGURU Co., LTD.)
3 PTUMLCVsp; C:\Windows\System32\Drivers\PTUMLCVsp.sys [183424 2011-10-16] (DEVGURU Co., LTD.(www.devguru.co.kr))
3 PTUMLMdm; C:\Windows\System32\Drivers\PTUMLMdm.sys [183424 2011-10-16] (DEVGURU Co., LTD.(www.devguru.co.kr))
3 PTUMLNET61; C:\Windows\System32\Drivers\PTUMLNET61.sys [111872 2011-10-16] (DEVGURU Co., LTD.)
3 PTUMLNVsp; C:\Windows\System32\Drivers\PTUMLNVsp.sys [184448 2011-10-16] (DEVGURU Co., LTD.(www.devguru.co.kr))
3 PTUMLRMNET; C:\Windows\System32\Drivers\PTUMLRMNET.sys [63744 2011-10-16] (DEVGURU Co., LTD.)
3 PTUMLVsp; C:\Windows\System32\Drivers\PTUMLVsp.sys [183424 2011-10-16] (DEVGURU Co., LTD.(www.devguru.co.kr))
1 SASDIFSV; \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
1 SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
3 SrvHsfPCI; C:\Windows\System32\DRIVERS\VSTBS26.SYS [411136 2009-06-10] (Conexant Systems, Inc.)
3 UBHelper; C:\Windows\System32\Drivers\UBHelper.sys [16896 2009-05-05] (NewTech Infosystems Corporation)
3 UsbFltr; C:\Windows\System32\Drivers\UsbFltr.sys [12288 2007-04-09] (Waytech Development, Inc.)
3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()
1 bxuvtfye; \??\C:\Windows\system32\drivers\bxuvtfye.sys [x]
4 EraserUtilDrv11010; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11010.sys [x]
1 gqsilmwj; \??\C:\Windows\system32\drivers\gqsilmwj.sys [x]
1 mvjitznu; \??\C:\Windows\system32\drivers\mvjitznu.sys [x]
1 noncrhtv; \??\C:\Windows\system32\drivers\noncrhtv.sys [x]
4 NPF; C:\Windows\System32\DRIVERS\npf.sys [x]
1 pjnmgrrl; \??\C:\Windows\system32\drivers\pjnmgrrl.sys [x]
4 PTDUBus; C:\Windows\System32\DRIVERS\PTDUBus.sys [x]
4 PTDUMdm; C:\Windows\System32\DRIVERS\PTDUMdm.sys [x]
4 PTDUVsp; C:\Windows\System32\DRIVERS\PTDUVsp.sys [x]
4 PTDUWFLT; C:\Windows\System32\DRIVERS\PTDUWFLT.sys [x]
4 PTDUWWAN; C:\Windows\System32\DRIVERS\PTDUWWAN.sys [x]
3 SABProcEnum; \??\C:\Program Files (x86)\Internet Explorer\SABProcEnum.sys [x]
4 SMSIVZAM5X64; \??\C:\PROGRA~2\VERIZO~1\VZAccess Manager\SMSIVZAM5X64.SYS [x]
1 xkgkrypf; \??\C:\Windows\system32\drivers\xkgkrypf.sys [x]
1 ykuqjoqn; \??\C:\Windows\system32\drivers\ykuqjoqn.sys [x]

========================== NetSvcs (Whitelisted) ===========


============ One Month Created Files and Folders ==============

2012-07-24 17:34 - 2012-07-24 17:34 - 00000000 ____D C:\FRST
2012-07-24 09:10 - 2012-07-24 09:10 - 00000000 ____D C:\$HBCDTmp
2012-07-23 16:38 - 2012-07-23 16:37 - 00892164 ____A (Farbar) C:\FRST.exe
2012-07-23 13:53 - 2012-07-23 13:53 - 00743538 ____A C:\Windows\SysWOW64\PerfStringBackup.INI
2012-07-23 13:53 - 2012-07-23 13:53 - 00001945 ____A C:\Windows\epplauncher.mif
2012-07-23 13:53 - 2012-07-23 13:53 - 00000000 ____D C:\Program Files\Microsoft Security Client
2012-07-23 13:53 - 2012-07-23 13:53 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2012-07-23 13:50 - 2012-07-23 13:52 - 12621696 ____A (Microsoft Corporation) C:\Users\Owner\Downloads\mseinstall.exe
2012-07-23 13:26 - 2012-07-23 13:26 - 00011379 ____A C:\Users\Owner\Documents\Book2.xlsx
2012-07-23 13:21 - 2012-07-23 13:21 - 00001094 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-07-23 13:21 - 2012-07-23 13:21 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-07-23 13:00 - 2012-07-23 13:05 - 00003439 ____A C:\FRST.txt
2012-07-23 11:13 - 2012-07-23 11:13 - 00000000 ____D C:\i386
2012-07-21 08:40 - 2012-07-21 08:40 - 00056320 ___AH (FRISK Software International) C:\Windows\SysWOW64\rrineown.dll
2012-07-18 17:04 - 2012-07-18 17:04 - 00009854 ____A C:\Users\Owner\Documents\rent pay.xlsx
2012-07-18 16:59 - 2012-07-19 04:29 - 51686344 ____A C:\Users\Owner\Downloads\avast_internet_security_setup.exe
2012-07-18 08:39 - 2012-07-21 08:41 - 00000000 ____D C:\Users\All Users\7531E8D000547533199543F3F875F002
2012-07-13 19:46 - 2012-07-18 17:04 - 00001509 ____A C:\Users\Owner\Documents\breeding schedule.csv
2012-07-12 03:35 - 2012-07-12 03:35 - 00010240 ____A C:\Users\Owner\Documents\Ingles.wps
2012-07-10 11:53 - 2012-07-18 17:04 - 00011776 ____A C:\Users\Owner\Documents\ami.wps
2012-07-09 05:18 - 2012-07-09 05:18 - 00567109 ____A C:\Users\Owner\Downloads\FreeMusic.exe
2012-07-08 03:21 - 2012-07-08 03:21 - 00005416 ____A C:\Users\Owner\Documents\temp.csv
2012-06-29 06:22 - 2012-06-29 06:22 - 00001103 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2012-06-29 06:22 - 2012-06-29 06:22 - 00000000 ____D C:\Users\All Users\Mozilla
2012-06-29 06:22 - 2012-06-29 06:22 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2012-06-29 03:28 - 2012-06-29 03:33 - 16577248 ____A (Mozilla) C:\Users\Owner\Downloads\Firefox Setup 13.0.1.exe
2012-06-29 03:15 - 2012-06-29 03:15 - 00001123 ____A C:\Users\Owner\Documents\does and kids (Autosaved).csv
2012-06-27 04:28 - 2012-06-29 03:14 - 00000503 ____A C:\Users\Owner\Documents\herd test bucks.csv
2012-06-27 04:25 - 2012-06-29 03:14 - 00001590 ____A C:\Users\Owner\Documents\herd testing.csv
2012-06-25 07:56 - 2012-06-25 07:56 - 00002512 ____A C:\Users\Owner\Documents\does and kids.csv
2012-06-24 05:28 - 2012-06-24 05:28 - 00000000 ____D C:\Users\Owner\AppData\Local\{02D8F9CA-C399-4B7B-987E-A9D401D7E066}

============ 3 Months Modified Files ========================

2012-07-23 16:37 - 2012-07-23 16:38 - 00892164 ____A (Farbar) C:\FRST.exe
2012-07-23 14:43 - 2009-08-21 21:29 - 00291276 ____A C:\Windows\PFRO.log
2012-07-23 14:42 - 2011-08-10 09:23 - 02389407 ____A C:\Windows\System32\ptumlacsvc-1.log
2012-07-23 14:24 - 2009-10-10 06:11 - 01317759 ____A C:\Windows\WindowsUpdate.log
2012-07-23 13:55 - 2009-07-13 20:45 - 00009920 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2012-07-23 13:55 - 2009-07-13 20:45 - 00009920 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2012-07-23 13:53 - 2012-07-23 13:53 - 00743538 ____A C:\Windows\SysWOW64\PerfStringBackup.INI
2012-07-23 13:53 - 2012-07-23 13:53 - 00001945 ____A C:\Windows\epplauncher.mif
2012-07-23 13:52 - 2012-07-23 13:50 - 12621696 ____A (Microsoft Corporation) C:\Users\Owner\Downloads\mseinstall.exe
2012-07-23 13:48 - 2009-07-13 21:13 - 00726444 ____A C:\Windows\System32\PerfStringBackup.INI
2012-07-23 13:43 - 2009-07-13 20:51 - 00281065 ____A C:\Windows\setupact.log
2012-07-23 13:26 - 2012-07-23 13:26 - 00011379 ____A C:\Users\Owner\Documents\Book2.xlsx
2012-07-23 13:21 - 2012-07-23 13:21 - 00001094 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-07-23 13:05 - 2012-07-23 13:00 - 00003439 ____A C:\FRST.txt
2012-07-21 08:40 - 2012-07-21 08:40 - 00056320 ___AH (FRISK Software International) C:\Windows\SysWOW64\rrineown.dll
2012-07-19 04:29 - 2012-07-18 16:59 - 51686344 ____A C:\Users\Owner\Downloads\avast_internet_security_setup.exe
2012-07-18 17:04 - 2012-07-18 17:04 - 00009854 ____A C:\Users\Owner\Documents\rent pay.xlsx
2012-07-18 17:04 - 2012-07-13 19:46 - 00001509 ____A C:\Users\Owner\Documents\breeding schedule.csv
2012-07-18 17:04 - 2012-07-10 11:53 - 00011776 ____A C:\Users\Owner\Documents\ami.wps
2012-07-18 17:04 - 2009-12-08 11:44 - 00000356 ____A C:\Users\Owner\AppData\Roaming\wklnhst.dat
2012-07-12 17:44 - 2012-04-04 18:44 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2012-07-12 17:44 - 2011-08-31 12:27 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2012-07-12 03:35 - 2012-07-12 03:35 - 00010240 ____A C:\Users\Owner\Documents\Ingles.wps
2012-07-09 05:18 - 2012-07-09 05:18 - 00567109 ____A C:\Users\Owner\Downloads\FreeMusic.exe
2012-07-08 03:21 - 2012-07-08 03:21 - 00005416 ____A C:\Users\Owner\Documents\temp.csv
2012-07-03 09:46 - 2011-05-19 04:40 - 00024904 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2012-06-29 06:22 - 2012-06-29 06:22 - 00001103 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2012-06-29 03:33 - 2012-06-29 03:28 - 16577248 ____A (Mozilla) C:\Users\Owner\Downloads\Firefox Setup 13.0.1.exe
2012-06-29 03:15 - 2012-06-29 03:15 - 00001123 ____A C:\Users\Owner\Documents\does and kids (Autosaved).csv
2012-06-29 03:14 - 2012-06-27 04:28 - 00000503 ____A C:\Users\Owner\Documents\herd test bucks.csv
2012-06-29 03:14 - 2012-06-27 04:25 - 00001590 ____A C:\Users\Owner\Documents\herd testing.csv
2012-06-25 07:56 - 2012-06-25 07:56 - 00002512 ____A C:\Users\Owner\Documents\does and kids.csv
2012-06-23 08:17 - 2012-06-23 08:16 - 01528184 ____A (Microsoft Corporation) C:\Users\Owner\Downloads\GenuineCheck.exe
2012-06-16 12:06 - 2012-06-16 12:05 - 01501801 ____A C:\Users\Owner\Downloads\ErrorRepair_file.exe
2012-06-16 06:39 - 2012-06-16 06:39 - 00000831 ____A C:\Users\Public\Desktop\WiseFixer.lnk
2012-06-16 06:39 - 2012-06-16 06:37 - 03961536 ____A (FoxthSoft ) C:\Users\Owner\Downloads\WiseFixer(1).exe
2012-06-16 06:36 - 2012-06-16 06:34 - 03961536 ____A (FoxthSoft ) C:\Users\Owner\Downloads\WiseFixer.exe
2012-06-13 17:22 - 2012-06-13 17:13 - 33946033 ____A C:\Users\Owner\Downloads\avast_free_antivirus_setup(1).exe
2012-06-13 11:36 - 2012-06-13 10:10 - 00032410 ____A C:\Windows\System32\PTUMLsetup_20120613.log
2012-06-13 10:27 - 2012-06-13 10:07 - 67395445 ____A C:\Users\Owner\Downloads\avast_free_antivirus_setup.exe
2012-06-11 17:07 - 2009-01-13 11:44 - 00025218 ____A C:\Users\Owner\Documents\SS-light-swirls.abr
2012-06-02 17:17 - 2012-06-02 17:11 - 16111032 ____A (Microsoft Corporation) C:\Users\Owner\Downloads\Windows-KB890830-V4.8(2).exe
2012-06-02 17:16 - 2012-06-02 17:11 - 16111032 ____A (Microsoft Corporation) C:\Users\Owner\Downloads\Windows-KB890830-V4.8(1).exe
2012-06-02 17:02 - 2012-06-02 16:59 - 16111032 ____A (Microsoft Corporation) C:\Users\Owner\Downloads\Windows-KB890830-V4.8.exe
2012-05-28 13:42 - 2012-05-28 13:42 - 00796360 ____A (Solid State Networks) C:\Users\Owner\Downloads\install_flashplayer11x64_aih.exe
2012-05-24 14:46 - 2012-05-14 11:49 - 00000000 __ASH C:\Windows\System32\dds_trash_log.cmd
2012-05-24 12:53 - 2012-05-24 12:53 - 00001831 ____A C:\Users\Public\Desktop\SUPERAntiSpyware Professional.lnk
2012-05-14 12:03 - 2012-05-14 12:03 - 00000999 ____A C:\Users\Owner\Desktop\Smart Fortress 2012 Order.lnk
2012-05-14 12:03 - 2012-05-14 12:03 - 00000134 ____A C:\Users\Owner\Desktop\Smart Fortress 2012 Support Site.url
2012-05-08 23:29 - 2009-07-13 20:45 - 03681720 ____A C:\Windows\System32\FNTCACHE.DAT
2012-05-08 23:09 - 2010-01-01 16:31 - 57848688 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2012-04-26 16:08 - 2012-06-02 17:04 - 55656824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\MRT.exe


========================= Known DLLs (Whitelisted) ============


========================= Bamital & volsnap Check ============

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

========================= Memory info ======================

Percentage of memory in use: 10%
Total physical RAM: 7935.18 MB
Available physical RAM: 7127.25 MB
Total Pagefile: 7933.38 MB
Available Pagefile: 7138.1 MB
Total Virtual: 8192 MB
Available Virtual: 8191.9 MB

======================= Partitions =========================

1 Drive c: (Gateway) (Fixed) (Total:916.41 GB) (Free:795.65 GB) NTFS
2 Drive e: (PQSERVICE) (Fixed) (Total:15 GB) (Free:5.43 GB) NTFS
4 Drive g: () (Removable) (Total:14.91 GB) (Free:6.79 GB) NTFS
10 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
11 Drive y: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 931 GB 0 B
Disk 1 Online 14 GB 0 B
Disk 2 No Media 0 B 0 B
Disk 3 No Media 0 B 0 B
Disk 4 No Media 0 B 0 B
Disk 5 No Media 0 B 0 B
Disk 6 No Media 0 B 0 B

Partitions of Disk 0:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Recovery 15 GB 1024 KB
Partition 2 Primary 100 MB 15 GB
Partition 3 Primary 916 GB 15 GB

==================================================================================

Disk: 0
Partition 1
Type : 27
Hidden: Yes
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 E PQSERVICE NTFS Partition 15 GB Healthy Hidden

==================================================================================

Disk: 0
Partition 2
Type : 07
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 Y SYSTEM RESE NTFS Partition 100 MB Healthy

==================================================================================

Disk: 0
Partition 3
Type : 07
Hidden: No
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 C Gateway NTFS Partition 916 GB Healthy

==================================================================================

Partitions of Disk 1:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 14 GB 31 KB

==================================================================================

Disk: 1
Partition 1
Type : 07
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 4 G NTFS Removable 14 GB Healthy

==================================================================================

==========================================================

Last Boot: 2012-07-21 07:49

======================= End Of Log ==========================

Attached Files

  • Attached File  FRST.txt   19.39KB   0 downloads


BC AdBot (Login to Remove)

 


#2 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:12:08 AM

Posted 26 July 2012 - 01:28 AM

Greetings And Welcome To The Forums!!

My name is Gringo and I'll be glad to help you with your malware problems.

I have put together somethings for you to keep in mind while I am helping you to make things go easier and faster for both of us

  • Please do not run any tools unless instructed to do so.
    • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
  • Please do not attach logs or use code boxes, just copy and paste the text.
    • Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
  • Please read every post completely before doing anything.
    • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
  • Please provide feedback about your experience as we go.
    • A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.
NOTE: At the top of your post, click on the Watch Topic Button, select Immediate Notification, and click on Proceed. This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of hartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the flash drive as fixlist.txt



1 bxuvtfye; \??\C:\Windows\system32\drivers\bxuvtfye.sys [x]
1 gqsilmwj; \??\C:\Windows\system32\drivers\gqsilmwj.sys [x]
1 mvjitznu; \??\C:\Windows\system32\drivers\mvjitznu.sys [x]
1 noncrhtv; \??\C:\Windows\system32\drivers\noncrhtv.sys [x]
1 pjnmgrrl; \??\C:\Windows\system32\drivers\pjnmgrrl.sys [x]
1 xkgkrypf; \??\C:\Windows\system32\drivers\xkgkrypf.sys [x]
1 ykuqjoqn; \??\C:\Windows\system32\drivers\ykuqjoqn.sys [x]
SubSystems: [Windows] ATTENTION! ====> ZeroAccess


NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options.

Run FRST64 and press the Fix button just once and wait.
The tool will make a log on the flash drive (Fixlog.txt) please post it to your reply.

Gringo[/b]
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#3 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:12:08 AM

Posted 29 July 2012 - 01:37 AM

Hello

48 Hour bump

It has been more than 48 hours since my last post.

  • do you still need help with this?
  • do you need more time?
  • are you having problems following my instructions?
  • if after 48hrs you have not replied to this thread then it will have to be closed!

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#4 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:12:08 AM

Posted 01 August 2012 - 05:44 AM

Due to the lack of feedback, this topic is now closed.In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days. Please include a link to your topic in the Private Message. Thank you.
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users