Jump to content

sjlisius_99M

Members
  • Posts

    3
  • Joined

  • Last visited

Everything posted by sjlisius_99M

  1. Ran these scans as suggested, thank you. The logs are attached. TDSS Killer cured one malicious item (it was a rootkit, that makes sense) and ComboFix did it's thing. I restarted, then enabled windows firewall, security essentials, and malwarebytes before reconnecting my network cable. There have been no suspicious connections to malicious websites, only one explorer.exe process, and the machine is idling smoothly. I re-ran DDS, and it appeared to work fine, producing two full logs. Those are attached as well. Let me know if there is anything else I should check or any more utilities to run. Now I know where to start when faced with malware. I will certainly consult this forum again if I have further issues. Thanks again attach 3_2_14.txt ComboFix.txt dds 3_2_14.txt TDSSKiller.3.0.0.25_02.03.2014_14.36.18_log.txt TDSSKiller.3.0.0.25_02.03.2014_14.38.32_log.txt
  2. Thanks for the quick reply. I ran the scans you suggested, results below. Malwarebytes and RogueKiller worked fine, but dds only gave me attach.txt, no DDS.txt, and attach.txt seems to be incomplete compared to other examples I have found. I disabled what I could as suggested (I am using MSE, disabled real-time protection and closed malwarebytes, also turned off windows firewall after disconnecting my network cable), and it still only gives me one file. I ran dds on a win7 pro 64 bit machine I have at home and it worked perfectly fine, with good looking reports of both titles. What I have is posted below. Thanks ATTACH.TXT . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.IF REQUESTED, ZIP IT UP & ATTACH IT.DDS (Ver_2012-11-20.01).Microsoft Windows 7 Home Premium Boot Device: \Device\HarddiskVolume3Install Date: 11/12/2010 1:54:37 Before NoonSystem Uptime: 3/1/2014 12:08:06 Before Noon (0 hours ago).Motherboard: ASUSTeK Computer INC. | | P7H55-M PROProcessor: Intel® Core i5 CPU 661 @ 3.33GHz | LGA1156 | 3334/133mhz.==== Disk Partitions =========================.C: is FIXED (NTFS) - 931 GiB total, 622.919 GiB free.D: is FIXED (NTFS) - 147 GiB total, 53.743 GiB free.E: is FIXED (FAT32) - 5 GiB total, 0.658 GiB free.F: is CDROM (CDFS)H: is RemovableI: is RemovableJ: is RemovableK: is Removable.==== Disabled Device Manager Items =============.Class GUID: {678dcf40-e2e6-11d5-8cd5-e960089ea00a}Description: Saitek Magic BusDevice ID: ROOT\SAITEK_MAGIC_BUS\0001Manufacturer: SaitekName: Root EnumeratorPNP Device ID: ROOT\SAITEK_MAGIC_BUS\0001Service: SaiNtBus.Class GUID: {678dcf40-e2e6-11d5-8cd5-e960089ea00a}Description: Saitek Magic BusDevice ID: ROOT\SAITEK_MAGIC_BUS\0002Manufacturer: SaitekName: Root EnumeratorPNP Device ID: ROOT\SAITEK_MAGIC_BUS\0002Service: SaiNtBus.==== System Restore Points ===================.RP832: 1/18/2014 3:32:36 Before Noon - Windows UpdateRP833: 1/22/2014 3:32:27 Before Noon - Windows UpdateRP834: 1/24/2014 9:49:17 After Noon - Installed Java 7 Update 51RP835: 1/25/2014 4:54:29 After Noon - Windows UpdateRP836: 1/29/2014 4:54:50 After Noon - Windows UpdateRP837: 2/2/2014 5:35:06 After Noon - Windows UpdateRP838: 2/5/2014 10:45:34 After Noon - Installed Java 7 Update 45 (64-bit)RP839: 2/6/2014 10:19:30 After Noon - Windows UpdateRP840: 2/10/2014 10:19:26 After Noon - Windows UpdateRP841: 2/13/2014 3:00:12 Before Noon - Windows UpdateRP842: 2/16/2014 3:00:16 Before Noon - Windows UpdateRP843: 2/19/2014 3:41:11 Before Noon - Windows UpdateRP844: 2/27/2014 2:25:03 Before Noon - Scheduled CheckpointRP845: 2/28/2014 6:54:11 After Noon - Windows Update.==== Image File Execution Options =============..==== Installed Programs ======================..==== End Of File =========================== MALWAREBYTES LOG Malwarebytes Anti-Malware (Trial) 1.75.0.1300www.malwarebytes.org Database version: v2014.02.26.01 Windows 7 Service Pack 1 x64 NTFSInternet Explorer 11.0.9600.16518Owner :: OWNER-PC [administrator] Protection: Enabled 2/28/2014 11:42:07 After Noonmbam-log-2014-02-28 (23-42-07).txt Scan type: Quick scanScan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUMScan options disabled: P2PObjects scanned: 236452Time elapsed: 7 minute(s), 28 second(s) Memory Processes Detected: 0(No malicious items detected) Memory Modules Detected: 0(No malicious items detected) Registry Keys Detected: 0(No malicious items detected) Registry Values Detected: 0(No malicious items detected) Registry Data Items Detected: 0(No malicious items detected) Folders Detected: 0(No malicious items detected) Files Detected: 0(No malicious items detected) (end) ROGUEKILLER REPORT RogueKiller V8.8.10 _x64_ [Feb 28 2014] by Adlice Softwaremail : http://www.adlice.com/contact/Feedback : http://forum.adlice.comWebsite : http://www.adlice.com/softwares/roguekiller/Blog : http://www.adlice.com Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits versionStarted in : Normal modeUser : Owner [Admin rights]Mode : Scan -- Date : 02/28/2014 23:54:45| ARK || FAK || MBR | ¤¤¤ Bad processes : 0 ¤¤¤ ¤¤¤ Registry Entries : 2 ¤¤¤[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND ¤¤¤ Scheduled tasks : 0 ¤¤¤ ¤¤¤ Startup Entries : 0 ¤¤¤ ¤¤¤ Web browsers : 0 ¤¤¤ ¤¤¤ Browser Addons : 0 ¤¤¤ ¤¤¤ Particular Files / Folders: ¤¤¤ ¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤ ¤¤¤ External Hives: ¤¤¤-> D:\windows\system32\config\SYSTEM | DRVINFO [Drv - D:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND]-> D:\windows\system32\config\SOFTWARE | DRVINFO [Drv - D:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND]-> D:\windows\system32\config\SECURITY | DRVINFO [Drv - D:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND]-> D:\windows\system32\config\SAM | DRVINFO [Drv - D:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND]-> D:\windows\system32\config\DEFAULT | DRVINFO [Drv - D:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND]-> D:\Documents and Settings\Administrator\NTUSER.DAT | DRVINFO [Drv - D:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND]-> D:\Documents and Settings\All Users\NTUSER.DAT | DRVINFO [Drv - D:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - NOT_FOUND]-> D:\Documents and Settings\Default User\NTUSER.DAT | DRVINFO [Drv - D:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND]-> D:\Documents and Settings\LocalService\NTUSER.DAT | DRVINFO [Drv - D:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND]-> D:\Documents and Settings\NetworkService\NTUSER.DAT | DRVINFO [Drv - D:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND] ¤¤¤ Infection : ¤¤¤ ¤¤¤ HOSTS File: ¤¤¤--> %SystemRoot%\System32\drivers\etc\hosts ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) ST31000528AS ATA Device +++++--- User ---[MBR] 458fe7b9213c82602c762812b7d3bcac[bSP] 1b119a1dd93e8f23b366d5f434f73f66 : Windows 7/8 MBR CodePartition table:0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 953767 MoUser = LL1 ... OK!User = LL2 ... OK! +++++ PhysicalDrive1: (\\.\PHYSICALDRIVE1 @ IDE) Maxtor 6Y160P0 ATA Device +++++--- User ---[MBR] 42752de480ecd46378871c03dfa056eb[bSP] 1aad33938f4675cd0e275336065ec374 : Legit.B MBR CodePartition table:0 - [XXXXXX] FAT32 (0x0b) [VISIBLE] Offset (sectors): 63 | Size: 5322 Mo1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 10901520 | Size: 151000 MoUser = LL1 ... OK!User = LL2 ... OK! Finished : << RKreport[0]_S_02282014_235445.txt >>
  3. Hello, I've been struggling with some malware on my windows 7 home premium 64 bit home PC. About two weeks ago, I noticed something was wrong when the PC got really laggy and the cpu was pegged and RAM was full. After struggling into task manager, I found some sketchy processes, long story short some nasty .exe files hanging out in AppData that I used safe mode with command prompt to delete (havac.exe among them, if that rings a bell). I have all my files backed up, and have been going at this thing with malwarebytes and microsoft security essentials, as I don't know what else to do. Everything shows up clean now, but I'll get multiple explorer.exe processes running and using all my resources. Malwarebytes also informs me that explorer.exe is trying to access malicious web addresses. It changes almost every time, and I haven't written any of the addresses down. Bottom line, there's stuff still here making it hard for me to use my PC, and I don't know how else to attack it. I've read some about this kind of issue but descriptions and solutions vary so I figured I'd start fresh. I've also read about the security issues and vulnerability associated with this kind of thing, so I want to get this resolved asap. Thank-you in advance for all your help.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.