jeffpate1964

Results of screen317's Security Check version 0.99.54 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 8 Out of date! ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Enabled! Norton Internet Security WMI entry may not exist for antivirus; attempting automatic update. `````````Anti-malware/Other Utilities Check:````````` Secunia PSI (2.0.0.4003) Malwarebytes Anti-Malware version 1.65.1.1000 JavaFX 2.1.1 Java 7 Update 7 Java version out of Date! Adobe Flash Player 11.5.502.110 Adobe Reader X (10.1.4) Mozilla Firefox 12.0 Firefox out of Date! Google Chrome 21.0.1180.83 Google Chrome 21.0.1180.89 Google Chrome 22.0.1229.79 Google Chrome 22.0.1229.92 Google Chrome 22.0.1229.94 Google Chrome 23.0.1271.64 ````````Process Check: objlist.exe by Laurent```````` Norton ccSvcHst.exe Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Malwarebytes' Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: 1% ````````````````````End of Log``````````````````````

# AdwCleaner v2.008 - Logfile created 11/23/2012 at 09:49:43 # Updated 17/11/2012 by Xplode # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits) # User : Jeff - JEFF-PC # Boot Mode : Normal # Running from : C:\Users\Jeff\Desktop\adwcleaner.exe # Option [Delete] ***** [services] ***** ***** [Files / Folders] ***** File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml File Deleted : C:\user.js Folder Deleted : C:\ProgramData\Babylon Folder Deleted : C:\Users\Jeff\AppData\Local\Babylon Folder Deleted : C:\Users\Jeff\AppData\Roaming\Babylon ***** [Registry] ***** Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9} Key Deleted : HKLM\Software\Babylon Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB} Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap Key Deleted : HKLM\Software\Freeze.com Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B} Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1} Key Deleted : HKLM\SOFTWARE\Software ***** [internet Browsers] ***** -\\ Internet Explorer v8.0.7601.17514 Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://isearch.babylon.com/?babsrc=HP_ss&mntrId=f04f7068000000000000e89a8f6fde94 --> hxxp://www.google.com Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://isearch.babylon.com/?babsrc=NT_ss&mntrId=f04f7068000000000000e89a8f6fde94 --> hxxp://www.google.com -\\ Mozilla Firefox v12.0 (en-US) Profile name : default File : C:\Users\Jeff\AppData\Roaming\Mozilla\Firefox\Profiles\13l6al6m.default\prefs.js C:\Users\Jeff\AppData\Roaming\Mozilla\Firefox\Profiles\13l6al6m.default\user.js ... Deleted ! Deleted : user_pref("extensions.BabylonToolbar.admin", false); Deleted : user_pref("extensions.BabylonToolbar.aflt", "babsst"); Deleted : user_pref("extensions.BabylonToolbar.babExt", ""); Deleted : user_pref("extensions.BabylonToolbar.babTrack", "affID=112546"); Deleted : user_pref("extensions.BabylonToolbar.bbDpng", 23); Deleted : user_pref("extensions.BabylonToolbar.dfltSrch", false); Deleted : user_pref("extensions.BabylonToolbar.hmpg", false); Deleted : user_pref("extensions.BabylonToolbar.id", "f04f7068000000000000e89a8f6fde94"); Deleted : user_pref("extensions.BabylonToolbar.instlDay", "15451"); Deleted : user_pref("extensions.BabylonToolbar.instlRef", "sst"); Deleted : user_pref("extensions.BabylonToolbar.lastDP", 23); Deleted : user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.5.3.1717:58:42"); Deleted : user_pref("extensions.BabylonToolbar.mntrFFxVrsn", "12.0"); Deleted : user_pref("extensions.BabylonToolbar.newTab", true); Deleted : user_pref("extensions.BabylonToolbar.newTabUrl", "hxxp://search.babylon.com/?babsrc=NT_bb"); Deleted : user_pref("extensions.BabylonToolbar.noFFXTlbr", false); Deleted : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar"); Deleted : user_pref("extensions.BabylonToolbar.propectorlck", 92241028); Deleted : user_pref("extensions.BabylonToolbar.prtnrId", "babylon"); Deleted : user_pref("extensions.BabylonToolbar.ptch_0717", true); Deleted : user_pref("extensions.BabylonToolbar.smplGrp", "azb"); Deleted : user_pref("extensions.BabylonToolbar.srcExt", "ss"); Deleted : user_pref("extensions.BabylonToolbar.tlbrId", "base"); Deleted : user_pref("extensions.BabylonToolbar.vrsn", "1.5.3.17"); Deleted : user_pref("extensions.BabylonToolbar.vrsnTs", "1.5.3.1717:58:42"); Deleted : user_pref("extensions.BabylonToolbar.vrsni", "1.5.3.17"); Deleted : user_pref("extensions.BabylonToolbar_i.aflt", "babsst"); Deleted : user_pref("extensions.BabylonToolbar_i.babExt", ""); Deleted : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=112546"); Deleted : user_pref("extensions.BabylonToolbar_i.hardId", "f04f7068000000000000e89a8f6fde94"); Deleted : user_pref("extensions.BabylonToolbar_i.id", "f04f7068000000000000e89a8f6fde94"); Deleted : user_pref("extensions.BabylonToolbar_i.instlDay", "15451"); Deleted : user_pref("extensions.BabylonToolbar_i.instlRef", "sst"); Deleted : user_pref("extensions.BabylonToolbar_i.ovrDmn", "isearch.babylon.com"); Deleted : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar"); Deleted : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon"); Deleted : user_pref("extensions.BabylonToolbar_i.smplGrp", "none"); Deleted : user_pref("extensions.BabylonToolbar_i.srcExt", "ss"); Deleted : user_pref("extensions.BabylonToolbar_i.tlbrId", "base"); Deleted : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17"); Deleted : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1717:58:42"); Deleted : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17"); Deleted : user_pref("extensions.enabledAddons", "ffxtlbr@babylon.com:1.1.9,{972ce4c6-7e08-4474-a285-3208198ce6[...] Profile name : default File : C:\Users\Melvalyn\AppData\Roaming\Mozilla\Firefox\Profiles\1qwz2i2l.default\prefs.js [OK] File is clean. ************************* AdwCleaner[R1].txt - [5571 octets] - [23/11/2012 09:04:46] AdwCleaner[R2].txt - [5512 octets] - [23/11/2012 09:49:03] AdwCleaner[s1].txt - [5587 octets] - [23/11/2012 09:49:43] ########## EOF - C:\AdwCleaner[s1].txt - [5647 octets] ##########

It's going well so far--thanks. It didn't shut down overnight like it had been for the past three days. Here's the log for the adwcleaner search: # AdwCleaner v2.008 - Logfile created 11/23/2012 at 09:04:46 # Updated 17/11/2012 by Xplode # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits) # User : Jeff - JEFF-PC # Boot Mode : Normal # Running from : C:\Users\Jeff\Desktop\adwcleaner.exe # Option [search] ***** [services] ***** ***** [Files / Folders] ***** File Found : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml File Found : C:\user.js Folder Found : C:\ProgramData\Babylon Folder Found : C:\Users\Jeff\AppData\Local\Babylon Folder Found : C:\Users\Jeff\AppData\Roaming\Babylon Folder Found : C:\Users\Jeff\AppData\Roaming\Mozilla\Firefox\Profiles\13l6al6m.default\extensions\ffxtlbr@babylon.com ***** [Registry] ***** Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9} Key Found : HKLM\Software\Babylon Key Found : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947} Key Found : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB} Key Found : HKLM\SOFTWARE\Classes\AppID\escort.DLL Key Found : HKLM\SOFTWARE\Classes\Prod.cap Key Found : HKLM\Software\Freeze.com Key Found : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32 Key Found : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B} Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1} Key Found : HKLM\SOFTWARE\Software Key Found : HKU\S-1-5-21-3623149405-208912857-704148503-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9} ***** [internet Browsers] ***** -\\ Internet Explorer v8.0.7601.17514 [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://isearch.babylon.com/?babsrc=HP_ss&mntrId=f04f7068000000000000e89a8f6fde94 [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://isearch.babylon.com/?babsrc=NT_ss&mntrId=f04f7068000000000000e89a8f6fde94 -\\ Mozilla Firefox v12.0 (en-US) Profile name : default File : C:\Users\Jeff\AppData\Roaming\Mozilla\Firefox\Profiles\13l6al6m.default\prefs.js Found : user_pref("extensions.BabylonToolbar.admin", false); Found : user_pref("extensions.BabylonToolbar.aflt", "babsst"); Found : user_pref("extensions.BabylonToolbar.babExt", ""); Found : user_pref("extensions.BabylonToolbar.babTrack", "affID=112546"); Found : user_pref("extensions.BabylonToolbar.bbDpng", 22); Found : user_pref("extensions.BabylonToolbar.dfltSrch", false); Found : user_pref("extensions.BabylonToolbar.hmpg", false); Found : user_pref("extensions.BabylonToolbar.id", "f04f7068000000000000e89a8f6fde94"); Found : user_pref("extensions.BabylonToolbar.instlDay", "15451"); Found : user_pref("extensions.BabylonToolbar.instlRef", "sst"); Found : user_pref("extensions.BabylonToolbar.lastDP", 22); Found : user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.5.3.1717:58:42"); Found : user_pref("extensions.BabylonToolbar.mntrFFxVrsn", "12.0"); Found : user_pref("extensions.BabylonToolbar.newTab", true); Found : user_pref("extensions.BabylonToolbar.newTabUrl", "hxxp://search.babylon.com/?babsrc=NT_bb"); Found : user_pref("extensions.BabylonToolbar.noFFXTlbr", false); Found : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar"); Found : user_pref("extensions.BabylonToolbar.propectorlck", 92164695); Found : user_pref("extensions.BabylonToolbar.prtnrId", "babylon"); Found : user_pref("extensions.BabylonToolbar.ptch_0717", true); Found : user_pref("extensions.BabylonToolbar.smplGrp", "azb"); Found : user_pref("extensions.BabylonToolbar.srcExt", "ss"); Found : user_pref("extensions.BabylonToolbar.tlbrId", "base"); Found : user_pref("extensions.BabylonToolbar.vrsn", "1.5.3.17"); Found : user_pref("extensions.BabylonToolbar.vrsnTs", "1.5.3.1717:58:42"); Found : user_pref("extensions.BabylonToolbar.vrsni", "1.5.3.17"); Found : user_pref("extensions.BabylonToolbar_i.aflt", "babsst"); Found : user_pref("extensions.BabylonToolbar_i.babExt", ""); Found : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=112546"); Found : user_pref("extensions.BabylonToolbar_i.hardId", "f04f7068000000000000e89a8f6fde94"); Found : user_pref("extensions.BabylonToolbar_i.id", "f04f7068000000000000e89a8f6fde94"); Found : user_pref("extensions.BabylonToolbar_i.instlDay", "15451"); Found : user_pref("extensions.BabylonToolbar_i.instlRef", "sst"); Found : user_pref("extensions.BabylonToolbar_i.ovrDmn", "isearch.babylon.com"); Found : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar"); Found : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon"); Found : user_pref("extensions.BabylonToolbar_i.smplGrp", "none"); Found : user_pref("extensions.BabylonToolbar_i.srcExt", "ss"); Found : user_pref("extensions.BabylonToolbar_i.tlbrId", "base"); Found : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17"); Found : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1717:58:42"); Found : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17"); Found : user_pref("extensions.enabledAddons", "ffxtlbr@babylon.com:1.1.9,{972ce4c6-7e08-4474-a285-3208198ce6[...] Profile name : default File : C:\Users\Melvalyn\AppData\Roaming\Mozilla\Firefox\Profiles\1qwz2i2l.default\prefs.js [OK] File is clean. ************************* AdwCleaner[R1].txt - [5446 octets] - [23/11/2012 09:04:46] ########## EOF - C:\AdwCleaner[R1].txt - [5506 octets] ########## Thanks so much for your help.

Yeah, it did give me the "illegal operation" message and the reboot solved it. Here's the log from Combofix ComboFix 12-11-22.03 - Jeff 11/22/2012 15:52:01.1.2 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4044.2238 [GMT -5:00] Running from: c:\users\Jeff\Desktop\ComboFix.exe AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF} FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4} SP: Norton Internet Security *Disabled/Outdated* {D8BEB080-B73A-17E3-1B37-B6B462689202} SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . C:\Install.exe c:\programdata\126286f2l228e818f077w0jcy6l8 c:\programdata\dsgsdgdsgdsgw.pad . . ((((((((((((((((((((((((( Files Created from 2012-10-22 to 2012-11-22 ))))))))))))))))))))))))))))))) . . 2012-11-15 11:07 . 2012-07-26 04:55 785512 ----a-w- c:\windows\system32\drivers\Wdf01000.sys 2012-11-15 11:07 . 2012-07-26 04:55 54376 ----a-w- c:\windows\system32\drivers\WdfLdr.sys 2012-11-15 11:07 . 2012-07-26 04:47 2560 ----a-w- c:\windows\system32\drivers\en-US\wdf01000.sys.mui 2012-11-15 11:07 . 2012-07-26 02:36 9728 ----a-w- c:\windows\system32\Wdfres.dll 2012-11-15 11:01 . 2012-07-26 03:08 229888 ----a-w- c:\windows\system32\WUDFHost.exe 2012-11-15 11:01 . 2012-07-26 03:08 84992 ----a-w- c:\windows\system32\WUDFSvc.dll 2012-11-15 11:01 . 2012-07-26 03:08 744448 ----a-w- c:\windows\system32\WUDFx.dll 2012-11-15 11:01 . 2012-07-26 03:08 45056 ----a-w- c:\windows\system32\WUDFCoinstaller.dll 2012-11-15 11:01 . 2012-07-26 03:08 194048 ----a-w- c:\windows\system32\WUDFPlatform.dll 2012-11-15 11:01 . 2012-07-26 02:26 87040 ----a-w- c:\windows\system32\drivers\WUDFPf.sys 2012-11-15 11:01 . 2012-07-26 02:26 198656 ----a-w- c:\windows\system32\drivers\WUDFRd.sys 2012-11-14 23:10 . 2012-09-25 22:47 78336 ----a-w- c:\windows\SysWow64\synceng.dll 2012-11-14 23:10 . 2012-09-25 22:46 95744 ----a-w- c:\windows\system32\synceng.dll 2012-11-12 11:38 . 2012-11-12 11:38 -------- d-----w- c:\program files (x86)\PC Tools 2012-11-12 11:23 . 2012-11-12 23:59 -------- d-----w- c:\program files (x86)\Common Files\PC Tools 2012-11-12 11:23 . 2012-11-01 20:35 253256 ----a-w- c:\windows\system32\drivers\PCTSD64.sys 2012-11-12 11:21 . 2012-11-12 23:58 -------- d-----w- c:\programdata\PC Tools 2012-11-12 11:21 . 2012-11-12 11:21 -------- d-----w- c:\users\Jeff\AppData\Roaming\TestApp . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-11-17 17:41 . 2012-04-13 09:57 697272 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-11-17 17:41 . 2011-09-14 01:22 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-11-15 11:01 . 2011-08-26 10:00 66395536 ----a-w- c:\windows\system32\MRT.exe 2012-09-30 00:54 . 2011-10-18 01:27 25928 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-09-14 19:19 . 2012-10-10 10:06 2048 ----a-w- c:\windows\system32\tzres.dll 2012-09-14 18:28 . 2012-10-10 10:06 2048 ----a-w- c:\windows\SysWow64\tzres.dll 2012-09-06 11:30 . 2012-09-06 11:30 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2012-09-06 11:30 . 2012-07-30 10:24 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll 2012-09-06 11:30 . 2011-03-24 02:26 746984 ----a-w- c:\windows\SysWow64\deployJava1.dll 2012-08-31 18:19 . 2012-10-10 10:07 1659760 ----a-w- c:\windows\system32\drivers\ntfs.sys 2012-08-30 18:03 . 2012-10-10 10:07 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe 2012-08-30 17:12 . 2012-10-10 10:07 3914096 ----a-w- c:\windows\SysWow64\ntoskrnl.exe 2012-08-30 17:12 . 2012-10-10 10:07 3968880 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-06-29 39408] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "ToshibaServiceStation"="c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2010-11-29 1294712] "SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096] "AdobeCS5.5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848] . c:\users\Jeff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Microsoft Find Fast.lnk - c:\program files (x86)\Microsoft Office\Office\FINDFAST.EXE [1996-11-20 111376] Office Startup.lnk - c:\program files (x86)\Microsoft Office\Office\OSA.EXE [1996-11-20 51984] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2012-9-23 113664] Secunia PSI Tray.lnk - c:\program files (x86)\Secunia\PSI\psi_tray.exe [2011-10-14 291896] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . R1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20110901.001\BHDrvx64.sys [2011-09-02 1151096] R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1206000.01D\Ironx64.SYS [2011-01-27 171128] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944] R3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2010-09-01 17976] R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-12-01 250984] R3 RSUSBVSTOR;RTSUVSTOR.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RTSUVSTOR.sys [2010-11-30 307304] R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864] R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312] R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864] R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096] R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2010-11-29 54136] R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2010-12-08 137632] R3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [2010-12-21 822704] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-08-18 1255736] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184] S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1206000.01D\SYMDS64.SYS [2011-01-27 450680] S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1206000.01D\SYMEFA64.SYS [2011-03-15 912504] S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys [2009-06-24 482384] S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20110912.030\IDSvia64.sys [2011-08-23 488568] S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1206000.01D\SYMNETS.SYS [2011-07-08 386168] S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624] S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-09-30 399432] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-09-30 676936] S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe [2011-04-17 130008] S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe [2011-10-14 994360] S2 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe [2011-10-14 399416] S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776] S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe [2011-03-02 266680] S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys [2009-06-20 14472] S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-12-21 2656280] S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [2011-08-01 52584] S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-15 317440] S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2010-11-08 76912] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-09-30 25928] S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [2011-02-09 38096] S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [2011-08-01 45416] S3 QIOMem;Generic IO & Memory Access;c:\windows\system32\DRIVERS\QIOMem.sys [2009-06-15 12800] S3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;c:\windows\system32\DRIVERS\rtl8192Ce.sys [2011-01-05 1109096] S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264] S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648] S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960] S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376] S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496] . . --- Other Services/Drivers In Memory --- . *NewlyCreated* - WS2IFSL . Contents of the 'Scheduled Tasks' folder . 2012-11-22 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-13 17:41] . 2012-11-22 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3623149405-208912857-704148503-1001Core.job - c:\users\Melvalyn\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-09-15 05:07] . 2012-11-22 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3623149405-208912857-704148503-1001UA.job - c:\users\Melvalyn\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-09-15 05:07] . 2012-11-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-29 02:21] . 2012-11-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-29 02:21] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-04-08 167256] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-08 391000] "Persistence"="c:\windows\system32\igfxpers.exe" [2011-04-08 418136] "SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2010-12-14 316032] "TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376] "TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2010-12-08 710040] "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 2417032] "AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-15 499608] . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://isearch.babylon.com/?babsrc=HP_ss&mntrId=f04f7068000000000000e89a8f6fde94 mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = <local> TCP: DhcpNameServer = 192.168.1.254 FF - ProfilePath - c:\users\Jeff\AppData\Roaming\Mozilla\Firefox\Profiles\13l6al6m.default\ FF - prefs.js: browser.startup.homepage - www.facebook.com FF - prefs.js: keyword.URL - hxxp://www.google.com/webhp?hl=en&tab=ww FF - prefs.js: network.proxy.type - 0 FF - user.js: yahoo.ytff.general.dontshowhpoffer - true);user_pref(extensions.BabylonToolbar_i.babTrack, affID=112546 FF - user.js: extensions.BabylonToolbar_i.babExt - FF - user.js: extensions.BabylonToolbar_i.srcExt - ss FF - user.js: extensions.BabylonToolbar_i.ovrDmn - isearch.babylon.com FF - user.js: extensions.BabylonToolbar_i.id - f04f7068000000000000e89a8f6fde94 FF - user.js: extensions.BabylonToolbar_i.hardId - f04f7068000000000000e89a8f6fde94 FF - user.js: extensions.BabylonToolbar_i.instlDay - 15451 FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17 FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1717:58 FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar FF - user.js: extensions.BabylonToolbar_i.aflt - babsst FF - user.js: extensions.BabylonToolbar_i.smplGrp - none FF - user.js: extensions.BabylonToolbar_i.tlbrId - base FF - user.js: extensions.BabylonToolbar_i.instlRef - sst . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) Wow6432Node-HKLM-Run-TSleepSrv - %ProgramFiles(x86)%\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe Toolbar-Locked - (no file) HKLM-Run-TPwrMain - c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE HKLM-Run-HSON - c:\program files (x86)\TOSHIBA\TBS\HSON.exe HKLM-Run-TCrdMain - c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe HKLM-Run-Teco - c:\program files (x86)\TOSHIBA\TECO\Teco.exe HKLM-Run-TosWaitSrv - c:\program files (x86)\TOSHIBA\TPHM\TosWaitSrv.exe HKLM-Run-TosNC - c:\program files (x86)\Toshiba\BulletinBoard\TosNcCore.exe HKLM-Run-TosReelTimeMonitor - c:\program files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS] "ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\18.6.0.29\diMaster.dll\" /prefetch:1" . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Other Running Processes ------------------------ . c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe . ************************************************************************** . Completion time: 2012-11-22 16:07:13 - machine was rebooted ComboFix-quarantined-files.txt 2012-11-22 21:07 . Pre-Run: 252,357,386,240 bytes free Post-Run: 253,763,616,768 bytes free . - - End Of File - - 79DBE9C85427C790ED53037670958DD8

First scan --------------------------------------- Malwarebytes Anti-Rootkit BETA 1.01.0.1009 © Malwarebytes Corporation 2011-2012 OS version: 6.1.7601 Windows 7 Service Pack 1 x64 Account is Administrative Internet Explorer version: 8.0.7601.17514 File system is: NTFS Disk drives: C:\ DRIVE_FIXED, Q:\ DRIVE_FIXED CPU speed: 1.995000 GHz Memory total: 4240293888, free: 1661186048 ------------ Kernel report ------------ 11/22/2012 13:05:59 ------------ Loaded modules ----------- \SystemRoot\system32\ntoskrnl.exe \SystemRoot\system32\hal.dll \SystemRoot\system32\kdcom.dll \SystemRoot\system32\mcupdate_GenuineIntel.dll \SystemRoot\system32\PSHED.dll \SystemRoot\system32\CLFS.SYS \SystemRoot\system32\CI.dll \SystemRoot\system32\drivers\Wdf01000.sys \SystemRoot\system32\drivers\WDFLDR.SYS \SystemRoot\system32\drivers\ACPI.sys \SystemRoot\system32\drivers\WMILIB.SYS \SystemRoot\system32\drivers\msisadrv.sys \SystemRoot\system32\drivers\pci.sys \SystemRoot\system32\drivers\vdrvroot.sys \SystemRoot\System32\drivers\partmgr.sys \SystemRoot\system32\drivers\compbatt.sys \SystemRoot\system32\drivers\BATTC.SYS \SystemRoot\system32\drivers\volmgr.sys \SystemRoot\System32\drivers\volmgrx.sys \SystemRoot\System32\drivers\mountmgr.sys \SystemRoot\system32\DRIVERS\pciide.sys \SystemRoot\system32\DRIVERS\PCIIDEX.SYS \SystemRoot\system32\DRIVERS\iaStor.sys \SystemRoot\system32\drivers\atapi.sys \SystemRoot\system32\drivers\ataport.SYS \SystemRoot\system32\DRIVERS\msahci.sys \SystemRoot\system32\drivers\amdxata.sys \SystemRoot\system32\drivers\fltmgr.sys \SystemRoot\system32\drivers\NISx64\1206000.01D\SYMDS64.SYS \SystemRoot\system32\drivers\fileinfo.sys \SystemRoot\system32\drivers\NISx64\1206000.01D\SYMEFA64.SYS \SystemRoot\System32\Drivers\Ntfs.sys \SystemRoot\System32\Drivers\msrpc.sys \SystemRoot\System32\Drivers\ksecdd.sys \SystemRoot\System32\Drivers\cng.sys \SystemRoot\System32\drivers\pcw.sys \SystemRoot\System32\Drivers\Fs_Rec.sys \SystemRoot\system32\drivers\ndis.sys \SystemRoot\system32\drivers\NETIO.SYS \SystemRoot\System32\Drivers\ksecpkg.sys \SystemRoot\System32\drivers\tcpip.sys \SystemRoot\System32\drivers\fwpkclnt.sys \SystemRoot\system32\drivers\wd.sys \SystemRoot\system32\drivers\volsnap.sys \SystemRoot\system32\DRIVERS\TVALZ_O.SYS \SystemRoot\system32\DRIVERS\tos_sps64.sys \SystemRoot\System32\Drivers\spldr.sys \SystemRoot\System32\drivers\rdyboost.sys \SystemRoot\System32\Drivers\mup.sys \SystemRoot\System32\drivers\hwpolicy.sys \SystemRoot\System32\DRIVERS\fvevol.sys \SystemRoot\system32\drivers\disk.sys \SystemRoot\system32\drivers\CLASSPNP.SYS \SystemRoot\system32\DRIVERS\cdrom.sys \SystemRoot\System32\Drivers\Null.SYS \SystemRoot\System32\Drivers\Beep.SYS \SystemRoot\System32\drivers\vga.sys \SystemRoot\System32\drivers\VIDEOPRT.SYS \SystemRoot\System32\drivers\watchdog.sys \SystemRoot\System32\DRIVERS\RDPCDD.sys \SystemRoot\system32\drivers\rdpencdd.sys \SystemRoot\system32\drivers\rdprefmp.sys \SystemRoot\System32\Drivers\Msfs.SYS \SystemRoot\System32\Drivers\Npfs.SYS \SystemRoot\system32\DRIVERS\tdx.sys \SystemRoot\system32\DRIVERS\TDI.SYS \SystemRoot\system32\drivers\afd.sys \SystemRoot\System32\DRIVERS\netbt.sys \SystemRoot\system32\DRIVERS\wfplwf.sys \SystemRoot\system32\DRIVERS\pacer.sys \SystemRoot\system32\DRIVERS\vwififlt.sys \SystemRoot\system32\DRIVERS\netbios.sys \SystemRoot\system32\DRIVERS\wanarp.sys \SystemRoot\system32\DRIVERS\termdd.sys \SystemRoot\System32\Drivers\NISx64\1206000.01D\SYMNETS.SYS \??\C:\windows\system32\Drivers\SYMEVENT64x86.SYS \SystemRoot\system32\drivers\NISx64\1206000.01D\SRTSPX64.SYS \SystemRoot\system32\DRIVERS\rdbss.sys \SystemRoot\system32\drivers\nsiproxy.sys \SystemRoot\system32\DRIVERS\mssmbios.sys \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20110912.030\IDSvia64.sys \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys \SystemRoot\System32\drivers\discache.sys \SystemRoot\System32\Drivers\dfsc.sys \SystemRoot\system32\DRIVERS\blbdrive.sys \SystemRoot\system32\DRIVERS\tunnel.sys \SystemRoot\system32\DRIVERS\igdkmd64.sys \SystemRoot\System32\drivers\dxgkrnl.sys \SystemRoot\System32\drivers\dxgmms1.sys \SystemRoot\system32\DRIVERS\HECIx64.sys \SystemRoot\system32\drivers\usbehci.sys \SystemRoot\system32\drivers\USBPORT.SYS \SystemRoot\system32\DRIVERS\HDAudBus.sys \SystemRoot\system32\DRIVERS\rtl8192Ce.sys \SystemRoot\system32\DRIVERS\vwifibus.sys \SystemRoot\system32\DRIVERS\L1C62x64.sys \SystemRoot\system32\DRIVERS\i8042prt.sys \SystemRoot\system32\DRIVERS\kbdclass.sys \SystemRoot\system32\DRIVERS\SynTP.sys \SystemRoot\system32\DRIVERS\USBD.SYS \SystemRoot\system32\DRIVERS\mouclass.sys \SystemRoot\system32\DRIVERS\tdcmdpst.sys \SystemRoot\system32\DRIVERS\intelppm.sys \SystemRoot\system32\DRIVERS\CmBatt.sys \SystemRoot\system32\DRIVERS\QIOMem.sys \SystemRoot\system32\DRIVERS\TVALZFL.sys \SystemRoot\system32\DRIVERS\wmiacpi.sys \SystemRoot\system32\DRIVERS\CompositeBus.sys \SystemRoot\system32\DRIVERS\AgileVpn.sys \SystemRoot\system32\DRIVERS\rasl2tp.sys \SystemRoot\system32\DRIVERS\ndistapi.sys \SystemRoot\system32\DRIVERS\ndiswan.sys \SystemRoot\system32\DRIVERS\raspppoe.sys \SystemRoot\system32\DRIVERS\raspptp.sys \SystemRoot\system32\DRIVERS\rassstp.sys \SystemRoot\system32\DRIVERS\swenum.sys \SystemRoot\system32\DRIVERS\ks.sys \SystemRoot\system32\DRIVERS\umbus.sys \SystemRoot\system32\DRIVERS\usbhub.sys \SystemRoot\System32\Drivers\NDProxy.SYS \SystemRoot\system32\drivers\CHDRT64.sys \SystemRoot\system32\drivers\portcls.sys \SystemRoot\system32\drivers\drmk.sys \SystemRoot\system32\drivers\ksthunk.sys \SystemRoot\system32\DRIVERS\IntcDAud.sys \SystemRoot\system32\DRIVERS\usbccgp.sys \SystemRoot\system32\DRIVERS\dc3d.sys \SystemRoot\system32\DRIVERS\HIDPARSE.SYS \SystemRoot\system32\DRIVERS\hidusb.sys \SystemRoot\system32\DRIVERS\HIDCLASS.SYS \SystemRoot\system32\DRIVERS\kbdhid.sys \SystemRoot\system32\DRIVERS\mouhid.sys \SystemRoot\system32\DRIVERS\point64.sys \SystemRoot\System32\Drivers\usbvideo.sys \SystemRoot\system32\DRIVERS\pgeffect.sys \SystemRoot\System32\win32k.sys \SystemRoot\System32\drivers\Dxapi.sys \SystemRoot\System32\Drivers\crashdmp.sys \SystemRoot\System32\Drivers\dump_iaStor.sys \SystemRoot\System32\Drivers\dump_dumpfve.sys \SystemRoot\system32\DRIVERS\monitor.sys \SystemRoot\System32\TSDDD.dll \SystemRoot\System32\cdd.dll \SystemRoot\System32\ATMFD.DLL \SystemRoot\system32\drivers\luafv.sys \??\C:\windows\system32\drivers\mbam.sys \SystemRoot\system32\DRIVERS\Sftvollh.sys \SystemRoot\system32\DRIVERS\lltdio.sys \SystemRoot\system32\DRIVERS\nwifi.sys \SystemRoot\system32\DRIVERS\ndisuio.sys \SystemRoot\system32\DRIVERS\rspndr.sys \SystemRoot\system32\drivers\HTTP.sys \SystemRoot\System32\DRIVERS\srvnet.sys \SystemRoot\system32\DRIVERS\bowser.sys \SystemRoot\system32\DRIVERS\mrxsmb.sys \SystemRoot\system32\DRIVERS\mrxsmb10.sys \SystemRoot\system32\DRIVERS\mrxsmb20.sys \SystemRoot\System32\DRIVERS\srv2.sys \SystemRoot\System32\DRIVERS\srv.sys \SystemRoot\system32\drivers\peauth.sys \SystemRoot\System32\Drivers\secdrv.SYS \SystemRoot\system32\DRIVERS\Sftfslh.sys \SystemRoot\system32\DRIVERS\Sftplaylh.sys \SystemRoot\System32\drivers\tcpipreg.sys \SystemRoot\system32\DRIVERS\Sftredirlh.sys \SystemRoot\system32\DRIVERS\psi_mf.sys \??\C:\windows\system32\drivers\mbamchameleon.sys \??\C:\windows\system32\drivers\mbamswissarmy.sys \Windows\System32\ntdll.dll \Windows\System32\smss.exe \Windows\System32\apisetschema.dll \Windows\System32\autochk.exe ----------- End ----------- <<<1>>> Upper Device Name: \Device\Harddisk0\DR0 Upper Device Object: 0xfffffa80067c7060 Upper Device Driver Name: \Driver\Disk\ Lower Device Name: \Device\Ide\IAAStorageDevice-1\ Lower Device Object: 0xfffffa8004981050 Lower Device Driver Name: \00000463\ Driver name found: iaStor DriverEntry returned 0x0 Function returned 0x0 Downloaded database version: v2012.11.22.08 Downloaded database version: v2012.11.19.01 Initializing... Done! Scanning directory: C:\windows\system32\drivers... <<<2>>> Device number: 0, partition: 2 Physical Sector Size: 512 Drive: 0, DevicePointer: 0xfffffa80067c7060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ --------- Disk Stack ------ DevicePointer: 0xfffffa80067c7b90, DeviceName: Unknown, DriverName: \Driver\partmgr\ DevicePointer: 0xfffffa80067c7060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ DevicePointer: 0xfffffa8004981050, DeviceName: \Device\Ide\IAAStorageDevice-1\, DriverName: \00000463\ ------------ End ---------- Upper DeviceData: 0xfffff8a00f7bf060, 0xfffffa80067c7060, 0xfffffa800afc4090 Lower DeviceData: 0xfffff8a009e03ca0, 0xfffffa8004981050, 0xfffffa80087c8830 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Done! Drive 0 Scanning MBR on drive 0... MBR is forged! Inspecting partition table: MBR Signature: 55AA Disk Signature: 4E59E2AF Partition information: Partition 0 type is Empty (0x0) Partition is ACTIVE. Partition starts at LBA: 17 Numsec = 0 Partition is not bootable Infected: VBR on Empty active partition --> [Rootkit.Pihar.c.MBR] Changing partition to empty and not active. New active partition is 1 on drive 0 ... Partition 0 type is Other (0x27) Partition is ACTIVE. Partition starts at LBA: 2048 Numsec = 3072000 Partition file system is NTFS Partition is bootable Partition 1 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 3074048 Numsec = 593276928 Partition file system is NTFS Partition is bootable Partition 2 type is HIDDEN (0x17) Partition is NOT ACTIVE. Partition starts at LBA: 596350976 Numsec = 28790784 Partition is not bootable Hidden partition VBR is not infected. Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 MBR infection found on drive 0 Disk Size: 320072933376 bytes Sector size: 512 bytes Scanning physical sectors of unpartitioned space on drive 0 (1-16-625122448-625142448)... Sector 625142189 --> [Forged physical sector] Sector 625142190 --> [Forged physical sector] Sector 625142191 --> [Forged physical sector] Sector 625142192 --> [Forged physical sector] Sector 625142193 --> [Forged physical sector] Sector 625142194 --> [Forged physical sector] Sector 625142195 --> [Forged physical sector] Sector 625142196 --> [Forged physical sector] Sector 625142197 --> [Forged physical sector] Sector 625142198 --> [Forged physical sector] Sector 625142199 --> [Forged physical sector] Sector 625142200 --> [Forged physical sector] Sector 625142201 --> [Forged physical sector] Sector 625142202 --> [Forged physical sector] Sector 625142203 --> [Forged physical sector] Sector 625142204 --> [Forged physical sector] Sector 625142205 --> [Forged physical sector] Sector 625142206 --> [Forged physical sector] Sector 625142207 --> [Forged physical sector] Sector 625142208 --> [Forged physical sector] Sector 625142209 --> [Forged physical sector] Sector 625142210 --> [Forged physical sector] Sector 625142211 --> [Forged physical sector] Sector 625142212 --> [Forged physical sector] Sector 625142213 --> [Forged physical sector] Sector 625142214 --> [Forged physical sector] Sector 625142215 --> [Forged physical sector] Sector 625142216 --> [Forged physical sector] Sector 625142217 --> [Forged physical sector] Sector 625142218 --> [Forged physical sector] Sector 625142219 --> [Forged physical sector] Sector 625142220 --> [Forged physical sector] Sector 625142221 --> [Forged physical sector] Sector 625142222 --> [Forged physical sector] Sector 625142223 --> [Forged physical sector] Sector 625142224 --> [Forged physical sector] Sector 625142225 --> [Forged physical sector] Sector 625142226 --> [Forged physical sector] Sector 625142227 --> [Forged physical sector] Sector 625142228 --> [Forged physical sector] Sector 625142229 --> [Forged physical sector] Sector 625142230 --> [Forged physical sector] Sector 625142231 --> [Forged physical sector] Sector 625142232 --> [Forged physical sector] Sector 625142233 --> [Forged physical sector] Sector 625142234 --> [Forged physical sector] Sector 625142235 --> [Forged physical sector] Sector 625142236 --> [Forged physical sector] Sector 625142237 --> [Forged physical sector] Sector 625142238 --> [Forged physical sector] Sector 625142239 --> [Forged physical sector] Sector 625142240 --> [Forged physical sector] Sector 625142241 --> [Forged physical sector] Sector 625142242 --> [Forged physical sector] Sector 625142243 --> [Forged physical sector] Sector 625142244 --> [Forged physical sector] Sector 625142245 --> [Forged physical sector] Sector 625142246 --> [Forged physical sector] Sector 625142247 --> [Forged physical sector] Sector 625142248 --> [Forged physical sector] Sector 625142249 --> [Forged physical sector] Sector 625142250 --> [Forged physical sector] Sector 625142251 --> [Forged physical sector] Sector 625142252 --> [Forged physical sector] Sector 625142253 --> [Forged physical sector] Sector 625142254 --> [Forged physical sector] Sector 625142255 --> [Forged physical sector] Sector 625142256 --> [Forged physical sector] Sector 625142257 --> [Forged physical sector] Sector 625142258 --> [Forged physical sector] Sector 625142259 --> [Forged physical sector] Sector 625142260 --> [Forged physical sector] Sector 625142261 --> [Forged physical sector] Sector 625142262 --> [Forged physical sector] Sector 625142263 --> [Forged physical sector] Sector 625142264 --> [Forged physical sector] Sector 625142265 --> [Forged physical sector] Sector 625142266 --> [Forged physical sector] Sector 625142267 --> [Forged physical sector] Sector 625142268 --> [Forged physical sector] Sector 625142269 --> [Forged physical sector] Sector 625142270 --> [Forged physical sector] Sector 625142271 --> [Forged physical sector] Sector 625142272 --> [Forged physical sector] Sector 625142273 --> [Forged physical sector] Sector 625142274 --> [Forged physical sector] Sector 625142275 --> [Forged physical sector] Sector 625142276 --> [Forged physical sector] Sector 625142277 --> [Forged physical sector] Sector 625142278 --> [Forged physical sector] Sector 625142279 --> [Forged physical sector] Sector 625142280 --> [Forged physical sector] Sector 625142281 --> [Forged physical sector] Sector 625142282 --> [Forged physical sector] Sector 625142283 --> [Forged physical sector] Sector 625142284 --> [Forged physical sector] Sector 625142285 --> [Forged physical sector] Sector 625142286 --> [Forged physical sector] Sector 625142287 --> [Forged physical sector] Sector 625142288 --> [Forged physical sector] Sector 625142289 --> [Forged physical sector] Sector 625142290 --> [Forged physical sector] Sector 625142291 --> [Forged physical sector] Sector 625142292 --> [Forged physical sector] Sector 625142293 --> [Forged physical sector] Sector 625142294 --> [Forged physical sector] Sector 625142295 --> [Forged physical sector] Sector 625142296 --> [Forged physical sector] Sector 625142297 --> [Forged physical sector] Sector 625142298 --> [Forged physical sector] Sector 625142299 --> [Forged physical sector] Sector 625142300 --> [Forged physical sector] Sector 625142301 --> [Forged physical sector] Sector 625142302 --> [Forged physical sector] Sector 625142303 --> [Forged physical sector] Sector 625142304 --> [Forged physical sector] Sector 625142305 --> [Forged physical sector] Sector 625142306 --> [Forged physical sector] Sector 625142307 --> [Forged physical sector] Sector 625142308 --> [Forged physical sector] Sector 625142309 --> [Forged physical sector] Sector 625142310 --> [Forged physical sector] Sector 625142311 --> [Forged physical sector] Sector 625142312 --> [Forged physical sector] Sector 625142313 --> [Forged physical sector] Sector 625142314 --> [Forged physical sector] Sector 625142315 --> [Forged physical sector] Sector 625142316 --> [Forged physical sector] Sector 625142317 --> [Forged physical sector] Sector 625142318 --> [Forged physical sector] Sector 625142319 --> [Forged physical sector] Sector 625142320 --> [Forged physical sector] Sector 625142321 --> [Forged physical sector] Sector 625142322 --> [Forged physical sector] Sector 625142323 --> [Forged physical sector] Sector 625142324 --> [Forged physical sector] Sector 625142325 --> [Forged physical sector] Sector 625142326 --> [Forged physical sector] Sector 625142327 --> [Forged physical sector] Sector 625142328 --> [Forged physical sector] Sector 625142329 --> [Forged physical sector] Sector 625142330 --> [Forged physical sector] Sector 625142331 --> [Forged physical sector] Sector 625142332 --> [Forged physical sector] Sector 625142333 --> [Forged physical sector] Sector 625142334 --> [Forged physical sector] Sector 625142335 --> [Forged physical sector] Sector 625142336 --> [Forged physical sector] Sector 625142337 --> [Forged physical sector] Sector 625142338 --> [Forged physical sector] Sector 625142339 --> [Forged physical sector] Sector 625142340 --> [Forged physical sector] Sector 625142341 --> [Forged physical sector] Sector 625142342 --> [Forged physical sector] Sector 625142343 --> [Forged physical sector] Sector 625142344 --> [Forged physical sector] Sector 625142345 --> [Forged physical sector] Sector 625142346 --> [Forged physical sector] Sector 625142347 --> [Forged physical sector] Sector 625142348 --> [Forged physical sector] Sector 625142349 --> [Forged physical sector] Sector 625142350 --> [Forged physical sector] Sector 625142351 --> [Forged physical sector] Sector 625142352 --> [Forged physical sector] Sector 625142353 --> [Forged physical sector] Sector 625142354 --> [Forged physical sector] Sector 625142355 --> [Forged physical sector] Sector 625142356 --> [Forged physical sector] Sector 625142357 --> [Forged physical sector] Sector 625142358 --> [Forged physical sector] Sector 625142359 --> [Forged physical sector] Sector 625142360 --> [Forged physical sector] Sector 625142361 --> [Forged physical sector] Sector 625142362 --> [Forged physical sector] Sector 625142363 --> [Forged physical sector] Sector 625142364 --> [Forged physical sector] Sector 625142365 --> [Forged physical sector] Sector 625142366 --> [Forged physical sector] Sector 625142367 --> [Forged physical sector] Sector 625142368 --> [Forged physical sector] Sector 625142369 --> [Forged physical sector] Sector 625142370 --> [Forged physical sector] Sector 625142371 --> [Forged physical sector] Sector 625142372 --> [Forged physical sector] Sector 625142373 --> [Forged physical sector] Sector 625142374 --> [Forged physical sector] Sector 625142375 --> [Forged physical sector] Sector 625142376 --> [Forged physical sector] Sector 625142377 --> [Forged physical sector] Sector 625142378 --> [Forged physical sector] Sector 625142379 --> [Forged physical sector] Sector 625142380 --> [Forged physical sector] Sector 625142381 --> [Forged physical sector] Sector 625142382 --> [Forged physical sector] Sector 625142383 --> [Forged physical sector] Sector 625142384 --> [Forged physical sector] Sector 625142385 --> [Forged physical sector] Sector 625142386 --> [Forged physical sector] Sector 625142387 --> [Forged physical sector] Sector 625142388 --> [Forged physical sector] Sector 625142389 --> [Forged physical sector] Sector 625142390 --> [Forged physical sector] Sector 625142391 --> [Forged physical sector] Sector 625142392 --> [Forged physical sector] Sector 625142393 --> [Forged physical sector] Sector 625142394 --> [Forged physical sector] Sector 625142395 --> [Forged physical sector] Sector 625142396 --> [Forged physical sector] Sector 625142397 --> [Forged physical sector] Sector 625142398 --> [Forged physical sector] Sector 625142399 --> [Forged physical sector] Sector 625142400 --> [Forged physical sector] Sector 625142401 --> [Forged physical sector] Sector 625142402 --> [Forged physical sector] Sector 625142403 --> [Forged physical sector] Sector 625142404 --> [Forged physical sector] Sector 625142405 --> [Forged physical sector] Sector 625142406 --> [Forged physical sector] Sector 625142407 --> [Forged physical sector] Sector 625142408 --> [Forged physical sector] Sector 625142409 --> [Forged physical sector] Sector 625142410 --> [Forged physical sector] Sector 625142411 --> [Forged physical sector] Sector 625142412 --> [Forged physical sector] Sector 625142413 --> [Forged physical sector] Sector 625142414 --> [Forged physical sector] Sector 625142415 --> [Forged physical sector] Sector 625142416 --> [Forged physical sector] Sector 625142417 --> [Forged physical sector] Sector 625142418 --> [Forged physical sector] Sector 625142419 --> [Forged physical sector] Sector 625142420 --> [Forged physical sector] Sector 625142421 --> [Forged physical sector] Sector 625142422 --> [Forged physical sector] Sector 625142423 --> [Forged physical sector] Sector 625142424 --> [Forged physical sector] Sector 625142425 --> [Forged physical sector] Sector 625142426 --> [Forged physical sector] Sector 625142427 --> [Forged physical sector] Sector 625142428 --> [Forged physical sector] Sector 625142429 --> [Forged physical sector] Sector 625142430 --> [Forged physical sector] Sector 625142431 --> [Forged physical sector] Sector 625142432 --> [Forged physical sector] Sector 625142433 --> [Forged physical sector] Sector 625142434 --> [Forged physical sector] Sector 625142435 --> [Forged physical sector] Sector 625142436 --> [Forged physical sector] Sector 625142437 --> [Forged physical sector] Sector 625142438 --> [Forged physical sector] Sector 625142439 --> [Forged physical sector] Sector 625142440 --> [Forged physical sector] Sector 625142441 --> [Forged physical sector] Sector 625142442 --> [Forged physical sector] Sector 625142443 --> [Forged physical sector] Sector 625142444 --> [Forged physical sector] Sector 625142445 --> [Forged physical sector] Sector 625142446 --> [Forged physical sector] Sector 625142447 --> [Forged physical sector] Done! Performing system, memory and registry scan... Read File: File "C:\ProgramData\{373A11D3-0B96-4E16-9184-7D0FBE86932F}\Best Buy pc app Setup.dat" is compressed (flags = 1) Read File: File "C:\ProgramData\{373A11D3-0B96-4E16-9184-7D0FBE86932F}\instance.dat" is compressed (flags = 1) Infected: C:\Windows\ARTGALRY.CAG --> [Trojan.Downloader] Infected: C:\Windows\assembly\GAC_32\Desktop.ini --> [Rootkit.0access] Infected: C:\Windows\assembly\GAC_64\Desktop.ini --> [Rootkit.0access] Infected: C:\Windows\svchost.exe --> [Trojan.Agent] Infected: C:\Windows\svchost.exe --> [Trojan.Agent] Infected: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows --> [Hijack.Trojan.Siredef.D] Done! Scan finished Creating System Restore point... Scheduling clean up... <<<2>>> Device number: 0, partition: 2 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes BCD Entry for BOOTEMS is missing Malicious Entry 26000022 for BOOTEMS present! Removal scheduling successful. System shutdown needed. System shutdown occured ======================================= --------------------------------------- Malwarebytes Anti-Rootkit BETA 1.01.0.1009 © Malwarebytes Corporation 2011-2012 OS version: 6.1.7601 Windows 7 Service Pack 1 x64 Account is Administrative Internet Explorer version: 8.0.7601.17514 File system is: NTFS Disk drives: C:\ DRIVE_FIXED, Q:\ DRIVE_FIXED CPU speed: 1.995000 GHz Memory total: 4240293888, free: 3022487552 Second scan revealed no malware found... Will keep you posted. Thanks a bunch! Happy Thanksgiving!

Here's the Rkiller report: RogueKiller V8.3.1 [Nov 22 2012] by Tigzy mail: tigzyRK<at>gmail<dot>com Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/ Website: http://tigzy.geekstogo.com/roguekiller.php Blog: http://tigzyrk.blogspot.com Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version Started in : Normal mode User : Jeff [Admin rights] Mode : Remove -- Date : 11/22/2012 12:01:17 ¤¤¤ Bad processes : 1 ¤¤¤ [sVCHOST] svchost.exe -- \\.\globalroot\systemroot\svchost.exe -> KILLED [TermProc] ¤¤¤ Registry Entries : 3 ¤¤¤ [sTARTUP][sUSP PATH] Best Buy pc app.lnk @Default : C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe -> DELETED [HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0) [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0) ¤¤¤ Particular Files / Folders: ¤¤¤ [ZeroAccess][FILE] Desktop.ini : C:\windows\Assembly\GAC_32\Desktop.ini --> REMOVED AT REBOOT [ZeroAccess][FILE] Desktop.ini : C:\windows\Assembly\GAC_64\Desktop.ini --> REMOVED AT REBOOT ¤¤¤ Driver : [NOT LOADED] ¤¤¤ ¤¤¤ Infection : ZeroAccess ¤¤¤ [ZeroAccess] sys32\consrv.dll present! ¤¤¤ HOSTS File: ¤¤¤ --> C:\windows\system32\drivers\etc\hosts ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: TOSHIBA MK3265GSXN +++++ --- User --- [MBR] 9a16b4edb03fb02adc82e492c63f619a [bSP] 63885d87e66f1c5e0588240d5acca9d1 : Windows Vista MBR Code Partition table: 0 - [ACTIVE] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 1500 Mo 1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 3074048 | Size: 289686 Mo 2 - [XXXXXX] NTFS (0x17) [HIDDEN!] Offset (sectors): 596350976 | Size: 14058 Mo User != LL1 ... KO! --- LL1 --- [MBR] cd0dd60cb410dca6ae4983b5c62d017d [bSP] 63885d87e66f1c5e0588240d5acca9d1 : Windows Vista MBR Code Partition table: 1 - [ACTIVE] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 1500 Mo 2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 3074048 | Size: 289686 Mo 3 - [XXXXXX] NTFS (0x17) [HIDDEN!] Offset (sectors): 596350976 | Size: 14058 Mo User != LL2 ... KO! --- LL2 --- [MBR] cd0dd60cb410dca6ae4983b5c62d017d [bSP] 63885d87e66f1c5e0588240d5acca9d1 : Windows Vista MBR Code Partition table: 1 - [ACTIVE] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 1500 Mo 2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 3074048 | Size: 289686 Mo 3 - [XXXXXX] NTFS (0x17) [HIDDEN!] Offset (sectors): 596350976 | Size: 14058 Mo Finished : << RKreport[2]_D_11222012_02d1201.txt >> RKreport[1]_S_11222012_02d1156.txt ; RKreport[2]_D_11222012_02d1201.txt Going to run Malwarebytes again and scan.

This Trojan is not being deleted by Malwarebytes even though the program identifies and says it will delete on reboot, a subsequent scan shows it's still there. It also causes the computer to shut down overnight where upon re-starting I get an error message and have to shut it down again and start in Safe mode. From there I can re-start in Normal and everything runs fine. This has happened the past three days. I'm running Rogue killer and deleted what it said and I'm waiting to run another scan through Malwarebytes. Malwarebytes Anti-Malware 1.65.1.1000 www.malwarebytes.org Database version: v2012.11.19.10 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 8.0.7601.17514 Jeff :: JEFF-PC [administrator] 11/22/2012 9:03:28 AM mbam-log-2012-11-22 (09-03-28).txt Scan type: Full scan (C:\|) Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 399995 Time elapsed: 40 minute(s), 51 second(s) Memory Processes Detected: 1 C:\Windows\svchost.exe (Trojan.Agent) -> 5332 -> Delete on reboot. Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 1 C:\Windows\svchost.exe (Trojan.Agent) -> Delete on reboot. (end)