Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

ZEROACCESS - Remnants detected by rKill


  • This topic is locked This topic is locked
15 replies to this topic

#1 codacious

codacious

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:04:09 PM

Posted 08 August 2013 - 04:39 PM

Working on a computer that is infected by ZEROACCESS. Removed with a combination of TDSS, MBAM, HitmanPRO, Combofix, RougeKiller, and AdwCleaner.

Unfortunately rKill still detects a reparse point junction (have included .txt below). I do not really know what this means but it leads me to believe that I am still infected. Thank you so much in advance.

DDS:
DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 10.0.9200.16635
Run by Mike at 16:28:45 on 2013-08-08
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.3032.1534 [GMT -5:00]
.
AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\STacSV64.exe
C:\Program Files\Dell\DellDock\DockLogin.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE
C:\Windows\system32\WLANExt.exe
C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwltry.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskhost.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Program Files\IDT\WDM\sttray64.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.EXE
C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\ProgramData\Macrovision\FLEXnet Connect\11\ISUSPM.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Windows\system32\Macromed\Flash\FlashUtil64_11_8_800_94_ActiveX.exe
C:\Windows\System32\Notepad.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://msn.com/
mStart Page = hxxp://www.google.com
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - <orphaned>
BHO: Symantec NCO BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\CoIEPlg.dll
BHO: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\CoIEPlg.dll
uRun: [ISUSPM] "C:\ProgramData\Macrovision\FLEXnet Connect\11\ISUSPM.exe" -scheduler
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe"
mRun: [DellSupportCenter] "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
mRun: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDrives = dword:0
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\smartprintsetup.exe
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {B69F2A9C-E470-11D3-AFA3-525400DB7692} - hxxp://ibhost.dancik.com/download/actimage40930.cab
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
TCP: NameServer = 192.168.1.251 192.168.1.247
TCP: Interfaces\{3C7A1DCE-9AF7-4295-BE48-051F2F6453CC} : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{B92214EB-B5D1-40FC-B16D-C733C8F09217} : DHCPNameServer = 192.168.1.251 192.168.1.247
TCP: Interfaces\{B92214EB-B5D1-40FC-B16D-C733C8F09217}\2656C6B696E6E2733336 : DHCPNameServer = 192.168.2.1
TCP: Interfaces\{B92214EB-B5D1-40FC-B16D-C733C8F09217}\3414050535 : DHCPNameServer = 207.70.128.209 207.70.172.13
Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\CoIEPlg.dll
SSODL: WebCheck - <orphaned>
x64-BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
x64-Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
x64-Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe
x64-Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe
x64-Run: [Broadcom Wireless Manager UI] C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.exe
x64-Run: [IAAnotif] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe
x64-Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
x64-IE: {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - <orphaned>
x64-DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
x64-DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
x64-DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
x64-Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - <orphaned>
x64-Notify: GoToAssist - C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
.
============= SERVICES / DRIVERS ===============
.
R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\System32\drivers\MpFilter.sys [2013-6-18 247216]
R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2009-9-24 55280]
R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\drivers\NISx64\1008030.006\SymEFA64.sys [2011-10-11 402992]
R1 avgtp;avgtp;C:\Windows\System32\drivers\avgtpx64.sys [2012-9-4 45856]
R1 BHDrvx64;Symantec Heuristics Driver;C:\Windows\System32\drivers\NISx64\1008030.006\BHDrvx64.sys [2011-10-11 334384]
R1 ccHP;Symantec Hash Provider;C:\Windows\System32\drivers\NISx64\1008030.006\cchpx64.sys [2011-10-11 561800]
R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100128.002\IDSviA64.sys [2010-1-30 466992]
R2 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe [2008-12-18 155648]
R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2009-9-24 648432]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver;C:\Windows\System32\drivers\CtClsFlt.sys [2009-9-24 172704]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2009-9-24 215552]
R3 SYMNDISV;Symantec Network Filter Driver;C:\Windows\System32\drivers\NISx64\1008030.006\symndisv.sys [2011-10-11 56952]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\System32\drivers\yk62x64.sys [2009-9-24 393728]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 Norton Internet Security;Norton Internet Security;C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\ccSvcHst.exe [2011-10-11 117648]
S3 NisDrv;Microsoft Network Inspection System;C:\Windows\System32\drivers\NisDrvWFP.sys [2013-1-20 139616]
S3 NisSrv;Microsoft Network Inspection;C:\Program Files\Microsoft Security Client\NisSrv.exe [2013-6-20 366600]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-6-27 59392]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-4-25 52736]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-4-21 1255736]
.
=============== Created Last 30 ================
.
2013-08-08 20:00:02 9460976 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{1A0752A4-E42E-43C8-9F5D-F1527F4B62F5}\mpengine.dll
2013-08-08 16:29:56 -------- d-----w- C:\ProgramData\HitmanPro
2013-08-08 16:04:17 -------- d-sh--w- C:\$RECYCLE.BIN
2013-08-08 15:10:54 -------- d-----w- C:\Windows\ERUNT
2013-08-06 20:56:15 -------- d-----w- C:\Windows\System32\MRT
2013-08-06 15:11:06 -------- d-----w- C:\Program Files (x86)\ESET
2013-08-06 15:10:26 964552 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2013-08-06 15:10:26 941720 ------w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{82A97BDB-4165-4B68-8840-C8CC601386D5}\gapaengine.dll
2013-08-06 15:09:38 9460976 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-08-06 15:04:12 328704 ----a-w- C:\Windows\System32\Services.exe
2013-08-06 14:07:00 33240 ----a-w- C:\Windows\System32\drivers\GEARAspiWDM.sys
2013-08-06 14:06:26 -------- d-----w- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-08-06 14:06:26 -------- d-----w- C:\Program Files\iTunes
2013-08-06 14:06:26 -------- d-----w- C:\Program Files\iPod
2013-08-06 14:06:26 -------- d-----w- C:\Program Files (x86)\iTunes
2013-08-06 14:03:18 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin5.dll
2013-08-06 14:03:18 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin4.dll
2013-08-06 14:03:18 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin3.dll
2013-08-06 14:03:18 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin2.dll
2013-08-06 14:03:18 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin.dll
2013-07-29 02:16:56 -------- d-----w- C:\ProgramData\9A3FE798B4A88B2300009A3F4D5D8F4B
2013-07-29 02:15:50 -------- d-----w- C:\Users\Mike\AppData\Local\Google
2013-07-11 02:37:42 -------- d-----w- C:\Users\Mike\AppData\Roaming\Auslogics
2013-07-11 02:37:38 -------- d-----w- C:\Program Files (x86)\Auslogics
2013-07-11 02:28:12 -------- d-----w- C:\Program Files (x86)\Microsoft Security Client
2013-07-11 02:28:10 -------- d-----w- C:\Program Files\Microsoft Security Client
2013-07-11 02:21:18 -------- d-----w- C:\ProgramData\Dumps
2013-07-11 02:20:54 -------- d-----w- C:\Windows\pss
2013-07-11 02:13:02 -------- d-----w- C:\Users\Mike\AppData\Roaming\QuickScan
2013-07-11 02:12:50 -------- d-----w- C:\Program Files\Bitdefender
2013-07-10 21:33:11 98816 ----a-w- C:\Windows\sed.exe
2013-07-10 21:33:11 256000 ----a-w- C:\Windows\PEV.exe
2013-07-10 21:33:11 208896 ----a-w- C:\Windows\MBR.exe
2013-07-10 21:29:28 -------- d-----w- C:\Program Files\CCleaner
2013-07-10 20:37:06 3153920 ----a-w- C:\Windows\System32\win32k.sys
2013-07-10 20:37:05 624128 ----a-w- C:\Windows\System32\qedit.dll
2013-07-10 20:37:05 509440 ----a-w- C:\Windows\SysWow64\qedit.dll
2013-07-10 20:37:05 1887744 ----a-w- C:\Windows\System32\WMVDECOD.DLL
2013-07-10 20:37:05 1620480 ----a-w- C:\Windows\SysWow64\WMVDECOD.DLL
2013-07-10 20:37:01 1732608 ----a-w- C:\Program Files\Windows Journal\NBDoc.DLL
2013-07-10 20:37:01 1402880 ----a-w- C:\Program Files\Windows Journal\JNWDRV.dll
2013-07-10 20:37:01 1393152 ----a-w- C:\Program Files\Windows Journal\JNTFiltr.dll
2013-07-10 20:37:01 1367040 ----a-w- C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll
2013-07-10 20:37:00 936448 ----a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\ink\journal.dll
2013-07-10 20:35:21 1643520 ----a-w- C:\Windows\System32\DWrite.dll
2013-07-10 20:35:21 1247744 ----a-w- C:\Windows\SysWow64\DWrite.dll
2013-07-10 20:05:52 -------- d-----w- C:\TDSSKiller_Quarantine
2013-07-10 16:25:38 -------- d-----w- C:\Users\Mike\AppData\Roaming\AVG2012
2013-07-10 15:12:28 -------- d-----w- C:\Users\Mike\AppData\Roaming\Malwarebytes
2013-07-10 15:12:04 -------- d-----w- C:\ProgramData\Malwarebytes
2013-07-10 15:12:03 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys
2013-07-10 15:12:03 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-10 15:11:52 -------- d-----w- C:\Users\Mike\AppData\Local\Programs
2013-07-10 15:10:56 829264 ----a-w- C:\Windows\System32\msvcr100.dll
2013-07-10 15:10:56 608080 ----a-w- C:\Windows\System32\msvcp100.dll
2013-07-10 15:10:51 -------- d-----w- C:\Program Files (x86)\VS Revo Group
2013-07-09 22:57:43 -------- d-----w- C:\Users\Mike\AppData\Roaming\TuneUp Software
.
==================== Find3M  ====================
.
2013-08-06 14:51:47 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2013-08-06 14:51:47 692104 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2013-06-28 22:26:40 45856 ----a-w- C:\Windows\System32\drivers\avgtpx64.sys
2013-06-19 02:50:08 247216 ----a-w- C:\Windows\System32\drivers\MpFilter.sys
2013-06-19 02:50:08 139616 ----a-w- C:\Windows\System32\drivers\NisDrvWFP.sys
2013-06-11 23:43:37 1767936 ----a-w- C:\Windows\SysWow64\wininet.dll
2013-06-11 23:43:00 2877440 ----a-w- C:\Windows\SysWow64\jscript9.dll
2013-06-11 23:42:58 61440 ----a-w- C:\Windows\SysWow64\iesetup.dll
2013-06-11 23:42:58 109056 ----a-w- C:\Windows\SysWow64\iesysprep.dll
2013-06-11 23:26:20 2241024 ----a-w- C:\Windows\System32\wininet.dll
2013-06-11 23:25:16 3958784 ----a-w- C:\Windows\System32\jscript9.dll
2013-06-11 23:25:13 67072 ----a-w- C:\Windows\System32\iesetup.dll
2013-06-11 23:25:13 136704 ----a-w- C:\Windows\System32\iesysprep.dll
2013-06-11 22:51:45 71680 ----a-w- C:\Windows\SysWow64\RegisterIEPKEYs.exe
2013-06-11 22:50:58 89600 ----a-w- C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-07 03:22:18 2706432 ----a-w- C:\Windows\System32\mshtml.tlb
2013-06-07 02:37:52 2706432 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2013-05-13 05:51:01 184320 ----a-w- C:\Windows\System32\cryptsvc.dll
2013-05-13 05:51:00 1464320 ----a-w- C:\Windows\System32\crypt32.dll
2013-05-13 05:51:00 139776 ----a-w- C:\Windows\System32\cryptnet.dll
2013-05-13 05:50:40 52224 ----a-w- C:\Windows\System32\certenc.dll
2013-05-13 04:45:55 140288 ----a-w- C:\Windows\SysWow64\cryptsvc.dll
2013-05-13 04:45:55 1160192 ----a-w- C:\Windows\SysWow64\crypt32.dll
2013-05-13 04:45:55 103936 ----a-w- C:\Windows\SysWow64\cryptnet.dll
2013-05-13 03:43:55 1192448 ----a-w- C:\Windows\System32\certutil.exe
2013-05-13 03:08:10 903168 ----a-w- C:\Windows\SysWow64\certutil.exe
2013-05-13 03:08:06 43008 ----a-w- C:\Windows\SysWow64\certenc.dll
.
============= FINISH: 16:29:12.85 ===============
 

 

rKill:

Rkill 2.6.0 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2013 BleepingComputer.com
More Information about Rkill can be found at this link:
 http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 08/08/2013 04:03:24 PM in x64 mode.
Windows Version: Windows 7 Home Premium Service Pack 1

Checking for Windows services to stop:

 * No malware services found to stop.

Checking for processes to terminate:

 * No malware processes found to kill.

Checking Registry for malware related settings:

 * No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

 * ALERT: ZEROACCESS Reparse Point/Junction found!

     * C:\Windows\winsxs\amd64_security-malware-windows-defender-events_31bf3856ad364e35_6.1.7600.16385_none_118cf1dcd54a3dea\MpEvMsg.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MpAsDesc.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MpClient.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MpCmdRun.exe => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MpCommu.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MpOAV.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MpRTP.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MpSvc.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MSASCui.exe => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MsMpLics.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MsMpRes.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MpAsDesc.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MpClient.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MpCmdRun.exe => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MpCommu.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MpOAV.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MpRTP.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MpSvc.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MSASCui.exe => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MsMpCom.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MsMpLics.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MsMpRes.dll => c:\windows\system32\config [File]

 * No issues found.

Checking Windows Service Integrity:

 * No issues found.

Searching for Missing Digital Signatures:

 * No issues found.

Checking HOSTS File:

 * HOSTS file entries found:

  127.0.0.1       localhost

Program finished at: 08/08/2013 04:20:58 PM
Execution time: 0 hours(s), 17 minute(s), and 34 seconds(s)

 

 

Thank you again for any help!,

-Cody


 

Attached Files



BC AdBot (Login to Remove)

 


#2 B-boy/StyLe/

B-boy/StyLe/

    Bleepin' Freestyler


  • Malware Response Team
  • 8,307 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria
  • Local time:12:09 AM

Posted 08 August 2013 - 05:23 PM

Hello! Welcome to BleepingComputer Forums! :welcome:
My name is Georgi and and I will be helping you with your computer problems.

Before we begin, please note the following:

  • I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The logs can take some time to research, so please be patient with me.
  • Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
  • Instructions that I give are for your system only!
  • Please do not run any tools until requested ! The reason for this is so I know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.
  • Please perform all steps in the order received. If you can't understand something don't hesitate to ask.
  • Again I would like to remind you to make no further changes to your computer unless I direct you to do so. I will not help you if you do not follow my instructions.

 

 

Please download a new version of Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

 

Regards,
Georgi


cXfZ4wS.png


#3 codacious

codacious
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:04:09 PM

Posted 09 August 2013 - 08:29 AM

Attached File  Addition.txt   14.67KB   2 downloadsThanks for the quick reply!

FRST:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-08-2013 02
Ran by Mike (administrator) on 09-08-2013 08:23:34
Running from C:\Users\Mike\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\STacSV64.exe
(Stardock Corporation) C:\Program Files\Dell\DellDock\DockLogin.exe
() C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Dell Inc.) C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwltry.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(SoftThinks) C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Intel Corporation) C:\WINDOWS\System32\igfxtray.exe
(Intel Corporation) C:\WINDOWS\System32\hkcmd.exe
(Intel Corporation) C:\WINDOWS\System32\igfxpers.exe
(Dell Inc.) C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Acresso Corporation) C:\ProgramData\Macrovision\FLEXnet Connect\11\ISUSPM.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Java\jre6\bin\jusched.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\HidFind.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apntex.exe
(SupportSoft, Inc.) C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(SupportSoft, Inc.) C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\system32\Macromed\Flash\FlashUtil64_11_8_800_94_ActiveX.exe
(Microsoft Corporation) C:\Windows\SysWOW64\NOTEPAD.EXE
(Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Apoint] - C:\Program Files\DellTPad\Apoint.exe [305664 2009-01-22] (Alps Electric Co., Ltd.)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [444416 2009-06-28] (IDT, Inc.)
HKLM\...\Run: [Broadcom Wireless Manager UI] - C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.exe [4968960 2009-07-16] (Dell Inc.)
HKLM\...\Run: [IAAnotif] - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)
HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [1356240 2013-06-20] (Microsoft Corporation)
Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll [X]
HKCU\...\Run: [ISUSPM] - C:\ProgramData\Macrovision\FLEXnet Connect\11\ISUSPM.exe [210208 2008-09-26] (Acresso Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Java\jre6\bin\jusched.exe [148888 2009-09-24] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [DellSupportCenter] - C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe [206064 2009-05-21] (SupportSoft, Inc.)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] -  [x]
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-05-31] (Apple Inc.)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://msn.com/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {BF473298-829C-4DA0-B488-78A28140B6FD} URL =
BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\coIEPlg.dll (Symantec Corporation)
BHO-x32: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab
DPF: HKLM-x32 {B69F2A9C-E470-11D3-AFA3-525400DB7692} http://ibhost.dancik.com/download/actimage40930.cab
Handler: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} -  No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler-x32: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files (x86)\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler-x32: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\coIEPlg.dll (Symantec Corporation)
Winsock: Catalog5 01 %SystemRoot%\System32\mswsock.dll [232448] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5-x64 01 %SystemRoot%\System32\mswsock.dll [326144] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Tcpip\Parameters: [DhcpNameServer] 192.168.1.251 192.168.1.247

==================== Services (Whitelisted) =================

R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-06-20] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366600 2013-06-20] (Microsoft Corporation)
S2 Norton Internet Security; C:\Program Files (x86)\Norton Internet Security\Engine\16.8.3.6\ccSvcHst.exe [117648 2011-09-21] (Symantec Corporation)
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\STacSV64.exe [240128 2009-06-28] (IDT, Inc.)
R2 wltrysvc; C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE [33280 2009-07-16] ()

==================== Drivers (Whitelisted) ====================

R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [45856 2013-06-28] (AVG Technologies)
R1 BHDrvx64; C:\Windows\System32\Drivers\NISx64\1008030.006\BHDrvx64.sys [334384 2009-08-22] (Symantec Corporation)
R1 ccHP; C:\Windows\System32\Drivers\NISx64\1008030.006\ccHPx64.sys [561800 2011-10-11] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [475696 2010-01-04] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [475696 2010-01-04] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20100128.002\IDSvia64.sys [466992 2009-10-28] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20100128.002\IDSvia64.sys [466992 2009-10-28] (Symantec Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [247216 2013-06-18] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [139616 2013-06-18] (Microsoft Corporation)
S3 SRTSP; C:\Windows\System32\Drivers\NISx64\1008030.006\SRTSP64.SYS [476720 2009-08-22] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1008030.006\SRTSPX64.SYS [32304 2009-08-22] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1008030.006\SYMEFA64.SYS [402992 2009-08-22] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [172592 2010-01-04] (Symantec Corporation)
R3 SYMFW; C:\Windows\System32\Drivers\NISx64\1008030.006\SYMFW.SYS [120952 2011-09-21] (Symantec Corporation)
R1 SymIM; C:\Windows\System32\DRIVERS\SymIMv.sys [31280 2009-08-22] (Symantec Corporation)
R3 SYMNDISV; C:\Windows\System32\Drivers\NISx64\1008030.006\SYMNDISV.SYS [56952 2011-09-21] (Symantec Corporation)
R1 SYMTDI; C:\Windows\System32\Drivers\NISx64\1008030.006\SYMTDI.SYS [279160 2011-09-21] (Symantec Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100203.022\ENG64.SYS [x]
S3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100203.022\EX64.SYS [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-08-09 08:23 - 2013-08-09 08:23 - 00000000 ____D C:\FRST
2013-08-09 08:22 - 2013-08-09 08:22 - 01790169 _____ (Farbar) C:\Users\Mike\Desktop\FRST64.exe
2013-08-08 16:29 - 2013-08-08 16:29 - 00016962 _____ C:\Users\Mike\Desktop\dds.txt
2013-08-08 16:29 - 2013-08-08 16:29 - 00007210 _____ C:\Users\Mike\Desktop\attach.txt
2013-08-08 16:26 - 2013-08-08 16:26 - 00688992 ____R (Swearware) C:\Users\Mike\Desktop\dds.com
2013-08-08 12:03 - 2013-08-08 12:03 - 00001467 _____ C:\Users\Mike\Desktop\RKreport[0]_S_08082013_120327.txt
2013-08-08 11:58 - 2013-08-08 11:58 - 00002324 _____ C:\Users\Mike\Desktop\RKreport[0]_D_08082013_115844.txt
2013-08-08 11:55 - 2013-08-08 11:55 - 00002199 _____ C:\Users\Mike\Desktop\RKreport[0]_S_08082013_115550.txt
2013-08-08 11:54 - 2013-08-08 12:04 - 00000000 ____D C:\Users\Mike\Desktop\RK_Quarantine
2013-08-08 11:29 - 2013-08-08 11:51 - 00000000 ____D C:\ProgramData\HitmanPro
2013-08-08 11:29 - 2013-08-08 11:29 - 00920576 _____ C:\Users\Mike\Desktop\RogueKiller.exe
2013-08-08 11:28 - 2013-08-08 11:28 - 02240864 _____ (Kaspersky Lab ZAO) C:\Users\Mike\Desktop\tdsskiller.exe
2013-08-08 11:27 - 2013-08-08 11:30 - 09853928 _____ (SurfRight B.V.) C:\Users\Mike\Desktop\HitmanPro_x64.exe
2013-08-08 11:01 - 2013-08-08 11:01 - 00020364 _____ C:\ComboFix.txt
2013-08-08 10:31 - 2013-08-08 10:31 - 05100713 ____R (Swearware) C:\Users\Mike\Desktop\ComboFix.exe
2013-08-08 10:16 - 2013-08-08 10:16 - 00000911 _____ C:\Users\Mike\Desktop\JRT.txt
2013-08-08 10:10 - 2013-08-08 10:10 - 00000000 ____D C:\Windows\ERUNT
2013-08-08 09:41 - 2013-08-08 10:01 - 00002157 _____ C:\AdwCleaner[S1].txt
2013-08-08 09:36 - 2013-08-08 09:36 - 00957230 _____ (Oleg N. Scherbakov) C:\Users\Mike\Desktop\JRT.exe
2013-08-08 09:35 - 2013-08-08 09:35 - 00666633 _____ C:\Users\Mike\Desktop\AdwCleaner.exe
2013-08-08 09:32 - 2013-08-08 16:20 - 00009678 _____ C:\Users\Mike\Desktop\Rkill.txt
2013-08-08 09:31 - 2013-08-08 09:31 - 01893504 _____ (Bleeping Computer, LLC) C:\Users\Mike\Desktop\rkill.com
2013-08-06 15:56 - 2013-08-06 15:58 - 00000000 ____D C:\Windows\system32\MRT
2013-08-06 10:11 - 2013-08-06 10:11 - 00000000 ____D C:\Program Files (x86)\ESET
2013-08-06 10:06 - 2013-08-08 11:03 - 00006544 _____ C:\Windows\PFRO.log
2013-08-06 10:05 - 2013-08-06 10:05 - 00697480 _____ C:\Users\Mike\Desktop\ESETSirefefCleaner.exe_20130806.100542.2904.log
2013-08-06 10:04 - 2009-07-13 20:39 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\Services.exe
2013-08-06 10:03 - 2013-08-06 10:04 - 00184941 _____ C:\Users\Mike\Desktop\ESETSirefefCleaner.exe_20130806.100337.3864.zip
2013-08-06 10:03 - 2013-08-06 10:04 - 00007270 _____ C:\Users\Mike\Desktop\ESETSirefefCleaner.exe_20130806.100337.3864.log
2013-08-06 10:03 - 2013-08-06 10:03 - 00343248 _____ (ESET) C:\Users\Mike\Desktop\ESETSirefefCleaner.exe
2013-08-06 09:50 - 2013-08-08 16:02 - 00000560 _____ C:\Windows\setupact.log
2013-08-06 09:50 - 2013-08-06 09:50 - 00000000 _____ C:\Windows\setuperr.log
2013-08-06 09:43 - 2013-08-06 09:43 - 00000824 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-08-06 09:07 - 2013-08-06 09:07 - 00001785 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-08-06 09:07 - 2012-08-21 13:01 - 00033240 _____ (GEAR Software Inc.) C:\Windows\system32\Drivers\GEARAspiWDM.sys
2013-08-06 09:06 - 2013-08-06 09:06 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-08-06 09:06 - 2013-08-06 09:06 - 00000000 ____D C:\Program Files\iTunes
2013-08-06 09:06 - 2013-08-06 09:06 - 00000000 ____D C:\Program Files\iPod
2013-08-06 09:06 - 2013-08-06 09:06 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-08-06 09:03 - 2013-08-06 09:03 - 00001847 _____ C:\Users\Public\Desktop\QuickTime Player.lnk
2013-08-06 09:03 - 2013-08-06 09:03 - 00000000 ____D C:\Program Files (x86)\QuickTime
2013-07-28 21:16 - 2013-08-06 08:51 - 00000000 ____D C:\ProgramData\9A3FE798B4A88B2300009A3F4D5D8F4B
2013-07-28 21:15 - 2013-07-28 21:15 - 00000000 ____D C:\Users\Mike\AppData\Local\Google
2013-07-10 21:37 - 2013-07-10 21:37 - 00000000 ____D C:\Users\Mike\AppData\Roaming\Auslogics
2013-07-10 21:37 - 2013-07-10 21:37 - 00000000 ____D C:\Program Files (x86)\Auslogics
2013-07-10 21:29 - 2013-08-08 14:59 - 00001945 _____ C:\Windows\epplauncher.mif
2013-07-10 21:28 - 2013-08-08 14:56 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-07-10 21:28 - 2013-08-08 14:56 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2013-07-10 21:21 - 2013-07-10 21:21 - 00000000 ____D C:\ProgramData\Dumps
2013-07-10 21:20 - 2013-07-10 21:20 - 00000000 ____D C:\Windows\pss
2013-07-10 21:13 - 2013-07-10 21:13 - 00000000 ____D C:\Users\Mike\AppData\Roaming\QuickScan
2013-07-10 21:12 - 2013-07-10 21:21 - 00000000 ____D C:\Program Files\Bitdefender
2013-07-10 21:11 - 2013-07-10 21:12 - 08691304 _____ C:\Users\Mike\Downloads\Antivirus_Free_Edition_x64.exe
2013-07-10 21:11 - 2013-07-10 21:11 - 00162208 _____ C:\Users\Mike\Downloads\Antivirus_Free_Edition.exe
2013-07-10 21:10 - 2013-07-10 21:10 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-10 21:09 - 2013-07-10 21:09 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-10 17:43 - 2013-07-10 17:43 - 00000328 _____ C:\Users\Mike\Documents\backup.reg
2013-07-10 16:33 - 2011-06-26 01:45 - 00256000 _____ C:\Windows\PEV.exe
2013-07-10 16:33 - 2010-11-07 12:20 - 00208896 _____ C:\Windows\MBR.exe
2013-07-10 16:33 - 2009-04-19 23:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-07-10 16:33 - 2000-08-30 19:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-07-10 16:33 - 2000-08-30 19:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-07-10 16:33 - 2000-08-30 19:00 - 00098816 _____ C:\Windows\sed.exe
2013-07-10 16:33 - 2000-08-30 19:00 - 00080412 _____ C:\Windows\grep.exe
2013-07-10 16:33 - 2000-08-30 19:00 - 00068096 _____ C:\Windows\zip.exe
2013-07-10 16:29 - 2013-08-06 09:43 - 00000000 ____D C:\Program Files\CCleaner
2013-07-10 16:29 - 2013-07-10 16:29 - 00002770 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-07-10 15:47 - 2013-06-11 18:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-10 15:47 - 2013-06-11 18:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-10 15:47 - 2013-06-11 18:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-10 15:47 - 2013-06-11 18:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-10 15:47 - 2013-06-11 18:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-10 15:47 - 2013-06-11 18:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-10 15:47 - 2013-06-11 18:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-10 15:47 - 2013-06-11 18:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-10 15:47 - 2013-06-11 18:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-10 15:47 - 2013-06-11 18:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-10 15:47 - 2013-06-11 18:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-10 15:47 - 2013-06-11 18:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-10 15:47 - 2013-06-11 18:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-10 15:47 - 2013-06-11 18:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-10 15:47 - 2013-06-11 18:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-10 15:47 - 2013-06-11 18:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-10 15:47 - 2013-06-11 18:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-10 15:47 - 2013-06-11 18:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-10 15:47 - 2013-06-11 18:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-10 15:47 - 2013-06-11 18:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-10 15:47 - 2013-06-11 18:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-10 15:47 - 2013-06-11 18:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-10 15:47 - 2013-06-11 18:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-10 15:47 - 2013-06-11 18:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-10 15:47 - 2013-06-11 18:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-10 15:47 - 2013-06-11 18:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-10 15:47 - 2013-06-11 18:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-10 15:47 - 2013-06-11 17:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-10 15:47 - 2013-06-11 17:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-10 15:47 - 2013-06-06 22:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-10 15:47 - 2013-06-06 21:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-10 15:37 - 2013-06-04 22:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-10 15:37 - 2013-06-04 01:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-10 15:37 - 2013-06-03 23:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-10 15:37 - 2013-05-06 01:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-10 15:37 - 2013-05-05 23:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-10 15:35 - 2013-04-09 18:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-10 15:35 - 2013-04-02 17:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-10 15:05 - 2013-07-10 15:05 - 00000000 ____D C:\TDSSKiller_Quarantine
2013-07-10 14:48 - 2013-07-10 16:52 - 00000000 ____D C:\Windows\ERDNT
2013-07-10 14:47 - 2013-08-08 11:01 - 00000000 ____D C:\Qoobox
2013-07-10 11:25 - 2013-07-10 11:25 - 00000000 ____D C:\Users\Mike\AppData\Roaming\AVG2012
2013-07-10 10:12 - 2013-07-10 10:12 - 00000000 ____D C:\Users\Mike\AppData\Roaming\Malwarebytes
2013-07-10 10:12 - 2013-07-10 10:12 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-10 10:12 - 2013-07-10 10:12 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-10 10:12 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-07-10 10:10 - 2013-07-10 21:24 - 00000000 ____D C:\Program Files (x86)\VS Revo Group
2013-07-10 10:10 - 2013-07-10 10:10 - 00000000 ____D C:\Users\Mike\AppData\Roaming\Mozilla
2013-07-10 10:10 - 2013-02-05 02:25 - 00829264 _____ (Microsoft Corporation) C:\Windows\system32\msvcr100.dll
2013-07-10 10:10 - 2013-02-05 02:25 - 00608080 _____ (Microsoft Corporation) C:\Windows\system32\msvcp100.dll

==================== One Month Modified Files and Folders =======

2013-08-09 08:23 - 2013-08-09 08:23 - 00000000 ____D C:\FRST
2013-08-09 08:22 - 2013-08-09 08:22 - 01790169 _____ (Farbar) C:\Users\Mike\Desktop\FRST64.exe
2013-08-09 08:22 - 2012-05-19 19:51 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-09 01:16 - 2009-07-14 00:10 - 01834461 _____ C:\Windows\WindowsUpdate.log
2013-08-08 16:29 - 2013-08-08 16:29 - 00016962 _____ C:\Users\Mike\Desktop\dds.txt
2013-08-08 16:29 - 2013-08-08 16:29 - 00007210 _____ C:\Users\Mike\Desktop\attach.txt
2013-08-08 16:26 - 2013-08-08 16:26 - 00688992 ____R (Swearware) C:\Users\Mike\Desktop\dds.com
2013-08-08 16:20 - 2013-08-08 09:32 - 00009678 _____ C:\Users\Mike\Desktop\Rkill.txt
2013-08-08 16:15 - 2009-07-13 23:45 - 00014240 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-08 16:15 - 2009-07-13 23:45 - 00014240 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-08 16:02 - 2013-08-06 09:50 - 00000560 _____ C:\Windows\setupact.log
2013-08-08 16:02 - 2009-07-14 00:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-08 14:59 - 2013-07-10 21:29 - 00001945 _____ C:\Windows\epplauncher.mif
2013-08-08 14:56 - 2013-07-10 21:28 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-08-08 14:56 - 2013-07-10 21:28 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2013-08-08 12:04 - 2013-08-08 11:54 - 00000000 ____D C:\Users\Mike\Desktop\RK_Quarantine
2013-08-08 12:03 - 2013-08-08 12:03 - 00001467 _____ C:\Users\Mike\Desktop\RKreport[0]_S_08082013_120327.txt
2013-08-08 11:58 - 2013-08-08 11:58 - 00002324 _____ C:\Users\Mike\Desktop\RKreport[0]_D_08082013_115844.txt
2013-08-08 11:55 - 2013-08-08 11:55 - 00002199 _____ C:\Users\Mike\Desktop\RKreport[0]_S_08082013_115550.txt
2013-08-08 11:51 - 2013-08-08 11:29 - 00000000 ____D C:\ProgramData\HitmanPro
2013-08-08 11:30 - 2013-08-08 11:27 - 09853928 _____ (SurfRight B.V.) C:\Users\Mike\Desktop\HitmanPro_x64.exe
2013-08-08 11:29 - 2013-08-08 11:29 - 00920576 _____ C:\Users\Mike\Desktop\RogueKiller.exe
2013-08-08 11:28 - 2013-08-08 11:28 - 02240864 _____ (Kaspersky Lab ZAO) C:\Users\Mike\Desktop\tdsskiller.exe
2013-08-08 11:03 - 2013-08-06 10:06 - 00006544 _____ C:\Windows\PFRO.log
2013-08-08 11:01 - 2013-08-08 11:01 - 00020364 _____ C:\ComboFix.txt
2013-08-08 11:01 - 2013-07-10 14:47 - 00000000 ____D C:\Qoobox
2013-08-08 10:59 - 2009-07-13 21:34 - 00000215 _____ C:\Windows\system.ini
2013-08-08 10:47 - 2009-07-13 22:20 - 00000000 __RHD C:\Users\Default
2013-08-08 10:31 - 2013-08-08 10:31 - 05100713 ____R (Swearware) C:\Users\Mike\Desktop\ComboFix.exe
2013-08-08 10:16 - 2013-08-08 10:16 - 00000911 _____ C:\Users\Mike\Desktop\JRT.txt
2013-08-08 10:10 - 2013-08-08 10:10 - 00000000 ____D C:\Windows\ERUNT
2013-08-08 10:01 - 2013-08-08 09:41 - 00002157 _____ C:\AdwCleaner[S1].txt
2013-08-08 09:36 - 2013-08-08 09:36 - 00957230 _____ (Oleg N. Scherbakov) C:\Users\Mike\Desktop\JRT.exe
2013-08-08 09:35 - 2013-08-08 09:35 - 00666633 _____ C:\Users\Mike\Desktop\AdwCleaner.exe
2013-08-08 09:31 - 2013-08-08 09:31 - 01893504 _____ (Bleeping Computer, LLC) C:\Users\Mike\Desktop\rkill.com
2013-08-06 15:58 - 2013-08-06 15:56 - 00000000 ____D C:\Windows\system32\MRT
2013-08-06 15:53 - 2009-07-14 00:13 - 00740814 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-06 10:11 - 2013-08-06 10:11 - 00000000 ____D C:\Program Files (x86)\ESET
2013-08-06 10:05 - 2013-08-06 10:05 - 00697480 _____ C:\Users\Mike\Desktop\ESETSirefefCleaner.exe_20130806.100542.2904.log
2013-08-06 10:04 - 2013-08-06 10:03 - 00184941 _____ C:\Users\Mike\Desktop\ESETSirefefCleaner.exe_20130806.100337.3864.zip
2013-08-06 10:04 - 2013-08-06 10:03 - 00007270 _____ C:\Users\Mike\Desktop\ESETSirefefCleaner.exe_20130806.100337.3864.log
2013-08-06 10:03 - 2013-08-06 10:03 - 00343248 _____ (ESET) C:\Users\Mike\Desktop\ESETSirefefCleaner.exe
2013-08-06 09:51 - 2012-05-19 19:51 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-06 09:51 - 2012-05-19 19:51 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-06 09:51 - 2012-05-19 19:51 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-06 09:51 - 2010-03-01 17:21 - 00000000 ____D C:\Users\Mike\AppData\Local\Adobe
2013-08-06 09:50 - 2013-08-06 09:50 - 00000000 _____ C:\Windows\setuperr.log
2013-08-06 09:43 - 2013-08-06 09:43 - 00000824 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-08-06 09:43 - 2013-07-10 16:29 - 00000000 ____D C:\Program Files\CCleaner
2013-08-06 09:07 - 2013-08-06 09:07 - 00001785 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-08-06 09:06 - 2013-08-06 09:06 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-08-06 09:06 - 2013-08-06 09:06 - 00000000 ____D C:\Program Files\iTunes
2013-08-06 09:06 - 2013-08-06 09:06 - 00000000 ____D C:\Program Files\iPod
2013-08-06 09:06 - 2013-08-06 09:06 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-08-06 09:03 - 2013-08-06 09:03 - 00001847 _____ C:\Users\Public\Desktop\QuickTime Player.lnk
2013-08-06 09:03 - 2013-08-06 09:03 - 00000000 ____D C:\Program Files (x86)\QuickTime
2013-08-06 08:51 - 2013-07-28 21:16 - 00000000 ____D C:\ProgramData\9A3FE798B4A88B2300009A3F4D5D8F4B
2013-07-28 21:15 - 2013-07-28 21:15 - 00000000 ____D C:\Users\Mike\AppData\Local\Google
2013-07-18 22:04 - 2010-06-22 05:41 - 00003238 _____ C:\Users\Mike\AppData\Roaming\wklnhst.dat
2013-07-16 14:16 - 2013-07-02 13:17 - 00000000 ____D C:\Users\Mike\AppData\Roaming\HpUpdate
2013-07-14 20:20 - 2009-07-14 00:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-07-14 18:46 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\system32\NDF
2013-07-10 21:37 - 2013-07-10 21:37 - 00000000 ____D C:\Users\Mike\AppData\Roaming\Auslogics
2013-07-10 21:37 - 2013-07-10 21:37 - 00000000 ____D C:\Program Files (x86)\Auslogics
2013-07-10 21:24 - 2013-07-10 10:10 - 00000000 ____D C:\Program Files (x86)\VS Revo Group
2013-07-10 21:21 - 2013-07-10 21:21 - 00000000 ____D C:\ProgramData\Dumps
2013-07-10 21:21 - 2013-07-10 21:12 - 00000000 ____D C:\Program Files\Bitdefender
2013-07-10 21:20 - 2013-07-10 21:20 - 00000000 ____D C:\Windows\pss
2013-07-10 21:20 - 2010-01-04 16:12 - 00000000 ___RD C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-07-10 21:13 - 2013-07-10 21:13 - 00000000 ____D C:\Users\Mike\AppData\Roaming\QuickScan
2013-07-10 21:12 - 2013-07-10 21:11 - 08691304 _____ C:\Users\Mike\Downloads\Antivirus_Free_Edition_x64.exe
2013-07-10 21:11 - 2013-07-10 21:11 - 00162208 _____ C:\Users\Mike\Downloads\Antivirus_Free_Edition.exe
2013-07-10 21:10 - 2013-07-10 21:10 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-10 21:09 - 2013-07-10 21:09 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-10 17:43 - 2013-07-10 17:43 - 00000328 _____ C:\Users\Mike\Documents\backup.reg
2013-07-10 16:52 - 2013-07-10 14:48 - 00000000 ____D C:\Windows\ERDNT
2013-07-10 16:30 - 2011-05-08 16:26 - 00000000 ____D C:\Users\Mike\Tracing
2013-07-10 16:30 - 2010-04-09 13:18 - 00000000 ____D C:\Windows\Minidump
2013-07-10 16:30 - 2009-09-24 11:35 - 00000000 ____D C:\Windows\Panther
2013-07-10 16:29 - 2013-07-10 16:29 - 00002770 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-07-10 16:03 - 2009-07-14 00:08 - 00032650 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-07-10 15:57 - 2013-03-13 03:02 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-10 15:57 - 2013-03-13 03:02 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-10 15:57 - 2009-07-13 23:45 - 00319776 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-10 15:56 - 2009-07-14 02:45 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-10 15:05 - 2013-07-10 15:05 - 00000000 ____D C:\TDSSKiller_Quarantine
2013-07-10 11:25 - 2013-07-10 11:25 - 00000000 ____D C:\Users\Mike\AppData\Roaming\AVG2012
2013-07-10 11:20 - 2013-07-09 18:04 - 00021171 _____ C:\Windows\SysWOW64\commonpriv.log
2013-07-10 10:19 - 2009-09-24 09:09 - 00000000 ____D C:\Program Files (x86)\Norton Internet Security
2013-07-10 10:12 - 2013-07-10 10:12 - 00000000 ____D C:\Users\Mike\AppData\Roaming\Malwarebytes
2013-07-10 10:12 - 2013-07-10 10:12 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-10 10:12 - 2013-07-10 10:12 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-10 10:10 - 2013-07-10 10:10 - 00000000 ____D C:\Users\Mike\AppData\Roaming\Mozilla

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

LastRegBack: 2013-08-06 09:22

==================== End Of Log ============================

 


 



#4 B-boy/StyLe/

B-boy/StyLe/

    Bleepin' Freestyler


  • Malware Response Team
  • 8,307 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria
  • Local time:12:09 AM

Posted 09 August 2013 - 08:39 AM

Hi,

 

 

Next please download and save it to the Desktop.
NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

 

Reboot and post a new log from Rkill.

 

 

 

Regards,

Georgi

 


cXfZ4wS.png


#5 codacious

codacious
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:04:09 PM

Posted 09 August 2013 - 09:16 AM

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 08-08-2013 02
Ran by Mike at 2013-08-09 08:54:48 Run:1
Running from C:\Users\Mike\Desktop
Boot Mode: Normal
==============================================

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\\\GoToAssist => Value not found.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => Value deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BF473298-829C-4DA0-B488-78A28140B6FD} => Key deleted successfully.
HKCR\CLSID\{BF473298-829C-4DA0-B488-78A28140B6FD} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB} => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} => Value deleted successfully.
HKCR\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068} => Key not found.
HKCR\PROTOCOLS\Handler\symres => Key deleted successfully.
HKCR\CLSID\{AA1061FE-6C41-421f-9344-69640C9732AB} => Key not found.
Winsock: Catalog5 entry 000000000001\\LibraryPath  was set successfully to %SystemRoot%\system32\NLAapi.dll
Winsock: Catalog5-x64 entry 000000000001\\LibraryPath  was set successfully to %SystemRoot%\system32\NLAapi.dll
catchme => Service deleted successfully.
C:\ProgramData\9A3FE798B4A88B2300009A3F4D5D8F4B => Moved successfully.

==== End of Fixlog ====

 

Rkill 2.6.0 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2013 BleepingComputer.com
More Information about Rkill can be found at this link:
 http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 08/09/2013 08:56:35 AM in x64 mode.
Windows Version: Windows 7 Home Premium Service Pack 1

Checking for Windows services to stop:

 * No malware services found to stop.

Checking for processes to terminate:

 * No malware processes found to kill.

Checking Registry for malware related settings:

 * No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

 * ALERT: ZEROACCESS Reparse Point/Junction found!

     * C:\Windows\winsxs\amd64_security-malware-windows-defender-events_31bf3856ad364e35_6.1.7600.16385_none_118cf1dcd54a3dea\MpEvMsg.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MpAsDesc.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MpClient.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MpCmdRun.exe => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MpCommu.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MpOAV.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MpRTP.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MpSvc.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MSASCui.exe => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MsMpLics.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MsMpRes.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MpAsDesc.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MpClient.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MpCmdRun.exe => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MpCommu.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MpOAV.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MpRTP.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MpSvc.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MSASCui.exe => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MsMpCom.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MsMpLics.dll => c:\windows\system32\config [File]
     * C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MsMpRes.dll => c:\windows\system32\config [File]

 * No issues found.

Checking Windows Service Integrity:

 * No issues found.

Searching for Missing Digital Signatures:

 * No issues found.

Checking HOSTS File:

 * HOSTS file entries found:

  127.0.0.1       localhost

Program finished at: 08/09/2013 09:14:29 AM
Execution time: 0 hours(s), 17 minute(s), and 54 seconds(s)



#6 B-boy/StyLe/

B-boy/StyLe/

    Bleepin' Freestyler


  • Malware Response Team
  • 8,307 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria
  • Local time:12:09 AM

Posted 09 August 2013 - 09:54 AM

Hmm that strange - usually when junction points are removed from %programfiles%\Windows Defender folder Windows update the changes to winsxs folder automatically.

 

Ok, I will remove them manually:

 

Next please download and save it to the Desktop.
NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

 

Reboot and post a new log from Rkill.

 

 

Regards,

Georgi


Edited by B-boy/StyLe/, 09 August 2013 - 09:54 AM.

cXfZ4wS.png


#7 codacious

codacious
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:04:09 PM

Posted 09 August 2013 - 10:18 AM

rKill doesn't appear to have found anything!

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 08-08-2013 02
Ran by Mike at 2013-08-09 09:57:13 Run:2
Running from C:\Users\Mike\Desktop
Boot Mode: Normal
==============================================

=========  fsutil reparsepoint delete "C:\Windows\winsxs\amd64_security-malware-windows-defender-events_31bf3856ad364e35_6.1.7600.16385_none_118cf1dcd54a3dea\MpEvMsg.dll" =========

========= End of CMD: =========

=========  fsutil reparsepoint delete "C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MpAsDesc.dll" =========

========= End of CMD: =========

=========  fsutil reparsepoint delete "C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MpClient.dll" =========

========= End of CMD: =========

=========  fsutil reparsepoint delete "C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MpCmdRun.exe" =========

========= End of CMD: =========

=========  fsutil reparsepoint delete "C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MpCommu.dll" =========

========= End of CMD: =========

=========  fsutil reparsepoint delete "C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MpOAV.dll" =========

========= End of CMD: =========

=========  fsutil reparsepoint delete "C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MpRTP.dll" =========

========= End of CMD: =========

=========  fsutil reparsepoint delete "C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MpSvc.dll" =========

========= End of CMD: =========

=========  fsutil reparsepoint delete "C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MSASCui.exe" =========

========= End of CMD: =========

=========  fsutil reparsepoint delete "C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MsMpLics.dll" =========

========= End of CMD: =========

=========  fsutil reparsepoint delete "C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7600.16385_none_b3b1a27171e01f6c\MsMpRes.dll" =========

========= End of CMD: =========

=========  fsutil reparsepoint delete "C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MpAsDesc.dll" =========

Error:  The file or directory is not a reparse point.

========= End of CMD: =========

=========  fsutil reparsepoint delete "C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MpClient.dll" =========

Error:  The file or directory is not a reparse point.

========= End of CMD: =========

=========  fsutil reparsepoint delete "C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MpCmdRun.exe" =========

Error:  The file or directory is not a reparse point.

========= End of CMD: =========

=========  fsutil reparsepoint delete "C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MpCommu.dll" =========

Error:  The file or directory is not a reparse point.

========= End of CMD: =========

=========  fsutil reparsepoint delete "C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MpOAV.dll" =========

Error:  The file or directory is not a reparse point.

========= End of CMD: =========

=========  fsutil reparsepoint delete "C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MpRTP.dll" =========

Error:  The file or directory is not a reparse point.

========= End of CMD: =========

=========  fsutil reparsepoint delete "C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MpSvc.dll" =========

Error:  The file or directory is not a reparse point.

========= End of CMD: =========

=========  fsutil reparsepoint delete "C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MSASCui.exe" =========

Error:  The file or directory is not a reparse point.

========= End of CMD: =========

=========  fsutil reparsepoint delete "C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MsMpCom.dll" =========

========= End of CMD: =========

=========  fsutil reparsepoint delete "C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MsMpLics.dll" =========

Error:  The file or directory is not a reparse point.

========= End of CMD: =========

=========  fsutil reparsepoint delete "C:\Windows\winsxs\amd64_security-malware-windows-defender_31bf3856ad364e35_6.1.7601.17514_none_b5e2b6396ecea306\MsMpRes.dll" =========

Error:  The file or directory is not a reparse point.

========= End of CMD: =========

==== End of Fixlog ====

 

Rkill 2.6.0 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2013 BleepingComputer.com
More Information about Rkill can be found at this link:
 http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 08/09/2013 09:59:50 AM in x64 mode.
Windows Version: Windows 7 Home Premium Service Pack 1

Checking for Windows services to stop:

 * No malware services found to stop.

Checking for processes to terminate:

 * No malware processes found to kill.

Checking Registry for malware related settings:

 * No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

 * No issues found.

Checking Windows Service Integrity:

 * No issues found.

Searching for Missing Digital Signatures:

 * No issues found.

Checking HOSTS File:

 * HOSTS file entries found:

  127.0.0.1       localhost

Program finished at: 08/09/2013 10:17:39 AM
Execution time: 0 hours(s), 17 minute(s), and 49 seconds(s)

 

 



#8 B-boy/StyLe/

B-boy/StyLe/

    Bleepin' Freestyler


  • Malware Response Team
  • 8,307 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria
  • Local time:12:09 AM

Posted 09 August 2013 - 11:13 AM

Good,

 

 

 

STEP 1

 

 

 

I'd like us to scan your machine with ESET OnlineScan

 

  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the Run ESET Online Scanner button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on esetSmartInstall.png to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the esetSmartInstallDesktopIcon.png icon on your desktop.
  • Check esetAcceptTerms.png
  • Click the esetStart.png button.
  • Accept any security warnings from your browser.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is  checked.
  • Now click on Advanced Settings and select the following:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push esetListThreats.png
  • Push esetExport.png, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Push the esetBack.png button.
  • Push esetFinish.png

 

 

 

STEP 2



Download Security Check by screen317 from here.

  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

 

Regards,

Georgi


cXfZ4wS.png


#9 codacious

codacious
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:04:09 PM

Posted 09 August 2013 - 02:31 PM

Eset found one issue:

C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\hstart.exe a variant of Win32/HiddenStart.A application
 

Security Check: Results of screen317's Security Check version 0.99.72 
 Windows 7 Service Pack 1 x64 (UAC is enabled) 
 Internet Explorer 10 
``````````````Antivirus/Firewall Check:``````````````
 Windows Firewall Enabled! 
Microsoft Security Essentials  
  (On Access scanning disabled!)
 Error obtaining update status for antivirus! 
`````````Anti-malware/Other Utilities Check:`````````
 Malwarebytes Anti-Malware version 1.75.0.1300 
 Java™ 6 Update 14 
 Java version out of Date!
 Adobe Flash Player 11.7.700.224 
 Adobe Reader 9 Adobe Reader out of Date!
````````Process Check: objlist.exe by Laurent```````` 
 Microsoft Security Essentials MSMpEng.exe
 Microsoft Security Essentials msseces.exe
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 0%
````````````````````End of Log``````````````````````
 

 

 



#10 codacious

codacious
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:04:09 PM

Posted 09 August 2013 - 02:33 PM

I should add that I had turned off the real time scanning in Microsoft Security Essentials so that it did not interfere with combofix and the other malware tools that I was using. Forgot to turn it back on.
 



#11 B-boy/StyLe/

B-boy/StyLe/

    Bleepin' Freestyler


  • Malware Response Team
  • 8,307 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria
  • Local time:12:09 AM

Posted 09 August 2013 - 04:59 PM

Hi,

 

 

So far, so good. :)

 

 

UPDATING TASKS


Visit Microsoft's Windows Update Site Frequently


 

  • It is important that you visit Windows Update regularly.
  • This will ensure your computer has always the latest security updates available installed on your computer.
  • If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.


Note:
It is recommended to turn automatic updates on: Click here for more information.
 

 

Upgrading Java:


javaicon.gif Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application.

 

  • Download the latest version of Java SE 7.
  • Click the Java™ 7 Update 25 "Download JRE" button to the right.
  • Select your Platform, Register and check the box that says: "I agree to the Java SE Runtime Environment 7 License Agreement.".
  • Click on Continue.
  • Click on the link to download Windows Offline Installation (jre-7u25-windows-i586.exe) and save it to your desktop. Do NOT use the Sun Download Manager..
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel > Programs, click on Uninstall a program and remove all older versions of Java:

     Java™ 6 Update 14

     

  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on the download to install the newest version. (Vista/Windows 7 users, right click on the jre-7u25-windows-i586.exe and select "Run as an Administrator.")



Your Adobe Reader is out of date.
Older versions may have vulnerabilities that malware can use to infect your system.
Please download Adobe Reader 11.0.03 to your PC's desktop.
 

  • Uninstall Adobe Reader 9 via Start => Control Panel > Uninstall a program
  • Install the new downloaded updated software.


Note that the McAfee Security scan is prechecked. You may wish to uncheck it before downloading.
mcafee-ssp.jpg



Your adobe flash player is out of date. Older versions are vulnerable to attack and exploitation. Please go to the links below to update it:

Adobe Flash Player 11.8.800.94 Final for (Internet Explorer)

Adobe Flash Player 11.8.800.94 Final for (Firefox, Safari, Opera)

Note: Your browsers should be closed before proceeding with the installation process.

 

  • It is possible for other programs on your computer to have security vulnerability that can allow malware to infect you.
  • Therefore, it is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities.
  • You can check these by visiting Secunia Software Inspector or you can use the following application for this purpose PatchMyPC

 

and one final check before my final recommendations:

 

Please download Farbar Service Scanner and run it on the computer with the issue.

  • Make sure that all options are checked.
  • Press "Scan".
  • It will create a log (FSS.txt) in the same directory the tool is run.
  • Please copy and paste the log to your reply.

 

Regards,

Georgi


cXfZ4wS.png


#12 codacious

codacious
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:04:09 PM

Posted 09 August 2013 - 08:15 PM

Georgi,

Everything appears to be up to date now and the Secunia inspector didn't turn up with anything. Thank you so much for your help and your quick responses. You've been a life saver. I'll be waiting on any final recommendations you may have. Here is the log you requested.

-Cody

Farbar Service Scanner Version: 04-08-2013
Ran by Mike (administrator) on 09-08-2013 at 20:10:52
Running from "C:\Users\Mike\Desktop"
Microsoft Windows 7 Home Premium  Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.

Windows Firewall:
=============

Firewall Disabled Policy:
==================

System Restore:
============

System Restore Disabled Policy:
========================

Action Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================

Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.

Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1

Other Services:
==============

File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit

**** End of log ****

 

 



#13 B-boy/StyLe/

B-boy/StyLe/

    Bleepin' Freestyler


  • Malware Response Team
  • 8,307 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria
  • Local time:12:09 AM

Posted 10 August 2013 - 02:48 AM

Hi,



Nicely done ! This is the end of our journey if you don't have any more questions.
I have some final words for you.
All Clean !
Your machine appears to be clean, please take the time to read below on how to secure the machine and take the necessary steps to keep it Clean.



STEP 1 CLEANUP



To remove all of the tools we used and the files and folders they created, please do the following:

 
Download the following file and save it to the Desktop.
NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST/FRST64 and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

 

 

 

Since you used Combofix on your own please do this:

 

Click on Start => now type in ComboFix /Uninstall into the serach-box and click OK.
Note the space between the X and the /Uninstall, it needs to be there.

windows-7-start-menu.jpg

 

 

Please download OTC.exe by OldTimer and save it to your desktop.
 

  • Right-click the OTC.exe and choose Run as Administrator.
  • Click on CleanUp! button.
  • If you are prompted to Reboot during the cleanup, select Yes.
  • The tool will delete itself once it finishes.



  • Next please download Delfix.exe by Xplode and save it to your desktop.
  • Please start it and check the box next to "Remove disinfection tools" and click on the run button.
  • The tool will delete itself once it finishes.



Note: If any tool, file, log file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.

Feel free to uninstall Eset Online Scanner.



STEP 3 SECURITY ADVICES



Change all your passwords !


Since your computer was infected for peace of mind, I would however advise you that all your passwords be changed immediately !! (just in case).
Use different passwords for all your accounts. Also don't use easy passwords such as your favorite teams, bands or pets because this will allow people to guess your password.
You can use PC Tools Password Generator to create random passwords and then install an application like KeePass Password Safe to store them for easy access.If you do Online Banikng please read the article below:
Online Banking Protection Against Identity Theft



Keep your antivirus software turned on and up-to-date





  • Make sure your antivirus software is turned on and up-to-date.
  • New viruses come out every minute, so it is essential that you have the latest signatures for your antivirus program to provide you with the best possible protection from malicious software.
    Note:
  • You should only have one antivirus installed at a time. Having more than one antivirus program installed at once is likely to cause conflicts and may well decrease your overall protection as well as impairing the performance of your PC.
  • You should scan your computer with an AntiSpyware program like Malwarebytes' Anti-Malware on a regular basis just as you would an antivirus software.
  • Be sure to check for and download any definition updates prior to performing a scan.



Install HIPS based software


HIPS based software controls what an application is allowed to do and not allowed to do.
It monitors what each application tries to do, how it use the internet and give you the ability to block any suspicious activity occurring on your computer.
In my opinion the best way to prevent an unknown malware from gaining access is to use some HIPS programs (like COMODO, PrivateFirewall, Online Armor etc.) to control the access rights of legitimate applications, although this would only be advisable for experienced users...
However, you should be aware though that (if you install Comodo Firewall and not the whole package Comodo Internet Security) this is not an replacement for a standard antivirus application. It's a great tool to add another layer of protection to your existent antivirus application. It takes some time and knowledge to configure it for individual purposes but once done, you should not have a problems with it.
There are so many reviews on YouTube and blogs about all these programs.
Keep in mind to choose carefully in order to avoid conflicts or instability caused by incompatible security programs.
Also having more than one "real-time" program can be a drain on your PC's efficiency...
 
If you like Comodo you should choose for yourself which version of Comodo you will use 5 or 6. Personally I stick to version 5!
COMODO V5 & V6 Users Count Poll
 

Practice Safe Internet


One of the main reasons people get infected in the first place is that they are not practicing Safe Internet. You practice Safe Internet when you educate yourself on how to properly use the Internet through the use of security tools and good practice. Knowing how you can get infected and what types of files and sites to avoid will be the most crucial step in keeping your computer malware free. The reality is that the majority of people who are infected with malware are ones who click on things they shouldn't be clicking on. Whether these things are files or sites it doesn't really matter. If something is out to get you, and you click on it, it most likely will.  Below are a list of simple precautions to take to keep your computer clean and running securely:

 


  • If you receive an attachment from someone you do not know, DO NOT OPEN IT! Simple as that.  Opening attachments from people you do not know is a very common method for viruses or worms to infect your computer.
  • .exe, .com, .bat, .pif, .scr, .vb, .vbe, .vbs, .ws, .wsf, .shs, .hta, .jar, .js or .jse do not open the attachment unless you know for a fact that it is clean.  For the casual computer user, you will almost never receive a valid attachment of this type.
  • If you receive an attachment from someone you know, and it looks suspicious, then it probably is.  The email could be from someone you know infected with a malware that is trying to infect everyone in their address book.
  • If you are browsing the Internet and a popup appears saying that you are infected, ignore it!. These are, as far as I am concerned, scams that are being used to scare you into purchasing a piece of software. For an example of these types of popups, or Foistware, you should read this article:
    Foistware, And how to avoid it. There are also programs that disguise themselves as Anti-Spyware or security products but are instead scams.  For a list of these types of programs we recommend you visit this link: About Malwares, Rogues, Scarewares, SmitfraudFix
  • Another tactic to fool you on the web is when a site displays a popup that looks like a normal Windows message  or alert. When you click on them, though, they instead bring you to another site that is trying to push a product on you.  We suggest that you close these windows by clicking on the X instead of the OK button. Alternatively, you can check to see if it's a real alert by right-clicking on the window.  If there is a menu that comes up saying Add to Favorites... you know it's a fake.
  • Do not go to adult sites. I know this may bother some of you, but the fact is that a large amount of malware is pushed through these types of sites. I am not saying all adult sites do this, but a lot do.
  • When using an Instant Messaging program be cautious about clicking on links people send to you. It is not uncommon for infections to send a message to everyone in the infected person's contact list that contains a link to an infection. Instead when you receive a message that contains a link, message back to the person asking if it is legit before you click on it.
  • Stay away from Warez and Crack sites! In addition to the obvious copyright issues, the downloads from these sites are typically overrun with infections. Avoid using cracks and unknown programs from sources you don't trust. There are MANY alternative open-source applications. Malware writers just love cracks and keygens, and will often attach malicious code into them. By using cracks and/or keygens, you are asking for problems. So my advice is - stay away from them!
  • Be careful of what you download off of web sites and Peer-2-Peer networks. Some sites disguise malware as legitimate software to trick you into installing them and Peer-2-Peer networks are crawling with it. If you want to download a piece of software a from a site, and are not sure if they are legitimate, you can use McAfee Siteadvisor to look up info on the site. Note: skip this advice if your antivirus have a Web Guard.
  • DO NOT INSTALL any software without first reading the End User License Agreement, otherwise known as the EULA. A tactic that some developers use is to offer their software for free, but have spyware and other programs you do not want bundled with it. This is where they make their money. By reading the agreement there is a good chance you can spot this and not install the software.



Tweak your browsers
 
 
MOZILLA FIREFOX
 

To prevent further infections be sure to install the following add-ons NoScript and AdBlock Plus.
 
 

 

 

Adblock Plus hides all those annoying (and potentially dangerous) advertisements on websites that try and tempt you to buy or download something. AdBlock not only speeds up your browsing and makes it easier on your eyes, but also makes it safer.


Adblock Plus can be found here.



 

NoScript is only for advanced users as it blocks all the interactive parts of a webpage, such as login options. Obviously you wouldn’t want to block your ability to log on to your internet banking or your webmail, but thankfully you can tell NoScript to allow certain websites and block others. This is very useful to ensure that the website you’re visiting is not trying to tempt you to interact with another, more dangerous website.


NoScript can be found here
 

Google Chrome

 
If you like Google Chrome there are many similar extensions for this browser as well. Since I am not a Google Chrome user I can't tell you which of them are good and how they work. You should find out by yourself.

However Google Chrome can block a lot of unknown malware because of his sandbox.


For Internet Explorer 10 read the articles below:
 

Enhanced Protected Mode
Use Tracking Protection in Internet Explorer


Immunize your browsers with SpywareBlaster 5 and Spybot Search and Destroy 1.6

Also MBAM acquired the following software Malwarebytes Anti-Exploit and it should work with the most popular browsers. Beware the product is in beta stage.
 

Create an image of your system




  • Now when your pc is malware free it is a good idea to do a backup of all important files just in case something happens it.
  • Macrium Reflect is very good choice that enables you to create an image of your system drive which can be restored in case of problems.
  • The download link is here.
  • The tutorials can be found here.
  • Be sure to read the tutorial first.



Optimize Windows 7 for better performance


Check the articles below for more info:

Optimize Windows 7 for better performance
 

 

Follow this list and your potential for being infected again will reduce dramatically.

Safe Surfing! :)


Regards,
Georgi


Edited by B-boy/StyLe/, 10 August 2013 - 02:50 AM.

cXfZ4wS.png


#14 codacious

codacious
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:04:09 PM

Posted 10 August 2013 - 10:11 AM

Thank your sir!

You have been awesome! I will follow these instructions and hopefully we can avoid this in the future.

Thanks again.

 

-Cody



#15 B-boy/StyLe/

B-boy/StyLe/

    Bleepin' Freestyler


  • Malware Response Team
  • 8,307 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria
  • Local time:12:09 AM

Posted 10 August 2013 - 11:47 AM

Hi Cody,

 

 

You are more than welcome ! :)
I'll leave the topic open for a few days just in case.
Take care!

 

 

Regards,

Georgi


cXfZ4wS.png





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users