Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Green Dot virus help


  • This topic is locked This topic is locked
4 replies to this topic

#1 Groundhangers

Groundhangers

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:03:43 AM

Posted 13 June 2013 - 08:45 AM

Hi to all at Bleeping.

 

12 mths ago i got the dreaded virus on my Toshiba l510 laptop (Win 7 32bit) and i havent touched it since. Ive done a little searching around on the net and ive ended up here. Id really like to try and repair it as id like to use it again. Ive read quite a few threads and it seems that downloading Farbar is the first step.

 

Anyway i took it upon myself to get a copy of the log.

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-06-2013 04
Ran by SYSTEM on 13-06-2013 22:46:19
Running from F:\
Windows Vista ™ Home Premium Service Pack 1 (X86) OS Language: English(US)
Internet Explorer Version 7
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE [468320 2009-03-06] (TOSHIBA Corporation)
HKLM\...\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe [55160 2009-03-09] (TOSHIBA Corporation)
HKLM\...\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe [448376 2008-12-18] (TOSHIBA Corporation)
HKLM\...\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe [729088 2009-03-23] (TOSHIBA Corporation)
HKLM\...\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [61440 2009-04-21] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [6965792 2009-03-12] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1451304 2009-03-18] (Synaptics Incorporated)
HKLM\...\Run: [ITSecMng] %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START [83336 2008-12-19] (TOSHIBA CORPORATION)
HKLM\...\Run: [Teco] "%ProgramFiles%\TOSHIBA\TECO\Teco.exe" /r [1318912 2009-04-14] (TOSHIBA Corporation)
HKLM\...\Run: [TWebCamera] "%ProgramFiles%\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun [2513472 2009-04-16] (TOSHIBA)
HKLM\...\Run: [SmartFaceVWatcher] %ProgramFiles%\Toshiba\SmartFaceV\SmartFaceVWatcher.exe [163840 2009-03-24] (TOSHIBA Corporation)
HKLM\...\Run: [NDSTray.exe] "C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe" [299008 2009-05-12] (TOSHIBA CORPORATION)
HKLM\...\Run: [cfFncEnabler.exe] "C:\Program Files\TOSHIBA\ConfigFree\cfFncEnabler.exe" [16384 2009-03-24] (Toshiba Corporation)
HKLM\...\Run: [TPCHWMsg] %ProgramFiles%\TOSHIBA\TPHM\TPCHWMsg.exe [570736 2009-04-09] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe [1007616 2009-03-24] (TOSHIBA Corporation)
HKLM\...\Run: [ToshibaServiceStation] "C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60 [1295224 2010-07-01] (TOSHIBA Corporation)
HKLM\...\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup [30192 2011-04-23] (Google)
HKLM\...\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide [1008184 2008-01-20] (Microsoft Corporation)
HKLM\...\Run: [NBAgent] "C:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe" /WinStart [1234216 2010-03-26] (Nero AG)
HKLM\...\Run: [Skytel] C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-03-12] (Realtek Semiconductor Corp.)
HKLM\...\Run: [iTunes] C:\iTunes\iTunesHelper.exe [822272 2011-09-16] (Apple Inc.)
HKLM\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [38872 2012-07-31] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [919008 2012-07-11] (Adobe Systems Incorporated)
HKLM\...\Run: [iBryte playbryte Desktop] C:\Program Files\iBryte\playbryte\ibrytedesktop.exe [163840 2012-03-02] (iBryte)
HKLM\...\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59240 2012-02-20] (Apple Inc.)
HKLM\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [421888 2011-10-23] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [421736 2012-03-06] (Apple Inc.)
HKLM\...\Run: [Windows Media Sharing] C:\ProgramData\Windows Media Player\wmpnscfg.exe [482816 2012-09-27] (Microsoft Corporation)
HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [254696 2012-01-17] (Sun Microsystems, Inc.)
HKLM\...\Winlogon: [Shell] Explorer.exe, C:\Users\KIARA\AppData\Roaming\sfzodrMz [x ] ()
HKU\Default\...\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [ 2008-12-10] (TOSHIBA)
HKU\KIARA\...\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [ 2008-12-10] (TOSHIBA)
HKU\KIARA\...\Run: [WlNRAR] C:\Users\KIARA\AppData\Roaming\Microsoft\System\Services\WlNRAR.exe [x]
HKU\KIARA\...\Run: [EPSON Stylus Photo R230 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIAIP.EXE /FU "C:\Windows\TEMP\E_SDB2B.tmp" /EF "HKCU" [ 2011-06-01] ()
HKU\KIARA\...\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent [x]
HKU\KIARA\...\Run: [KGShareApp] C:\Program Files\Kodak\KODAK Share Button App\KGShare_App.exe [ 2012-02-02] (Eastman Kodak Company)
HKU\KIARA\...\Run: [DownloadManager] "C:\Program Files\Zoom Downloader\DownloadManager.exe" /as [ 2012-03-02] (Zoom Downloader)
HKU\KIARA\...\Run: [Facebook Update] "C:\Users\KIARA\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver [ 2012-07-15] (Facebook Inc.)
HKU\KIARA\...\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun [ 2012-07-12] (Skype Technologies S.A.)
HKU\KIARA\...\Run: [Utlaziebo] C:\Users\KIARA\AppData\Roaming\Ikahu\ehuv.exe [ 2012-01-21] ()
HKU\KIARA\...\Run: [pppu_yuds] C:\ProgramData\sfzodrMz [x]
HKU\KIARA\...\Policies\system: [DisableTaskMgr] 1
HKU\KIARA\...\Command Processor: "C:\Users\KIARA\AppData\Local\sfzodrMz.exe" <===== ATTENTION!
Startup: C:\Users\KIARA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()

========================== Services (Whitelisted) =================

S2 AdobeActiveFileMonitor7.0; C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [169312 2008-09-16] (Adobe Systems Incorporated)
S2 camsvc; C:\Program Files\TOSHIBA\TOSHIBA Web Camera Application\TWebCameraSrv.exe [20544 2009-04-16] (TOSHIBA)
S2 ConfigFree Service; C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [46448 2009-03-10] (TOSHIBA CORPORATION)
S2 DCService.exe; C:\ProgramData\DatacardService\DCService.exe [229376 2010-08-19] ()
S3 GameConsoleService; C:\Program Files\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe [246520 2010-09-30] (WildTangent, Inc.)
S3 GoogleDesktopManager-051210-111108; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [30192 2011-04-23] (Google)
S3 MSSQL$MSSMLBIZ; c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [28933976 2006-04-14] (Microsoft Corporation)
S2 MSSQL$SQLEXPRESS; c:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [29178224 2007-02-10] (Microsoft Corporation)
S2 NAUpdate; C:\Program Files\Nero\Update\NASvc.exe [490280 2010-03-25] (Nero AG)
S2 Norton Internet Security; C:\Program Files\Norton Internet Security\Engine\16.8.3.6\diMaster.dll [135024 2011-10-11] (Symantec Corporation)
S2 ProtexisLicensing; C:\Windows\system32\PSIService.exe [177704 2007-06-05] ()
S2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [241734 2008-04-07] ()
S2 RSELSVC; C:\Program Files\TOSHIBA\RSelect\RSelSvc.exe [57344 2009-02-19] (TOSHIBA Corporation)
S3 TMachInfo; C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [51576 2010-07-01] (TOSHIBA Corporation)
S2 TOSHIBA eco Utility Service; C:\Program Files\TOSHIBA\TECO\TecoService.exe [176128 2009-04-14] (TOSHIBA Corporation)
S2 TOSHIBA HDD SSD Alert Service; C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [73728 2009-03-17] (TOSHIBA Corporation)
S2 TPCHSrv; C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe [656752 2009-04-09] (TOSHIBA Corporation)
S2 USmsServ; C:\Windows\Desktop Manager\dwm.exe [142336 2011-06-11] (Microsoft Corporation)
S2 WMPNetworkSvchost; C:\Program Files\Common Files\Windows Media Player\wmpnetwk.exe [44544 2012-05-14] (Microsoft Corporation)
S3 msiserver; %systemroot%\system32\msiexec /V [x]

==================== Drivers (Whitelisted) ====================

S1 BHDrvx86; C:\Windows\System32\Drivers\NIS\1008030.006\BHDrvx86.sys [259632 2010-01-20] (Symantec Corporation)
S1 ccHP; C:\Windows\System32\Drivers\NIS\1008030.006\ccHPx86.sys [467592 2011-10-11] (Symantec Corporation)
S1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [374392 2011-05-09] (Symantec Corporation)
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [14216 2010-07-15] ()
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [8456 2010-07-15] ()
S1 IDSVix86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20110622.001\IDSvix86.sys [367736 2011-06-02] (Symantec Corporation)
S3 MarvinBus; C:\Windows\System32\DRIVERS\MarvinBus.sys [171520 2005-09-23] (Pinnacle Systems GmbH)
S3 NuidFltr; C:\Windows\System32\DRIVERS\NuidFltr.sys [14736 2009-05-09] (Microsoft Corporation)
S3 PGEffect; C:\Windows\System32\DRIVERS\pgeffect.sys [22272 2009-03-18] (TOSHIBA Corporation)
S1 PQNTDrv; C:\Windows\System32\Drivers\PQNTDrv.sys [4228 2002-09-16] (PowerQuest Corporation)
S3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [153952 2009-02-20] (Realtek Semiconductor Corp.)
S3 rtl819xp; C:\Windows\System32\DRIVERS\rtl819xp.sys [500224 2009-03-09] (Realtek Semiconductor Corporation                           )
S1 RtlProt; C:\Windows\System32\DRIVERS\rtlprot.sys [25896 2007-04-23] (Windows ® Codename Longhorn DDK provider)
S3 SRTSP; C:\Windows\System32\Drivers\NIS\1008030.006\SRTSP.SYS [308272 2010-01-20] (Symantec Corporation)
S1 SRTSPX; C:\Windows\system32\drivers\NIS\1008030.006\SRTSPX.SYS [43696 2010-01-20] (Symantec Corporation)
S0 SymEFA; C:\Windows\System32\drivers\NIS\1008030.006\SYMEFA.SYS [310320 2010-01-20] (Symantec Corporation)
S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [124976 2011-04-24] (Symantec Corporation)
S1 SymIM; C:\Windows\System32\DRIVERS\SymIMv.sys [25648 2010-01-20] (Symantec Corporation)
S1 SYMTDI; C:\Windows\System32\Drivers\NIS\1008030.006\SYMTDI.SYS [217464 2011-09-21] (Symantec Corporation)
S2 TVALZFL; C:\Windows\System32\DRIVERS\TVALZFL.sys [12920 2009-03-20] (TOSHIBA Corporation)
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20110621.035\NAVENG.SYS [x]
S3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20110621.035\NAVEX15.SYS [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 SYMFW; \SystemRoot\System32\Drivers\NIS\1008000.029\SYMFW.SYS [x]
S3 SYMNDISV; \SystemRoot\System32\Drivers\NIS\1008000.029\SYMNDISV.SYS [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-13 22:46 - 2013-06-13 22:46 - 00000000 ____D C:\FRST

==================== One Month Modified Files and Folders ========

2013-06-13 22:46 - 2013-06-13 22:46 - 00000000 ____D C:\FRST
2013-06-13 04:30 - 2012-11-27 02:15 - 00155648 ____A C:\Users\KIARA\AppData\Roaming\sfzodrMz.exe
2013-06-13 04:30 - 2012-11-26 01:53 - 00155648 ____A C:\Users\KIARA\AppData\Local\sfzodrMz.exe
2013-06-13 04:24 - 2012-06-08 02:50 - 00000928 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-940247114-2019873722-32288300-1004UA.job
2013-06-13 04:24 - 2012-06-08 02:49 - 00000906 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-940247114-2019873722-32288300-1004Core.job
2013-06-13 04:24 - 2012-06-05 22:09 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-13 04:24 - 2012-05-28 02:35 - 00000884 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-13 04:24 - 2012-05-28 02:34 - 00000880 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-13 04:24 - 2011-04-23 13:44 - 00000012 ____A C:\Windows\bthservsdp.dat
2013-06-13 04:24 - 2006-11-02 05:01 - 00032608 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-13 04:24 - 2006-11-02 05:01 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-13 04:24 - 2006-11-02 04:47 - 00003616 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-13 04:24 - 2006-11-02 04:47 - 00003616 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

Files to move or delete:
====================
C:\ProgramData\sfzodrMz.exe

==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2012-09-14 09:00:52
Restore point made on: 2012-09-16 11:46:48
Restore point made on: 2012-09-19 03:09:11
Restore point made on: 2012-09-23 03:52:27
Restore point made on: 2012-09-28 07:55:49
Restore point made on: 2012-09-29 00:05:51
Restore point made on: 2012-09-29 16:01:42
Restore point made on: 2012-10-04 01:21:47
Restore point made on: 2012-10-10 22:41:53
Restore point made on: 2012-10-12 03:05:39
Restore point made on: 2012-10-14 00:17:16
Restore point made on: 2012-11-02 01:27:40
Restore point made on: 2012-11-03 16:27:43
Restore point made on: 2012-11-16 00:05:59
Restore point made on: 2012-11-19 02:38:10
Restore point made on: 2012-11-22 22:18:52
Restore point made on: 2012-11-25 23:13:17

==================== Memory info ===========================

Percentage of memory in use: 18%
Total physical RAM: 2045.24 MB
Available physical RAM: 1658.75 MB
Total Pagefile: 1869.79 MB
Available Pagefile: 1729.01 MB
Total Virtual: 2047.88 MB
Available Virtual: 1963.02 MB

==================== Drives ================================

Drive c: (S3A7152D004) (Fixed) (Total:284.65 GB) (Free:20.6 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (TOSHIBA SYSTEM VOLUME) (Fixed) (Total:1.46 GB) (Free:1.32 GB) NTFS
Drive f: () (Removable) (Total:15.04 GB) (Free:4.32 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298 GB) (Disk ID: 68EAB709)
Partition 1: (Not Active) - (Size=1 GB) - (Type=27)
Partition 2: (Active) - (Size=285 GB) - (Type=07 NTFS)
Partition 3: (Active) - (Size=12 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 15 GB) (Disk ID: 1F2F246C)
Partition 1: (Not Active) - (Size=15 GB) - (Type=0C)


LastRegBack: 2012-12-08 04:09

==================== End Of Log ============================

 

 

Thanks Mods in advance

Greg



BC AdBot (Login to Remove)

 


#2 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:12:43 PM

Posted 14 June 2013 - 09:59 AM

Hello Greg

I would like to welcome you to the Malware Removal section of the forum.

Around here they call me Gringo and I will be glad to help you with your malware problems.


Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!

  • Please do not run any tools unless instructed to do so.
    • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
  • Please do not attach logs or use code boxes, just copy and paste the text.
    • Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
  • Please read every post completely before doing anything.
    • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
  • Please provide feedback about your experience as we go.
    • A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.
NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the flash drive as fixlist.txt


 
HKU\KIARA\...\Run: [Utlaziebo] C:\Users\KIARA\AppData\Roaming\Ikahu\ehuv.exe [ 2012-01-21] ()
HKU\KIARA\...\Run: [pppu_yuds] C:\ProgramData\sfzodrMz [x]
HKU\KIARA\...\Policies\system: [DisableTaskMgr] 1
HKU\KIARA\...\Command Processor: "C:\Users\KIARA\AppData\Local\sfzodrMz.exe" <===== ATTENTION!
2013-06-13 04:30 - 2012-11-27 02:15 - 00155648 ____A C:\Users\KIARA\AppData\Roaming\sfzodrMz.exe
2013-06-13 04:30 - 2012-11-26 01:53 - 00155648 ____A C:\Users\KIARA\AppData\Local\sfzodrMz.exe
C:\ProgramData\sfzodrMz.exe
C:\Users\KIARA\AppData\Roaming\Ikahu\ehuv.exe
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options.

Run FRST again like we did before but this time press the Fix button just once and wait.
The tool will make a log on the flash drive (Fixlog.txt) please post it to your reply.

Also boot the computer into normal mode and let me know how things are looking.

Gringo

Edited by gringo_pr, 15 June 2013 - 01:34 PM.

I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#3 Groundhangers

Groundhangers
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:03:43 AM

Posted 15 June 2013 - 06:07 AM

Thanks Gringo, after doing this i managed to get back into windows. The only thing that i had interest in that was on the HD was photos. I have taken them off, scaned them on another computer and appear to be clean. I am now going to format the HD and load on a fresh copy of Windows. Is that sufficient enough to rid of the malware?

 

Thanks

Greg



#4 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:12:43 PM

Posted 15 June 2013 - 01:36 PM

Hello Greg

formatting the harddrive should remove the virus from your system


Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#5 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:12:43 PM

Posted 18 June 2013 - 01:01 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users