Jump to content

jeffpate1964

Members
 View Profile  See their activity

  • Posts

    7

  • Joined

  • Last visited

 Content Type 

Posts posted by jeffpate1964

    Trojan Agent Won't Go

    in Resolved Malware Removal Logs

    Posted

    Results of screen317's Security Check version 0.99.54

    Windows 7 Service Pack 1 x64 (UAC is enabled)

    Internet Explorer 8 Out of date!

    ``````````````Antivirus/Firewall Check:``````````````

    Windows Firewall Enabled!

    Norton Internet Security

    WMI entry may not exist for antivirus; attempting automatic update.

    `````````Anti-malware/Other Utilities Check:`````````

    Secunia PSI (2.0.0.4003)

    Malwarebytes Anti-Malware version 1.65.1.1000

    JavaFX 2.1.1

    Java 7 Update 7

    Java version out of Date!

    Adobe Flash Player 11.5.502.110

    Adobe Reader X (10.1.4)

    Mozilla Firefox 12.0 Firefox out of Date!

    Google Chrome 21.0.1180.83

    Google Chrome 21.0.1180.89

    Google Chrome 22.0.1229.79

    Google Chrome 22.0.1229.92

    Google Chrome 22.0.1229.94

    Google Chrome 23.0.1271.64

    ````````Process Check: objlist.exe by Laurent````````

    Norton ccSvcHst.exe

    Malwarebytes Anti-Malware mbamservice.exe

    Malwarebytes Anti-Malware mbamgui.exe

    Malwarebytes' Anti-Malware mbamscheduler.exe

    `````````````````System Health check`````````````````

    Total Fragmentation on Drive C: 1%

    ````````````````````End of Log``````````````````````

    Trojan Agent Won't Go

    in Resolved Malware Removal Logs

    Posted

    # AdwCleaner v2.008 - Logfile created 11/23/2012 at 09:49:43

    # Updated 17/11/2012 by Xplode

    # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

    # User : Jeff - JEFF-PC

    # Boot Mode : Normal

    # Running from : C:\Users\Jeff\Desktop\adwcleaner.exe

    # Option [Delete]

    ***** [services] *****

    ***** [Files / Folders] *****

    File Deleted : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml

    File Deleted : C:\user.js

    Folder Deleted : C:\ProgramData\Babylon

    Folder Deleted : C:\Users\Jeff\AppData\Local\Babylon

    Folder Deleted : C:\Users\Jeff\AppData\Roaming\Babylon

    ***** [Registry] *****

    Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}

    Key Deleted : HKLM\Software\Babylon

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}

    Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL

    Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap

    Key Deleted : HKLM\Software\Freeze.com

    Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32

    Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}

    Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}

    Key Deleted : HKLM\SOFTWARE\Software

    ***** [internet Browsers] *****

    -\\ Internet Explorer v8.0.7601.17514

    Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://isearch.babylon.com/?babsrc=HP_ss&mntrId=f04f7068000000000000e89a8f6fde94 --> hxxp://www.google.com

    Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://isearch.babylon.com/?babsrc=NT_ss&mntrId=f04f7068000000000000e89a8f6fde94 --> hxxp://www.google.com

    -\\ Mozilla Firefox v12.0 (en-US)

    Profile name : default

    File : C:\Users\Jeff\AppData\Roaming\Mozilla\Firefox\Profiles\13l6al6m.default\prefs.js

    C:\Users\Jeff\AppData\Roaming\Mozilla\Firefox\Profiles\13l6al6m.default\user.js ... Deleted !

    Deleted : user_pref("extensions.BabylonToolbar.admin", false);

    Deleted : user_pref("extensions.BabylonToolbar.aflt", "babsst");

    Deleted : user_pref("extensions.BabylonToolbar.babExt", "");

    Deleted : user_pref("extensions.BabylonToolbar.babTrack", "affID=112546");

    Deleted : user_pref("extensions.BabylonToolbar.bbDpng", 23);

    Deleted : user_pref("extensions.BabylonToolbar.dfltSrch", false);

    Deleted : user_pref("extensions.BabylonToolbar.hmpg", false);

    Deleted : user_pref("extensions.BabylonToolbar.id", "f04f7068000000000000e89a8f6fde94");

    Deleted : user_pref("extensions.BabylonToolbar.instlDay", "15451");

    Deleted : user_pref("extensions.BabylonToolbar.instlRef", "sst");

    Deleted : user_pref("extensions.BabylonToolbar.lastDP", 23);

    Deleted : user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.5.3.1717:58:42");

    Deleted : user_pref("extensions.BabylonToolbar.mntrFFxVrsn", "12.0");

    Deleted : user_pref("extensions.BabylonToolbar.newTab", true);

    Deleted : user_pref("extensions.BabylonToolbar.newTabUrl", "hxxp://search.babylon.com/?babsrc=NT_bb");

    Deleted : user_pref("extensions.BabylonToolbar.noFFXTlbr", false);

    Deleted : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");

    Deleted : user_pref("extensions.BabylonToolbar.propectorlck", 92241028);

    Deleted : user_pref("extensions.BabylonToolbar.prtnrId", "babylon");

    Deleted : user_pref("extensions.BabylonToolbar.ptch_0717", true);

    Deleted : user_pref("extensions.BabylonToolbar.smplGrp", "azb");

    Deleted : user_pref("extensions.BabylonToolbar.srcExt", "ss");

    Deleted : user_pref("extensions.BabylonToolbar.tlbrId", "base");

    Deleted : user_pref("extensions.BabylonToolbar.vrsn", "1.5.3.17");

    Deleted : user_pref("extensions.BabylonToolbar.vrsnTs", "1.5.3.1717:58:42");

    Deleted : user_pref("extensions.BabylonToolbar.vrsni", "1.5.3.17");

    Deleted : user_pref("extensions.BabylonToolbar_i.aflt", "babsst");

    Deleted : user_pref("extensions.BabylonToolbar_i.babExt", "");

    Deleted : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=112546");

    Deleted : user_pref("extensions.BabylonToolbar_i.hardId", "f04f7068000000000000e89a8f6fde94");

    Deleted : user_pref("extensions.BabylonToolbar_i.id", "f04f7068000000000000e89a8f6fde94");

    Deleted : user_pref("extensions.BabylonToolbar_i.instlDay", "15451");

    Deleted : user_pref("extensions.BabylonToolbar_i.instlRef", "sst");

    Deleted : user_pref("extensions.BabylonToolbar_i.ovrDmn", "isearch.babylon.com");

    Deleted : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");

    Deleted : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");

    Deleted : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");

    Deleted : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");

    Deleted : user_pref("extensions.BabylonToolbar_i.tlbrId", "base");

    Deleted : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");

    Deleted : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1717:58:42");

    Deleted : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");

    Deleted : user_pref("extensions.enabledAddons", "ffxtlbr@babylon.com:1.1.9,{972ce4c6-7e08-4474-a285-3208198ce6[...]

    Profile name : default

    File : C:\Users\Melvalyn\AppData\Roaming\Mozilla\Firefox\Profiles\1qwz2i2l.default\prefs.js

    [OK] File is clean.

    *************************

    AdwCleaner[R1].txt - [5571 octets] - [23/11/2012 09:04:46]

    AdwCleaner[R2].txt - [5512 octets] - [23/11/2012 09:49:03]

    AdwCleaner[s1].txt - [5587 octets] - [23/11/2012 09:49:43]

    ########## EOF - C:\AdwCleaner[s1].txt - [5647 octets] ##########

    Trojan Agent Won't Go

    in Resolved Malware Removal Logs

    Posted

    It's going well so far--thanks. It didn't shut down overnight like it had been for the past three days. Here's the log for the adwcleaner search:

    # AdwCleaner v2.008 - Logfile created 11/23/2012 at 09:04:46

    # Updated 17/11/2012 by Xplode

    # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

    # User : Jeff - JEFF-PC

    # Boot Mode : Normal

    # Running from : C:\Users\Jeff\Desktop\adwcleaner.exe

    # Option [search]

    ***** [services] *****

    ***** [Files / Folders] *****

    File Found : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml

    File Found : C:\user.js

    Folder Found : C:\ProgramData\Babylon

    Folder Found : C:\Users\Jeff\AppData\Local\Babylon

    Folder Found : C:\Users\Jeff\AppData\Roaming\Babylon

    Folder Found : C:\Users\Jeff\AppData\Roaming\Mozilla\Firefox\Profiles\13l6al6m.default\extensions\ffxtlbr@babylon.com

    ***** [Registry] *****

    Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}

    Key Found : HKLM\Software\Babylon

    Key Found : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}

    Key Found : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}

    Key Found : HKLM\SOFTWARE\Classes\AppID\escort.DLL

    Key Found : HKLM\SOFTWARE\Classes\Prod.cap

    Key Found : HKLM\Software\Freeze.com

    Key Found : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32

    Key Found : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}

    Key Found : HKLM\SOFTWARE\Software

    Key Found : HKU\S-1-5-21-3623149405-208912857-704148503-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}

    ***** [internet Browsers] *****

    -\\ Internet Explorer v8.0.7601.17514

    [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://isearch.babylon.com/?babsrc=HP_ss&mntrId=f04f7068000000000000e89a8f6fde94

    [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://isearch.babylon.com/?babsrc=NT_ss&mntrId=f04f7068000000000000e89a8f6fde94

    -\\ Mozilla Firefox v12.0 (en-US)

    Profile name : default

    File : C:\Users\Jeff\AppData\Roaming\Mozilla\Firefox\Profiles\13l6al6m.default\prefs.js

    Found : user_pref("extensions.BabylonToolbar.admin", false);

    Found : user_pref("extensions.BabylonToolbar.aflt", "babsst");

    Found : user_pref("extensions.BabylonToolbar.babExt", "");

    Found : user_pref("extensions.BabylonToolbar.babTrack", "affID=112546");

    Found : user_pref("extensions.BabylonToolbar.bbDpng", 22);

    Found : user_pref("extensions.BabylonToolbar.dfltSrch", false);

    Found : user_pref("extensions.BabylonToolbar.hmpg", false);

    Found : user_pref("extensions.BabylonToolbar.id", "f04f7068000000000000e89a8f6fde94");

    Found : user_pref("extensions.BabylonToolbar.instlDay", "15451");

    Found : user_pref("extensions.BabylonToolbar.instlRef", "sst");

    Found : user_pref("extensions.BabylonToolbar.lastDP", 22);

    Found : user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.5.3.1717:58:42");

    Found : user_pref("extensions.BabylonToolbar.mntrFFxVrsn", "12.0");

    Found : user_pref("extensions.BabylonToolbar.newTab", true);

    Found : user_pref("extensions.BabylonToolbar.newTabUrl", "hxxp://search.babylon.com/?babsrc=NT_bb");

    Found : user_pref("extensions.BabylonToolbar.noFFXTlbr", false);

    Found : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");

    Found : user_pref("extensions.BabylonToolbar.propectorlck", 92164695);

    Found : user_pref("extensions.BabylonToolbar.prtnrId", "babylon");

    Found : user_pref("extensions.BabylonToolbar.ptch_0717", true);

    Found : user_pref("extensions.BabylonToolbar.smplGrp", "azb");

    Found : user_pref("extensions.BabylonToolbar.srcExt", "ss");

    Found : user_pref("extensions.BabylonToolbar.tlbrId", "base");

    Found : user_pref("extensions.BabylonToolbar.vrsn", "1.5.3.17");

    Found : user_pref("extensions.BabylonToolbar.vrsnTs", "1.5.3.1717:58:42");

    Found : user_pref("extensions.BabylonToolbar.vrsni", "1.5.3.17");

    Found : user_pref("extensions.BabylonToolbar_i.aflt", "babsst");

    Found : user_pref("extensions.BabylonToolbar_i.babExt", "");

    Found : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=112546");

    Found : user_pref("extensions.BabylonToolbar_i.hardId", "f04f7068000000000000e89a8f6fde94");

    Found : user_pref("extensions.BabylonToolbar_i.id", "f04f7068000000000000e89a8f6fde94");

    Found : user_pref("extensions.BabylonToolbar_i.instlDay", "15451");

    Found : user_pref("extensions.BabylonToolbar_i.instlRef", "sst");

    Found : user_pref("extensions.BabylonToolbar_i.ovrDmn", "isearch.babylon.com");

    Found : user_pref("extensions.BabylonToolbar_i.prdct", "BabylonToolbar");

    Found : user_pref("extensions.BabylonToolbar_i.prtnrId", "babylon");

    Found : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");

    Found : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");

    Found : user_pref("extensions.BabylonToolbar_i.tlbrId", "base");

    Found : user_pref("extensions.BabylonToolbar_i.vrsn", "1.5.3.17");

    Found : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.3.1717:58:42");

    Found : user_pref("extensions.BabylonToolbar_i.vrsni", "1.5.3.17");

    Found : user_pref("extensions.enabledAddons", "ffxtlbr@babylon.com:1.1.9,{972ce4c6-7e08-4474-a285-3208198ce6[...]

    Profile name : default

    File : C:\Users\Melvalyn\AppData\Roaming\Mozilla\Firefox\Profiles\1qwz2i2l.default\prefs.js

    [OK] File is clean.

    *************************

    AdwCleaner[R1].txt - [5446 octets] - [23/11/2012 09:04:46]

    ########## EOF - C:\AdwCleaner[R1].txt - [5506 octets] ##########

    Thanks so much for your help.

    Trojan Agent Won't Go

    in Resolved Malware Removal Logs

    Posted

    Yeah, it did give me the "illegal operation" message and the reboot solved it. Here's the log from Combofix

    ComboFix 12-11-22.03 - Jeff 11/22/2012 15:52:01.1.2 - x64

    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4044.2238 [GMT -5:00]

    Running from: c:\users\Jeff\Desktop\ComboFix.exe

    AV: Norton Internet Security *Disabled/Outdated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

    FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

    SP: Norton Internet Security *Disabled/Outdated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

    SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    .

    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    C:\Install.exe

    c:\programdata\126286f2l228e818f077w0jcy6l8

    c:\programdata\dsgsdgdsgdsgw.pad

    .

    .

    ((((((((((((((((((((((((( Files Created from 2012-10-22 to 2012-11-22 )))))))))))))))))))))))))))))))

    .

    .

    2012-11-15 11:07 . 2012-07-26 04:55 785512 ----a-w- c:\windows\system32\drivers\Wdf01000.sys

    2012-11-15 11:07 . 2012-07-26 04:55 54376 ----a-w- c:\windows\system32\drivers\WdfLdr.sys

    2012-11-15 11:07 . 2012-07-26 04:47 2560 ----a-w- c:\windows\system32\drivers\en-US\wdf01000.sys.mui

    2012-11-15 11:07 . 2012-07-26 02:36 9728 ----a-w- c:\windows\system32\Wdfres.dll

    2012-11-15 11:01 . 2012-07-26 03:08 229888 ----a-w- c:\windows\system32\WUDFHost.exe

    2012-11-15 11:01 . 2012-07-26 03:08 84992 ----a-w- c:\windows\system32\WUDFSvc.dll

    2012-11-15 11:01 . 2012-07-26 03:08 744448 ----a-w- c:\windows\system32\WUDFx.dll

    2012-11-15 11:01 . 2012-07-26 03:08 45056 ----a-w- c:\windows\system32\WUDFCoinstaller.dll

    2012-11-15 11:01 . 2012-07-26 03:08 194048 ----a-w- c:\windows\system32\WUDFPlatform.dll

    2012-11-15 11:01 . 2012-07-26 02:26 87040 ----a-w- c:\windows\system32\drivers\WUDFPf.sys

    2012-11-15 11:01 . 2012-07-26 02:26 198656 ----a-w- c:\windows\system32\drivers\WUDFRd.sys

    2012-11-14 23:10 . 2012-09-25 22:47 78336 ----a-w- c:\windows\SysWow64\synceng.dll

    2012-11-14 23:10 . 2012-09-25 22:46 95744 ----a-w- c:\windows\system32\synceng.dll

    2012-11-12 11:38 . 2012-11-12 11:38 -------- d-----w- c:\program files (x86)\PC Tools

    2012-11-12 11:23 . 2012-11-12 23:59 -------- d-----w- c:\program files (x86)\Common Files\PC Tools

    2012-11-12 11:23 . 2012-11-01 20:35 253256 ----a-w- c:\windows\system32\drivers\PCTSD64.sys

    2012-11-12 11:21 . 2012-11-12 23:58 -------- d-----w- c:\programdata\PC Tools

    2012-11-12 11:21 . 2012-11-12 11:21 -------- d-----w- c:\users\Jeff\AppData\Roaming\TestApp

    .

    .

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2012-11-17 17:41 . 2012-04-13 09:57 697272 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

    2012-11-17 17:41 . 2011-09-14 01:22 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

    2012-11-15 11:01 . 2011-08-26 10:00 66395536 ----a-w- c:\windows\system32\MRT.exe

    2012-09-30 00:54 . 2011-10-18 01:27 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

    2012-09-14 19:19 . 2012-10-10 10:06 2048 ----a-w- c:\windows\system32\tzres.dll

    2012-09-14 18:28 . 2012-10-10 10:06 2048 ----a-w- c:\windows\SysWow64\tzres.dll

    2012-09-06 11:30 . 2012-09-06 11:30 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll

    2012-09-06 11:30 . 2012-07-30 10:24 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll

    2012-09-06 11:30 . 2011-03-24 02:26 746984 ----a-w- c:\windows\SysWow64\deployJava1.dll

    2012-08-31 18:19 . 2012-10-10 10:07 1659760 ----a-w- c:\windows\system32\drivers\ntfs.sys

    2012-08-30 18:03 . 2012-10-10 10:07 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe

    2012-08-30 17:12 . 2012-10-10 10:07 3914096 ----a-w- c:\windows\SysWow64\ntoskrnl.exe

    2012-08-30 17:12 . 2012-10-10 10:07 3968880 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe

    .

    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    .

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-06-29 39408]

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

    "ToshibaServiceStation"="c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2010-11-29 1294712]

    "SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]

    "AdobeCS5.5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]

    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]

    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

    .

    c:\users\Jeff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

    Microsoft Find Fast.lnk - c:\program files (x86)\Microsoft Office\Office\FINDFAST.EXE [1996-11-20 111376]

    Office Startup.lnk - c:\program files (x86)\Microsoft Office\Office\OSA.EXE [1996-11-20 51984]

    .

    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

    Adobe Gamma Loader.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2012-9-23 113664]

    Secunia PSI Tray.lnk - c:\program files (x86)\Secunia\PSI\psi_tray.exe [2011-10-14 291896]

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

    "ConsentPromptBehaviorAdmin"= 5 (0x5)

    "ConsentPromptBehaviorUser"= 3 (0x3)

    "EnableUIADesktopToggle"= 0 (0x0)

    .

    R1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20110901.001\BHDrvx64.sys [2011-09-02 1151096]

    R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1206000.01D\Ironx64.SYS [2011-01-27 171128]

    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

    R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]

    R3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2010-09-01 17976]

    R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-12-01 250984]

    R3 RSUSBVSTOR;RTSUVSTOR.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RTSUVSTOR.sys [2010-11-30 307304]

    R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [2009-06-10 292864]

    R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [2009-06-10 1485312]

    R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [2009-06-10 740864]

    R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

    R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2010-11-29 54136]

    R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2010-12-08 137632]

    R3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [2010-12-21 822704]

    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]

    R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]

    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-08-18 1255736]

    R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]

    S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1206000.01D\SYMDS64.SYS [2011-01-27 450680]

    S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1206000.01D\SYMEFA64.SYS [2011-03-15 912504]

    S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys [2009-06-24 482384]

    S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20110912.030\IDSvia64.sys [2011-08-23 488568]

    S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1206000.01D\SYMNETS.SYS [2011-07-08 386168]

    S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]

    S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-09-30 399432]

    S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-09-30 676936]

    S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe [2011-04-17 130008]

    S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe [2011-10-14 994360]

    S2 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe [2011-10-14 399416]

    S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]

    S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe [2011-03-02 266680]

    S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys [2009-06-20 14472]

    S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-12-21 2656280]

    S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [2011-08-01 52584]

    S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-15 317440]

    S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2010-11-08 76912]

    S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-09-30 25928]

    S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [2011-02-09 38096]

    S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [2011-08-01 45416]

    S3 QIOMem;Generic IO & Memory Access;c:\windows\system32\DRIVERS\QIOMem.sys [2009-06-15 12800]

    S3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;c:\windows\system32\DRIVERS\rtl8192Ce.sys [2011-01-05 1109096]

    S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]

    S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]

    S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]

    S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]

    S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]

    .

    .

    --- Other Services/Drivers In Memory ---

    .

    *NewlyCreated* - WS2IFSL

    .

    Contents of the 'Scheduled Tasks' folder

    .

    2012-11-22 c:\windows\Tasks\Adobe Flash Player Updater.job

    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-13 17:41]

    .

    2012-11-22 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3623149405-208912857-704148503-1001Core.job

    - c:\users\Melvalyn\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-09-15 05:07]

    .

    2012-11-22 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3623149405-208912857-704148503-1001UA.job

    - c:\users\Melvalyn\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-09-15 05:07]

    .

    2012-11-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-29 02:21]

    .

    2012-11-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

    - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-29 02:21]

    .

    .

    --------- X64 Entries -----------

    .

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-04-08 167256]

    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-04-08 391000]

    "Persistence"="c:\windows\system32\igfxpers.exe" [2011-04-08 418136]

    "SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2010-12-14 316032]

    "TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376]

    "TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2010-12-08 710040]

    "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 2417032]

    "AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-15 499608]

    .

    ------- Supplementary Scan -------

    .

    uLocal Page = c:\windows\system32\blank.htm

    uStart Page = hxxp://isearch.babylon.com/?babsrc=HP_ss&mntrId=f04f7068000000000000e89a8f6fde94

    mLocal Page = c:\windows\SysWOW64\blank.htm

    uInternet Settings,ProxyOverride = <local>

    TCP: DhcpNameServer = 192.168.1.254

    FF - ProfilePath - c:\users\Jeff\AppData\Roaming\Mozilla\Firefox\Profiles\13l6al6m.default\

    FF - prefs.js: browser.startup.homepage - www.facebook.com

    FF - prefs.js: keyword.URL - hxxp://www.google.com/webhp?hl=en&tab=ww

    FF - prefs.js: network.proxy.type - 0

    FF - user.js: yahoo.ytff.general.dontshowhpoffer - true);user_pref(extensions.BabylonToolbar_i.babTrack, affID=112546

    FF - user.js: extensions.BabylonToolbar_i.babExt -

    FF - user.js: extensions.BabylonToolbar_i.srcExt - ss

    FF - user.js: extensions.BabylonToolbar_i.ovrDmn - isearch.babylon.com

    FF - user.js: extensions.BabylonToolbar_i.id - f04f7068000000000000e89a8f6fde94

    FF - user.js: extensions.BabylonToolbar_i.hardId - f04f7068000000000000e89a8f6fde94

    FF - user.js: extensions.BabylonToolbar_i.instlDay - 15451

    FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17

    FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17

    FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1717:58

    FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon

    FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar

    FF - user.js: extensions.BabylonToolbar_i.aflt - babsst

    FF - user.js: extensions.BabylonToolbar_i.smplGrp - none

    FF - user.js: extensions.BabylonToolbar_i.tlbrId - base

    FF - user.js: extensions.BabylonToolbar_i.instlRef - sst

    .

    - - - - ORPHANS REMOVED - - - -

    .

    Toolbar-Locked - (no file)

    Wow6432Node-HKLM-Run-TSleepSrv - %ProgramFiles(x86)%\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe

    Toolbar-Locked - (no file)

    HKLM-Run-TPwrMain - c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE

    HKLM-Run-HSON - c:\program files (x86)\TOSHIBA\TBS\HSON.exe

    HKLM-Run-TCrdMain - c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe

    HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe

    HKLM-Run-Teco - c:\program files (x86)\TOSHIBA\TECO\Teco.exe

    HKLM-Run-TosWaitSrv - c:\program files (x86)\TOSHIBA\TPHM\TosWaitSrv.exe

    HKLM-Run-TosNC - c:\program files (x86)\Toshiba\BulletinBoard\TosNcCore.exe

    HKLM-Run-TosReelTimeMonitor - c:\program files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe

    .

    .

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS]

    "ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\18.6.0.29\diMaster.dll\" /prefetch:1"

    .

    --------------------- LOCKED REGISTRY KEYS ---------------------

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="FlashBroker"

    "LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

    "Enabled"=dword:00000001

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

    @="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="IFlashBroker5"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

    @="{00020424-0000-0000-C000-000000000046}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    "Version"="1.0"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="FlashBroker"

    "LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

    "Enabled"=dword:00000001

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

    @="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

    @Denied: (A 2) (Everyone)

    @="Shockwave Flash Object"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

    @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"

    "ThreadingModel"="Apartment"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

    @="0"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

    @="ShockwaveFlash.ShockwaveFlash.11"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

    @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

    @="1.0"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

    @="ShockwaveFlash.ShockwaveFlash"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

    @Denied: (A 2) (Everyone)

    @="Macromedia Flash Factory Object"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

    @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"

    "ThreadingModel"="Apartment"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

    @="FlashFactory.FlashFactory.1"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

    @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

    @="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

    @="1.0"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

    @="FlashFactory.FlashFactory"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="IFlashBroker5"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

    @="{00020424-0000-0000-C000-000000000046}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    "Version"="1.0"

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

    @Denied: (Full) (Everyone)

    .

    ------------------------ Other Running Processes ------------------------

    .

    c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

    c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

    c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

    .

    **************************************************************************

    .

    Completion time: 2012-11-22 16:07:13 - machine was rebooted

    ComboFix-quarantined-files.txt 2012-11-22 21:07

    .

    Pre-Run: 252,357,386,240 bytes free

    Post-Run: 253,763,616,768 bytes free

    .

    - - End Of File - - 79DBE9C85427C790ED53037670958DD8

    Trojan Agent Won't Go

    in Resolved Malware Removal Logs

    Posted

    First scan

    ---------------------------------------

    Malwarebytes Anti-Rootkit BETA 1.01.0.1009

    © Malwarebytes Corporation 2011-2012

    OS version: 6.1.7601 Windows 7 Service Pack 1 x64

    Account is Administrative

    Internet Explorer version: 8.0.7601.17514

    File system is: NTFS

    Disk drives: C:\ DRIVE_FIXED, Q:\ DRIVE_FIXED

    CPU speed: 1.995000 GHz

    Memory total: 4240293888, free: 1661186048

    ------------ Kernel report ------------

    11/22/2012 13:05:59

    ------------ Loaded modules -----------

    \SystemRoot\system32\ntoskrnl.exe

    \SystemRoot\system32\hal.dll

    \SystemRoot\system32\kdcom.dll

    \SystemRoot\system32\mcupdate_GenuineIntel.dll

    \SystemRoot\system32\PSHED.dll

    \SystemRoot\system32\CLFS.SYS

    \SystemRoot\system32\CI.dll

    \SystemRoot\system32\drivers\Wdf01000.sys

    \SystemRoot\system32\drivers\WDFLDR.SYS

    \SystemRoot\system32\drivers\ACPI.sys

    \SystemRoot\system32\drivers\WMILIB.SYS

    \SystemRoot\system32\drivers\msisadrv.sys

    \SystemRoot\system32\drivers\pci.sys

    \SystemRoot\system32\drivers\vdrvroot.sys

    \SystemRoot\System32\drivers\partmgr.sys

    \SystemRoot\system32\drivers\compbatt.sys

    \SystemRoot\system32\drivers\BATTC.SYS

    \SystemRoot\system32\drivers\volmgr.sys

    \SystemRoot\System32\drivers\volmgrx.sys

    \SystemRoot\System32\drivers\mountmgr.sys

    \SystemRoot\system32\DRIVERS\pciide.sys

    \SystemRoot\system32\DRIVERS\PCIIDEX.SYS

    \SystemRoot\system32\DRIVERS\iaStor.sys

    \SystemRoot\system32\drivers\atapi.sys

    \SystemRoot\system32\drivers\ataport.SYS

    \SystemRoot\system32\DRIVERS\msahci.sys

    \SystemRoot\system32\drivers\amdxata.sys

    \SystemRoot\system32\drivers\fltmgr.sys

    \SystemRoot\system32\drivers\NISx64\1206000.01D\SYMDS64.SYS

    \SystemRoot\system32\drivers\fileinfo.sys

    \SystemRoot\system32\drivers\NISx64\1206000.01D\SYMEFA64.SYS

    \SystemRoot\System32\Drivers\Ntfs.sys

    \SystemRoot\System32\Drivers\msrpc.sys

    \SystemRoot\System32\Drivers\ksecdd.sys

    \SystemRoot\System32\Drivers\cng.sys

    \SystemRoot\System32\drivers\pcw.sys

    \SystemRoot\System32\Drivers\Fs_Rec.sys

    \SystemRoot\system32\drivers\ndis.sys

    \SystemRoot\system32\drivers\NETIO.SYS

    \SystemRoot\System32\Drivers\ksecpkg.sys

    \SystemRoot\System32\drivers\tcpip.sys

    \SystemRoot\System32\drivers\fwpkclnt.sys

    \SystemRoot\system32\drivers\wd.sys

    \SystemRoot\system32\drivers\volsnap.sys

    \SystemRoot\system32\DRIVERS\TVALZ_O.SYS

    \SystemRoot\system32\DRIVERS\tos_sps64.sys

    \SystemRoot\System32\Drivers\spldr.sys

    \SystemRoot\System32\drivers\rdyboost.sys

    \SystemRoot\System32\Drivers\mup.sys

    \SystemRoot\System32\drivers\hwpolicy.sys

    \SystemRoot\System32\DRIVERS\fvevol.sys

    \SystemRoot\system32\drivers\disk.sys

    \SystemRoot\system32\drivers\CLASSPNP.SYS

    \SystemRoot\system32\DRIVERS\cdrom.sys

    \SystemRoot\System32\Drivers\Null.SYS

    \SystemRoot\System32\Drivers\Beep.SYS

    \SystemRoot\System32\drivers\vga.sys

    \SystemRoot\System32\drivers\VIDEOPRT.SYS

    \SystemRoot\System32\drivers\watchdog.sys

    \SystemRoot\System32\DRIVERS\RDPCDD.sys

    \SystemRoot\system32\drivers\rdpencdd.sys

    \SystemRoot\system32\drivers\rdprefmp.sys

    \SystemRoot\System32\Drivers\Msfs.SYS

    \SystemRoot\System32\Drivers\Npfs.SYS

    \SystemRoot\system32\DRIVERS\tdx.sys

    \SystemRoot\system32\DRIVERS\TDI.SYS

    \SystemRoot\system32\drivers\afd.sys

    \SystemRoot\System32\DRIVERS\netbt.sys

    \SystemRoot\system32\DRIVERS\wfplwf.sys

    \SystemRoot\system32\DRIVERS\pacer.sys

    \SystemRoot\system32\DRIVERS\vwififlt.sys

    \SystemRoot\system32\DRIVERS\netbios.sys

    \SystemRoot\system32\DRIVERS\wanarp.sys

    \SystemRoot\system32\DRIVERS\termdd.sys

    \SystemRoot\System32\Drivers\NISx64\1206000.01D\SYMNETS.SYS

    \??\C:\windows\system32\Drivers\SYMEVENT64x86.SYS

    \SystemRoot\system32\drivers\NISx64\1206000.01D\SRTSPX64.SYS

    \SystemRoot\system32\DRIVERS\rdbss.sys

    \SystemRoot\system32\drivers\nsiproxy.sys

    \SystemRoot\system32\DRIVERS\mssmbios.sys

    \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20110912.030\IDSvia64.sys

    \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys

    \SystemRoot\System32\drivers\discache.sys

    \SystemRoot\System32\Drivers\dfsc.sys

    \SystemRoot\system32\DRIVERS\blbdrive.sys

    \SystemRoot\system32\DRIVERS\tunnel.sys

    \SystemRoot\system32\DRIVERS\igdkmd64.sys

    \SystemRoot\System32\drivers\dxgkrnl.sys

    \SystemRoot\System32\drivers\dxgmms1.sys

    \SystemRoot\system32\DRIVERS\HECIx64.sys

    \SystemRoot\system32\drivers\usbehci.sys

    \SystemRoot\system32\drivers\USBPORT.SYS

    \SystemRoot\system32\DRIVERS\HDAudBus.sys

    \SystemRoot\system32\DRIVERS\rtl8192Ce.sys

    \SystemRoot\system32\DRIVERS\vwifibus.sys

    \SystemRoot\system32\DRIVERS\L1C62x64.sys

    \SystemRoot\system32\DRIVERS\i8042prt.sys

    \SystemRoot\system32\DRIVERS\kbdclass.sys

    \SystemRoot\system32\DRIVERS\SynTP.sys

    \SystemRoot\system32\DRIVERS\USBD.SYS

    \SystemRoot\system32\DRIVERS\mouclass.sys

    \SystemRoot\system32\DRIVERS\tdcmdpst.sys

    \SystemRoot\system32\DRIVERS\intelppm.sys

    \SystemRoot\system32\DRIVERS\CmBatt.sys

    \SystemRoot\system32\DRIVERS\QIOMem.sys

    \SystemRoot\system32\DRIVERS\TVALZFL.sys

    \SystemRoot\system32\DRIVERS\wmiacpi.sys

    \SystemRoot\system32\DRIVERS\CompositeBus.sys

    \SystemRoot\system32\DRIVERS\AgileVpn.sys

    \SystemRoot\system32\DRIVERS\rasl2tp.sys

    \SystemRoot\system32\DRIVERS\ndistapi.sys

    \SystemRoot\system32\DRIVERS\ndiswan.sys

    \SystemRoot\system32\DRIVERS\raspppoe.sys

    \SystemRoot\system32\DRIVERS\raspptp.sys

    \SystemRoot\system32\DRIVERS\rassstp.sys

    \SystemRoot\system32\DRIVERS\swenum.sys

    \SystemRoot\system32\DRIVERS\ks.sys

    \SystemRoot\system32\DRIVERS\umbus.sys

    \SystemRoot\system32\DRIVERS\usbhub.sys

    \SystemRoot\System32\Drivers\NDProxy.SYS

    \SystemRoot\system32\drivers\CHDRT64.sys

    \SystemRoot\system32\drivers\portcls.sys

    \SystemRoot\system32\drivers\drmk.sys

    \SystemRoot\system32\drivers\ksthunk.sys

    \SystemRoot\system32\DRIVERS\IntcDAud.sys

    \SystemRoot\system32\DRIVERS\usbccgp.sys

    \SystemRoot\system32\DRIVERS\dc3d.sys

    \SystemRoot\system32\DRIVERS\HIDPARSE.SYS

    \SystemRoot\system32\DRIVERS\hidusb.sys

    \SystemRoot\system32\DRIVERS\HIDCLASS.SYS

    \SystemRoot\system32\DRIVERS\kbdhid.sys

    \SystemRoot\system32\DRIVERS\mouhid.sys

    \SystemRoot\system32\DRIVERS\point64.sys

    \SystemRoot\System32\Drivers\usbvideo.sys

    \SystemRoot\system32\DRIVERS\pgeffect.sys

    \SystemRoot\System32\win32k.sys

    \SystemRoot\System32\drivers\Dxapi.sys

    \SystemRoot\System32\Drivers\crashdmp.sys

    \SystemRoot\System32\Drivers\dump_iaStor.sys

    \SystemRoot\System32\Drivers\dump_dumpfve.sys

    \SystemRoot\system32\DRIVERS\monitor.sys

    \SystemRoot\System32\TSDDD.dll

    \SystemRoot\System32\cdd.dll

    \SystemRoot\System32\ATMFD.DLL

    \SystemRoot\system32\drivers\luafv.sys

    \??\C:\windows\system32\drivers\mbam.sys

    \SystemRoot\system32\DRIVERS\Sftvollh.sys

    \SystemRoot\system32\DRIVERS\lltdio.sys

    \SystemRoot\system32\DRIVERS\nwifi.sys

    \SystemRoot\system32\DRIVERS\ndisuio.sys

    \SystemRoot\system32\DRIVERS\rspndr.sys

    \SystemRoot\system32\drivers\HTTP.sys

    \SystemRoot\System32\DRIVERS\srvnet.sys

    \SystemRoot\system32\DRIVERS\bowser.sys

    \SystemRoot\system32\DRIVERS\mrxsmb.sys

    \SystemRoot\system32\DRIVERS\mrxsmb10.sys

    \SystemRoot\system32\DRIVERS\mrxsmb20.sys

    \SystemRoot\System32\DRIVERS\srv2.sys

    \SystemRoot\System32\DRIVERS\srv.sys

    \SystemRoot\system32\drivers\peauth.sys

    \SystemRoot\System32\Drivers\secdrv.SYS

    \SystemRoot\system32\DRIVERS\Sftfslh.sys

    \SystemRoot\system32\DRIVERS\Sftplaylh.sys

    \SystemRoot\System32\drivers\tcpipreg.sys

    \SystemRoot\system32\DRIVERS\Sftredirlh.sys

    \SystemRoot\system32\DRIVERS\psi_mf.sys

    \??\C:\windows\system32\drivers\mbamchameleon.sys

    \??\C:\windows\system32\drivers\mbamswissarmy.sys

    \Windows\System32\ntdll.dll

    \Windows\System32\smss.exe

    \Windows\System32\apisetschema.dll

    \Windows\System32\autochk.exe

    ----------- End -----------

    <<<1>>>

    Upper Device Name: \Device\Harddisk0\DR0

    Upper Device Object: 0xfffffa80067c7060

    Upper Device Driver Name: \Driver\Disk\

    Lower Device Name: \Device\Ide\IAAStorageDevice-1\

    Lower Device Object: 0xfffffa8004981050

    Lower Device Driver Name: \00000463\

    Driver name found: iaStor

    DriverEntry returned 0x0

    Function returned 0x0

    Downloaded database version: v2012.11.22.08

    Downloaded database version: v2012.11.19.01

    Initializing...

    Done!

    Scanning directory: C:\windows\system32\drivers...

    <<<2>>>

    Device number: 0, partition: 2

    Physical Sector Size: 512

    Drive: 0, DevicePointer: 0xfffffa80067c7060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

    --------- Disk Stack ------

    DevicePointer: 0xfffffa80067c7b90, DeviceName: Unknown, DriverName: \Driver\partmgr\

    DevicePointer: 0xfffffa80067c7060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

    DevicePointer: 0xfffffa8004981050, DeviceName: \Device\Ide\IAAStorageDevice-1\, DriverName: \00000463\

    ------------ End ----------

    Upper DeviceData: 0xfffff8a00f7bf060, 0xfffffa80067c7060, 0xfffffa800afc4090

    Lower DeviceData: 0xfffff8a009e03ca0, 0xfffffa8004981050, 0xfffffa80087c8830

    <<<3>>>

    Volume: C:

    File system type: NTFS

    SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

    Done!

    Drive 0

    Scanning MBR on drive 0...

    MBR is forged!

    Inspecting partition table:

    MBR Signature: 55AA

    Disk Signature: 4E59E2AF

    Partition information:

    Partition 0 type is Empty (0x0)

    Partition is ACTIVE.

    Partition starts at LBA: 17 Numsec = 0

    Partition is not bootable

    Infected: VBR on Empty active partition --> [Rootkit.Pihar.c.MBR]

    Changing partition to empty and not active. New active partition is 1 on drive 0 ...

    Partition 0 type is Other (0x27)

    Partition is ACTIVE.

    Partition starts at LBA: 2048 Numsec = 3072000

    Partition file system is NTFS

    Partition is bootable

    Partition 1 type is Primary (0x7)

    Partition is ACTIVE.

    Partition starts at LBA: 3074048 Numsec = 593276928

    Partition file system is NTFS

    Partition is bootable

    Partition 2 type is HIDDEN (0x17)

    Partition is NOT ACTIVE.

    Partition starts at LBA: 596350976 Numsec = 28790784

    Partition is not bootable

    Hidden partition VBR is not infected.

    Partition 3 type is Empty (0x0)

    Partition is NOT ACTIVE.

    Partition starts at LBA: 0 Numsec = 0

    MBR infection found on drive 0

    Disk Size: 320072933376 bytes

    Sector size: 512 bytes

    Scanning physical sectors of unpartitioned space on drive 0 (1-16-625122448-625142448)...

    Sector 625142189 --> [Forged physical sector]

    Sector 625142190 --> [Forged physical sector]

    Sector 625142191 --> [Forged physical sector]

    Sector 625142192 --> [Forged physical sector]

    Sector 625142193 --> [Forged physical sector]

    Sector 625142194 --> [Forged physical sector]

    Sector 625142195 --> [Forged physical sector]

    Sector 625142196 --> [Forged physical sector]

    Sector 625142197 --> [Forged physical sector]

    Sector 625142198 --> [Forged physical sector]

    Sector 625142199 --> [Forged physical sector]

    Sector 625142200 --> [Forged physical sector]

    Sector 625142201 --> [Forged physical sector]

    Sector 625142202 --> [Forged physical sector]

    Sector 625142203 --> [Forged physical sector]

    Sector 625142204 --> [Forged physical sector]

    Sector 625142205 --> [Forged physical sector]

    Sector 625142206 --> [Forged physical sector]

    Sector 625142207 --> [Forged physical sector]

    Sector 625142208 --> [Forged physical sector]

    Sector 625142209 --> [Forged physical sector]

    Sector 625142210 --> [Forged physical sector]

    Sector 625142211 --> [Forged physical sector]

    Sector 625142212 --> [Forged physical sector]

    Sector 625142213 --> [Forged physical sector]

    Sector 625142214 --> [Forged physical sector]

    Sector 625142215 --> [Forged physical sector]

    Sector 625142216 --> [Forged physical sector]

    Sector 625142217 --> [Forged physical sector]

    Sector 625142218 --> [Forged physical sector]

    Sector 625142219 --> [Forged physical sector]

    Sector 625142220 --> [Forged physical sector]

    Sector 625142221 --> [Forged physical sector]

    Sector 625142222 --> [Forged physical sector]

    Sector 625142223 --> [Forged physical sector]

    Sector 625142224 --> [Forged physical sector]

    Sector 625142225 --> [Forged physical sector]

    Sector 625142226 --> [Forged physical sector]

    Sector 625142227 --> [Forged physical sector]

    Sector 625142228 --> [Forged physical sector]

    Sector 625142229 --> [Forged physical sector]

    Sector 625142230 --> [Forged physical sector]

    Sector 625142231 --> [Forged physical sector]

    Sector 625142232 --> [Forged physical sector]

    Sector 625142233 --> [Forged physical sector]

    Sector 625142234 --> [Forged physical sector]

    Sector 625142235 --> [Forged physical sector]

    Sector 625142236 --> [Forged physical sector]

    Sector 625142237 --> [Forged physical sector]

    Sector 625142238 --> [Forged physical sector]

    Sector 625142239 --> [Forged physical sector]

    Sector 625142240 --> [Forged physical sector]

    Sector 625142241 --> [Forged physical sector]

    Sector 625142242 --> [Forged physical sector]

    Sector 625142243 --> [Forged physical sector]

    Sector 625142244 --> [Forged physical sector]

    Sector 625142245 --> [Forged physical sector]

    Sector 625142246 --> [Forged physical sector]

    Sector 625142247 --> [Forged physical sector]

    Sector 625142248 --> [Forged physical sector]

    Sector 625142249 --> [Forged physical sector]

    Sector 625142250 --> [Forged physical sector]

    Sector 625142251 --> [Forged physical sector]

    Sector 625142252 --> [Forged physical sector]

    Sector 625142253 --> [Forged physical sector]

    Sector 625142254 --> [Forged physical sector]

    Sector 625142255 --> [Forged physical sector]

    Sector 625142256 --> [Forged physical sector]

    Sector 625142257 --> [Forged physical sector]

    Sector 625142258 --> [Forged physical sector]

    Sector 625142259 --> [Forged physical sector]

    Sector 625142260 --> [Forged physical sector]

    Sector 625142261 --> [Forged physical sector]

    Sector 625142262 --> [Forged physical sector]

    Sector 625142263 --> [Forged physical sector]

    Sector 625142264 --> [Forged physical sector]

    Sector 625142265 --> [Forged physical sector]

    Sector 625142266 --> [Forged physical sector]

    Sector 625142267 --> [Forged physical sector]

    Sector 625142268 --> [Forged physical sector]

    Sector 625142269 --> [Forged physical sector]

    Sector 625142270 --> [Forged physical sector]

    Sector 625142271 --> [Forged physical sector]

    Sector 625142272 --> [Forged physical sector]

    Sector 625142273 --> [Forged physical sector]

    Sector 625142274 --> [Forged physical sector]

    Sector 625142275 --> [Forged physical sector]

    Sector 625142276 --> [Forged physical sector]

    Sector 625142277 --> [Forged physical sector]

    Sector 625142278 --> [Forged physical sector]

    Sector 625142279 --> [Forged physical sector]

    Sector 625142280 --> [Forged physical sector]

    Sector 625142281 --> [Forged physical sector]

    Sector 625142282 --> [Forged physical sector]

    Sector 625142283 --> [Forged physical sector]

    Sector 625142284 --> [Forged physical sector]

    Sector 625142285 --> [Forged physical sector]

    Sector 625142286 --> [Forged physical sector]

    Sector 625142287 --> [Forged physical sector]

    Sector 625142288 --> [Forged physical sector]

    Sector 625142289 --> [Forged physical sector]

    Sector 625142290 --> [Forged physical sector]

    Sector 625142291 --> [Forged physical sector]

    Sector 625142292 --> [Forged physical sector]

    Sector 625142293 --> [Forged physical sector]

    Sector 625142294 --> [Forged physical sector]

    Sector 625142295 --> [Forged physical sector]

    Sector 625142296 --> [Forged physical sector]

    Sector 625142297 --> [Forged physical sector]

    Sector 625142298 --> [Forged physical sector]

    Sector 625142299 --> [Forged physical sector]

    Sector 625142300 --> [Forged physical sector]

    Sector 625142301 --> [Forged physical sector]

    Sector 625142302 --> [Forged physical sector]

    Sector 625142303 --> [Forged physical sector]

    Sector 625142304 --> [Forged physical sector]

    Sector 625142305 --> [Forged physical sector]

    Sector 625142306 --> [Forged physical sector]

    Sector 625142307 --> [Forged physical sector]

    Sector 625142308 --> [Forged physical sector]

    Sector 625142309 --> [Forged physical sector]

    Sector 625142310 --> [Forged physical sector]

    Sector 625142311 --> [Forged physical sector]

    Sector 625142312 --> [Forged physical sector]

    Sector 625142313 --> [Forged physical sector]

    Sector 625142314 --> [Forged physical sector]

    Sector 625142315 --> [Forged physical sector]

    Sector 625142316 --> [Forged physical sector]

    Sector 625142317 --> [Forged physical sector]

    Sector 625142318 --> [Forged physical sector]

    Sector 625142319 --> [Forged physical sector]

    Sector 625142320 --> [Forged physical sector]

    Sector 625142321 --> [Forged physical sector]

    Sector 625142322 --> [Forged physical sector]

    Sector 625142323 --> [Forged physical sector]

    Sector 625142324 --> [Forged physical sector]

    Sector 625142325 --> [Forged physical sector]

    Sector 625142326 --> [Forged physical sector]

    Sector 625142327 --> [Forged physical sector]

    Sector 625142328 --> [Forged physical sector]

    Sector 625142329 --> [Forged physical sector]

    Sector 625142330 --> [Forged physical sector]

    Sector 625142331 --> [Forged physical sector]

    Sector 625142332 --> [Forged physical sector]

    Sector 625142333 --> [Forged physical sector]

    Sector 625142334 --> [Forged physical sector]

    Sector 625142335 --> [Forged physical sector]

    Sector 625142336 --> [Forged physical sector]

    Sector 625142337 --> [Forged physical sector]

    Sector 625142338 --> [Forged physical sector]

    Sector 625142339 --> [Forged physical sector]

    Sector 625142340 --> [Forged physical sector]

    Sector 625142341 --> [Forged physical sector]

    Sector 625142342 --> [Forged physical sector]

    Sector 625142343 --> [Forged physical sector]

    Sector 625142344 --> [Forged physical sector]

    Sector 625142345 --> [Forged physical sector]

    Sector 625142346 --> [Forged physical sector]

    Sector 625142347 --> [Forged physical sector]

    Sector 625142348 --> [Forged physical sector]

    Sector 625142349 --> [Forged physical sector]

    Sector 625142350 --> [Forged physical sector]

    Sector 625142351 --> [Forged physical sector]

    Sector 625142352 --> [Forged physical sector]

    Sector 625142353 --> [Forged physical sector]

    Sector 625142354 --> [Forged physical sector]

    Sector 625142355 --> [Forged physical sector]

    Sector 625142356 --> [Forged physical sector]

    Sector 625142357 --> [Forged physical sector]

    Sector 625142358 --> [Forged physical sector]

    Sector 625142359 --> [Forged physical sector]

    Sector 625142360 --> [Forged physical sector]

    Sector 625142361 --> [Forged physical sector]

    Sector 625142362 --> [Forged physical sector]

    Sector 625142363 --> [Forged physical sector]

    Sector 625142364 --> [Forged physical sector]

    Sector 625142365 --> [Forged physical sector]

    Sector 625142366 --> [Forged physical sector]

    Sector 625142367 --> [Forged physical sector]

    Sector 625142368 --> [Forged physical sector]

    Sector 625142369 --> [Forged physical sector]

    Sector 625142370 --> [Forged physical sector]

    Sector 625142371 --> [Forged physical sector]

    Sector 625142372 --> [Forged physical sector]

    Sector 625142373 --> [Forged physical sector]

    Sector 625142374 --> [Forged physical sector]

    Sector 625142375 --> [Forged physical sector]

    Sector 625142376 --> [Forged physical sector]

    Sector 625142377 --> [Forged physical sector]

    Sector 625142378 --> [Forged physical sector]

    Sector 625142379 --> [Forged physical sector]

    Sector 625142380 --> [Forged physical sector]

    Sector 625142381 --> [Forged physical sector]

    Sector 625142382 --> [Forged physical sector]

    Sector 625142383 --> [Forged physical sector]

    Sector 625142384 --> [Forged physical sector]

    Sector 625142385 --> [Forged physical sector]

    Sector 625142386 --> [Forged physical sector]

    Sector 625142387 --> [Forged physical sector]

    Sector 625142388 --> [Forged physical sector]

    Sector 625142389 --> [Forged physical sector]

    Sector 625142390 --> [Forged physical sector]

    Sector 625142391 --> [Forged physical sector]

    Sector 625142392 --> [Forged physical sector]

    Sector 625142393 --> [Forged physical sector]

    Sector 625142394 --> [Forged physical sector]

    Sector 625142395 --> [Forged physical sector]

    Sector 625142396 --> [Forged physical sector]

    Sector 625142397 --> [Forged physical sector]

    Sector 625142398 --> [Forged physical sector]

    Sector 625142399 --> [Forged physical sector]

    Sector 625142400 --> [Forged physical sector]

    Sector 625142401 --> [Forged physical sector]

    Sector 625142402 --> [Forged physical sector]

    Sector 625142403 --> [Forged physical sector]

    Sector 625142404 --> [Forged physical sector]

    Sector 625142405 --> [Forged physical sector]

    Sector 625142406 --> [Forged physical sector]

    Sector 625142407 --> [Forged physical sector]

    Sector 625142408 --> [Forged physical sector]

    Sector 625142409 --> [Forged physical sector]

    Sector 625142410 --> [Forged physical sector]

    Sector 625142411 --> [Forged physical sector]

    Sector 625142412 --> [Forged physical sector]

    Sector 625142413 --> [Forged physical sector]

    Sector 625142414 --> [Forged physical sector]

    Sector 625142415 --> [Forged physical sector]

    Sector 625142416 --> [Forged physical sector]

    Sector 625142417 --> [Forged physical sector]

    Sector 625142418 --> [Forged physical sector]

    Sector 625142419 --> [Forged physical sector]

    Sector 625142420 --> [Forged physical sector]

    Sector 625142421 --> [Forged physical sector]

    Sector 625142422 --> [Forged physical sector]

    Sector 625142423 --> [Forged physical sector]

    Sector 625142424 --> [Forged physical sector]

    Sector 625142425 --> [Forged physical sector]

    Sector 625142426 --> [Forged physical sector]

    Sector 625142427 --> [Forged physical sector]

    Sector 625142428 --> [Forged physical sector]

    Sector 625142429 --> [Forged physical sector]

    Sector 625142430 --> [Forged physical sector]

    Sector 625142431 --> [Forged physical sector]

    Sector 625142432 --> [Forged physical sector]

    Sector 625142433 --> [Forged physical sector]

    Sector 625142434 --> [Forged physical sector]

    Sector 625142435 --> [Forged physical sector]

    Sector 625142436 --> [Forged physical sector]

    Sector 625142437 --> [Forged physical sector]

    Sector 625142438 --> [Forged physical sector]

    Sector 625142439 --> [Forged physical sector]

    Sector 625142440 --> [Forged physical sector]

    Sector 625142441 --> [Forged physical sector]

    Sector 625142442 --> [Forged physical sector]

    Sector 625142443 --> [Forged physical sector]

    Sector 625142444 --> [Forged physical sector]

    Sector 625142445 --> [Forged physical sector]

    Sector 625142446 --> [Forged physical sector]

    Sector 625142447 --> [Forged physical sector]

    Done!

    Performing system, memory and registry scan...

    Read File: File "C:\ProgramData\{373A11D3-0B96-4E16-9184-7D0FBE86932F}\Best Buy pc app Setup.dat" is compressed (flags = 1)

    Read File: File "C:\ProgramData\{373A11D3-0B96-4E16-9184-7D0FBE86932F}\instance.dat" is compressed (flags = 1)

    Infected: C:\Windows\ARTGALRY.CAG --> [Trojan.Downloader]

    Infected: C:\Windows\assembly\GAC_32\Desktop.ini --> [Rootkit.0access]

    Infected: C:\Windows\assembly\GAC_64\Desktop.ini --> [Rootkit.0access]

    Infected: C:\Windows\svchost.exe --> [Trojan.Agent]

    Infected: C:\Windows\svchost.exe --> [Trojan.Agent]

    Infected: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows --> [Hijack.Trojan.Siredef.D]

    Done!

    Scan finished

    Creating System Restore point...

    Scheduling clean up...

    <<<2>>>

    Device number: 0, partition: 2

    <<<3>>>

    Volume: C:

    File system type: NTFS

    SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

    BCD Entry for BOOTEMS is missing

    Malicious Entry 26000022 for BOOTEMS present!

    Removal scheduling successful. System shutdown needed.

    System shutdown occured

    =======================================

    ---------------------------------------

    Malwarebytes Anti-Rootkit BETA 1.01.0.1009

    © Malwarebytes Corporation 2011-2012

    OS version: 6.1.7601 Windows 7 Service Pack 1 x64

    Account is Administrative

    Internet Explorer version: 8.0.7601.17514

    File system is: NTFS

    Disk drives: C:\ DRIVE_FIXED, Q:\ DRIVE_FIXED

    CPU speed: 1.995000 GHz

    Memory total: 4240293888, free: 3022487552

    Second scan revealed no malware found...

    Will keep you posted. Thanks a bunch! Happy Thanksgiving!

    Trojan Agent Won't Go

    in Resolved Malware Removal Logs

    Posted

    Here's the Rkiller report:

    RogueKiller V8.3.1 [Nov 22 2012] by Tigzy

    mail: tigzyRK<at>gmail<dot>com

    Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/

    Website: http://tigzy.geekstogo.com/roguekiller.php

    Blog: http://tigzyrk.blogspot.com

    Operating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version

    Started in : Normal mode

    User : Jeff [Admin rights]

    Mode : Remove -- Date : 11/22/2012 12:01:17

    ¤¤¤ Bad processes : 1 ¤¤¤

    [sVCHOST] svchost.exe -- \\.\globalroot\systemroot\svchost.exe -> KILLED [TermProc]

    ¤¤¤ Registry Entries : 3 ¤¤¤

    [sTARTUP][sUSP PATH] Best Buy pc app.lnk @Default : C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe -> DELETED

    [HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)

    [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

    ¤¤¤ Particular Files / Folders: ¤¤¤

    [ZeroAccess][FILE] Desktop.ini : C:\windows\Assembly\GAC_32\Desktop.ini --> REMOVED AT REBOOT

    [ZeroAccess][FILE] Desktop.ini : C:\windows\Assembly\GAC_64\Desktop.ini --> REMOVED AT REBOOT

    ¤¤¤ Driver : [NOT LOADED] ¤¤¤

    ¤¤¤ Infection : ZeroAccess ¤¤¤

    [ZeroAccess] sys32\consrv.dll present!

    ¤¤¤ HOSTS File: ¤¤¤

    --> C:\windows\system32\drivers\etc\hosts

    ¤¤¤ MBR Check: ¤¤¤

    +++++ PhysicalDrive0: TOSHIBA MK3265GSXN +++++

    --- User ---

    [MBR] 9a16b4edb03fb02adc82e492c63f619a

    [bSP] 63885d87e66f1c5e0588240d5acca9d1 : Windows Vista MBR Code

    Partition table:

    0 - [ACTIVE] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 1500 Mo

    1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 3074048 | Size: 289686 Mo

    2 - [XXXXXX] NTFS (0x17) [HIDDEN!] Offset (sectors): 596350976 | Size: 14058 Mo

    User != LL1 ... KO!

    --- LL1 ---

    [MBR] cd0dd60cb410dca6ae4983b5c62d017d

    [bSP] 63885d87e66f1c5e0588240d5acca9d1 : Windows Vista MBR Code

    Partition table:

    1 - [ACTIVE] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 1500 Mo

    2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 3074048 | Size: 289686 Mo

    3 - [XXXXXX] NTFS (0x17) [HIDDEN!] Offset (sectors): 596350976 | Size: 14058 Mo

    User != LL2 ... KO!

    --- LL2 ---

    [MBR] cd0dd60cb410dca6ae4983b5c62d017d

    [bSP] 63885d87e66f1c5e0588240d5acca9d1 : Windows Vista MBR Code

    Partition table:

    1 - [ACTIVE] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 1500 Mo

    2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 3074048 | Size: 289686 Mo

    3 - [XXXXXX] NTFS (0x17) [HIDDEN!] Offset (sectors): 596350976 | Size: 14058 Mo

    Finished : << RKreport[2]_D_11222012_02d1201.txt >>

    RKreport[1]_S_11222012_02d1156.txt ; RKreport[2]_D_11222012_02d1201.txt

    Going to run Malwarebytes again and scan.

    Trojan Agent Won't Go

    in Resolved Malware Removal Logs

    Posted

    This Trojan is not being deleted by Malwarebytes even though the program identifies and says it will delete on reboot, a subsequent scan shows it's still there. It also causes the computer to shut down overnight where upon re-starting I get an error message and have to shut it down again and start in Safe mode. From there I can re-start in Normal and everything runs fine. This has happened the past three days. I'm running Rogue killer and deleted what it said and I'm waiting to run another scan through Malwarebytes.

    Malwarebytes Anti-Malware 1.65.1.1000

    www.malwarebytes.org

    Database version: v2012.11.19.10

    Windows 7 Service Pack 1 x64 NTFS

    Internet Explorer 8.0.7601.17514

    Jeff :: JEFF-PC [administrator]

    11/22/2012 9:03:28 AM

    mbam-log-2012-11-22 (09-03-28).txt

    Scan type: Full scan (C:\|)

    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

    Scan options disabled: P2P

    Objects scanned: 399995

    Time elapsed: 40 minute(s), 51 second(s)

    Memory Processes Detected: 1

    C:\Windows\svchost.exe (Trojan.Agent) -> 5332 -> Delete on reboot.

    Memory Modules Detected: 0

    (No malicious items detected)

    Registry Keys Detected: 0

    (No malicious items detected)

    Registry Values Detected: 0

    (No malicious items detected)

    Registry Data Items Detected: 0

    (No malicious items detected)

    Folders Detected: 0

    (No malicious items detected)

    Files Detected: 1

    C:\Windows\svchost.exe (Trojan.Agent) -> Delete on reboot.

    (end)

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.