Jump to content

CNadineH

Members
  • Posts

    10
  • Joined

  • Last visited

Everything posted by CNadineH

  1. What a fantastic job you did for me. Your instructions were clear and understandable. The tools you asked me to use were made readily available. You saved me a great deal of time. And most importantly you responded in reasonably short times. Thank you so much for volunteering your time. And why do drive-up ATMs have braille on them?

  2. Great!! Now I feel all squeaky clean!! Or at least I will as soon as I do the uninstalls and updates. This forum is amazing and you are awesome. I have learned about so many other tools that help to recover from these (*&^* viruses. Thanks so very much. NadineH
  3. I wouldn't expect this PC to be very secure at this point. I uninstalled the antivirus earlier to keep it out of the way. I am planning on reinstalling it when you let me know that it is okay to do so. I also need to run MS updates, and I think that Adobe has popped up looking to update during this process. Checkup.txt: Results of screen317's Security Check version 0.99.62 Windows XP Service Pack 3 x86 Internet Explorer 8 ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Enabled! `````````Anti-malware/Other Utilities Check:````````` Java 7 Update 9 Java version out of Date! Adobe Flash Player 11.6.602.180 Adobe Reader 10.1.4 Adobe Reader out of Date! ````````Process Check: objlist.exe by Laurent```````` `````````````````System Health check````````````````` Total Fragmentation on Drive C:: 5% ````````````````````End of Log`````````````````````` I am especially grateful for your assistance through this whole procedure. You ROCK!! NadineH
  4. There don't seem to be any files/folders in the log. Does that mean that we are clear?? log file: # AdwCleaner v2.200 - Logfile created 04/20/2013 at 14:58:09 # Updated 02/04/2013 by Xplode # Operating system : Microsoft Windows XP Service Pack 3 (32 bits) # User : Owner - MIKES # Boot Mode : Normal # Running from : C:\Documents and Settings\Owner\Desktop\adwcleaner.exe # Option [search] ***** [services] ***** ***** [Files / Folders] ***** ***** [Registry] ***** ***** [internet Browsers] ***** -\\ Internet Explorer v8.0.6001.18702 [OK] Registry is clean. -\\ Google Chrome v [unable to get version] File : C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences [OK] File is clean. ************************* AdwCleaner[R1].txt - [715 octets] - [20/04/2013 14:58:09] ########## EOF - C:\AdwCleaner[R1].txt - [774 octets] ########## NadineH
  5. Combo fix has completed. log file attached How are we doing?? NadineH combo_log.txt
  6. All right. That went much better. Looks like we found a rootkit. 3 log files attached. NadineH TDSSKiller.2.8.16.0_20.04.2013_11.16.51_log.txt TDSSKiller.2.8.16.0_20.04.2013_11.19.00_log.txt TDSSKiller.2.8.16.0_20.04.2013_11.24.42_log.txt
  7. DDS log files: DDS.txt: DDS (Ver_2012-11-20.01) - NTFS_x86 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.9.2 Run by Owner at 10:15:57 on 2013-04-20 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.735.385 [GMT -7:00] . AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095} . ============== Running Processes ================ . C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\acs.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Java\jre7\bin\jqs.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\WINDOWS\system32\SearchIndexer.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\ltmoh\Ltmoh.exe C:\Program Files\Apoint2K\Apoint.exe C:\Program Files\Microsoft Security Client\msseces.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Apoint2K\HidFind.exe C:\Program Files\Apoint2K\Apntex.exe C:\WINDOWS\system32\SearchProtocolHost.exe C:\WINDOWS\system32\SearchFilterHost.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k NetworkService C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\system32\svchost.exe -k LocalService C:\WINDOWS\System32\svchost.exe -k HTTPFilter . ============== Pseudo HJT Report =============== . mWinlogon: Shell = explorer.exe, BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - <orphaned> BHO: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - c:\program files\microsoft\search enhancement pack\search helper\SearchHelper.dll BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll BHO: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background mRun: [DisableWinXPWZCS] c:\program files\atheros\DisableWinXPWZCS.exe mRun: [LoadFujitsuQuickTouch] c:\program files\fujitsu\application panel\QuickTouch.exe mRun: [LoadBtnHnd] c:\program files\fujitsu\btnhnd\BtnHnd.exe mRun: [indicatorUtility] c:\program files\fujitsu\fujitsu hotkey utility\IndicatorUty.exe mRun: [AGRSMMSG] AGRSMMSG.exe mRun: [LtMoh] c:\program files\ltmoh\Ltmoh.exe mRun: [Apoint] c:\program files\apoint2k\Apoint.exe mRun: [ATIModeChange] Ati2mdxx.exe mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t dRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\FlashUtil32_11_6_602_180_ActiveX.exe -update activex uPolicies-Explorer: NoDriveTypeAutoRun = dword:145 mPolicies-Explorer: NoDriveTypeAutoRun = dword:145 IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe LSP: mswsock.dll DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://windowsupdate.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1351146397774 DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1351182425766 TCP: NameServer = 75.75.75.75 75.75.76.76 192.168.1.1 TCP: Interfaces\{6E9F196F-6FD6-4934-91E4-407AFCF964B4} : DHCPNameServer = 75.75.75.75 75.75.76.76 192.168.1.1 SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll . ============= SERVICES / DRIVERS =============== . R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2012-3-20 195296] R3 ALiIRDA;ALi Infrared Device Driver;c:\windows\system32\drivers\alifir.sys [2012-10-24 26624] R3 CONAN;CONAN;c:\windows\system32\drivers\o2mmb.sys [2012-10-24 190465] R3 MbxStby;MbxStby;c:\windows\system32\drivers\MbxStby.sys [2012-10-24 5817] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S3 Linksys_adapter_H;Linksys Adapter Network Driver;c:\windows\system32\drivers\AE2500xp.sys [2011-3-29 1034240] S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2013-4-20 40776] S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2008-4-14 14336] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504] . =============== Created Last 30 ================ . 2013-04-20 15:22:31 -------- d--h--w- c:\windows\PIF 2013-04-20 15:20:19 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2013-04-20 15:20:19 -------- d-----w- c:\documents and settings\owner\application data\Malwarebytes 2013-04-20 15:17:53 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes 2013-04-19 22:11:38 -------- d-----w- C:\_OTL 2013-04-15 23:44:06 -------- d-----w- C:\Malwarebytes . ==================== Find3M ==================== . 2013-04-02 01:36:18 693976 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2013-04-02 01:36:17 73432 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2013-01-30 10:53:21 232336 ------w- c:\windows\system32\MpSigStub.exe 2013-01-26 03:55:44 552448 ----a-w- c:\windows\system32\oleaut32.dll 2013-01-20 23:59:04 195296 ----a-w- c:\windows\system32\drivers\MpFilter.sys . =================== ROOTKIT ==================== . Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net Windows 5.1.2600 Disk: TOSHIBA_MK3021GAS rev.GA129D -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 . device: opened successfully user: MBR read successfully . Disk trace: called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x82F0F4B1]<< _asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x82f1693c]; MOV EAX, [0x82f16ab0]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; } 1 nt!IofCallDriver[0x804E37D5] -> \Device\Harddisk0\DR0[0x83765AB8] 3 CLASSPNP[0xF79A1FD7] -> nt!IofCallDriver[0x804E37D5] -> \Device\00000073[0x8378E9E8] 5 ACPI[0xF78F8620] -> nt!IofCallDriver[0x804E37D5] -> [0x8378FD98] \Driver\atapi[0x82FDA4F0] -> IRP_MJ_CREATE -> 0x82F0F4B1 error: Read A device attached to the system is not functioning. kernel: MBR read successfully _asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [bP+0x0], CH; JL 0x2e; JNZ 0x3a; } detected disk devices: detected hooks: \Driver\atapi DriverStartIo -> 0x82F0F2E2 user & kernel MBR OK Warning: possible TDL3 rootkit infection ! . ============= FINISH: 10:17:24.04 =============== attach.txt: . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2012-11-20.01) . Microsoft Windows XP Home Edition Boot Device: \Device\HarddiskVolume1 Install Date: 10/24/2012 9:32:43 PM System Uptime: 4/20/2013 10:13:50 AM (0 hours ago) . Motherboard: FUJITSU | | FJNB184 Processor: Intel® Pentium® 4 CPU 2.80GHz | Onboard | 2791/533mhz . ==== Disk Partitions ========================= . A: is Removable C: is FIXED (NTFS) - 28 GiB total, 18.721 GiB free. D: is CDROM () E: is Removable . ==== Disabled Device Manager Items ============= . Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: 1394 Net Adapter Device ID: V1394\NIC1394\242C87F0E10 Manufacturer: Microsoft Name: 1394 Net Adapter PNP Device ID: V1394\NIC1394\242C87F0E10 Service: NIC1394 . ==== System Restore Points =================== . RP58: 1/20/2013 4:11:26 PM - Software Distribution Service 3.0 RP59: 1/26/2013 11:10:50 AM - Software Distribution Service 3.0 RP60: 1/27/2013 8:33:43 PM - Software Distribution Service 3.0 RP61: 1/30/2013 1:28:28 PM - Software Distribution Service 3.0 RP62: 2/4/2013 8:46:46 PM - Software Distribution Service 3.0 RP63: 2/6/2013 4:32:59 PM - Software Distribution Service 3.0 RP64: 2/7/2013 9:07:22 PM - Software Distribution Service 3.0 RP65: 2/9/2013 7:02:15 PM - Software Distribution Service 3.0 RP66: 2/10/2013 8:47:35 PM - Software Distribution Service 3.0 RP67: 2/12/2013 1:39:25 PM - Software Distribution Service 3.0 RP68: 2/14/2013 9:19:44 PM - Software Distribution Service 3.0 RP69: 2/14/2013 10:20:49 PM - Software Distribution Service 3.0 RP70: 2/17/2013 8:44:25 PM - Software Distribution Service 3.0 RP71: 2/21/2013 11:51:01 AM - Software Distribution Service 3.0 RP72: 2/24/2013 10:12:13 PM - Software Distribution Service 3.0 RP73: 2/26/2013 7:15:26 PM - Software Distribution Service 3.0 RP74: 2/28/2013 3:08:51 PM - Software Distribution Service 3.0 RP75: 3/1/2013 8:10:48 PM - Software Distribution Service 3.0 RP76: 3/4/2013 2:22:22 PM - Software Distribution Service 3.0 RP77: 3/4/2013 2:47:19 PM - Software Distribution Service 3.0 RP78: 3/5/2013 4:25:15 PM - Software Distribution Service 3.0 RP79: 3/6/2013 6:33:22 PM - Software Distribution Service 3.0 RP80: 3/15/2013 4:35:17 PM - System Checkpoint RP81: 3/16/2013 5:51:32 PM - System Checkpoint RP82: 4/15/2013 5:48:44 PM - System Checkpoint RP83: 4/17/2013 8:17:48 PM - System Checkpoint RP84: 4/19/2013 10:35:54 PM - System Checkpoint . ==== Installed Programs ====================== . Adobe Flash Player 11 ActiveX Adobe Flash Player 11 Plugin Adobe Reader X (10.1.4) Agere Systems AC'97 Modem ALPS Touch Pad Driver Atheros Client Installation Program Atheros Install Program for Wireless Network Adapter Products ATI Control Panel ATI Display Driver Fujitsu Hotkey Utility Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB2756822) Hotfix for Windows XP (KB2779562) Hotfix for Windows XP (KB915800-v4) Hotfix for Windows XP (KB952287) Hotfix for Windows XP (KB954550-v5) Hotfix for Windows XP (KB954708) Hotfix for Windows XP (KB961118) Hoyle Card Games Java 7 Update 9 Java Auto Updater Junk Mail filter update K-Lite Codec Pack 9.3.0 (Full) LifeBook Application Panel Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Security Update (KB2742597) Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 4 Client Profile Microsoft Application Error Reporting Microsoft Choice Guard Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Search Enhancement Pack Microsoft Security Client Microsoft Security Essentials Microsoft Silverlight Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Sync Framework Runtime Native v1.0 (x86) Microsoft Sync Framework Services Native v1.0 (x86) Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual C++ 2005 Redistributable MSN MSVCRT O2Micro MemoryCardBus Windows Driver Realtek RTL8139/810x Fast Ethernet NIC Driver Setup Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416) Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405) Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827) Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449) Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019) Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595) Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642) Security Update for Microsoft Windows (KB2564958) Security Update for Windows Internet Explorer 8 (KB2510531) Security Update for Windows Internet Explorer 8 (KB2544521) Security Update for Windows Internet Explorer 8 (KB2618444) Security Update for Windows Internet Explorer 8 (KB2744842) Security Update for Windows Internet Explorer 8 (KB2792100) Security Update for Windows Internet Explorer 8 (KB2797052) Security Update for Windows Internet Explorer 8 (KB982381) Security Update for Windows Media Player (KB2378111) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player (KB954155) Security Update for Windows Media Player (KB973540) Security Update for Windows Media Player (KB975558) Security Update for Windows Media Player (KB978695) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows Search 4 - KB963093 Security Update for Windows XP (KB2115168) Security Update for Windows XP (KB2229593) Security Update for Windows XP (KB2296011) Security Update for Windows XP (KB2347290) Security Update for Windows XP (KB2360937) Security Update for Windows XP (KB2387149) Security Update for Windows XP (KB2393802) Security Update for Windows XP (KB2419632) Security Update for Windows XP (KB2423089) Security Update for Windows XP (KB2440591) Security Update for Windows XP (KB2443105) Security Update for Windows XP (KB2476490) Security Update for Windows XP (KB2478960) Security Update for Windows XP (KB2478971) Security Update for Windows XP (KB2479943) Security Update for Windows XP (KB2481109) Security Update for Windows XP (KB2483185) Security Update for Windows XP (KB2485663) Security Update for Windows XP (KB2506212) Security Update for Windows XP (KB2507618) Security Update for Windows XP (KB2507938) Security Update for Windows XP (KB2508429) Security Update for Windows XP (KB2509553) Security Update for Windows XP (KB2510581) Security Update for Windows XP (KB2535512) Security Update for Windows XP (KB2536276-v2) Security Update for Windows XP (KB2544521) Security Update for Windows XP (KB2544893-v2) Security Update for Windows XP (KB2566454) Security Update for Windows XP (KB2570947) Security Update for Windows XP (KB2584146) Security Update for Windows XP (KB2585542) Security Update for Windows XP (KB2592799) Security Update for Windows XP (KB2598479) Security Update for Windows XP (KB2603381) Security Update for Windows XP (KB2618451) Security Update for Windows XP (KB2619339) Security Update for Windows XP (KB2620712) Security Update for Windows XP (KB2624667) Security Update for Windows XP (KB2631813) Security Update for Windows XP (KB2646524) Security Update for Windows XP (KB2653956) Security Update for Windows XP (KB2655992) Security Update for Windows XP (KB2659262) Security Update for Windows XP (KB2661637) Security Update for Windows XP (KB2676562) Security Update for Windows XP (KB2686509) Security Update for Windows XP (KB2691442) Security Update for Windows XP (KB2698365) Security Update for Windows XP (KB2705219-v2) Security Update for Windows XP (KB2712808) Security Update for Windows XP (KB2719985) Security Update for Windows XP (KB2723135-v2) Security Update for Windows XP (KB2724197) Security Update for Windows XP (KB2727528) Security Update for Windows XP (KB2731847-v2) Security Update for Windows XP (KB2744842) Security Update for Windows XP (KB2753842-v2) Security Update for Windows XP (KB2757638) Security Update for Windows XP (KB2758857) Security Update for Windows XP (KB2770660) Security Update for Windows XP (KB2778344) Security Update for Windows XP (KB2780091) Security Update for Windows XP (KB2799494) Security Update for Windows XP (KB2802968) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB923789) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956744) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956844) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB960859) Security Update for Windows XP (KB969059) Security Update for Windows XP (KB970430) Security Update for Windows XP (KB971657) Security Update for Windows XP (KB972270) Security Update for Windows XP (KB973507) Security Update for Windows XP (KB973869) Security Update for Windows XP (KB973904) Security Update for Windows XP (KB974112) Security Update for Windows XP (KB974318) Security Update for Windows XP (KB974392) Security Update for Windows XP (KB974571) Security Update for Windows XP (KB975025) Security Update for Windows XP (KB975467) Security Update for Windows XP (KB975560) Security Update for Windows XP (KB975713) Security Update for Windows XP (KB977816) Security Update for Windows XP (KB977914) Security Update for Windows XP (KB978338) Security Update for Windows XP (KB978542) Security Update for Windows XP (KB978706) Security Update for Windows XP (KB979309) Security Update for Windows XP (KB979482) Security Update for Windows XP (KB979687) Security Update for Windows XP (KB981322) Security Update for Windows XP (KB981997) Security Update for Windows XP (KB982132) Security Update for Windows XP (KB982665) Segoe UI Sierra Utilities SigmaTel AC97 Audio Drivers Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) Update for Microsoft Windows (KB971513) Update for Windows Internet Explorer 8 (KB2598845) Update for Windows Internet Explorer 8 (KB2632503) Update for Windows XP (KB2345886) Update for Windows XP (KB2467659) Update for Windows XP (KB2492386) Update for Windows XP (KB2661254-v2) Update for Windows XP (KB2736233) Update for Windows XP (KB2749655) Update for Windows XP (KB898461) Update for Windows XP (KB951978) Update for Windows XP (KB961503) Update for Windows XP (KB968389) Update for Windows XP (KB971029) Update for Windows XP (KB973815) WebFldrs XP Windows Genuine Advantage Validation Tool (KB892130) Windows Internet Explorer 8 Windows Live Call Windows Live Communications Platform Windows Live Essentials Windows Live Mail Windows Live Messenger Windows Live Photo Gallery Windows Live Sign-in Assistant Windows Live Sync Windows Live Upload Tool Windows Live Writer Windows Management Framework Core Windows Media Format 11 runtime Windows Media Player 11 Windows Search 4.0 . ==== Event Viewer Messages From Past Week ======== . 4/17/2013 8:04:05 PM, error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service. . ==== End Of File =========================== I'm trying to run RogueKiller, but it just seems to sit there. I don't get an opportunity to tell it to scan. I has, however, created a folder on the desktop, "RK Quarantine", that is empty. Does it take a while for this to do its thing? And I will stick with you as long as you stick with me. You don't know how much I appreciate your assistance. NadineH
  8. Okay, well I'm happy to report that the second time is the charm. Don't know what I did wrong, bet we have different results. I've gotten past the ransom screen and discovered that his antivirus program was turned off. Not sure which came first, but I have my suspicions. Logfile: ========== OTL ========== Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:regsvr32 /n /i /s "C:\Documents and Settings\Owner\Local Settings\Application Data\mtdgxfpk.sdm" deleted successfully. C:\WINDOWS\system32\regsvr32.exe moved successfully. C:\Documents and Settings\Owner\Local Settings\Application Data\mtdgxfpk.sdm moved successfully. C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ctfmon.lnk moved successfully. C:\Documents and Settings\All Users\Application Data\baszmq.xtk moved successfully. OTLPE by OldTimer - Version 3.1.48.0 log created on 04192013_221116 I now have more work to do. Are there any more steps that you specifically want me to take? You help is very much appreciated. Thank you. NadineH
  9. I followed the instructions you gave me, but I am still not able to get past the ransomeware. Log file: Error: Unable to interpret <DRIVE%\*.*> in the current context! Error: Unable to interpret </md5start> in the current context! Error: Unable to interpret <explorer.exe> in the current context! Error: Unable to interpret <services.exe> in the current context! Error: Unable to interpret <winlogon.exe> in the current context! Error: Unable to interpret <userinit.exe> in the current context! Error: Unable to interpret </md5stop> in the current context! OTLPE by OldTimer - Version 3.1.48.0 log created on 04192013_181137 I don't think that all of the Error messages are what we were hoping for. NadineH
  10. Thank you so much for your help. I followed your instructions and the log file follows: OTL logfile created on: 4/18/2013 8:19:15 PM - Run OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM Internet Explorer (Version = 8.0.6001.18702) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 735.00 Mb Total Physical Memory | 541.00 Mb Available Physical Memory | 74.00% Memory free 675.00 Mb Paging File | 557.00 Mb Available in Paging File | 83.00% Paging File free Paging file location(s): C:\pagefile.sys 1104 2208 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 27.94 Gb Total Space | 14.37 Gb Free Space | 51.43% Space Free | Partition Type: NTFS Drive D: | 14.88 Gb Total Space | 14.86 Gb Free Space | 99.87% Space Free | Partition Type: FAT32 Drive X: | 284.12 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Computer Name: REATOGO | User Name: SYSTEM Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days Using ControlSet: ControlSet002 ========== Win32 Services (SafeList) ========== SRV - File not found [On_Demand] -- -- (AppMgmt) SRV - [2013/04/01 21:36:19 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012/10/26 01:49:14 | 000,161,768 | ---- | M] (Oracle Corporation) [Auto] -- C:\Program Files\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService) SRV - [2006/07/14 18:13:20 | 000,360,533 | ---- | M] (Atheros) [Auto] -- C:\WINDOWS\system32\acs.exe -- (ACS) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand] -- -- (WDICA) DRV - File not found [Kernel | On_Demand] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand] -- -- (PDCOMP) DRV - File not found [Kernel | System] -- -- (PCIDump) DRV - File not found [Kernel | System] -- -- (lbrtfdc) DRV - File not found [Kernel | System] -- -- (i2omgmt) DRV - File not found [Kernel | System] -- -- (Changer) DRV - [2012/10/26 01:25:04 | 000,005,248 | ---- | M] (FUJITSU LIMITED) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\fuj02b1.sys -- (FUJ02B1) DRV - [2012/10/25 01:55:36 | 000,011,861 | ---- | M] (Meetinghouse Data Communications) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\mdc8021x.sys -- (MDC8021X) WPA Security Protocol (IEEE 802.1x) DRV - [2011/03/29 11:22:30 | 001,034,240 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\AE2500xp.sys -- (Linksys_adapter_H) DRV - [2009/01/21 10:49:40 | 000,118,656 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Rtnicxp.sys -- (RTL8023xp) DRV - [2008/04/13 18:06:02 | 000,231,552 | ---- | M] (Acer Laboratories Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ac97ali.sys -- (aliadwdm) DRV - [2006/06/13 14:27:00 | 000,507,424 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ar5211.sys -- (AR5211) DRV - [2006/06/02 15:52:20 | 000,054,432 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\wsimd.sys -- (WSIMD) DRV - [2003/10/27 09:17:20 | 000,190,465 | ---- | M] (O2 Micro ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\o2mmb.sys -- (CONAN) DRV - [2003/08/25 21:46:00 | 000,005,817 | ---- | M] (O2 Micro) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\MbxStby.sys -- (MbxStby) DRV - [2003/08/21 12:37:24 | 000,019,712 | ---- | M] (FUJITSU LIMITED) [Kernel | Auto] -- C:\Program Files\Fujitsu\BtnHnd\BtnHnd.sys -- (BtnHnd) DRV - [2003/07/24 23:22:52 | 001,196,460 | ---- | M] (Agere Systems) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem) DRV - [2003/07/13 02:34:16 | 000,094,436 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Apfiltr.sys -- (ApfiltrService) DRV - [2003/07/11 00:51:52 | 000,586,752 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2002/10/03 22:04:10 | 000,046,976 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\R8139n51.sys -- (rtl8139) DRV - [2002/09/03 01:33:56 | 000,182,224 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\STAC97.sys -- (STAC97) Audio Driver (WDM) DRV - [2002/08/29 22:04:56 | 000,023,570 | ---- | M] (ATI Technologies Inc.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\atisgkaf.SYS -- (caboagp) DRV - [2001/08/17 09:49:02 | 000,026,624 | ---- | M] (Acer Laboratories Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\alifir.sys -- (ALiIRDA) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\NetworkService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Owner_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/ IE - HKU\Owner_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp IE - HKU\Owner_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us IE - HKU\Owner_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 50 AF 08 DE 39 B3 CD 01 [binary data] IE - HKU\Owner_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll () FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) O1 HOSTS File: ([2003/06/20 08:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Java Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3 - HKU\Owner_ON_C\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found. O4 - HKLM..\Run: [ATIModeChange] C:\WINDOWS\System32\Ati2mdxx.exe (ATI Technologies, Inc.) O4 - HKLM..\Run: [DisableWinXPWZCS] C:\Program Files\Atheros\DisableWinXPWZCS.exe () O4 - HKLM..\Run: [indicatorUtility] C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe (FUJITSU LIMITED) O4 - HKLM..\Run: [LoadBtnHnd] C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe (FUJITSU LIMITED) O4 - HKLM..\Run: [LoadFujitsuQuickTouch] C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe (FUJITSU LIMITED) O4 - HKLM..\Run: [LtMoh] C:\Program Files\ltmoh\ltmoh.exe (Agere Systems) O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ctfmon.lnk = X:\I386\SYSTEM32\REGSVR32.EXE (Microsoft Corporation) O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\Owner_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - File not found O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://windowsupdate.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1351146397774 (WUWebControl Class) O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1351182425766 (MUWebControl Class) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O20 - HKLM Winlogon: Shell - (regsvr32 /n /i /s "C:\Documents and Settings\Owner\Local Settings\Application Data\mtdgxfpk.sdm") - C:\WINDOWS\System32\regsvr32.exe (Microsoft Corporation) O20 - HKLM Winlogon: GinaDLL - (athgina.dll) - C:\WINDOWS\System32\athgina.dll (Atheros) O24 - Desktop WallPaper: B:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: B:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2012/10/25 00:29:31 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: 6to4 - File not found NetSvcs: AppMgmt - File not found NetSvcs: Ias - File not found NetSvcs: Iprip - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: Sharedaccess - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: BITS - File not found Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation) Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.) Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.) Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.) Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll () Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll () Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation) Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation) ========== Files/Folders - Created Within 30 Days ========== [2013/04/15 19:44:06 | 000,000,000 | ---D | C] -- C:\Malwarebytes [2013/04/15 15:10:49 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013/04/18 19:27:15 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2013/04/18 19:12:00 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job [2013/04/18 18:02:11 | 000,000,422 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{D78917A7-813D-49A4-ACC6-4493747C35BC}.job [2013/04/17 21:46:12 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2013/04/11 20:55:59 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat [2013/04/11 20:49:49 | 000,054,784 | ---- | M] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\mtdgxfpk.sdm [2013/04/11 20:49:49 | 000,000,581 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ctfmon.lnk [2013/04/11 20:49:46 | 000,000,000 | R--D | M] -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup [2013/04/11 20:49:43 | 000,054,784 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\baszmq.xtk [2013/04/04 19:05:03 | 000,001,857 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\MSN Installer.lnk [2013/04/01 21:36:18 | 000,693,976 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe [2013/04/01 21:36:17 | 000,073,432 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2013/04/11 20:49:49 | 000,054,784 | ---- | C] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\mtdgxfpk.sdm [2013/04/11 20:49:46 | 000,000,581 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ctfmon.lnk [2013/04/11 20:49:43 | 000,054,784 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\baszmq.xtk [2012/11/02 19:39:33 | 000,000,394 | ---- | C] () -- C:\WINDOWS\SIERRA.INI [2012/11/01 22:27:37 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat [2012/10/26 01:17:36 | 000,178,688 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2012/10/25 03:43:31 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll [2012/10/25 02:00:26 | 000,294,912 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.exe [2012/10/25 02:00:26 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.dll [2012/10/25 01:55:23 | 000,651,264 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll [2012/10/25 01:55:23 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll [2012/10/25 01:55:23 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\AegisI5.exe [2012/10/25 00:32:48 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2012/10/25 00:25:51 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2012/10/24 17:17:25 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2012/10/24 17:15:53 | 000,096,664 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2008/05/27 00:59:42 | 000,018,904 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschematrivial.bin [2008/05/27 00:59:40 | 000,106,605 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschema.bin [2008/04/14 08:55:28 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin [2007/09/27 13:51:02 | 000,020,698 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini [2007/09/27 13:48:48 | 000,030,628 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini [2007/09/27 13:48:28 | 000,031,698 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini [2006/12/31 11:57:08 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2003/06/20 08:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin [2003/06/20 08:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat [2003/06/20 08:00:00 | 000,502,944 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat [2003/06/20 08:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat [2003/06/20 08:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat [2003/06/20 08:00:00 | 000,086,988 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat [2003/06/20 08:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin [2003/06/20 08:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat [2003/06/20 08:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat [2003/06/20 08:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat ========== LOP Check ========== [2012/11/01 22:34:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\MSNInstaller [2012/10/25 02:44:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Windows Desktop Search [2012/10/26 12:42:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Windows Search [2013/04/18 18:02:11 | 000,000,422 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{D78917A7-813D-49A4-ACC6-4493747C35BC}.job ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.* > [2012/10/25 00:29:31 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT [2012/10/25 10:37:14 | 000,000,211 | -HS- | M] () -- C:\boot.ini [2012/10/25 00:29:31 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS [2012/10/25 00:29:31 | 000,000,000 | RHS- | M] () -- C:\IO.SYS [2012/10/25 00:29:31 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS [2008/04/14 01:13:04 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM [2008/04/14 03:01:44 | 000,250,048 | RHS- | M] () -- C:\ntldr [2013/04/17 23:02:26 | 1157,627,904 | -HS- | M] () -- C:\pagefile.sys < MD5 for: EXPLORER.EXE > [2008/04/14 08:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\explorer.exe [2008/04/14 08:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\system32\dllcache\explorer.exe < MD5 for: SERVICES.EXE > [2009/02/06 07:06:24 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=020CEAAEDC8EB655B6506B8C70D53BB6 -- C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\services.exe [2008/04/14 08:42:36 | 000,108,544 | ---- | M] (Microsoft Corporation) MD5=0E776ED5F7CC9F94299E70461B7B8185 -- C:\WINDOWS\$NtUninstallKB956572$\services.exe [2009/02/06 07:11:05 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 -- C:\WINDOWS\system32\dllcache\services.exe [2009/02/06 07:11:05 | 000,110,592 | ---- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 -- C:\WINDOWS\system32\services.exe < MD5 for: USERINIT.EXE > [2008/04/14 08:42:40 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\dllcache\userinit.exe [2008/04/14 08:42:40 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\userinit.exe < MD5 for: WINLOGON.EXE > [2013/04/04 10:50:32 | 000,218,184 | ---- | M] () MD5=B4C6E3889BB310CA7E974A04EC6E46AC -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe [2008/04/14 08:42:40 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\dllcache\winlogon.exe [2008/04/14 08:42:40 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\winlogon.exe < End of report > I'm very curious to see your interpretation of the log. This forum is awesome!! NadineH
  11. I'm trying to remove ransomeware from a friend's older, laptop computer. I can't get into safe mode; it blue screens. I don't want to access the internet because that would expose my home network to the virus. The BIOS won't allow booting from USB. I booted it up with Hiren's BootCD into Mini XP. I put the latest Malware Bytes on USB and was able to install it. MalwareBytes has found and cleaned several files already (I ran it until it didn't find anymore viruses), but the ransomeware is still there. I tried HitmanPro with Kickstart. Burned the kickstart CD and used Hitman on USB. It's supposed to bypass the ransomeware and let me get into the OS (Win XP Home) to remove the virus. It just takes me right back into the ransomeware. I'd like to avoid the drastic measure of a complete OS reinstall. I don't know how much of his personal data would be lost. I don't know where to go from here. I apologize for yet another request for help with ransomeware. TIA Nadine
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.