Classie83

Thank you! I appreciate everything!!!

Security Check Log Results of screen317's Security Check version 0.99.57 Windows 7 Service Pack 1 x86 (UAC is disabled!) Internet Explorer 9 ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Enabled! WMI entry may not exist for antivirus; attempting automatic update. `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware version 1.70.0.1100 Java 6 Update 29 Java version out of Date! Adobe Flash Player 10 Flash Player out of Date! Adobe Reader 9 Adobe Reader out of Date! ````````Process Check: objlist.exe by Laurent```````` Norton ccSvcHst.exe Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Malwarebytes' Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: 2% ````````````````````End of Log``````````````````````

Here is the AdwCleaner logfile. I will run the other program now. # AdwCleaner v2.105 - Logfile created 01/14/2013 at 11:16:28 # Updated 08/01/2013 by Xplode # Operating system : Windows 7 Professional Service Pack 1 (32 bits) # User : Teacher - 1282-SPROUTS1 # Boot Mode : Normal # Running from : C:\Users\Teacher\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E6EA0A49\AdwCleaner (1).exe # Option [Delete] ***** [services] ***** Stopped & Deleted : WajamUpdater ***** [Files / Folders] ***** Folder Deleted : C:\Program Files\OApps Folder Deleted : C:\Program Files\Wajam Folder Deleted : C:\Users\Teacher\AppData\Local\Wajam Folder Deleted : C:\Users\Teacher\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam ***** [Registry] ***** Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider Key Deleted : HKCU\Software\Cr_Installer Key Deleted : HKCU\Software\InstalledBrowserExtensions Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C} Key Deleted : HKCU\Software\Wajam Key Deleted : HKLM\SOFTWARE\Classes\AppID\{1FAEE6D5-34F4-42AA-8025-3FD8F3EC4634} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17} Key Deleted : HKLM\SOFTWARE\Classes\AppID\priam_bho.DLL Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{5D64294B-1341-4FE7-B6D8-7C36828D4DD5} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C} Key Deleted : HKLM\SOFTWARE\Classes\CrossriderApp0021804.BHO Key Deleted : HKLM\SOFTWARE\Classes\CrossriderApp0021804.BHO.1 Key Deleted : HKLM\SOFTWARE\Classes\CrossriderApp0021804.Sandbox Key Deleted : HKLM\SOFTWARE\Classes\CrossriderApp0021804.Sandbox.1 Key Deleted : HKLM\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D} Key Deleted : HKLM\SOFTWARE\Classes\wajam.WajamBHO Key Deleted : HKLM\SOFTWARE\Classes\wajam.WajamBHO.1 Key Deleted : HKLM\SOFTWARE\Classes\wajam.WajamDownloader Key Deleted : HKLM\SOFTWARE\Classes\wajam.WajamDownloader.1 Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Wajam Key Deleted : HKLM\Software\Wajam Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WajamUpdater ***** [internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16457 [OK] Registry is clean. ************************* AdwCleaner[R1].txt - [2877 octets] - [14/01/2013 06:59:20] AdwCleaner[R2].txt - [2941 octets] - [14/01/2013 11:15:50] AdwCleaner[s1].txt - [2946 octets] - [14/01/2013 11:16:28] ########## EOF - C:\AdwCleaner[s1].txt - [3006 octets] ##########

Good morning. Here is the log file as requested. # AdwCleaner v2.105 - Logfile created 01/14/2013 at 06:59:20 # Updated 08/01/2013 by Xplode # Operating system : Windows 7 Professional Service Pack 1 (32 bits) # User : Teacher - 1282-SPROUTS1 # Boot Mode : Normal # Running from : C:\Users\Teacher\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E6EA0A49\AdwCleaner.exe # Option [search] ***** [services] ***** Found : WajamUpdater ***** [Files / Folders] ***** Folder Found : C:\Program Files\OApps Folder Found : C:\Program Files\Wajam Folder Found : C:\Users\Teacher\AppData\Local\Wajam Folder Found : C:\Users\Teacher\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam ***** [Registry] ***** Key Found : HKCU\Software\AppDataLow\Software\Crossrider Key Found : HKCU\Software\Cr_Installer Key Found : HKCU\Software\InstalledBrowserExtensions Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C} Key Found : HKCU\Software\Wajam Key Found : HKLM\SOFTWARE\Classes\AppID\{1FAEE6D5-34F4-42AA-8025-3FD8F3EC4634} Key Found : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17} Key Found : HKLM\SOFTWARE\Classes\AppID\priam_bho.DLL Key Found : HKLM\SOFTWARE\Classes\CLSID\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2} Key Found : HKLM\SOFTWARE\Classes\CLSID\{5D64294B-1341-4FE7-B6D8-7C36828D4DD5} Key Found : HKLM\SOFTWARE\Classes\CLSID\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C} Key Found : HKLM\SOFTWARE\Classes\CrossriderApp0021804.BHO Key Found : HKLM\SOFTWARE\Classes\CrossriderApp0021804.BHO.1 Key Found : HKLM\SOFTWARE\Classes\CrossriderApp0021804.Sandbox Key Found : HKLM\SOFTWARE\Classes\CrossriderApp0021804.Sandbox.1 Key Found : HKLM\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{095BFD3C-4602-4FE1-96F1-AEFAFBFD067D} Key Found : HKLM\SOFTWARE\Classes\wajam.WajamBHO Key Found : HKLM\SOFTWARE\Classes\wajam.WajamBHO.1 Key Found : HKLM\SOFTWARE\Classes\wajam.WajamDownloader Key Found : HKLM\SOFTWARE\Classes\wajam.WajamDownloader.1 Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A7A6995D-6EE1-4FD1-A258-49395D5BF99C} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Wajam Key Found : HKLM\Software\Wajam Key Found : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WajamUpdater ***** [internet Browsers] ***** -\\ Internet Explorer v9.0.8112.16457 [OK] Registry is clean. ************************* AdwCleaner[R1].txt - [2748 octets] - [14/01/2013 06:59:20] ########## EOF - C:\AdwCleaner[R1].txt - [2808 octets] ##########

Oops i just left work. I will run the program and update on Monday.

I'm so happy to let you know that I'm posting this from NORMAL MODE! I could kiss you (but I know you'd prefer a donation)! Thank you so much.

Will do.

...I noticed that misconfig won't launch from the run menu.

When I run it, it says the program has encountered a problem and can't continue. Please try again later. I rebooted and still says the same thing. This is so discouraging, I could cry!

Will do. Give me a sec.

Ok. Thanks. The frozen taskbar thing had been happening while the malware was still on the computer. Two weeks ago, I noticed it begining to happen. Then last week everything seemed to work normally, until the day before. Do you think I should do a factory reset via the system repair menu upon boot up?

Oh and the MBAM scan is not finding any threats. Do you think this may not be related to the malware? Is the malware gone?

So the status is, when I boot in normal mode, it is entering the desktop, but not loading the icons and the taskbar is frozen. I just see the blue circle. Once in a while it will load the icons, but the taskbar will still be frozen. I can only boot into safe mode.

Ok.

Nevermind...it's scanning. Farbar Service Scanner Version: 05-01-2013 Ran by Teacher (administrator) on 11-01-2013 at 12:56:22 Running from "C:\Users\Teacher\Desktop" Windows 7 Professional Service Pack 1 (X86) Boot Mode: Network **************************************************************** Internet Services: ============ Connection Status: ============== Localhost is accessible. LAN connected. Attempt to access Google IP returned error. Google IP is offline Attempt to access Google.com returned error: Google.com is offline Attempt to access Yahoo IP returned error. Yahoo IP is offline Attempt to access Yahoo.com returned error: Yahoo.com is offline Windows Firewall: ============= Firewall Disabled Policy: ================== System Restore: ============ SDRSVC Service is not running. Checking service configuration: The start type of SDRSVC service is OK. The ImagePath of SDRSVC service is OK. The ServiceDll of SDRSVC service is OK. VSS Service is not running. Checking service configuration: The start type of VSS service is OK. The ImagePath of VSS service is OK. System Restore Disabled Policy: ======================== Action Center: ============ wscsvc Service is not running. Checking service configuration: The start type of wscsvc service is OK. The ImagePath of wscsvc service is OK. The ServiceDll of wscsvc service is OK. Windows Update: ============ wuauserv Service is not running. Checking service configuration: The start type of wuauserv service is OK. The ImagePath of wuauserv service is OK. The ServiceDll of wuauserv service is OK. BITS Service is not running. Checking service configuration: The start type of BITS service is OK. The ImagePath of BITS service is OK. The ServiceDll of BITS service is OK. EventSystem Service is not running. Checking service configuration: The start type of EventSystem service is OK. The ImagePath of EventSystem service is OK. The ServiceDll of EventSystem service is OK. Windows Autoupdate Disabled Policy: ============================ Windows Defender: ============== Other Services: ============== File Check: ======== C:\windows\system32\nsisvc.dll => MD5 is legit C:\windows\system32\Drivers\nsiproxy.sys => MD5 is legit C:\windows\system32\dhcpcore.dll => MD5 is legit C:\windows\system32\Drivers\afd.sys => MD5 is legit C:\windows\system32\Drivers\tdx.sys => MD5 is legit C:\windows\system32\Drivers\tcpip.sys [2012-11-15 10:57] - [2012-10-03 11:58] - 1293680 ____A (Microsoft Corporation) E23A56F843E2AEBBB209D0ACCA73C640 C:\windows\system32\dnsrslvr.dll => MD5 is legit C:\windows\system32\mpssvc.dll => MD5 is legit C:\windows\system32\bfe.dll => MD5 is legit C:\windows\system32\Drivers\mpsdrv.sys => MD5 is legit C:\windows\system32\SDRSVC.dll => MD5 is legit C:\windows\system32\vssvc.exe => MD5 is legit C:\windows\system32\wscsvc.dll => MD5 is legit C:\windows\system32\wbem\WMIsvc.dll => MD5 is legit C:\windows\system32\wuaueng.dll => MD5 is legit C:\windows\system32\qmgr.dll => MD5 is legit C:\windows\system32\es.dll => MD5 is legit C:\windows\system32\cryptsvc.dll => MD5 is legit C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit C:\windows\system32\svchost.exe => MD5 is legit C:\windows\system32\rpcss.dll => MD5 is legit **** End of log ****

I pressed scan, but it's not scanning anything.

I tried to do the gpedit.msc and the "not configured" was already selected. Just for good measure, I selected enable, rebooted (system protection tab still not there), then I rebooted and selected "not configured" again. Rebooted again and system protection tab not there. Then I accessed system restore from the system repair boot menu. When I pressed the system protection link, it just gave me a dialog box saying something about "since your computer is in a limited diagnostic state, any restore cannot be undone." I then pressed ok, and it did nothing after that. As a matter of fact, the "next" button was not even available. The only option was to press cancel.

Ok here is the most recent RKiller log RogueKiller V8.4.2 [Jan 6 2013] by Tigzy mail : tigzyRK<at>gmail<dot>com Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/ Website : http://tigzy.geekstogo.com/roguekiller.php Blog : http://tigzyrk.blogspot.com/ Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version Started in : Safe mode with network support User : Teacher [Admin rights] Mode : Scan -- Date : 01/11/2013 11:54:04 ¤¤¤ Bad processes : 2 ¤¤¤ [sUSP PATH] cbsidlm-tr1_10a-RogueKiller-SEO-75764640.exe -- C:\Users\Teacher\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KWHMROKA\cbsidlm-tr1_10a-RogueKiller-SEO-75764640.exe -> KILLED [TermProc] [sUSP PATH] Updater21804.exe -- C:\Users\Teacher\AppData\Local\Updater21804\Updater21804.exe -> KILLED [TermProc] ¤¤¤ Registry Entries : 7 ¤¤¤ [HJPOL] HKCU\[...]\System : disableregistrytools (0) -> FOUND [HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND [HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND [HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND [HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND [HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND ¤¤¤ Particular Files / Folders: ¤¤¤ ¤¤¤ Driver : [NOT LOADED] ¤¤¤ ¤¤¤ HOSTS File: ¤¤¤ --> C:\windows\system32\drivers\etc\hosts 127.0.0.1 localhost ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: +++++ --- User --- [MBR] 999c59079689fbfcab8e037a122045ec [bSP] 42b3664ffc88267bf9e22417f1ffdce5 : Windows 7/8 MBR Code Partition table: 0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 500 Mo 1 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 1026048 | Size: 30000 Mo 2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 62466048 | Size: 274743 Mo User = LL1 ... OK! User = LL2 ... OK! Finished : << RKreport[2]_S_01112013_02d1154.txt >> RKreport[1]_S_01102013_02d1512.txt ; RKreport[2]_S_01112013_02d1154.txt

I ran combofix and after it was done, it rebooted the computer back into normal mode. However I still couldn't access the task bar. Therefore, I couldn't get to the txt file log. I rebooted into safe mode w/networking and I can't find the log. I tried booting into normal mode and there is a black screen with this error message: "C:Users/Teacher/Desktop/mbar/Data/cleanup.dll Specified module can't be found." I did the start up repair and it couldn't find any problems. Then I tried system restore, but I am not seeing the System Protection tab. Please advise. Thanks!

Ok. I'm running combofix now.

The computer doesn't want to start up properly in normal mode. It gets passed the login screen and Windows Explorer just stays frozen with the little blue circle that keeps going around and around. I booted into safemode w/networking and ran an MBAM scan. Here is the log. It didn't find any bugs. Malwarebytes Anti-Malware (PRO) 1.70.0.1100 www.malwarebytes.org Database version: v2013.01.10.10 Windows 7 Service Pack 1 x86 NTFS (Safe Mode/Networking) Internet Explorer 9.0.8112.16421 Teacher :: 1282-SPROUTS1 [administrator] Protection: Disabled 1/11/2013 7:09:56 AM mbam-log-2013-01-11 (07-09-56).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 243534 Time elapsed: 4 minute(s), 24 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)

Thank you again! I went to start the computer again, but it wouldn't start. Then it automatically began a start up repair. I was at work while this happened, so I will see what is going on and hopefully run combo fix it when I return to work tomorrow.

Hi. I ran MBAM and here is the resulting log. Upon the second scan, there were no threats found. --------------------------------------- Malwarebytes Anti-Rootkit BETA 1.01.0.1011 © Malwarebytes Corporation 2011-2012 OS version: 6.1.7601 Windows 7 Service Pack 1 x86 System is currently in a safe mode Account is Administrative Internet Explorer version: 9.0.8112.16421 Java version: 1.6.0_29 File system is: NTFS Disk drives: C:\ DRIVE_FIXED CPU speed: 1.596000 GHz Memory total: 3347234816, free: 2750840832 ------------ Kernel report ------------ 01/10/2013 15:38:47 ------------ Loaded modules ----------- \SystemRoot\system32\ntkrnlpa.exe \SystemRoot\system32\halmacpi.dll \SystemRoot\system32\kdcom.dll \SystemRoot\system32\mcupdate_AuthenticAMD.dll \SystemRoot\system32\PSHED.dll \SystemRoot\system32\BOOTVID.dll \SystemRoot\system32\CLFS.SYS \SystemRoot\system32\CI.dll \SystemRoot\system32\drivers\Wdf01000.sys \SystemRoot\system32\drivers\WDFLDR.SYS \SystemRoot\system32\drivers\ACPI.sys \SystemRoot\system32\drivers\WMILIB.SYS \SystemRoot\system32\drivers\msisadrv.sys \SystemRoot\system32\drivers\pci.sys \SystemRoot\system32\drivers\vdrvroot.sys \SystemRoot\System32\drivers\partmgr.sys \SystemRoot\system32\DRIVERS\compbatt.sys \SystemRoot\system32\DRIVERS\BATTC.SYS \SystemRoot\system32\drivers\volmgr.sys \SystemRoot\System32\drivers\volmgrx.sys \SystemRoot\System32\drivers\mountmgr.sys \SystemRoot\system32\drivers\vmbus.sys \SystemRoot\system32\drivers\winhv.sys \SystemRoot\system32\drivers\atapi.sys \SystemRoot\system32\drivers\ataport.SYS \SystemRoot\system32\drivers\msahci.sys \SystemRoot\system32\drivers\PCIIDEX.SYS \SystemRoot\system32\DRIVERS\amdsata.sys \SystemRoot\system32\DRIVERS\storport.sys \SystemRoot\system32\drivers\amdxata.sys \SystemRoot\system32\drivers\fltmgr.sys \SystemRoot\system32\drivers\fileinfo.sys \SystemRoot\System32\Drivers\Ntfs.sys \SystemRoot\System32\Drivers\msrpc.sys \SystemRoot\System32\Drivers\ksecdd.sys \SystemRoot\System32\Drivers\cng.sys \SystemRoot\System32\drivers\pcw.sys \SystemRoot\System32\Drivers\Fs_Rec.sys \SystemRoot\system32\drivers\ndis.sys \SystemRoot\system32\drivers\NETIO.SYS \SystemRoot\System32\Drivers\ksecpkg.sys \SystemRoot\System32\drivers\tcpip.sys \SystemRoot\System32\drivers\fwpkclnt.sys \SystemRoot\system32\drivers\vmstorfl.sys \SystemRoot\system32\drivers\volsnap.sys \SystemRoot\System32\DRIVERS\ApsHM86.sys \SystemRoot\System32\drivers\rdyboost.sys \SystemRoot\System32\DRIVERS\Apsx86.sys \SystemRoot\System32\Drivers\mup.sys \SystemRoot\System32\drivers\hwpolicy.sys \SystemRoot\System32\DRIVERS\fvevol.sys \SystemRoot\system32\DRIVERS\disk.sys \SystemRoot\system32\DRIVERS\CLASSPNP.SYS \SystemRoot\system32\DRIVERS\AtiPcie.sys \SystemRoot\System32\Drivers\Null.SYS \SystemRoot\System32\Drivers\Beep.SYS \SystemRoot\System32\drivers\vga.sys \SystemRoot\System32\drivers\VIDEOPRT.SYS \SystemRoot\System32\drivers\watchdog.sys \SystemRoot\system32\drivers\rdpencdd.sys \SystemRoot\System32\Drivers\Msfs.SYS \SystemRoot\System32\Drivers\Npfs.SYS \SystemRoot\system32\DRIVERS\tdx.sys \SystemRoot\system32\DRIVERS\TDI.SYS \SystemRoot\system32\drivers\afd.sys \SystemRoot\System32\DRIVERS\netbt.sys \SystemRoot\system32\DRIVERS\wfplwf.sys \SystemRoot\system32\DRIVERS\pacer.sys \SystemRoot\system32\DRIVERS\vwififlt.sys \SystemRoot\system32\DRIVERS\netbios.sys \SystemRoot\system32\DRIVERS\rdbss.sys \SystemRoot\system32\drivers\nsiproxy.sys \SystemRoot\system32\drivers\csc.sys \SystemRoot\System32\Drivers\dfsc.sys \SystemRoot\system32\DRIVERS\tunnel.sys \SystemRoot\system32\drivers\HDAudBus.sys \SystemRoot\system32\DRIVERS\Rt86win7.sys \SystemRoot\system32\DRIVERS\usbohci.sys \SystemRoot\system32\DRIVERS\USBPORT.SYS \SystemRoot\system32\DRIVERS\usbfilter.sys \SystemRoot\system32\DRIVERS\usbehci.sys \SystemRoot\system32\DRIVERS\i8042prt.sys \SystemRoot\system32\drivers\kbdclass.sys \SystemRoot\system32\DRIVERS\SynTP.sys \SystemRoot\system32\DRIVERS\USBD.SYS \SystemRoot\system32\DRIVERS\mouclass.sys \SystemRoot\system32\DRIVERS\ibmpmdrv.sys \SystemRoot\system32\DRIVERS\rtl8192Ce.sys \SystemRoot\system32\DRIVERS\vwifibus.sys \SystemRoot\system32\DRIVERS\wmiacpi.sys \SystemRoot\system32\DRIVERS\blbdrive.sys \SystemRoot\system32\drivers\CompositeBus.sys \SystemRoot\system32\drivers\mssmbios.sys \SystemRoot\system32\DRIVERS\AgileVpn.sys \SystemRoot\system32\DRIVERS\rasl2tp.sys \SystemRoot\system32\DRIVERS\ndistapi.sys \SystemRoot\system32\DRIVERS\ndiswan.sys \SystemRoot\system32\DRIVERS\raspppoe.sys \SystemRoot\system32\DRIVERS\raspptp.sys \SystemRoot\system32\DRIVERS\rassstp.sys \SystemRoot\system32\DRIVERS\rdpbus.sys \SystemRoot\system32\drivers\termdd.sys \SystemRoot\system32\drivers\swenum.sys \SystemRoot\system32\drivers\ks.sys \SystemRoot\system32\drivers\umbus.sys \SystemRoot\system32\DRIVERS\usbhub.sys \SystemRoot\System32\Drivers\NDProxy.SYS \SystemRoot\System32\win32k.sys \SystemRoot\System32\drivers\Dxapi.sys \SystemRoot\System32\drivers\dxg.sys \SystemRoot\System32\TSDDD.dll \SystemRoot\System32\framebuf.dll \SystemRoot\System32\Drivers\crashdmp.sys \SystemRoot\System32\Drivers\dump_diskdump.sys \SystemRoot\System32\Drivers\dump_amdsata.sys \SystemRoot\System32\Drivers\dump_dumpfve.sys \SystemRoot\system32\DRIVERS\usbccgp.sys \SystemRoot\system32\drivers\WudfPf.sys \SystemRoot\system32\DRIVERS\nwifi.sys \SystemRoot\system32\DRIVERS\ndisuio.sys \SystemRoot\system32\DRIVERS\bowser.sys \SystemRoot\System32\drivers\mpsdrv.sys \SystemRoot\system32\DRIVERS\mrxsmb.sys \SystemRoot\system32\DRIVERS\mrxsmb10.sys \SystemRoot\system32\DRIVERS\mrxsmb20.sys \??\C:\windows\system32\drivers\mbamchameleon.sys \??\C:\windows\system32\drivers\mbamswissarmy.sys \Windows\System32\ntdll.dll \Windows\System32\smss.exe \Windows\System32\apisetschema.dll \Windows\System32\autochk.exe \Windows\System32\difxapi.dll \Windows\System32\urlmon.dll \Windows\System32\Wldap32.dll \Windows\System32\shell32.dll \Windows\System32\ws2_32.dll \Windows\System32\sechost.dll \Windows\System32\comdlg32.dll \Windows\System32\psapi.dll \Windows\System32\gdi32.dll \Windows\System32\nsi.dll \Windows\System32\msctf.dll \Windows\System32\oleaut32.dll \Windows\System32\setupapi.dll \Windows\System32\msvcrt.dll \Windows\System32\normaliz.dll \Windows\System32\advapi32.dll \Windows\System32\imagehlp.dll \Windows\System32\kernel32.dll \Windows\System32\usp10.dll \Windows\System32\imm32.dll \Windows\System32\shlwapi.dll \Windows\System32\wininet.dll \Windows\System32\ole32.dll \Windows\System32\iertutil.dll \Windows\System32\rpcrt4.dll \Windows\System32\user32.dll \Windows\System32\clbcatq.dll \Windows\System32\lpk.dll \Windows\System32\cfgmgr32.dll \Windows\System32\wintrust.dll \Windows\System32\comctl32.dll \Windows\System32\devobj.dll \Windows\System32\KernelBase.dll \Windows\System32\crypt32.dll \Windows\System32\msasn1.dll ----------- End ----------- <<<1>>> Upper Device Name: \Device\Harddisk0\DR0 Upper Device Object: 0xffffffff8635d030 Upper Device Driver Name: \Driver\Disk\ Lower Device Name: \Device\00000066\ Lower Device Object: 0xffffffff8623d420 Lower Device Driver Name: \Driver\amdsata\ Driver name found: amdsata DriverEntry returned 0x0 Function returned 0x0 Downloaded database version: v2013.01.10.12 Downloaded database version: v2013.01.04.01 Initializing... Done! <<<2>>> Device number: 0, partition: 3 Physical Sector Size: 512 Drive: 0, DevicePointer: 0xffffffff8635d030, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ --------- Disk Stack ------ DevicePointer: 0xffffffff8635cd10, DeviceName: Unknown, DriverName: \Driver\partmgr\ DevicePointer: 0xffffffff8635d5d0, DeviceName: Unknown, DriverName: \Driver\Shockprf\ DevicePointer: 0xffffffff8635d030, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ DevicePointer: 0xffffffff86351020, DeviceName: Unknown, DriverName: \Driver\amdxata\ DevicePointer: 0xffffffff8623d2f8, DeviceName: Unknown, DriverName: \Driver\ACPI\ DevicePointer: 0xffffffff8623d420, DeviceName: \Device\00000066\, DriverName: \Driver\amdsata\ ------------ End ---------- Upper DeviceData: 0xffffffffa4267130, 0xffffffff8635d030, 0xffffffff85f08728 Lower DeviceData: 0xffffffffa00a8708, 0xffffffff8623d420, 0xffffffff85ea91a0 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Scanning directory: C:\windows\system32\drivers... Done! Drive 0 Scanning MBR on drive 0... Inspecting partition table: MBR Signature: 55AA Disk Signature: BA21B413 Partition information: Partition 0 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 2048 Numsec = 1024000 Partition file system is NTFS Partition is bootable Partition 1 type is Other (0x27) Partition is NOT ACTIVE. Partition starts at LBA: 1026048 Numsec = 61440000 Partition 2 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 62466048 Numsec = 562673664 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Disk Size: 320072933376 bytes Sector size: 512 bytes Scanning physical sectors of unpartitioned space on drive 0 (1-2047-625122448-625142448)... Done! Performing system, memory and registry scan... Infected: C:\$Recycle.Bin\S-1-5-21-3698045114-3507409308-3228407656-1004\$4341bd91f259578dbf8874db5a5cba77\@ --> [Trojan.Siredef.C] Infected: HKCU\SOFTWARE\CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} --> [Hijack.Trojan.Siredef.C] Infected: HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS|Load --> [PUM.UserWLoad] Infected: C:\$Recycle.Bin\S-1-5-21-3698045114-3507409308-3228407656-1004\$4341bd91f259578dbf8874db5a5cba77\U --> [Trojan.Siredef.C] Infected: C:\$Recycle.Bin\S-1-5-21-3698045114-3507409308-3228407656-1004\$4341bd91f259578dbf8874db5a5cba77\L --> [Trojan.Siredef.C] Infected: C:\$Recycle.Bin\S-1-5-21-3698045114-3507409308-3228407656-1004\$4341bd91f259578dbf8874db5a5cba77 --> [Trojan.Siredef.C] Done! Scan finished Creating System Restore point... Could not create restore point... Scheduling clean up... <<<2>>> Device number: 0, partition: 3 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Removal scheduling successful. System shutdown needed. System shutdown occurred ======================================= --------------------------------------- Malwarebytes Anti-Rootkit BETA 1.01.0.1011 © Malwarebytes Corporation 2011-2012 OS version: 6.1.7601 Windows 7 Service Pack 1 x86 Account is Administrative Internet Explorer version: 9.0.8112.16421 Java version: 1.6.0_29 File system is: NTFS Disk drives: C:\ DRIVE_FIXED CPU speed: 1.596000 GHz Memory total: 3347234816, free: 2769465344 --------------------------------------- Malwarebytes Anti-Rootkit BETA 1.01.0.1011 © Malwarebytes Corporation 2011-2012 OS version: 6.1.7601 Windows 7 Service Pack 1 x86 System is currently in a safe mode Account is Administrative Internet Explorer version: 9.0.8112.16421 Java version: 1.6.0_29 File system is: NTFS Disk drives: C:\ DRIVE_FIXED CPU speed: 1.596000 GHz Memory total: 3347234816, free: 2910150656 ------------ Kernel report ------------ 01/10/2013 16:01:13 ------------ Loaded modules ----------- \SystemRoot\system32\ntkrnlpa.exe \SystemRoot\system32\halmacpi.dll \SystemRoot\system32\kdcom.dll \SystemRoot\system32\mcupdate_AuthenticAMD.dll \SystemRoot\system32\PSHED.dll \SystemRoot\system32\BOOTVID.dll \SystemRoot\system32\CLFS.SYS \SystemRoot\system32\CI.dll \SystemRoot\system32\drivers\Wdf01000.sys \SystemRoot\system32\drivers\WDFLDR.SYS \SystemRoot\system32\drivers\ACPI.sys \SystemRoot\system32\drivers\WMILIB.SYS \SystemRoot\system32\drivers\msisadrv.sys \SystemRoot\system32\drivers\pci.sys \SystemRoot\system32\drivers\vdrvroot.sys \SystemRoot\System32\drivers\partmgr.sys \SystemRoot\system32\DRIVERS\compbatt.sys \SystemRoot\system32\DRIVERS\BATTC.SYS \SystemRoot\system32\drivers\volmgr.sys \SystemRoot\System32\drivers\volmgrx.sys \SystemRoot\System32\drivers\mountmgr.sys \SystemRoot\system32\drivers\vmbus.sys \SystemRoot\system32\drivers\winhv.sys \SystemRoot\system32\drivers\atapi.sys \SystemRoot\system32\drivers\ataport.SYS \SystemRoot\system32\drivers\msahci.sys \SystemRoot\system32\drivers\PCIIDEX.SYS \SystemRoot\system32\DRIVERS\amdsata.sys \SystemRoot\system32\DRIVERS\storport.sys \SystemRoot\system32\drivers\amdxata.sys \SystemRoot\system32\drivers\fltmgr.sys \SystemRoot\system32\drivers\fileinfo.sys \SystemRoot\System32\Drivers\Ntfs.sys \SystemRoot\System32\Drivers\msrpc.sys \SystemRoot\System32\Drivers\ksecdd.sys \SystemRoot\System32\Drivers\cng.sys \SystemRoot\System32\drivers\pcw.sys \SystemRoot\System32\Drivers\Fs_Rec.sys \SystemRoot\system32\drivers\ndis.sys \SystemRoot\system32\drivers\NETIO.SYS \SystemRoot\System32\Drivers\ksecpkg.sys \SystemRoot\System32\drivers\tcpip.sys \SystemRoot\System32\drivers\fwpkclnt.sys \SystemRoot\system32\drivers\vmstorfl.sys \SystemRoot\system32\drivers\volsnap.sys \SystemRoot\System32\DRIVERS\ApsHM86.sys \SystemRoot\System32\drivers\rdyboost.sys \SystemRoot\System32\DRIVERS\Apsx86.sys \SystemRoot\System32\Drivers\mup.sys \SystemRoot\System32\drivers\hwpolicy.sys \SystemRoot\System32\DRIVERS\fvevol.sys \SystemRoot\system32\DRIVERS\disk.sys \SystemRoot\system32\DRIVERS\CLASSPNP.SYS \SystemRoot\system32\DRIVERS\AtiPcie.sys \SystemRoot\System32\Drivers\Null.SYS \SystemRoot\System32\Drivers\Beep.SYS \SystemRoot\System32\drivers\vga.sys \SystemRoot\System32\drivers\VIDEOPRT.SYS \SystemRoot\System32\drivers\watchdog.sys \SystemRoot\system32\drivers\rdpencdd.sys \SystemRoot\System32\Drivers\Msfs.SYS \SystemRoot\System32\Drivers\Npfs.SYS \SystemRoot\system32\DRIVERS\tdx.sys \SystemRoot\system32\DRIVERS\TDI.SYS \SystemRoot\system32\drivers\afd.sys \SystemRoot\System32\DRIVERS\netbt.sys \SystemRoot\system32\DRIVERS\wfplwf.sys \SystemRoot\system32\DRIVERS\pacer.sys \SystemRoot\system32\DRIVERS\vwififlt.sys \SystemRoot\system32\DRIVERS\netbios.sys \SystemRoot\system32\DRIVERS\rdbss.sys \SystemRoot\system32\drivers\nsiproxy.sys \SystemRoot\system32\drivers\csc.sys \SystemRoot\System32\Drivers\dfsc.sys \SystemRoot\system32\DRIVERS\tunnel.sys \SystemRoot\system32\drivers\HDAudBus.sys \SystemRoot\system32\DRIVERS\Rt86win7.sys \SystemRoot\system32\DRIVERS\usbohci.sys \SystemRoot\system32\DRIVERS\USBPORT.SYS \SystemRoot\system32\DRIVERS\usbfilter.sys \SystemRoot\system32\DRIVERS\usbehci.sys \SystemRoot\system32\DRIVERS\i8042prt.sys \SystemRoot\system32\drivers\kbdclass.sys \SystemRoot\system32\DRIVERS\SynTP.sys \SystemRoot\system32\DRIVERS\USBD.SYS \SystemRoot\system32\DRIVERS\mouclass.sys \SystemRoot\system32\DRIVERS\ibmpmdrv.sys \SystemRoot\system32\DRIVERS\rtl8192Ce.sys \SystemRoot\system32\DRIVERS\vwifibus.sys \SystemRoot\system32\DRIVERS\wmiacpi.sys \SystemRoot\system32\DRIVERS\blbdrive.sys \SystemRoot\system32\drivers\CompositeBus.sys \SystemRoot\system32\drivers\mssmbios.sys \SystemRoot\system32\DRIVERS\AgileVpn.sys \SystemRoot\system32\DRIVERS\rasl2tp.sys \SystemRoot\system32\DRIVERS\ndistapi.sys \SystemRoot\system32\DRIVERS\ndiswan.sys \SystemRoot\system32\DRIVERS\raspppoe.sys \SystemRoot\system32\DRIVERS\raspptp.sys \SystemRoot\system32\DRIVERS\rassstp.sys \SystemRoot\system32\DRIVERS\rdpbus.sys \SystemRoot\system32\drivers\termdd.sys \SystemRoot\system32\drivers\swenum.sys \SystemRoot\system32\drivers\ks.sys \SystemRoot\system32\drivers\umbus.sys \SystemRoot\system32\DRIVERS\usbhub.sys \SystemRoot\System32\Drivers\NDProxy.SYS \SystemRoot\System32\win32k.sys \SystemRoot\System32\drivers\Dxapi.sys \SystemRoot\System32\drivers\dxg.sys \SystemRoot\System32\TSDDD.dll \SystemRoot\System32\framebuf.dll \SystemRoot\System32\Drivers\crashdmp.sys \SystemRoot\System32\Drivers\dump_diskdump.sys \SystemRoot\System32\Drivers\dump_amdsata.sys \SystemRoot\System32\Drivers\dump_dumpfve.sys \SystemRoot\system32\DRIVERS\usbccgp.sys \SystemRoot\system32\drivers\WudfPf.sys \SystemRoot\system32\DRIVERS\nwifi.sys \SystemRoot\system32\DRIVERS\ndisuio.sys \SystemRoot\system32\DRIVERS\bowser.sys \SystemRoot\System32\drivers\mpsdrv.sys \SystemRoot\system32\DRIVERS\mrxsmb.sys \SystemRoot\system32\DRIVERS\mrxsmb10.sys \SystemRoot\system32\DRIVERS\mrxsmb20.sys \??\C:\windows\system32\drivers\mbamchameleon.sys \??\C:\windows\system32\drivers\mbamswissarmy.sys \Windows\System32\ntdll.dll \Windows\System32\smss.exe \Windows\System32\apisetschema.dll \Windows\System32\autochk.exe \Windows\System32\advapi32.dll \Windows\System32\comdlg32.dll \Windows\System32\rpcrt4.dll \Windows\System32\imagehlp.dll \Windows\System32\gdi32.dll \Windows\System32\Wldap32.dll \Windows\System32\normaliz.dll \Windows\System32\nsi.dll \Windows\System32\psapi.dll \Windows\System32\shell32.dll \Windows\System32\difxapi.dll \Windows\System32\shlwapi.dll \Windows\System32\sechost.dll \Windows\System32\usp10.dll \Windows\System32\msvcrt.dll \Windows\System32\imm32.dll \Windows\System32\msctf.dll \Windows\System32\oleaut32.dll \Windows\System32\lpk.dll \Windows\System32\urlmon.dll \Windows\System32\setupapi.dll \Windows\System32\ole32.dll \Windows\System32\kernel32.dll \Windows\System32\user32.dll \Windows\System32\ws2_32.dll \Windows\System32\iertutil.dll \Windows\System32\clbcatq.dll \Windows\System32\wininet.dll \Windows\System32\KernelBase.dll \Windows\System32\comctl32.dll \Windows\System32\crypt32.dll \Windows\System32\cfgmgr32.dll \Windows\System32\wintrust.dll \Windows\System32\devobj.dll \Windows\System32\msasn1.dll ----------- End ----------- <<<1>>> Upper Device Name: \Device\Harddisk0\DR0 Upper Device Object: 0xffffffff8635da90 Upper Device Driver Name: \Driver\Disk\ Lower Device Name: \Device\00000066\ Lower Device Object: 0xffffffff8623d478 Lower Device Driver Name: \Driver\amdsata\ Driver name found: amdsata DriverEntry returned 0x0 Function returned 0x0 Initializing... Done! <<<2>>> Device number: 0, partition: 3 Physical Sector Size: 512 Drive: 0, DevicePointer: 0xffffffff8635da90, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ --------- Disk Stack ------ DevicePointer: 0xffffffff8635d430, DeviceName: Unknown, DriverName: \Driver\partmgr\ DevicePointer: 0xffffffff8635c020, DeviceName: Unknown, DriverName: \Driver\Shockprf\ DevicePointer: 0xffffffff8635da90, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ DevicePointer: 0xffffffff863478d0, DeviceName: Unknown, DriverName: \Driver\amdxata\ DevicePointer: 0xffffffff86347e00, DeviceName: Unknown, DriverName: \Driver\ACPI\ DevicePointer: 0xffffffff8623d478, DeviceName: \Device\00000066\, DriverName: \Driver\amdsata\ ------------ End ---------- Upper DeviceData: 0xffffffff824237f0, 0xffffffff8635da90, 0xffffffff87a20848 Lower DeviceData: 0xffffffff82574308, 0xffffffff8623d478, 0xffffffff879dc918 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Scanning directory: C:\windows\system32\drivers... Done! Drive 0 Scanning MBR on drive 0... Inspecting partition table: MBR Signature: 55AA Disk Signature: BA21B413 Partition information: Partition 0 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 2048 Numsec = 1024000 Partition file system is NTFS Partition is bootable Partition 1 type is Other (0x27) Partition is NOT ACTIVE. Partition starts at LBA: 1026048 Numsec = 61440000 Partition 2 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 62466048 Numsec = 562673664 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Disk Size: 320072933376 bytes Sector size: 512 bytes Scanning physical sectors of unpartitioned space on drive 0 (1-2047-625122448-625142448)... Done! Performing system, memory and registry scan... Done! Scan finished =======================================

Thank you! Here is the log from RogueKiller RogueKiller V8.4.2 [Jan 6 2013] by Tigzy mail : tigzyRK<at>gmail<dot>com Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/ Website : http://tigzy.geekstogo.com/roguekiller.php Blog : http://tigzyrk.blogspot.com/ Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version Started in : Safe mode with network support User : Teacher [Admin rights] Mode : Scan -- Date : 01/10/2013 15:12:30 ¤¤¤ Bad processes : 0 ¤¤¤ ¤¤¤ Registry Entries : 7 ¤¤¤ [sHELL][sUSP PATH] HKCU\[...]\Windows : Load (C:\Users\Teacher\LOCALS~1\Temp\msauafifp.pif) -> FOUND [sHELL][sUSP PATH] HKUS\S-1-5-21-3698045114-3507409308-3228407656-1004[...]\Windows : Load (C:\Users\Teacher\LOCALS~1\Temp\msauafifp.pif) -> FOUND [HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND [HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND [HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND [HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND ¤¤¤ Particular Files / Folders: ¤¤¤ [ZeroAccess][FILE] @ : C:\$recycle.bin\S-1-5-21-3698045114-3507409308-3228407656-1004\$4341bd91f259578dbf8874db5a5cba77\@ --> FOUND [ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-21-3698045114-3507409308-3228407656-1004\$4341bd91f259578dbf8874db5a5cba77\U --> FOUND [ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-21-3698045114-3507409308-3228407656-1004\$4341bd91f259578dbf8874db5a5cba77\L --> FOUND ¤¤¤ Driver : [NOT LOADED] ¤¤¤ ¤¤¤ Infection : ZeroAccess ¤¤¤ ¤¤¤ HOSTS File: ¤¤¤ --> C:\windows\system32\drivers\etc\hosts ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: +++++ --- User --- [MBR] 999c59079689fbfcab8e037a122045ec [bSP] 42b3664ffc88267bf9e22417f1ffdce5 : Windows 7/8 MBR Code Partition table: 0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 500 Mo 1 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 1026048 | Size: 30000 Mo 2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 62466048 | Size: 274743 Mo User = LL1 ... OK! User = LL2 ... OK! Finished : << RKreport[1]_S_01102013_02d1512.txt >> RKreport[1]_S_01102013_02d1512.txt