Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Trojan Horse, Virus:Win32/Alureon.gen!A and redirects


  • This topic is locked This topic is locked
33 replies to this topic

#1 kcnu

kcnu

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:06:35 PM

Posted 04 April 2014 - 04:29 PM

Hello,

Windows 7 computer that a family member uses was giving them problems with google redirects using Internet Explorer. At the time they decided to run a Windows 7 repair, but that did not correct
the problem. The repair and install removed some programs and documents including deleting their
Microsoft Office Key Code which they now can not find. A DDS, Malwarebytes, AdwCleaner and
Microsoft Malicious Software Removal Tool reports are below. The Microsoft Malicious Software
Removal Tool did not run automatically only right after the Malwarebytes ran. Please help.

 

Thank You

Malwarebytes found a (Trojen.Agent) in C:\WINDOWS\svhost.exe
 
Microsoft Malicious Software Removal Tool found Virus:Win32/Alureon.gen!A


AdwCleaner

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58F

Key Found : HKCU\Software\Microsoft\Internet

Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}
Key Found : [x64] HKCU\Software\Microsoft\Internet

Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}
Key Found : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Key Found : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL
Key Found : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}

 

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 9.0.8112.16506  BrowserJavaVersion: 10.40.2
Run by ADM at 16:11:00 on 2014-04-04
Microsoft Windows 7 Home Premium   6.1.7600.0.1252.1.1033.18.3034.1671 [GMT -5:00]
.
AV: Norton Internet Security *Disabled/Updated* {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}
SP: Norton Internet Security *Enabled/Updated* {631E4324-D31C-783F-EC5C-35AD42B18466}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Norton Internet Security *Enabled* {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\STacSV64.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\Dell\DellDock\DockLogin.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE
C:\Windows\system32\WLANExt.exe
C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwltry.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\AESTSr64.exe
C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\NIS.exe
C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE
C:\Program Files (x86)\Dell\DellComms\bin\sprtsvc.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
-netsvcs
C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\NIS.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\DellTPad\Apoint.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.EXE
C:\Program Files\IDT\WDM\sttray64.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Dell\DellDock\DellDock.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE
C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
C:\Program Files (x86)\Dell\DellComms\bin\sprtcmd.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
mWinlogon: Userinit = userinit.exe,
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - <orphaned>
BHO: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\CoIEPlg.dll
BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\IPS\IPSBHO.dll
BHO: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
TB: &Windows Live Toolbar: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\CoIEPlg.dll
TB: &Windows Live Toolbar: {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\CoIEPlg.dll
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun: [PDVDDXSrv] "C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
mRun: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2
mRun: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe"
mRun: [DellComms] "C:\Program Files (x86)\Dell\DellComms\bin\sprtcmd.exe" /P DellComms
mRun: [DellSupportCenter] "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRunOnce: [Malwarebytes Anti-Malware (cleanup)] rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript
StartupFolder: C:\Users\ADM\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\DELLDO~1.LNK - C:\Program Files\Dell\DellDock\DellDock.exe
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:0
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableLUA = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: PromptOnSecureDesktop = dword:0
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
TCP: NameServer = 75.75.75.75 75.75.76.76
TCP: Interfaces\{66847C62-D227-4F08-8D1E-A166D9A3150B} : DHCPNameServer = 75.75.75.75 75.75.76.76
TCP: Interfaces\{66847C62-D227-4F08-8D1E-A166D9A3150B}\E45445745414251323 : DHCPNameServer = 192.168.1.1
SSODL: WebCheck - <orphaned>
x64-BHO: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.2.0.38\CoIEPlg.dll
x64-BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
x64-TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.2.0.38\CoIEPlg.dll
x64-Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
x64-Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe
x64-Run: [Broadcom Wireless Manager UI] C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.exe
x64-Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe
x64-Run: [QuickSet] C:\Program Files\Dell\QuickSet\QuickSet.exe
x64-DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
x64-DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
x64-DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
x64-Notify: GoToAssist - C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
.
============= SERVICES / DRIVERS ===============
.
R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2009-10-31 55280]
R0 SymDS;Symantec Data Store;C:\Windows\System32\drivers\NISx64\1502000.026\SymDS64.sys [2014-4-3 493656]
R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\drivers\NISx64\1502000.026\SymEFA64.sys [2014-4-3 1148120]
R1 BHDrvx64;BHDrvx64;C:\Program Files (x86)\Norton Internet Security\NortonData\21.2.0.38\Definitions\BASHDefs\20140214.001\BHDrvx64.sys [2014-4-3 1526488]
R1 ccSet_NIS;NIS Settings Manager;C:\Windows\System32\drivers\NISx64\1502000.026\ccSetx64.sys [2014-4-3 162392]
R1 IDSVia64;IDSVia64;C:\Program Files (x86)\Norton Internet Security\NortonData\21.2.0.38\Definitions\IPSDefs\20140224.002\IDSviA64.sys [2014-4-3 524504]
R1 SymIRON;Symantec Iron Driver;C:\Windows\System32\drivers\NISx64\1502000.026\Ironx64.sys [2014-4-3 264280]
R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\System32\drivers\NISx64\1502000.026\symnets.sys [2014-4-3 593112]
R2 AESTFilters;Andrea ST Filters Service;C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\AESTSr64.exe [2009-10-31 89600]
R2 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe [2008-12-18 155648]
R2 NIS;Norton Internet Security;C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\NIS.exe [2014-4-3 276376]
R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2009-10-31 1692480]
R2 sprtsvc_DellComms;SupportSoft Sprocket Service (DellComms);C:\Program Files (x86)\Dell\DellComms\bin\sprtsvc.exe [2009-5-5 206064]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver;C:\Windows\System32\drivers\CtClsFlt.sys [2009-10-31 172704]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2014-4-3 137648]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2009-10-31 215040]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2009-10-31 215552]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2013-10-5 1255736]
.
=============== Created Last 30 ================
.
2014-04-04 15:56:06    --------    d-----w-    C:\AdwCleaner
2014-04-04 15:32:58    --------    d-----w-    C:\Users\ADM\AppData\Roaming\Malwarebytes
2014-04-04 15:32:50    --------    d-----w-    C:\ProgramData\Malwarebytes
2014-04-04 15:32:48    24176    ----a-w-    C:\Windows\System32\drivers\mbam.sys
2014-04-04 15:32:48    --------    d-----w-    C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-04-04 15:32:16    --------    d-----w-    C:\Users\ADM\AppData\Local\Programs
2014-04-04 03:14:22    875736    ----a-r-    C:\Windows\System32\drivers\NISx64\1502000.026\srtsp64.sys
2014-04-04 03:14:22    593112    ----a-r-    C:\Windows\System32\drivers\NISx64\1502000.026\symnets.sys
2014-04-04 03:14:22    493656    ----a-r-    C:\Windows\System32\drivers\NISx64\1502000.026\SymDS64.sys
2014-04-04 03:14:22    36952    ----a-r-    C:\Windows\System32\drivers\NISx64\1502000.026\srtspx64.sys
2014-04-04 03:14:22    264280    ----a-r-    C:\Windows\System32\drivers\NISx64\1502000.026\Ironx64.sys
2014-04-04 03:14:22    23568    ----a-r-    C:\Windows\System32\drivers\NISx64\1502000.026\SymELAM.sys
2014-04-04 03:14:22    162392    ----a-r-    C:\Windows\System32\drivers\NISx64\1502000.026\ccSetx64.sys
2014-04-04 03:14:22    1148120    ----a-r-    C:\Windows\System32\drivers\NISx64\1502000.026\SymEFA64.sys
2014-04-04 03:14:09    --------    d-----w-    C:\Windows\System32\drivers\NISx64\1502000.026
.
==================== Find3M  ====================
.
.
============= FINISH: 16:11:29.27 ===============

 

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 9/28/2013 6:02:43 PM
System Uptime: 4/4/2014 1:22:23 PM (3 hours ago)
.
Motherboard: Dell Inc. |  | 0K138P
Processor: Pentium® Dual-Core CPU       T4300  @ 2.10GHz | Microprocessor | 2100/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 218 GiB total, 180.085 GiB free.
D: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP12: 10/8/2013 8:41:09 PM - Windows Update
RP13: 4/4/2014 9:06:33 AM - Windows Update
.
==== Installed Programs ======================
.
Adobe Flash Player 10 ActiveX
Adobe Reader 9.1.2
Advanced Audio FX Engine
Cisco EAP-FAST Module
Cisco LEAP Module
Cisco PEAP Module
Compatibility Pack for the 2007 Office system
Dell Communications (Support Software)
Dell DataSafe Local Backup
Dell DataSafe Local Backup - Support Software
Dell Dock
Dell Edoc Viewer
Dell Getting Started Guide
Dell Support Center (Support Software)
Dell Touchpad
Dell Webcam Central
Dell Wireless WLAN Card Utility
GoToAssist 8.0.0.514
IDT Audio
Intel® Graphics Media Accelerator Driver
Java 7 Update 40
Java Auto Updater
Java™ 6 Update 14 (64-bit)
Junk Mail filter update
Live! Cam Avatar Creator
Malwarebytes Anti-Malware version 1.70.0.1100
Microsoft .NET Framework 4 Client Profile
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable (x64)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
Microsoft Works
MSVCRT
Norton Internet Security
PowerDVD DX
Quickset64
Roxio Burn
Roxio Update Manager
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Live Movie Maker
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Toolbar
Windows Live Upload Tool
Windows Live Writer
.
==== Event Viewer Messages From Past Week ========
.
4/4/2014 12:29:03 PM, Error: Service Control Manager [7011]  - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the SftService service.
4/3/2014 10:17:14 PM, Error: Service Control Manager [7034]  - The SoftThinks Agent Service service terminated unexpectedly.  It has done this 1 time(s).
.
==== End Of File ===========================


 



BC AdBot (Login to Remove)

 


m

#2 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:06:35 PM

Posted 05 April 2014 - 04:24 AM





Hello kcnu

I would like to welcome you to the Malware Removal section of the forum.

Around here they call me Gringo and I will be glad to help you with your malware problems.

Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!

  • Please do not run any tools unless instructed to do so.
    • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
  • Please do not attach logs or use code boxes, just copy and paste the text.
    • Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
  • Please read every post completely before doing anything.
    • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
  • Please provide feedback about your experience as we go.
    • A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.
NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

I would like you to run this program for me.

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#3 kcnu

kcnu
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:06:35 PM

Posted 05 April 2014 - 12:55 PM

Hello. Nice to meet you. Thank you for helping.

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by CARLA (administrator) on PC on 05-04-2014 13:37:30
Running from C:\Users\CARLA\Desktop
Windows 7 Home Premium (X64) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\STacSV64.exe
(Stardock Corporation) C:\Program Files\Dell\DellDock\DockLogin.exe
() C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Dell Inc.) C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwltry.exe
(Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\AESTSr64.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\NIS.exe
(Microsoft Corp.) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE
(SupportSoft, Inc.) C:\Program Files (x86)\Dell\DellComms\bin\sprtsvc.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\NIS.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE
() C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
(Intel Corporation) C:\WINDOWS\System32\igfxtray.exe
(Intel Corporation) C:\WINDOWS\System32\hkcmd.exe
(Intel Corporation) C:\WINDOWS\System32\igfxpers.exe
(Dell Inc.) C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.EXE
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Stardock Corporation) C:\Program Files\Dell\DellDock\DellDock.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe
(Creative Technology Ltd) C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
() C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe
(SupportSoft, Inc.) C:\Program Files (x86)\Dell\DellComms\bin\sprtcmd.exe
(SupportSoft, Inc.) C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\HidFind.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apntex.exe
() \\.\globalrootC:\Windows\svchost.exe
(SupportSoft, Inc.) C:\Program Files (x86)\Dell Support Center\bin\sprtsvc.exe
() C:\Program Files (x86)\Roxio\Roxio Burn\Roxio Burn.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Apoint] - C:\Program Files\DellTPad\Apoint.exe [309760 2009-03-10] (Alps Electric Co., Ltd.)
HKLM\...\Run: [Broadcom Wireless Manager UI] - C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.exe [4968960 2009-07-16] (Dell Inc.)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [444416 2009-06-28] (IDT, Inc.)
HKLM\...\Run: [QuickSet] - C:\Program Files\Dell\QuickSet\QuickSet.exe [3180624 2009-07-02] (Dell Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [35696 2009-02-27] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PDVDDXSrv] - C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe [140520 2009-06-24] (CyberLink Corp.)
HKLM-x32\...\Run: [Dell Webcam Central] - C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [409744 2009-06-24] (Creative Technology Ltd)
HKLM-x32\...\Run: [Desktop Disc Tool] - C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe [494064 2009-06-18] ()
HKLM-x32\...\Run: [DellComms] - C:\Program Files (x86)\Dell\DellComms\bin\sprtcmd.exe [206064 2009-05-05] (SupportSoft, Inc.)
HKLM-x32\...\Run: [DellSupportCenter] - C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe [206064 2009-05-21] (SupportSoft, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll [X]
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\.DEFAULT\...409d6c4515e9\InprocServer32: [Default-shell32] C:\Windows\TEMP\swbkicc\sfwsdhv\wow.dll ATTENTION! ====> ZeroAccess?
Startup: C:\Users\CARLA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk
ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {F9BD571C-0460-4B10-8D19-2DB3C72CDE2E} URL =
SearchScopes: HKCU - {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = http://nortonsafe.search.ask.com/web?q={SEARCHTERMS}&o=APN10506&l=dis&prt=NIS&chn=retail&geo=US&ver=21&locale=en_US&gct=sb&qsrc=2869
SearchScopes: HKCU - {F9BD571C-0460-4B10-8D19-2DB3C72CDE2E} URL =
BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.2.0.38\coIEPlg.dll (Symantec Corporation)
BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll (Microsoft Corp.)
BHO-x32: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.2.0.38\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKCU - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.2.0.38\coIEPlg.dll (Symantec Corporation)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76

==================== Services (Whitelisted) =================

R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\AESTSr64.exe [89600 2009-03-02] (Andrea Electronics Corporation)
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\21.2.0.38\NIS.exe [276376 2014-03-12] (Symantec Corporation)
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\STacSV64.exe [240128 2009-06-28] (IDT, Inc.)
R2 wltrysvc; C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwltry.exe [3417088 2009-07-16] (Dell Inc.)

==================== Drivers (Whitelisted) ====================

R1 BHDrvx64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.2.0.38\Definitions\BASHDefs\20140214.001\BHDrvx64.sys [1526488 2013-12-22] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1502000.026\ccSetx64.sys [162392 2014-02-24] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2014-04-03] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [137648 2014-04-03] (Symantec Corporation)
R1 IDSVia64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.2.0.38\Definitions\IPSDefs\20140224.002\IDSVia64.sys [524504 2014-02-20] (Symantec Corporation)
R3 NAVENG; C:\Program Files (x86)\Norton Internet Security\NortonData\21.2.0.38\Definitions\VirusDefs\20140403.018\ENG64.SYS [126040 2014-04-03] (Symantec Corporation)
R3 NAVEX15; C:\Program Files (x86)\Norton Internet Security\NortonData\21.2.0.38\Definitions\VirusDefs\20140403.018\EX64.SYS [2099288 2014-04-03] (Symantec Corporation)
R3 SRTSP; C:\Windows\System32\Drivers\NISx64\1502000.026\SRTSP64.SYS [875736 2014-02-12] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1502000.026\SRTSPX64.SYS [36952 2013-10-30] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1502000.026\SYMDS64.SYS [493656 2013-10-30] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1502000.026\SYMEFA64.SYS [1148120 2014-03-03] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2013-09-28] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1502000.026\Ironx64.SYS [264280 2013-10-30] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1502000.026\SYMNETS.SYS [593112 2014-02-17] (Symantec Corporation)
S3 SYMFW; \SystemRoot\system32\drivers\NISx64\1007000.01E\SYMFW.SYS [X]
S3 SYMNDISV; \SystemRoot\system32\drivers\NISx64\1007000.01E\SYMNDISV.SYS [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-05 13:33 - 2014-04-05 13:37 - 00012440 _____ () C:\Users\CARLA\Desktop\FRST.txt
2014-04-05 13:33 - 2014-04-05 13:33 - 00000000 ____D () C:\FRST
2014-04-05 13:32 - 2014-04-04 14:55 - 02157056 _____ (Farbar) C:\Users\CARLA\Desktop\FRST64.exe
2014-04-04 20:42 - 2014-04-05 08:26 - 00000000 ____D () C:\Users\CARLA\Tracing
2014-04-04 19:47 - 2014-04-04 20:32 - 00007627 _____ () C:\Users\CARLA\AppData\Local\resmon.resmoncfg
2014-04-04 16:11 - 2014-04-04 16:19 - 00012562 _____ () C:\Users\CARLA\Desktop\dds.txt
2014-04-04 16:11 - 2014-04-04 16:11 - 00003518 _____ () C:\Users\CARLA\Desktop\attach.txt
2014-04-04 12:25 - 2014-04-04 12:25 - 00000076 _____ () C:\Users\CARLA\Desktop\vII list.txt
2014-04-04 12:08 - 2014-04-04 12:08 - 00000076 _____ () C:\Users\CARLA\Desktop\v list.txt
2014-04-04 11:04 - 2014-04-04 11:04 - 00001023 _____ () C:\Users\CARLA\Desktop\AdwCleaner[S0].txt
2014-04-04 10:57 - 2014-04-04 10:57 - 00001067 _____ () C:\Users\CARLA\Desktop\AdwCleaner[R0].txt
2014-04-04 10:56 - 2014-04-04 20:27 - 00000000 ____D () C:\AdwCleaner
2014-04-04 10:32 - 2014-04-04 18:39 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-04-04 10:32 - 2014-04-04 10:32 - 00000000 ____D () C:\Users\CARLA\AppData\Roaming\Malwarebytes
2014-04-04 10:32 - 2014-04-04 10:32 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-03 22:19 - 2014-04-03 22:19 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Internet Security

==================== One Month Modified Files and Folders =======

2014-04-05 13:37 - 2014-04-05 13:33 - 00012440 _____ () C:\Users\CARLA\Desktop\FRST.txt
2014-04-05 13:33 - 2014-04-05 13:33 - 00000000 ____D () C:\FRST
2014-04-05 13:33 - 2009-07-14 00:10 - 01666000 _____ () C:\Windows\WindowsUpdate.log
2014-04-05 13:03 - 2009-07-13 23:45 - 00014240 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-05 13:03 - 2009-07-13 23:45 - 00014240 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-05 13:00 - 2009-10-31 09:32 - 00000000 ____D () C:\dell
2014-04-05 13:00 - 2009-07-14 00:13 - 00726316 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-05 12:08 - 2009-10-31 07:11 - 00000000 ____D () C:\Program Files (x86)\Dell DataSafe Local Backup
2014-04-05 12:07 - 2013-09-28 18:09 - 00000000 ____D () C:\Users\Default\AppData\Local\SoftThinks
2014-04-05 12:07 - 2013-09-28 18:09 - 00000000 ____D () C:\Users\Default User\AppData\Local\SoftThinks
2014-04-05 12:07 - 2013-09-28 18:09 - 00000000 ____D () C:\Users\CARLA\AppData\Local\SoftThinks
2014-04-05 12:07 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-05 12:07 - 2009-07-13 23:51 - 00037583 _____ () C:\Windows\setupact.log
2014-04-05 10:22 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-05 10:08 - 2013-09-28 18:02 - 00000000 ____D () C:\Users\CARLA
2014-04-05 09:33 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\registration
2014-04-05 09:31 - 2009-10-31 07:13 - 00000000 ____D () C:\ProgramData\Norton
2014-04-05 08:26 - 2014-04-04 20:42 - 00000000 ____D () C:\Users\CARLA\Tracing
2014-04-04 20:32 - 2014-04-04 19:47 - 00007627 _____ () C:\Users\CARLA\AppData\Local\resmon.resmoncfg
2014-04-04 20:27 - 2014-04-04 10:56 - 00000000 ____D () C:\AdwCleaner
2014-04-04 18:39 - 2014-04-04 10:32 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-04-04 18:39 - 2009-07-14 02:44 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-04-04 16:19 - 2014-04-04 16:11 - 00012562 _____ () C:\Users\CARLA\Desktop\dds.txt
2014-04-04 16:11 - 2014-04-04 16:11 - 00003518 _____ () C:\Users\CARLA\Desktop\attach.txt
2014-04-04 14:55 - 2014-04-05 13:32 - 02157056 _____ (Farbar) C:\Users\CARLA\Desktop\FRST64.exe
2014-04-04 12:25 - 2014-04-04 12:25 - 00000076 _____ () C:\Users\CARLA\Desktop\vII list.txt
2014-04-04 12:08 - 2014-04-04 12:08 - 00000076 _____ () C:\Users\CARLA\Desktop\v list.txt
2014-04-04 11:04 - 2014-04-04 11:04 - 00001023 _____ () C:\Users\CARLA\Desktop\AdwCleaner[S0].txt
2014-04-04 10:57 - 2014-04-04 10:57 - 00001067 _____ () C:\Users\CARLA\Desktop\AdwCleaner[R0].txt
2014-04-04 10:32 - 2014-04-04 10:32 - 00000000 ____D () C:\Users\CARLA\AppData\Roaming\Malwarebytes
2014-04-04 10:32 - 2014-04-04 10:32 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-04 10:31 - 2013-09-28 18:06 - 00000000 ____D () C:\Users\CARLA\AppData\Local\VirtualStore
2014-04-04 09:19 - 2013-10-08 20:41 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-03 22:47 - 2009-10-31 08:57 - 00016774 _____ () C:\Windows\PFRO.log
2014-04-03 22:19 - 2014-04-03 22:19 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Internet Security
2014-04-03 22:19 - 2013-09-28 20:40 - 00000000 ____D () C:\Users\CARLA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Norton
2014-04-03 22:16 - 2013-09-28 20:51 - 00003234 _____ () C:\Windows\System32\Tasks\Norton WSC Integration
2014-04-03 22:16 - 2009-10-31 07:13 - 00000000 ____D () C:\Windows\system32\Drivers\NISx64
2014-04-03 22:15 - 2013-09-28 20:49 - 00002503 _____ () C:\Users\Public\Desktop\Norton Internet Security.lnk
2014-04-03 22:10 - 2013-09-28 20:40 - 00001297 _____ () C:\Users\CARLA\Desktop\Norton Installation Files.lnk
2014-04-03 22:10 - 2013-09-28 20:40 - 00000000 ____D () C:\Users\Public\Downloads\Norton
C:\Windows\svchost.exe
ATTENTION ====> Check for partition/boot infection.

Some content of TEMP:
====================
C:\Users\CARLA\AppData\Local\Temp\2cjvnz2q.dll
C:\Users\CARLA\AppData\Local\Temp\jre-7u40-windows-i586-iftw.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

TDL4: custom:26000022 <===== ATTENTION!


LastRegBack: 2013-10-11 04:28

==================== End Of Log ============================

 

Attached File  Additional4-5-2014.txt   18KB   1 downloads


Edited by kcnu, 05 April 2014 - 01:16 PM.


#4 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:06:35 PM

Posted 05 April 2014 - 03:29 PM



Hello kcnu,

These are the programs I would like you to run next, if you have any problems with one of these just skip it and move on to the next one.

-AdwCleaner-

Please download AdwCleaner by Xplode onto your desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Scan.
  • After the scan is complete click on "Clean"
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next answer.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.
-Junkware-Removal-Tool-

Please download Junkware Removal Tool to your desktop.
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.
When they are complete let me have the two reports and let me know how things are running.

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#5 kcnu

kcnu
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:06:35 PM

Posted 05 April 2014 - 06:57 PM

Hello. Here are the logs. Thank you.

 

# AdwCleaner v3.023 - Report created 05/04/2014 at 19:16:37
# Updated 01/04/2014 by Xplode
# Operating System : Windows 7 Home Premium  (64 bits)
# Username : CARLA - CARLA-PC
# Running from : C:\Users\CARLA\Desktop\AdwCleaner3.0.2.3.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}

***** [ Browsers ] *****

-\\ Internet Explorer v9.0.8112.16506


*************************

AdwCleaner[R0].txt - [994 octets] - [05/04/2014 19:15:36]
AdwCleaner[S0].txt - [809 octets] - [05/04/2014 19:16:37]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [868 octets] ##########
 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.2 (02.20.2014:1)
OS: Windows 7 Home Premium x64
Ran by CARLA on Sat 04/05/2014 at 20:26:15.35
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files

Failed to delete [File] C:\Windows\svchost.exe  [Check for TDL4 Rootkit!]



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sat 04/05/2014 at 20:41:55.99
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 



#6 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:06:35 PM

Posted 05 April 2014 - 07:26 PM


Hello kcnu

I Would like you to do the following.

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"
  • In your next post I need the following
  • Log from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now?
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#7 kcnu

kcnu
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:06:35 PM

Posted 05 April 2014 - 10:30 PM

Hello.

I was following your directions to disable the antivirus program Norton Internet Security. The dashboard for this will not launch for me to disable any settings. At times it would display for a second or two and then be gone. I was going to uninstall the program to let ComboFix run. But then I got a Blue Screen error message. I pasted the details below. At present time, I did not run combofix and the norton is still not able to open. I asked the family member if they ever had a blue screen and they mentioned that it has happened on occasion but only when they are clicking on the IE web browser and the computer would shut down and restart. Sorry about the missed detail. Thank you. (Btw, if you would like the name of handy tool used to read the blue screen details, please let me know and I will find out. But I gather you would already have experience with this.)

Problem signature:
  Problem Event Name:    BlueScreen
  OS Version:    6.1.7600.2.0.0.768.3
  Locale ID:    1033

Additional information about the problem:
  BCCode:    1e
  BCP1:    FFFFFFFFC0000005
  BCP2:    FFFFFA80033C0B88
  BCP3:    0000000000000000
  BCP4:    000000007EFA8000
  OS Version:    6_1_7600
  Service Pack:    0_0
  Product:    768_1

Files that help describe the problem:
  C:\WINDOWS\Minidump\040514-26161-01.dmp
  C:\Users\CARLA\AppData\Local\Temp\WER-38376-0.sysdata.xml

Read our privacy statement online:
  http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409

If the online privacy statement is not available, please read our privacy statement offline:
  C:\Windows\system32\en-US\erofflps.txt


==================================================
Dump File         : 040514-26161-01.dmp
Crash Time        : 4/5/2014 10:55:29 PM
Bug Check String  : KMODE_EXCEPTION_NOT_HANDLED
Bug Check Code    : 0x0000001e
Parameter 1       : ffffffff`c0000005
Parameter 2       : fffffa80`033c0b88
Parameter 3       : 00000000`00000000
Parameter 4       : 00000000`7efa8000
Caused By Driver  : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+6f880
File Description  : NT Kernel & System
Product Name      : Microsoft® Windows® Operating System
Company           : Microsoft Corporation
File Version      : 6.1.7600.17273 (win7_gdr.130318-1532)
Processor         : x64
Crash Address     : ntoskrnl.exe+6f880
Stack Address 1   :
Stack Address 2   :
Stack Address 3   :
Computer Name     :
Full Path         : C:\Windows\Minidump\040514-26161-01.dmp
Processors Count  : 2
Major Version     : 15
Minor Version     : 7600
Dump File Size    : 277,168
Dump File Time    : 4/5/2014 10:56:23 PM
==================================================
 


Edited by kcnu, 05 April 2014 - 10:31 PM.


#8 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:06:35 PM

Posted 06 April 2014 - 05:36 AM


Hello kcnu,

Ok lets try this, I want you to run combofix in safe mode but it is very important that when combofix reboots the computer for you to direct it back into safe mode so it can finish the scan.

Boot into Safe Mode

Reboot your computer in Safe Mode.
  • If the computer is running, shut down Windows, and then turn off the power.
  • Wait 30 seconds, and then turn the computer on.
  • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
  • Ensure that the Safe Mode option is selected.
  • Press Enter. The computer then begins to start in Safe mode.
  • Login on your usual account.
after combofix has finished its scan please post the report back here.

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#9 kcnu

kcnu
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:06:35 PM

Posted 06 April 2014 - 10:47 AM

I logged into safemode and the Combofix began to run with erunt but with a message that combofix was out of date and click yes to run in restricted mode, click no to stop. I selected yes and the combofix deleted itself without running. This has also happens in regular mode. At this time the computer is offline, not connected to the internet.

 

UPDATE:

 

I re-downloaded a new copy of combofix for today and it worked through regular mode.

 

ComboFix 14-04-06.01 - CARLA 04/06/2014  12:50:35.1.2 - x64
Microsoft Windows 7 Home Premium   6.1.7600.0.1252.1.1033.18.3034.1952 [GMT -4:00]
Running from: c:\users\CARLA\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\svchost.exe
.
.
(((((((((((((((((((((((((   Files Created from 2014-03-06 to 2014-04-06  )))))))))))))))))))))))))))))))
.
.
2014-04-06 16:58 . 2014-04-06 16:58    --------    d-----w-    c:\users\Default\AppData\Local\temp
2014-04-06 00:37 . 2014-04-06 00:37    --------    d-----w-    c:\users\CARLA\AppData\Local\Apps
2014-04-06 00:16 . 2014-04-06 00:57    --------    d-----w-    c:\users\CARLA\AppData\Local\Microsoft Games
2014-04-05 18:33 . 2014-04-05 18:38    --------    d-----w-    C:\FRST
2014-04-05 15:21 . 2014-04-06 01:47    --------    d-----w-    c:\users\CARLA\AppData\Local\ElevatedDiagnostics
2014-04-05 01:42 . 2014-04-05 13:26    --------    d-----w-    c:\users\CARLA\Tracing
2014-04-04 15:56 . 2014-04-06 00:16    --------    d-----w-    C:\AdwCleaner
2014-04-04 15:32 . 2014-04-04 15:32    --------    d-----w-    c:\users\CARLA\AppData\Roaming\Malwarebytes
2014-04-04 15:32 . 2014-04-04 15:32    --------    d-----w-    c:\programdata\Malwarebytes
2014-04-04 15:32 . 2014-04-04 23:39    --------    d-----w-    c:\program files (x86)\Malwarebytes' Anti-Malware
2014-04-04 15:32 . 2014-04-04 15:32    --------    d-----w-    c:\users\CARLA\AppData\Local\Programs
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"PDVDDXSrv"="c:\program files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-06-25 140520]
"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2009-06-24 409744]
"Desktop Disc Tool"="c:\program files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [2009-06-19 494064]
"DellComms"="c:\program files (x86)\Dell\DellComms\bin\sprtcmd.exe" [2009-05-05 206064]
"DellSupportCenter"="c:\program files (x86)\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
.
c:\users\CARLA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-6-30 1316192]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe /firstrun [2009-6-30 1316192]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\AESTSr64.exe;c:\windows\SYSNATIVE\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\AESTSr64.exe [x]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe;c:\program files\Dell\DellDock\DockLogin.exe [x]
S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [x]
S2 sprtsvc_DellComms;SupportSoft Sprocket Service (DellComms);c:\program files (x86)\Dell\DellComms\bin\sprtsvc.exe;c:\program files (x86)\Dell\DellComms\bin\sprtsvc.exe [x]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys;c:\windows\SYSNATIVE\DRIVERS\CtClsFlt.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2009-03-10 309760]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-06-05 165912]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-06-05 385560]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-06-05 365080]
"Broadcom Wireless Manager UI"="c:\program files\Dell\Dell Wireless WLAN Card\WLTRAY.exe" [2009-07-17 4968960]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2009-06-29 444416]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 75.75.75.75 75.75.76.76
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Toolbar-Locked - (no file)
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10b.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10b.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}]
@Denied: (A 2) (Everyone)
@="IFlashBroker2"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2014-04-06  13:01:18
ComboFix-quarantined-files.txt  2014-04-06 17:01
.
Pre-Run: 190,625,374,208 bytes free
Post-Run: 190,144,032,768 bytes free
.
- - End Of File - - 836542BB68402CBBC306C94789D73F09
CDB4DE4BBD714F152979DA2DCBEF57EB
 


Edited by kcnu, 06 April 2014 - 12:11 PM.


#10 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:06:35 PM

Posted 07 April 2014 - 07:28 AM


Hello kcnu,

At this time I would like you to run this script for me and it is a good time to check out the computer to see if there is anything else that needs to be addressed.

:Run CFScript:

Please start by opening Notepad and copy/paste the text in the box into the window:

ClearJavaCache::


 
Save it to your desktop as CFScript.txt

Referring to the picture above, drag CFScript.txt into ComboFix.exe
CFScriptB-4.gif
This will let ComboFix run again.
Restart if you have to.
Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"
  • In your next post I need the following
    • report from Combofix
    • let me know of any problems you may have had
    • How is the computer doing now after running the script?
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#11 kcnu

kcnu
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:06:35 PM

Posted 07 April 2014 - 12:18 PM

hello gringo_pr. here is the log. no issues while scanning. Is there anyway to locate the files and key that were erased when my family member decided to try to correct the problem as posted in the 1st posting?

 

thank you.

 

ComboFix 14-04-06.01 - CARLA 04/07/2014  11:47:27.2.2 - x64
Microsoft Windows 7 Home Premium   6.1.7600.0.1252.1.1033.18.3034.1967 [GMT -4:00]
Running from: c:\users\CARLA\Desktop\ComboFix.exe
Command switches used :: c:\users\CARLA\Desktop\CFScript.txt.txt
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\svchost.exe
.
.
(((((((((((((((((((((((((   Files Created from 2014-03-07 to 2014-04-07  )))))))))))))))))))))))))))))))
.
.
2014-04-07 15:54 . 2014-04-07 15:54    --------    d-----w-    c:\users\Default\AppData\Local\temp
2014-04-06 00:37 . 2014-04-06 00:37    --------    d-----w-    c:\users\CARLA\AppData\Local\Apps
2014-04-05 18:33 . 2014-04-05 18:38    --------    d-----w-    C:\FRST
2014-04-05 15:21 . 2014-04-06 01:47    --------    d-----w-    c:\users\CARLA\AppData\Local\ElevatedDiagnostics
2014-04-05 01:42 . 2014-04-05 13:26    --------    d-----w-    c:\users\CARLA\Tracing
2014-04-04 15:56 . 2014-04-06 00:16    --------    d-----w-    C:\AdwCleaner
2014-04-04 15:32 . 2014-04-04 15:32    --------    d-----w-    c:\users\CARLA\AppData\Roaming\Malwarebytes
2014-04-04 15:32 . 2014-04-04 15:32    --------    d-----w-    c:\programdata\Malwarebytes
2014-04-04 15:32 . 2014-04-04 23:39    --------    d-----w-    c:\program files (x86)\Malwarebytes' Anti-Malware
2014-04-04 15:32 . 2014-04-04 15:32    --------    d-----w-    c:\users\CARLA\AppData\Local\Programs
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"PDVDDXSrv"="c:\program files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-06-25 140520]
"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2009-06-24 409744]
"Desktop Disc Tool"="c:\program files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [2009-06-19 494064]
"DellComms"="c:\program files (x86)\Dell\DellComms\bin\sprtcmd.exe" [2009-05-05 206064]
"DellSupportCenter"="c:\program files (x86)\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
.
c:\users\CARLA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-6-30 1316192]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe /firstrun [2009-6-30 1316192]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\AESTSr64.exe;c:\windows\SYSNATIVE\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\AESTSr64.exe [x]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe;c:\program files\Dell\DellDock\DockLogin.exe [x]
S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [x]
S2 sprtsvc_DellComms;SupportSoft Sprocket Service (DellComms);c:\program files (x86)\Dell\DellComms\bin\sprtsvc.exe;c:\program files (x86)\Dell\DellComms\bin\sprtsvc.exe [x]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys;c:\windows\SYSNATIVE\DRIVERS\CtClsFlt.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2009-03-10 309760]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-06-05 165912]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-06-05 385560]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-06-05 365080]
"Broadcom Wireless Manager UI"="c:\program files\Dell\Dell Wireless WLAN Card\WLTRAY.exe" [2009-07-17 4968960]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2009-06-29 444416]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 75.75.75.75 75.75.76.76
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10b.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10b.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}]
@Denied: (A 2) (Everyone)
@="IFlashBroker2"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2014-04-07  11:57:10
ComboFix-quarantined-files.txt  2014-04-07 15:57
ComboFix2.txt  2014-04-06 17:01
.
Pre-Run: 190,085,238,784 bytes free
Post-Run: 190,022,868,992 bytes free
.
- - End Of File - - E11650AF6630AD391FDF1E88DEE917AC
CDB4DE4BBD714F152979DA2DCBEF57EB
 


Edited by kcnu, 07 April 2014 - 12:23 PM.


#12 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:06:35 PM

Posted 07 April 2014 - 06:54 PM


Hello kcnu

You might get lucky using one of these programs - http://pcsupport.about.com/od/productkeysactivation/tp/topkeyfinder.htm

At this time I would like you to run this script for me and it is a good time to check out the computer to see if there is anything else that needs to be addressed.

:Run CFScript:

Please start by opening Notepad and copy/paste the text in the box into the window:

ClearJavaCache::


 
Save it to your desktop as CFScript.txt

Referring to the picture above, drag CFScript.txt into ComboFix.exe
CFScriptB-4.gif
This will let ComboFix run again.
Restart if you have to.
Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"
  • In your next post I need the following
    • report from Combofix
    • let me know of any problems you may have had
    • How is the computer doing now after running the script?
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#13 kcnu

kcnu
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:06:35 PM

Posted 08 April 2014 - 01:43 PM

hello gringo_pr.

 

I ran the combo fix with the CFScript. The log is pasted below. Note that is took more than 5 minutes to generate the log once the scan was complete.

 

I also have noticed the computer needing to complete a start up repair.  "startup repair - your computer was unable to start - startup repair is checking your system for problems..." This has happened a few times.

 

There was also a blue screen as posted in an earlier post.

 

 

ComboFix 14-04-08.01 - CARLA 04/08/2014  14:28:29.1.2 - x64
Microsoft Windows 7 Home Premium   6.1.7600.0.1252.1.1033.18.3034.1973 [GMT -4:00]
Running from: c:\users\CARLA\Desktop\ComboFix.exe
Command switches used :: c:\users\CARLA\Desktop\CFScript.txt.txt
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Created a new restore point
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\svchost.exe
.
.
(((((((((((((((((((((((((   Files Created from 2014-03-08 to 2014-04-08  )))))))))))))))))))))))))))))))
.
.
2014-04-08 17:38 . 2014-04-08 17:38    --------    d-----w-    c:\users\Default\AppData\Local\temp
2014-04-07 20:17 . 2014-04-08 18:07    --------    d-----w-    c:\users\CARLA\AppData\Local\PowerDVD DX
2014-04-07 20:17 . 2014-04-07 20:17    --------    d-----w-    c:\programdata\CyberLink
2014-04-06 00:37 . 2014-04-06 00:37    --------    d-----w-    c:\users\CARLA\AppData\Local\Apps
2014-04-05 18:33 . 2014-04-05 18:38    --------    d-----w-    C:\FRST
2014-04-05 15:21 . 2014-04-07 16:49    --------    d-----w-    c:\users\CARLA\AppData\Local\ElevatedDiagnostics
2014-04-05 01:42 . 2014-04-05 13:26    --------    d-----w-    c:\users\CARLA\Tracing
2014-04-04 15:56 . 2014-04-06 00:16    --------    d-----w-    C:\AdwCleaner
2014-04-04 15:32 . 2014-04-04 15:32    --------    d-----w-    c:\users\CARLA\AppData\Roaming\Malwarebytes
2014-04-04 15:32 . 2014-04-04 15:32    --------    d-----w-    c:\programdata\Malwarebytes
2014-04-04 15:32 . 2014-04-04 23:39    --------    d-----w-    c:\program files (x86)\Malwarebytes' Anti-Malware
2014-04-04 15:32 . 2014-04-04 15:32    --------    d-----w-    c:\users\CARLA\AppData\Local\Programs
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"PDVDDXSrv"="c:\program files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-06-25 140520]
"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2009-06-24 409744]
"Desktop Disc Tool"="c:\program files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [2009-06-19 494064]
"DellComms"="c:\program files (x86)\Dell\DellComms\bin\sprtcmd.exe" [2009-05-05 206064]
"DellSupportCenter"="c:\program files (x86)\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
.
c:\users\CARLA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-6-30 1316192]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe /firstrun [2009-6-30 1316192]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\AESTSr64.exe;c:\windows\SYSNATIVE\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\AESTSr64.exe [x]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe;c:\program files\Dell\DellDock\DockLogin.exe [x]
S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [x]
S2 sprtsvc_DellComms;SupportSoft Sprocket Service (DellComms);c:\program files (x86)\Dell\DellComms\bin\sprtsvc.exe;c:\program files (x86)\Dell\DellComms\bin\sprtsvc.exe [x]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys;c:\windows\SYSNATIVE\DRIVERS\CtClsFlt.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2009-03-10 309760]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-06-05 165912]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-06-05 385560]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-06-05 365080]
"Broadcom Wireless Manager UI"="c:\program files\Dell\Dell Wireless WLAN Card\WLTRAY.exe" [2009-07-17 4968960]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2009-06-29 444416]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 75.75.75.75 75.75.76.76
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Toolbar-Locked - (no file)
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10b.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10b.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}]
@Denied: (A 2) (Everyone)
@="IFlashBroker2"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2014-04-08  13:53:26
ComboFix-quarantined-files.txt  2014-04-08 17:53
ComboFix2.txt  2014-04-07 15:57
ComboFix3.txt  2014-04-06 17:01
.
Pre-Run: 188,404,158,464 bytes free
Post-Run: 187,863,130,112 bytes free
.
- - End Of File - - 8E22AD39ABFDE562E8C1279E3B194A68
CDB4DE4BBD714F152979DA2DCBEF57EB
 


Edited by kcnu, 08 April 2014 - 07:06 PM.


#14 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:06:35 PM

Posted 09 April 2014 - 08:06 AM

Hello kcnu,



Malwarebytes Anti-Rootkit

1.Download Malwarebytes Anti-Rootkit
2.Unzip the contents to a folder in a convenient location.
3.Open the folder where the contents were unzipped and run mbar.exe
4.Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
5.Click on the Cleanup button to remove any threats and reboot if prompted to do so.
6.Wait while the system shuts down and the cleanup process is performed.
7.Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
8.If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:
  • •Internet access
    •Windows Update
    •Windows Firewall
9.If there are additional problems with your system, such as any of those listed above or other system issues, then run the 'fixdamage' tool included with Malwarebytes Anti-Rootkit and reboot.
10.Verify that your system is now functioning normally.


--RogueKiller--

Download & SAVE to your Desktop RogueKiller for 32bit or Roguekiller for 64bit
  • Quit all programs that you may have started.
  • Please disconnect any external drives from the computer before you run this scan!
  • For Vista or Windows 7, right-click and select "Run as Administrator to start"
  • For Windows XP, double-click to start.
  • Wait until Prescan has finished ...
  • Then Click on "Scan" button
  • Wait until the Status box shows "Scan Finished"
  • click on "delete"
  • Wait until the Status box shows "Deleting Finished"
  • Click on "Report" and copy/paste the content of the Notepad into your next reply.
  • the scan will make two reports the one I would like to see is called RKreport[2].txt on your Desktop
  • Exit/Close RogueKiller+
send me the reports made from MBAR and Roguekiller and also let me know how the computer is doing at this time.

Gringo

Edited by gringo_pr, 09 April 2014 - 08:09 AM.

I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#15 kcnu

kcnu
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:06:35 PM

Posted 09 April 2014 - 10:05 PM

hello gringo_pr.

 

Malwarebytes Anti-Rootkit

As a note, this computer does not have internet access at the moment, so I am unable to update the Malwarebytes Anti-Rootkit BETA 1.07.0.1009. Is there a way to download the update on another computer and transfer the update over? I ran the program as is for your review and can run again with your direction. I included 3 logs for from the Anti-rootkit - 1 is the general log and the 2 additional are for the program log runs. It found 4 items and needed to run twice. The second run came back clean as you will see in the logs.

 

Rouge

I did not see the RKreport[2].txt for Rogue. I saw logs with various letters. I attached two for your review. If they are not correct, please post and I will re-post the correct logs. I may have run this program twice.

 

thank you.

 

 

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1009

© Malwarebytes Corporation 2011-2012

OS version: 6.1.7600 Windows 7 x64

Account is Administrative

Internet Explorer version: 9.0.8112.16421

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED
CPU speed: 2.100000 GHz
Memory total: 3181760512, free: 2056269824

Initializing...
======================
------------ Kernel report ------------
     04/09/2014 22:40:50
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\DRIVERS\ACPI.sys
\SystemRoot\system32\DRIVERS\WMILIB.SYS
\SystemRoot\system32\DRIVERS\msisadrv.sys
\SystemRoot\system32\DRIVERS\pci.sys
\SystemRoot\system32\DRIVERS\vdrvroot.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\DRIVERS\compbatt.sys
\SystemRoot\system32\DRIVERS\BATTC.SYS
\SystemRoot\system32\DRIVERS\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\DRIVERS\atapi.sys
\SystemRoot\system32\DRIVERS\ataport.SYS
\SystemRoot\system32\DRIVERS\msahci.sys
\SystemRoot\system32\DRIVERS\PCIIDEX.SYS
\SystemRoot\system32\DRIVERS\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\PxHlpa64.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\DRIVERS\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\DRIVERS\disk.sys
\SystemRoot\system32\DRIVERS\CLASSPNP.SYS
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\ws2ifsl.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\vwififlt.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\igdkmd64.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\DRIVERS\usbuhci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\bcmwl664.sys
\SystemRoot\system32\DRIVERS\vwifibus.sys
\SystemRoot\system32\DRIVERS\Rt64win7.sys
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\Apfiltr.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\CmBatt.sys
\SystemRoot\system32\DRIVERS\wmiacpi.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\CompositeBus.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\DRIVERS\stwrt64.sys
\SystemRoot\system32\DRIVERS\portcls.sys
\SystemRoot\system32\DRIVERS\drmk.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_dumpata.sys
\SystemRoot\System32\Drivers\dump_msahci.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\System32\Drivers\usbvideo.sys
\SystemRoot\system32\DRIVERS\CtClsFlt.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\drivers\BCM42RLY.sys
\SystemRoot\System32\Drivers\fastfat.SYS
\SystemRoot\system32\DRIVERS\cdfs.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
\WINDOWS\System32\ntdll.dll
\WINDOWS\System32\smss.exe
\WINDOWS\System32\apisetschema.dll
\WINDOWS\System32\autochk.exe
\WINDOWS\System32\lpk.dll
\WINDOWS\System32\kernel32.dll
\WINDOWS\System32\difxapi.dll
\WINDOWS\System32\comdlg32.dll
\WINDOWS\System32\ws2_32.dll
\WINDOWS\System32\imagehlp.dll
\WINDOWS\System32\Wldap32.dll
\WINDOWS\System32\imm32.dll
\WINDOWS\System32\setupapi.dll
\WINDOWS\System32\psapi.dll
\WINDOWS\System32\rpcrt4.dll
\WINDOWS\System32\gdi32.dll
\WINDOWS\System32\shell32.dll
\WINDOWS\System32\ole32.dll
\WINDOWS\System32\user32.dll
\WINDOWS\System32\shlwapi.dll
\WINDOWS\System32\msctf.dll
\WINDOWS\System32\sechost.dll
\WINDOWS\System32\urlmon.dll
\WINDOWS\System32\advapi32.dll
\WINDOWS\System32\oleaut32.dll
\WINDOWS\System32\nsi.dll
\WINDOWS\System32\usp10.dll
\WINDOWS\System32\wininet.dll
\WINDOWS\System32\clbcatq.dll
\WINDOWS\System32\msvcrt.dll
\WINDOWS\System32\iertutil.dll
\WINDOWS\System32\normaliz.dll
\WINDOWS\System32\devobj.dll
\WINDOWS\System32\crypt32.dll
\WINDOWS\System32\KernelBase.dll
\WINDOWS\System32\comctl32.dll
\WINDOWS\System32\cfgmgr32.dll
\WINDOWS\System32\wintrust.dll
\WINDOWS\System32\msasn1.dll
----------- End -----------
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa8003058060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-0\
Lower Device Object: 0xfffffa8002e3c680
Lower Device Driver Name: \00000428\
IRP handler 0 of \Driver\atapi points to an unknown module
Unhooking enabled.
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa8003058060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-0\
Lower Device Object: 0xfffffa8002e3c680
Lower Device Driver Name: \00000428\
Driver name found: atapi
Initialization returned 0x0
Port sub-driver loaded: \??\C:\WINDOWS\System32\drivers\ataport.sys (0x0)
Load Function returned 0x0
<<<2>>>
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa8003058060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8003058ab0, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa8003058060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa8002e3c680, DeviceName: \Device\Ide\IdeDeviceP0T0L0-0\, DriverName: \00000428\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0xfffff8a0097f5510, 0xfffffa8003058060, 0xfffffa80035c5090
Lower DeviceData: 0xfffff8a00981dda0, 0xfffffa8002e3c680, 0xfffffa8002673cf0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Done!
Drive 0
Scanning MBR on drive 0...
MBR buffers are not equal
MBR is forged! [eab6d36cb5d8b230fa58bcc6ad7fe01c]
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 86F8F0B

Partition information:

    Partition 0 type is Other (0xde)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 63  Numsec = 80262

    Partition 1 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 81920  Numsec = 30720000
    Partition file system is NTFS
    Partition is bootable

    Partition 2 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 30801920  Numsec = 457593200

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

Infected: MBR on Drive 0 --> [Rootkit.Pihar.MBR]
Replacement MBR for a drive 0 found
MBR infection found on drive 0
Disk Size: 250059350016 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-62-488377168-488397168)...
Sectors 488396368 - 488397167 --> [Forged physical sectors]
Done!
Infected: C:\WINDOWS\svchost.exe --> [Trojan.Agent]
Infected: C:\WINDOWS\svchost.exe --> [Trojan.Agent]
Scan finished
Creating System Restore point...
Cleaning up...
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
BCD Entry for BOOTEMS is missing
Malicious Entry 26000022 for BOOTEMS present!
Removal scheduling successful. System shutdown needed.
System shutdown occurred
=======================================





Malwarebytes Anti-Rootkit BETA 1.07.0.1009
www.malwarebytes.org

Database version: v2013.10.02.12

Windows 7 x64 NTFS
Internet Explorer 9.0.8112.16421
CARLA :: CARLA-PC [administrator]

4/9/2014 9:54:24 PM
mbar-log-2014-04-09 (21-54-24).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 213399
Time elapsed: 9 minute(s), 31 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)



Malwarebytes Anti-Rootkit BETA 1.07.0.1009
www.malwarebytes.org

Database version: v2013.10.02.12

Windows 7 x64 NTFS
Internet Explorer 9.0.8112.16421
CARLA :: CARLA-PC [administrator]

4/9/2014 9:54:24 PM
mbar-log-2014-04-09 (21-54-24).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 213399
Time elapsed: 9 minute(s), 31 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)


RogueKiller V8.8.15 _x64_ [Mar 27 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7600 ) 64 bits version
Started in : Normal mode
User : CARLA [Admin rights]
Mode : Scan -- Date : 04/09/2014 22:17:11
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 7 ¤¤¤
[HJ POL][PUM] HKCU\[...]\System : DisableRegistryTools (0) -> FOUND
[HJ DESK][PUM] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ DESK][PUM] HKCU\[...]\ClassicStartMenu : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND
[HJ DESK][PUM] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ DESK][PUM] HKCU\[...]\NewStartPanel : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Browser Addons : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤
[Address] EAT @explorer.exe (WlanAllocateMemory) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA218AC8)
[Address] EAT @explorer.exe (WlanCloseHandle) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA2138A0)
[Address] EAT @explorer.exe (WlanConnect) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA215558)
[Address] EAT @explorer.exe (WlanDeleteProfile) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA216D10)
[Address] EAT @explorer.exe (WlanDisconnect) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA2157E8)
[Address] EAT @explorer.exe (WlanEnumInterfaces) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA213A80)
[Address] EAT @explorer.exe (WlanExtractPsdIEDataList) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA218394)
[Address] EAT @explorer.exe (WlanFreeMemory) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA21A5A0)
[Address] EAT @explorer.exe (WlanGetAvailableNetworkList) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA214F88)
[Address] EAT @explorer.exe (WlanGetFilterList) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA217F9C)
[Address] EAT @explorer.exe (WlanGetInterfaceCapability) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA214188)
[Address] EAT @explorer.exe (WlanGetNetworkBssList) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA215268)
[Address] EAT @explorer.exe (WlanGetProfile) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA216A20)
[Address] EAT @explorer.exe (WlanGetProfileCustomUserData) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA217B1C)
[Address] EAT @explorer.exe (WlanGetProfileList) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA217404)
[Address] EAT @explorer.exe (WlanGetSecuritySettings) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA218D88)
[Address] EAT @explorer.exe (WlanHostedNetworkForceStart) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA21935C)
[Address] EAT @explorer.exe (WlanHostedNetworkForceStop) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA219418)
[Address] EAT @explorer.exe (WlanHostedNetworkInitSettings) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA2199D8)
[Address] EAT @explorer.exe (WlanHostedNetworkQueryProperty) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA2194D4)
[Address] EAT @explorer.exe (WlanHostedNetworkQuerySecondaryKey) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA21A020)
[Address] EAT @explorer.exe (WlanHostedNetworkQueryStatus) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA219B50)
[Address] EAT @explorer.exe (WlanHostedNetworkRefreshSecuritySettings) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA219A94)
[Address] EAT @explorer.exe (WlanHostedNetworkSetProperty) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA219744)
[Address] EAT @explorer.exe (WlanHostedNetworkSetSecondaryKey) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA219D78)
[Address] EAT @explorer.exe (WlanHostedNetworkStartUsing) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA2191EC)
[Address] EAT @explorer.exe (WlanHostedNetworkStopUsing) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA2192A4)
[Address] EAT @explorer.exe (WlanIhvControl) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA214A00)
[Address] EAT @explorer.exe (WlanOpenHandle) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA211960)
[Address] EAT @explorer.exe (WlanQueryAutoConfigParameter) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA213EE8)
[Address] EAT @explorer.exe (WlanQueryInterface) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA214668)
[Address] EAT @explorer.exe (WlanReasonCodeToString) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA218A54)
[Address] EAT @explorer.exe (WlanRegisterNotification) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA215A08)
[Address] EAT @explorer.exe (WlanRegisterVirtualStationNotification) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA21A358)
[Address] EAT @explorer.exe (WlanRenameProfile) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA216F4C)
[Address] EAT @explorer.exe (WlanSaveTemporaryProfile) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA2187D0)
[Address] EAT @explorer.exe (WlanScan) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA214D40)
[Address] EAT @explorer.exe (WlanSetAutoConfigParameter) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA213D10)
[Address] EAT @explorer.exe (WlanSetFilterList) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA217DCC)
[Address] EAT @explorer.exe (WlanSetInterface) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA214470)
[Address] EAT @explorer.exe (WlanSetProfile) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA216760)
[Address] EAT @explorer.exe (WlanSetProfileCustomUserData) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA2178A4)
[Address] EAT @explorer.exe (WlanSetProfileEapUserData) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA215CC4)
[Address] EAT @explorer.exe (WlanSetProfileEapXmlUserData) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA215F9C)
[Address] EAT @explorer.exe (WlanSetProfileList) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA2171A8)
[Address] EAT @explorer.exe (WlanSetProfilePosition) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA217644)
[Address] EAT @explorer.exe (WlanSetPsdIEDataList) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA2181B0)
[Address] EAT @explorer.exe (WlanSetSecuritySettings) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA218B58)

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection :  ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts




¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) WDC WD2500BEVT-75ZCT2 ATA Device +++++
--- User ---
[MBR] 2dbc9862d931294e7119278110e1b0c1
[BSP] f2554e82efed46df96eec1d04c45713e : Windows Vista MBR Code
Partition table:
0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 MB
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 81920 | Size: 15000 MB
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 30801920 | Size: 223434 MB
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[0]_S_04092014_221711.txt >>




RogueKiller V8.8.15 _x64_ [Mar 27 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7600 ) 64 bits version
Started in : Normal mode
User : CARLA [Admin rights]
Mode : Remove -- Date : 04/09/2014 22:18:59
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 7 ¤¤¤
[HJ POL][PUM] HKCU\[...]\System : DisableRegistryTools (0) -> DELETED
[HJ DESK][PUM] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
[HJ DESK][PUM] HKCU\[...]\ClassicStartMenu : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> REPLACED (0)
[HJ DESK][PUM] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
[HJ DESK][PUM] HKCU\[...]\NewStartPanel : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> REPLACED (0)
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Browser Addons : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤
[Address] EAT @explorer.exe (WlanAllocateMemory) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA218AC8)
[Address] EAT @explorer.exe (WlanCloseHandle) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA2138A0)
[Address] EAT @explorer.exe (WlanConnect) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA215558)
[Address] EAT @explorer.exe (WlanDeleteProfile) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA216D10)
[Address] EAT @explorer.exe (WlanDisconnect) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA2157E8)
[Address] EAT @explorer.exe (WlanEnumInterfaces) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA213A80)
[Address] EAT @explorer.exe (WlanExtractPsdIEDataList) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA218394)
[Address] EAT @explorer.exe (WlanFreeMemory) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA21A5A0)
[Address] EAT @explorer.exe (WlanGetAvailableNetworkList) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA214F88)
[Address] EAT @explorer.exe (WlanGetFilterList) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA217F9C)
[Address] EAT @explorer.exe (WlanGetInterfaceCapability) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA214188)
[Address] EAT @explorer.exe (WlanGetNetworkBssList) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA215268)
[Address] EAT @explorer.exe (WlanGetProfile) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA216A20)
[Address] EAT @explorer.exe (WlanGetProfileCustomUserData) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA217B1C)
[Address] EAT @explorer.exe (WlanGetProfileList) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA217404)
[Address] EAT @explorer.exe (WlanGetSecuritySettings) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA218D88)
[Address] EAT @explorer.exe (WlanHostedNetworkForceStart) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA21935C)
[Address] EAT @explorer.exe (WlanHostedNetworkForceStop) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA219418)
[Address] EAT @explorer.exe (WlanHostedNetworkInitSettings) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA2199D8)
[Address] EAT @explorer.exe (WlanHostedNetworkQueryProperty) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA2194D4)
[Address] EAT @explorer.exe (WlanHostedNetworkQuerySecondaryKey) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA21A020)
[Address] EAT @explorer.exe (WlanHostedNetworkQueryStatus) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA219B50)
[Address] EAT @explorer.exe (WlanHostedNetworkRefreshSecuritySettings) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA219A94)
[Address] EAT @explorer.exe (WlanHostedNetworkSetProperty) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA219744)
[Address] EAT @explorer.exe (WlanHostedNetworkSetSecondaryKey) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA219D78)
[Address] EAT @explorer.exe (WlanHostedNetworkStartUsing) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA2191EC)
[Address] EAT @explorer.exe (WlanHostedNetworkStopUsing) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA2192A4)
[Address] EAT @explorer.exe (WlanIhvControl) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA214A00)
[Address] EAT @explorer.exe (WlanOpenHandle) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA211960)
[Address] EAT @explorer.exe (WlanQueryAutoConfigParameter) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA213EE8)
[Address] EAT @explorer.exe (WlanQueryInterface) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA214668)
[Address] EAT @explorer.exe (WlanReasonCodeToString) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA218A54)
[Address] EAT @explorer.exe (WlanRegisterNotification) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA215A08)
[Address] EAT @explorer.exe (WlanRegisterVirtualStationNotification) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA21A358)
[Address] EAT @explorer.exe (WlanRenameProfile) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA216F4C)
[Address] EAT @explorer.exe (WlanSaveTemporaryProfile) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA2187D0)
[Address] EAT @explorer.exe (WlanScan) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA214D40)
[Address] EAT @explorer.exe (WlanSetAutoConfigParameter) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA213D10)
[Address] EAT @explorer.exe (WlanSetFilterList) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA217DCC)
[Address] EAT @explorer.exe (WlanSetInterface) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA214470)
[Address] EAT @explorer.exe (WlanSetProfile) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA216760)
[Address] EAT @explorer.exe (WlanSetProfileCustomUserData) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA2178A4)
[Address] EAT @explorer.exe (WlanSetProfileEapUserData) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA215CC4)
[Address] EAT @explorer.exe (WlanSetProfileEapXmlUserData) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA215F9C)
[Address] EAT @explorer.exe (WlanSetProfileList) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA2171A8)
[Address] EAT @explorer.exe (WlanSetProfilePosition) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA217644)
[Address] EAT @explorer.exe (WlanSetPsdIEDataList) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA2181B0)
[Address] EAT @explorer.exe (WlanSetSecuritySettings) : MSIMG32.dll -> HOOKED (C:\Windows\system32\Wlanapi.dll @ 0xFA218B58)

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection :  ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts




¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) WDC WD2500BEVT-75ZCT2 ATA Device +++++
--- User ---
[MBR] 2dbc9862d931294e7119278110e1b0c1
[BSP] f2554e82efed46df96eec1d04c45713e : Windows Vista MBR Code
Partition table:
0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 MB
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 81920 | Size: 15000 MB
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 30801920 | Size: 223434 MB
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[0]_D_04092014_221859.txt >>
RKreport[0]_S_04092014_221711.txt


 






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users