Jump to content

Infected by xsecva.exe

Seph

By Seph
in Resolved Malware Removal Logs

 Share

Recommended Posts

Seph

Seph

Posted
Posted

I just noticed in my autostart options this xsecva.exe. It's there two times. I googled it and it seems to be some sort of virus. Can you help me to get rid of it? It deactivated my security essentials as well.

.

DDS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 10.5.1

Run by Seph at 18:55:17 on 2012-09-05

Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.8175.5709 [GMT 2:00]

.

AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\System32\spoolsv.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Windows\system32\svchost.exe -k bthsvcs

C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\SysWOW64\PnkBstrA.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Windows\system32\svchost.exe -k bthaudiosvc

C:\Windows\system32\WUDFHost.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

C:\Windows\system32\taskhost.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

D:\Programme\MSI Afterburner\MSIAfterburner.exe

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe

D:\Programme\Logitech\SetPointP\SetPoint.exe

C:\Program Files\Logitech\FlowScroll\KhalScroll.exe

C:\Program Files\Microsoft Security Client\msseces.exe

D:\Programme\Kies\External\FirmwareUpdate\KiesPDLR.exe

D:\Programme\Kies\Kies.exe

C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE

C:\Windows\System32\StikyNot.exe

C:\Users\Seph\AppData\Roaming\Dropbox\bin\Dropbox.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\SearchIndexer.exe

C:\Windows\SysWOW64\CtHelper.exe

D:\Programme\Logitech\SetPointG\SetPointII.exe

D:\Programme\MSI Afterburner\Bundle\OSDServer\RTSS.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

D:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

D:\Programme\Trillian\trillian.exe

D:\Programme\Firefox\firefox.exe

C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe

D:\Programme\Firefox\plugin-container.exe

C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe

C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe

"C:\Windows\SysWOW64\svchost.exe" -k LocalServiceDns

D:\Programme\Malwarebytes' Anti-Malware\mbam.exe

C:\Windows\System32\svchost.exe -k swprv

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\SysWOW64\cscript.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

mWinlogon: Userinit=C:\Windows\system32\userinit.exe,"C:\Users\Seph\AppData\Roaming\xsecva\xsecva.exe" -s,C:\Users\Seph\AppData\Roaming\appConf32.exe,

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: Java Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll

BHO: Windows Live ID-Anmelde-Hilfsprogramm: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll

BHO: Logitech Flow Scroll: {e11db59d-5008-42ff-9069-535843bc0be1} - C:\Program Files\Logitech\FlowScroll\32-bit\LogiSmooth.dll

TB: loadtbs: {dfefcdee-cf1a-4fc8-88ad-129872198372} - C:\Users\Seph\AppData\Roaming\loadtbs\toolbar.dll

uRun: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe

mRun: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun: [AsioThk32Reg] REGSVR32.EXE /S CTASIO.DLL

mRun: [CTHelper] CTHELPER.EXE

StartupFolder: C:\Users\Seph\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\Seph\AppData\Roaming\Dropbox\bin\Dropbox.exe

mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableLUA = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: PromptOnSecureDesktop = 0 (0x0)

IE: E&xport to Microsoft Excel - D:\PROGRA~1\OFFICE~1\Office14\EXCEL.EXE/3000

IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}

LSP: mswsock.dll

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab

DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} - hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab

DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab

DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/110926/CTPID.cab

TCP: DhcpNameServer = 192.168.178.1

TCP: Interfaces\{C3F21B97-B671-4606-BB56-C6CDEF8FDB02} : DhcpNameServer = 192.168.178.1

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

{18DF081C-E8AD-4283-A596-FA578C2EBDC3}

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}

{9030D464-4C02-4ABF-8ECC-5164760863C6}

{B4F3A835-0E21-4959-BA22-42B3008E02FF}

{DBC80044-A445-435b-BC74-9C25C1C588A9}

{E11DB59D-5008-42ff-9069-535843BC0BE1}

{DFEFCDEE-CF1A-4FC8-88AD-129872198372}

mRun-x64: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe

mRun-x64: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun-x64: [AsioThk32Reg] REGSVR32.EXE /S CTASIO.DLL

mRun-x64: [CTHelper] CTHELPER.EXE

IE-X64: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Seph\AppData\Roaming\Mozilla\Firefox\Profiles\tx3jwk86.default\

FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL

FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL

FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

FF - plugin: C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll

FF - plugin: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll

FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll

FF - plugin: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll

FF - plugin: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypchub.dll

FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll

FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll

FF - plugin: C:\Windows\SysWOW64\npmproxy.dll

FF - plugin: D:\Programme\Java\bin\new_plugin\npjp2.dll

FF - plugin: D:\Programme\VLC\npvlc.dll

.

---- FIREFOX POLICIES ----

FF - user.js: network.cookie.cookieBehavior - 0

FF - user.js: privacy.clearOnShutdown.cookies - false

FF - user.js: security.warn_viewing_mixed - false

FF - user.js: security.warn_viewing_mixed.show_once - false

FF - user.js: security.warn_submit_insecure - false

FF - user.js: security.warn_submit_insecure.show_once - false

.

============= SERVICES / DRIVERS ===============

.

R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys --> C:\Windows\system32\DRIVERS\MpFilter.sys [?]

R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\system32\DRIVERS\dtsoftbus01.sys --> C:\Windows\system32\DRIVERS\dtsoftbus01.sys [?]

R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-1-3 63928]

R2 cpuz135;cpuz135;\??\C:\Windows\system32\drivers\cpuz135_x64.sys --> C:\Windows\system32\drivers\cpuz135_x64.sys [?]

R2 HFGService;Handsfree Headset Service;C:\Windows\system32\svchost.exe -k bthaudiosvc [2009-7-14 20992]

R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2012-1-1 13592]

R2 MBAMService;MBAMService;D:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe [2012-7-7 655944]

R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2012-1-1 2656280]

R3 COMMONFX.SYS;COMMONFX.SYS;C:\Windows\system32\drivers\COMMONFX.SYS --> C:\Windows\system32\drivers\COMMONFX.SYS [?]

R3 CTAUDFX.SYS;CTAUDFX.SYS;C:\Windows\system32\drivers\CTAUDFX.SYS --> C:\Windows\system32\drivers\CTAUDFX.SYS [?]

R3 CTSBLFX.SYS;CTSBLFX.SYS;C:\Windows\system32\drivers\CTSBLFX.SYS --> C:\Windows\system32\drivers\CTSBLFX.SYS [?]

R3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;C:\Windows\system32\Drivers\EtronHub3.sys --> C:\Windows\system32\Drivers\EtronHub3.sys [?]

R3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;C:\Windows\system32\Drivers\EtronXHCI.sys --> C:\Windows\system32\Drivers\EtronXHCI.sys [?]

R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]

R3 MEIx64;Intel® Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]

R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\system32\drivers\nvhda64v.sys --> C:\Windows\system32\drivers\nvhda64v.sys [?]

R3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]

R3 RTCore64;RTCore64;D:\Programme\MSI Afterburner\RTCore64.sys [2012-7-24 10568]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 gupdate;Google Update-Dienst (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-4-7 116648]

S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-2-29 158856]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-4-3 250568]

S3 BthAudioHF;BthAudioHF-Dienst;C:\Windows\system32\DRIVERS\BthAudioHF.sys --> C:\Windows\system32\DRIVERS\BthAudioHF.sys [?]

S3 COMMONFX;COMMONFX;C:\Windows\system32\drivers\COMMONFX.SYS --> C:\Windows\system32\drivers\COMMONFX.SYS [?]

S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2012-5-27 79360]

S3 CTAUDFX;CTAUDFX;C:\Windows\system32\drivers\CTAUDFX.SYS --> C:\Windows\system32\drivers\CTAUDFX.SYS [?]

S3 CTERFXFX.SYS;CTERFXFX.SYS;C:\Windows\system32\drivers\CTERFXFX.SYS --> C:\Windows\system32\drivers\CTERFXFX.SYS [?]

S3 CTERFXFX;CTERFXFX;C:\Windows\system32\drivers\CTERFXFX.SYS --> C:\Windows\system32\drivers\CTERFXFX.SYS [?]

S3 CTSBLFX;CTSBLFX;C:\Windows\system32\drivers\CTSBLFX.SYS --> C:\Windows\system32\drivers\CTSBLFX.SYS [?]

S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);C:\Windows\system32\DRIVERS\ssudbus.sys --> C:\Windows\system32\DRIVERS\ssudbus.sys [?]

S3 dmvsc;dmvsc;C:\Windows\system32\drivers\dmvsc.sys --> C:\Windows\system32\drivers\dmvsc.sys [?]

S3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe [2012-1-21 135584]

S3 gupdatem;Google Update-Dienst (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-4-7 116648]

S3 hitmanpro36;Hitman Pro 3.5 Support Driver;\??\C:\Windows\system32\drivers\hitmanpro36.sys --> C:\Windows\system32\drivers\hitmanpro36.sys [?]

S3 IntcDAud;Intel® Display-Audio;C:\Windows\system32\DRIVERS\IntcDAud.sys --> C:\Windows\system32\DRIVERS\IntcDAud.sys [?]

S3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;C:\Windows\system32\DRIVERS\LEqdUsb.Sys --> C:\Windows\system32\DRIVERS\LEqdUsb.Sys [?]

S3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;C:\Windows\system32\DRIVERS\LHidEqd.Sys --> C:\Windows\system32\DRIVERS\LHidEqd.Sys [?]

S3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;C:\Windows\system32\DRIVERS\MijXfilt.sys --> C:\Windows\system32\DRIVERS\MijXfilt.sys [?]

S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-5-4 114144]

S3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys --> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?]

S3 NisSrv;Microsoft-Netzwerkinspektion;C:\Program Files\Microsoft Security Client\NisSrv.exe [2012-3-26 291696]

S3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-1-9 174440]

S3 pwdrvio;pwdrvio;\??\C:\Windows\system32\pwdrvio.sys --> C:\Windows\system32\pwdrvio.sys [?]

S3 pwdspio;pwdspio;\??\C:\Windows\system32\pwdspio.sys --> C:\Windows\system32\pwdspio.sys [?]

S3 RivaTuner64;RivaTuner64;D:\Programme\RivaTuner v2.24\RivaTuner64.sys [2009-8-22 19952]

S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);C:\Windows\system32\DRIVERS\ssudmdm.sys --> C:\Windows\system32\DRIVERS\ssudmdm.sys [?]

S3 StorSvc;Speicherdienst;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-14 20992]

S3 SwitchBoard;SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]

S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?]

.

=============== Created Last 30 ================

.

2012-08-30 07:32:56 -------- d-----w- C:\Program Files (x86)\Battlelog Web Plugins

2012-08-29 20:34:49 891240 ----a-w- C:\Windows\System32\nvvsvc.exe

2012-08-29 20:34:49 63336 ----a-w- C:\Windows\System32\nvshext.dll

2012-08-29 20:34:49 6198120 ----a-w- C:\Windows\System32\nvcpl.dll

2012-08-29 20:34:49 3492915 ----a-w- C:\Windows\System32\nvcoproc.bin

2012-08-29 20:34:49 3266920 ----a-w- C:\Windows\System32\nvsvc64.dll

2012-08-29 20:34:49 2557800 ----a-w- C:\Windows\System32\nvsvcr.dll

2012-08-29 20:34:49 118120 ----a-w- C:\Windows\System32\nvmctray.dll

2012-08-29 20:34:35 -------- d-----w- C:\ProgramData\NVIDIA Corporation

2012-08-29 16:48:09 -------- d-----w- C:\Users\Seph\AppData\Roaming\14001.018

2012-08-29 16:47:53 6400 ----a-w- C:\Users\Seph\AppData\Roaming\BAcroIEHelpe.dll

2012-08-29 16:47:51 199824 ----a-w- C:\Users\Seph\AppData\Roaming\AcroIEHelpe.dll

2012-08-29 16:47:40 264 ----a-w- C:\Users\Seph\AppData\Roaming\srvblck5.tmp

2012-08-29 16:47:33 -------- d-----w- C:\Users\Seph\AppData\Roaming\xmldm

2012-08-29 16:33:38 -------- d-----w- C:\Users\Seph\AppData\Roaming\kock

2012-08-29 15:18:04 -------- d-sh--w- C:\Windows\SysWow64\%APPDATA%

2012-08-29 14:56:19 153600 ----a-w- C:\Users\Seph\AppData\Roaming\sdvnc.dll

2012-08-29 14:56:17 -------- d-----w- C:\Users\Seph\AppData\Roaming\xsecva

2012-08-29 11:38:07 31080 ----a-w- C:\Windows\System32\nvhdap64.dll

2012-08-29 11:38:07 189288 ----a-w- C:\Windows\System32\drivers\nvhda64v.sys

2012-08-29 11:38:07 1472360 ----a-w- C:\Windows\System32\nvhdagenco6420103.dll

2012-08-28 16:52:57 9309624 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{2E31DEBB-BFE0-414E-971A-F4C4122B015B}\mpengine.dll

2012-08-27 16:28:35 9309624 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2012-08-19 23:49:18 0 ----a-w- C:\STF155D.tmp

2012-08-19 23:48:14 0 ----a-w- C:\STF18D5.tmp

2012-08-19 23:45:49 0 ----a-w- C:\STFE3FF.tmp

2012-08-19 23:43:49 0 ----a-w- C:\STFD20.tmp

2012-08-19 23:04:04 0 ----a-w- C:\STFAC4A.tmp

2012-08-19 23:03:25 0 ----a-w- C:\STF1068.tmp

2012-08-19 23:01:57 0 ----a-w- C:\STFBA4C.tmp

2012-08-15 23:00:32 552960 ----a-w- C:\Windows\System32\drivers\bthport.sys

2012-08-06 18:13:03 -------- d-----w- C:\Users\Seph\AppData\Roaming\TeamViewer

.

==================== Find3M ====================

.

2012-09-05 16:01:57 151552 ----a-w- C:\Windows\KMSEmulator.exe

2012-08-30 23:55:20 283304 ----a-w- C:\Windows\SysWow64\PnkBstrB.xtr

2012-08-30 23:55:20 283304 ----a-w- C:\Windows\SysWow64\PnkBstrB.exe

2012-08-30 23:54:56 280904 ----a-w- C:\Windows\SysWow64\PnkBstrB.ex0

2012-08-30 07:42:45 76888 ----a-w- C:\Windows\SysWow64\PnkBstrA.exe

2012-08-28 12:16:04 18960 ----a-w- C:\Windows\System32\drivers\LNonPnP.sys

2012-08-28 08:03:20 73416 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2012-08-28 08:03:20 696520 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2012-07-18 18:15:06 3148800 ----a-w- C:\Windows\System32\win32k.sys

2012-07-15 18:36:31 30496 ----a-w- C:\Windows\System32\drivers\hitmanpro36.sys

2012-07-13 11:38:45 669184 ----a-w- C:\Windows\SysWow64\pbsvc.exe

2012-07-05 20:06:30 772544 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll

2012-07-05 20:06:20 687544 ----a-w- C:\Windows\SysWow64\deployJava1.dll

2012-07-04 22:13:27 59392 ----a-w- C:\Windows\System32\browcli.dll

2012-07-04 22:13:27 136704 ----a-w- C:\Windows\System32\browser.dll

2012-07-04 21:14:34 41984 ----a-w- C:\Windows\SysWow64\browcli.dll

2012-07-03 11:46:44 24904 ----a-w- C:\Windows\System32\drivers\mbam.sys

2012-07-02 22:48:38 3130440 ----a-w- C:\Windows\SysWow64\pbsvc_blr.exe

2012-06-29 03:37:00 60776 ----a-w- C:\Windows\System32\OpenCL.dll

2012-06-29 03:37:00 52584 ----a-w- C:\Windows\SysWow64\OpenCL.dll

2012-06-27 07:06:53 1188864 ----a-w- C:\Windows\System32\wininet.dll

2012-06-27 05:53:07 981504 ----a-w- C:\Windows\SysWow64\wininet.dll

2012-06-27 04:53:10 1638912 ----a-w- C:\Windows\System32\mshtml.tlb

2012-06-27 04:10:55 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2012-06-26 07:02:40 330240 ----a-w- C:\Windows\MASetupCaller.dll

2012-06-26 07:02:38 45320 ----a-w- C:\Windows\SysWow64\MAMACExtract.dll

2012-06-26 07:02:38 172032 ----a-w- C:\Windows\SysWow64\muzapp.exe

2012-06-16 05:16:04 609792 ----a-w- C:\Windows\System32\vbscript.dll

2012-06-16 04:26:57 428032 ----a-w- C:\Windows\SysWow64\vbscript.dll

.

============= FINISH: 18:55:24,41 ===============

Attach.txt

Link to post
Share on other sites
  • Replies 50
  • Created
  • Last Reply

Top Posters In This Topic

Popular Days

Top Posters In This Topic

Popular Days

MrCharlie

MrCharlie

Posted
Posted

Welcome to the forum.

Please remove any usb or external drives from the computer before you run this scan!

Please download and run RogueKiller to your desktop.

For Windows XP, double-click to start.

For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

MrC

Link to post
Share on other sites
Seph

Seph

Posted
  • Author
Posted

Here's the logfile:

RogueKiller V8.0.2 [08/31/2012] durch Tigzy

mail: tigzyRK<at>gmail<dot>com

Kommentare: http://www.geekstogo.com/forum/files/file/413-roguekiller/

Blog: http://tigzyrk.blogspot.com

Betriebssystem: Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Gestartet in : Normal Modus

Benutzer : Seph [Admin Rechte]

Funktion : Scannen -- Datum : 09/05/2012 19:45:53

¤¤¤ Böswillige Prozesse : 1 ¤¤¤

[sVCHOST] svchost.exe -- C:\Windows\SysWOW64\svchost.exe -> GETöTET [TermProc]

¤¤¤ Registry-Einträge : 15 ¤¤¤

[RUN][bLACKLIST DLL] HKLM\[...]\Run : sdvnc (rundll32.exe "C:\Users\Seph\AppData\Roaming\sdvnc.dll",MawDeviceCallback) -> FAND

[RUN][bLPATH] HKLM\[...]\Wow6432Node\Run : AsioThk32Reg (REGSVR32.EXE /S CTASIO.DLL) -> FAND

[HJPOL] HKCU\[...]\System : disableregistrytools (0) -> FAND

[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> FAND

[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FAND

[HJPOL] HKLM\[...]\Wow6432Node\System : DisableRegistryTools (0) -> FAND

[HJ] HKLM\[...]\Wow6432Node\System : ConsentPromptBehaviorAdmin (0) -> FAND

[HJ] HKLM\[...]\System : EnableLUA (0) -> FAND

[HJ] HKLM\[...]\Wow6432Node\System : EnableLUA (0) -> FAND

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FAND

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FAND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FAND

[HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-5-21-4273373884-2151313797-3506864452-1000\$2ce1db01728cdbe3b99b46447f15e78a\n.) -> FAND

[HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-5-18\$2ce1db01728cdbe3b99b46447f15e78a\n.) -> FAND

[HJ INPROC][ZeroAccess] HKLM\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-5-18\$2ce1db01728cdbe3b99b46447f15e78a\n.) -> FAND

¤¤¤ Bestimmte Dateien / Ordner: ¤¤¤

[ZeroAccess][FILE] Desktop.ini : C:\Windows\Assembly\GAC_32\Desktop.ini --> FAND

[ZeroAccess][FILE] Desktop.ini : C:\Windows\Assembly\GAC_64\Desktop.ini --> FAND

[ZeroAccess][FILE] n : C:\$recycle.bin\S-1-5-18\$2ce1db01728cdbe3b99b46447f15e78a\n --> FAND

[ZeroAccess][FILE] n : C:\$recycle.bin\S-1-5-21-4273373884-2151313797-3506864452-1000\$2ce1db01728cdbe3b99b46447f15e78a\n --> FAND

[ZeroAccess][FILE] @ : C:\$recycle.bin\S-1-5-18\$2ce1db01728cdbe3b99b46447f15e78a\@ --> FAND

[ZeroAccess][FILE] @ : C:\$recycle.bin\S-1-5-21-4273373884-2151313797-3506864452-1000\$2ce1db01728cdbe3b99b46447f15e78a\@ --> FAND

[ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-18\$2ce1db01728cdbe3b99b46447f15e78a\U --> FAND

[ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-21-4273373884-2151313797-3506864452-1000\$2ce1db01728cdbe3b99b46447f15e78a\U --> FAND

[ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-18\$2ce1db01728cdbe3b99b46447f15e78a\L --> FAND

[ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-21-4273373884-2151313797-3506864452-1000\$2ce1db01728cdbe3b99b46447f15e78a\L --> FAND

¤¤¤ Treiber : [NICHT GELADEN] ¤¤¤

¤¤¤ Infektion : ZeroAccess ¤¤¤

¤¤¤ Hosts-Datei: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

127.0.0.1 localhost

¤¤¤ MBR überprüfen: ¤¤¤

+++++ PhysicalDrive0: WDC WD5000AAKX-001CA0 +++++

--- User ---

[MBR] bdf7f66084224aa0d21f335dcf6e6417

[bSP] eb10ce755ec7591856e3cbf55c501779 : Windows 7 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 74899 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 153600000 | Size: 401939 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Abgeschlossen : << RKreport[1].txt >>

RKreport[1].txt

Link to post
Share on other sites
Seph

Seph

Posted
  • Author
Posted

MBAM as well, says 17 objects...

Malwarebytes Anti-Malware 1.62.0.1300

www.malwarebytes.org

Datenbank Version: v2012.09.05.08

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 8.0.7601.17514

Seph :: CLOUD_STRIFE [Administrator]

05.09.2012 18:49:41

mbam-log-2012-09-05 (19-49-29).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 518779

Laufzeit: 56 Minute(n), 44 Sekunde(n)

Infizierte Speicherprozesse: 1

C:\Users\Seph\AppData\Roaming\xsecva\xsecva.exe (Spyware.Password) -> 3512 -> Keine Aktion durchgeführt.

Infizierte Speichermodule: 1

C:\Users\Seph\AppData\Roaming\sdvnc.dll (Spyware.Password) -> Keine Aktion durchgeführt.

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 3

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Userinit (Spyware.Password) -> Bösartig: ("C:\Users\Seph\AppData\Roaming\xsecva\xsecva.exe") Gut: () -> Keine Aktion durchgeführt.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Userinit (Backdoor.Agent) -> Bösartig: (C:\Users\Seph\AppData\Roaming\appConf32.exe) Gut: () -> Keine Aktion durchgeführt.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Userinit (Hijack.UserInit) -> Bösartig: (C:\Windows\system32\userinit.exe,"C:\Users\Seph\AppData\Roaming\xsecva\xsecva.exe" -s,C:\Users\Seph\AppData\Roaming\appConf32.exe,) Gut: (userinit.exe) -> Keine Aktion durchgeführt.

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 12

C:\Users\Seph\AppData\Roaming\xsecva\xsecva.exe (Spyware.Password) -> Keine Aktion durchgeführt.

C:\Users\Seph\AppData\Roaming\sdvnc.dll (Spyware.Password) -> Keine Aktion durchgeführt.

C:\$RECYCLE.BIN\S-1-5-18\$2ce1db01728cdbe3b99b46447f15e78a\n (Trojan.0Access) -> Keine Aktion durchgeführt.

C:\$RECYCLE.BIN\S-1-5-18\$2ce1db01728cdbe3b99b46447f15e78a\U\00000004.@ (Trojan.0Access) -> Keine Aktion durchgeführt.

C:\$RECYCLE.BIN\S-1-5-18\$2ce1db01728cdbe3b99b46447f15e78a\U\00000008.@ (Trojan.Dropper.BCMiner) -> Keine Aktion durchgeführt.

C:\$RECYCLE.BIN\S-1-5-18\$2ce1db01728cdbe3b99b46447f15e78a\U\000000cb.@ (Trojan.0Access) -> Keine Aktion durchgeführt.

C:\$RECYCLE.BIN\S-1-5-18\$2ce1db01728cdbe3b99b46447f15e78a\U\80000000.@ (Trojan.0Access) -> Keine Aktion durchgeführt.

C:\$RECYCLE.BIN\S-1-5-18\$2ce1db01728cdbe3b99b46447f15e78a\U\80000032.@ (Trojan.0Access) -> Keine Aktion durchgeführt.

C:\$RECYCLE.BIN\S-1-5-18\$2ce1db01728cdbe3b99b46447f15e78a\U\80000064.@ (Trojan.0Access) -> Keine Aktion durchgeführt.

C:\$RECYCLE.BIN\S-1-5-21-4273373884-2151313797-3506864452-1000\$2ce1db01728cdbe3b99b46447f15e78a\n (Trojan.0Access) -> Keine Aktion durchgeführt.

C:\Users\Seph\AppData\Roaming\14001.018\components\AcroFF.dll (Trojan.Agent) -> Keine Aktion durchgeführt.

C:\Users\Seph\AppData\Roaming\appConf32.exe (Backdoor.Agent) -> Keine Aktion durchgeführt.

(Ende)

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Here you go......

Your computer is infected with a nasty rootkit. Please read the following information first.

You're infected with Rootkit.ZeroAccess, a BackDoor Trojan.

BACKDOOR WARNING

------------------------------

One or more of the identified infections is known to use a backdoor.

This allows hackers to remotely control your computer, steal critical system information and download and execute files.

I would advice you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the infection has been identified and because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

http://www.dslreports.com/faq/10451

When Should I Format, How Should I Reinstall

http://www.dslreports.com/faq/10063

I will try my best to clean this machine but I can't guarantee that it will be 100% secure afterwards.

Let me know what you decide to do. If you decide to go through with the cleanup, please proceed with the following steps.

-----------------------------------------

Please read the directions carefully so you don't end up deleting something that is good!!

Please download the latest version of TDSSKiller from here and save it to your Desktop.

  • Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.
    image000q.png
  • Put a checkmark beside loaded modules.
    2012081514h0118.png
  • A reboot will be needed to apply the changes. Do it.
  • TDSSKiller will launch automatically after the reboot. Also your computer may seem very slow and unusable. This is normal. Give it enough time to load your background programs.
  • Then click on Change parameters in TDSSKiller.
  • Check all boxes then click OK.
    2012081517h0349.png
  • Click the Start Scan button.
    19695967.jpg
  • The scan should take no longer than 2 minutes.
  • If a suspicious object is detected, the default action will be Skip, click on Continue.
    67776163.jpg
  • If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
    Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
    62117367.jpg
    Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
  • A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.
  • Sometimes these logs can be very large, in that case please attach it or zip it up and attach it.

Here's a summary of what to do if you would like to print it out:

If a suspicious object is detected, the default action will be Skip, click on Continue

If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose

Skip and click on Continue

If malicious objects are found, they will show in the Scan results and offer three (3) options.

Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.

Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

MrC

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

That method didn't work on the infection, we have to do it this way:

For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.

For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

How to tell > 32 or 64 bit

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  • Use the arrow keys to select the Repair your computer menu item.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:

  • Insert the installation disc.
  • Restart your computer.
  • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  • Click Repair your computer.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account and click Next.

On the System Recovery Options menu you will get the following options:



    • Startup Repair
      System Restore
      Windows Complete PC Restore
      Windows Memory Diagnostic Tool
      Command Prompt

    [*]Select Command Prompt

    [*]In the command window type in notepad and press Enter.

    [*]The notepad opens. Under File menu select Open.

    [*]Select "Computer" and find your flash drive letter and close the notepad.

    [*]In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter

    Note: Replace letter e with the drive letter of your flash drive.

    [*]The tool will start to run.

    [*]When the tool opens click Yes to disclaimer.

    [*]Press Scan button.

    [*]FRST will let you know when the scan is complete and has written the FRST.txt to file, close out this message, then type the following into the search box:

    services.exe

    [*]Now press the Search button

    [*]When the search is complete, search.txt will also be written to your USB

    [*]Type exit and reboot the computer normally

    [*]Please copy and paste both logs in your reply.(FRST.txt and Search.txt)

MrC

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

OK, here you go......Please carefully carry out this procedure!!!!!!

Please download the attached fixlist.txt and copy it to your flashdrive.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options. (as you did before)

Run FRST64 or FRST (which ever one you're using) and press the Fix button just once and wait.

The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

MrC

Link to post
Share on other sites
Seph

Seph

Posted
  • Author
Posted

Here it comes:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 05-09-2012

Ran by SYSTEM at 2012-09-05 22:26:41 Run:3

Running from G:\

==============================================

HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\\Userinit Value was restored successfully .

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\\Default value was restored successfully .

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}] should be deleted in normal mode (if present).

C:\$Recycle.Bin\S-1-5-21-4273373884-2151313797-3506864452-1000\$2ce1db01728cdbe3b99b46447f15e78a not found.

C:\Windows\assembly\GAC_32\Desktop.ini not found.

C:\Windows\assembly\GAC_64\Desktop.ini not found.

==== End of Fixlog ====

Link to post
Share on other sites
Seph

Seph

Posted
  • Author
Posted

Here it comes. Firewall etc still not working. Maybe the fixlist thing didn't work?

RogueKiller V8.0.2 [08/31/2012] durch Tigzy

mail: tigzyRK<at>gmail<dot>com

Kommentare: http://www.geekstogo.com/forum/files/file/413-roguekiller/

Blog: http://tigzyrk.blogspot.com

Betriebssystem: Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Gestartet in : Normal Modus

Benutzer : Seph [Admin Rechte]

Funktion : Scannen -- Datum : 09/06/2012 10:58:39

¤¤¤ Böswillige Prozesse : 0 ¤¤¤

¤¤¤ Registry-Einträge : 13 ¤¤¤

[RUN][bLACKLIST DLL] HKLM\[...]\Run : sdvnc (rundll32.exe "C:\Users\Seph\AppData\Roaming\sdvnc.dll",MawDeviceCallback) -> FAND

[RUN][PREVRUN] HKLM\[...]\Wow6432Node\Run : AsioThk32Reg (REGSVR32.EXE /S CTASIO.DLL) -> FAND

[HJPOL] HKCU\[...]\System : disableregistrytools (0) -> FAND

[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> FAND

[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FAND

[HJPOL] HKLM\[...]\Wow6432Node\System : DisableRegistryTools (0) -> FAND

[HJ] HKLM\[...]\Wow6432Node\System : ConsentPromptBehaviorAdmin (0) -> FAND

[HJ] HKLM\[...]\System : EnableLUA (0) -> FAND

[HJ] HKLM\[...]\Wow6432Node\System : EnableLUA (0) -> FAND

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FAND

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FAND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FAND

[HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-5-21-4273373884-2151313797-3506864452-1000\$2ce1db01728cdbe3b99b46447f15e78a\n.) -> FAND

¤¤¤ Bestimmte Dateien / Ordner: ¤¤¤

[ZeroAccess][FILE] n : C:\$recycle.bin\S-1-5-18\$2ce1db01728cdbe3b99b46447f15e78a\n --> FAND

[ZeroAccess][FILE] @ : C:\$recycle.bin\S-1-5-18\$2ce1db01728cdbe3b99b46447f15e78a\@ --> FAND

[ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-18\$2ce1db01728cdbe3b99b46447f15e78a\U --> FAND

[ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-18\$2ce1db01728cdbe3b99b46447f15e78a\L --> FAND

¤¤¤ Treiber : [NICHT GELADEN] ¤¤¤

¤¤¤ Infektion : ZeroAccess ¤¤¤

¤¤¤ Hosts-Datei: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

127.0.0.1 localhost

¤¤¤ MBR überprüfen: ¤¤¤

+++++ PhysicalDrive0: WDC WD5000AAKX-001CA0 +++++

--- User ---

[MBR] bdf7f66084224aa0d21f335dcf6e6417

[bSP] eb10ce755ec7591856e3cbf55c501779 : Windows 7 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 74899 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 153600000 | Size: 401939 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Abgeschlossen : << RKreport[2].txt >>

RKreport[1].txt ; RKreport[2].txt

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Run RogueKiller again and click Scan

When the scan completes > click on the Registry tab

Put a check next to all of these and uncheck the rest: (if found)

[RUN][bLACKLIST DLL] HKLM\[...]\Run : sdvnc (rundll32.exe "C:\Users\Seph\AppData\Roaming\sdvnc.dll",MawDeviceCallback) -> FAND

[RUN][PREVRUN] HKLM\[...]\Wow6432Node\Run : AsioThk32Reg (REGSVR32.EXE /S CTASIO.DLL) -> FAND

[HJPOL] HKCU\[...]\System : disableregistrytools (0) -> FAND

[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> FAND

[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FAND

[HJPOL] HKLM\[...]\Wow6432Node\System : DisableRegistryTools (0) -> FAND

[HJ] HKLM\[...]\Wow6432Node\System : ConsentPromptBehaviorAdmin (0) -> FAND

[HJ] HKLM\[...]\System : EnableLUA (0) -> FAND

[HJ] HKLM\[...]\Wow6432Node\System : EnableLUA (0) -> FAND

[HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\$Recycle.Bin\S-1-5-21-4273373884-2151313797-3506864452-1000\$2ce1db01728cdbe3b99b46447f15e78a\n.) -> FAND

Now click Delete on the right hand column under Options

~~~~~~~~~~~~~

Next click on the Files tab and put a check next to these and uncheck the rest. (if found)

[ZeroAccess][FILE] n : C:\$recycle.bin\S-1-5-18\$2ce1db01728cdbe3b99b46447f15e78a\n --> FAND

[ZeroAccess][FILE] @ : C:\$recycle.bin\S-1-5-18\$2ce1db01728cdbe3b99b46447f15e78a\@ --> FAND

[ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-18\$2ce1db01728cdbe3b99b46447f15e78a\U --> FAND

[ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-18\$2ce1db01728cdbe3b99b46447f15e78a\L --> FAND

Now click Delete on the right hand column under Options

~~~~~~~~~~~~~

Reboot and ..........

Please Update and run a Quick Scan with MBAM, post the report.

Make sure that everything is checked, and click Remove Selected.

~~~~~~~~~~~~

Reboot and scan the system again with RogueKiller and post the new log.

MrC

Link to post
Share on other sites
Seph

Seph

Posted
  • Author
Posted

Here comes the MBAM log:

Malwarebytes Anti-Malware 1.62.0.1300

www.malwarebytes.org

Datenbank Version: v2012.09.05.08

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 8.0.7601.17514

Seph :: CLOUD_STRIFE [Administrator]

06.09.2012 19:19:52

mbam-log-2012-09-06 (19-19-52).txt

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 203917

Laufzeit: 1 Minute(n), 58 Sekunde(n)

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 4

C:\Users\Seph\AppData\Roaming\sdvnc.dll (Spyware.Password) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Seph\AppData\Roaming\14001.018\components\AcroFF.dll (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Seph\AppData\Roaming\xsecva\xsecva.exe (Spyware.Password) -> Erfolgreich gelöscht und in Quarantäne gestellt.

C:\Users\Seph\AppData\Roaming\appConf32.exe (Backdoor.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

Link to post
Share on other sites
Seph

Seph

Posted
  • Author
Posted

I'm sorry, I forgot to post it! Firewall etc. still not working btw.

RogueKiller V8.0.2 [08/31/2012] durch Tigzy

mail: tigzyRK<at>gmail<dot>com

Kommentare: http://www.geekstogo.com/forum/files/file/413-roguekiller/

Blog: http://tigzyrk.blogspot.com

Betriebssystem: Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Gestartet in : Normal Modus

Benutzer : Seph [Admin Rechte]

Funktion : Scannen -- Datum : 09/06/2012 20:29:16

¤¤¤ Böswillige Prozesse : 0 ¤¤¤

¤¤¤ Registry-Einträge : 3 ¤¤¤

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FAND

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FAND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FAND

¤¤¤ Bestimmte Dateien / Ordner: ¤¤¤

¤¤¤ Treiber : [NICHT GELADEN] ¤¤¤

¤¤¤ Infektion : ¤¤¤

¤¤¤ Hosts-Datei: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

127.0.0.1 localhost

¤¤¤ MBR überprüfen: ¤¤¤

+++++ PhysicalDrive0: WDC WD5000AAKX-001CA0 +++++

--- User ---

[MBR] bdf7f66084224aa0d21f335dcf6e6417

[bSP] eb10ce755ec7591856e3cbf55c501779 : Windows 7 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 74899 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 153600000 | Size: 401939 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Abgeschlossen : << RKreport[3].txt >>

RKreport[1].txt ; RKreport[2].txt ; RKreport[3].txt

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Looks Good.....

Please download Farbar Service Scanner and run it on the computer with the issue.

  • Make sure the following options are checked:
    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center
    • Windows Update
    • Windows Defender

    [*]Press "Scan".

    [*]It will create a log (FSS.txt) in the same directory the tool is run.

    [*]Please copy and paste the log to your reply.

MrC

Link to post
Share on other sites
Seph

Seph

Posted
  • Author
Posted

Here it comes:

Farbar Service Scanner Version: 06-08-2012

Ran by Seph (administrator) on 06-09-2012 at 20:58:53

Running from "C:\Users\Seph\Desktop"

Microsoft Windows 7 Professional Service Pack 1 (X64)

Boot Mode: Normal

****************************************************************

Internet Services:

============

Connection Status:

==============

Localhost is accessible.

LAN connected.

Google IP is accessible.

Google.com is accessible.

Yahoo IP is accessible.

Yahoo.com is accessible.

Windows Firewall:

=============

mpsdrv Service is not running. Checking service configuration:

The start type of mpsdrv service is OK.

The ImagePath of mpsdrv service is OK.

MpsSvc Service is not running. Checking service configuration:

Checking Start type: ATTENTION!=====> Unable to open MpsSvc registry key. The service key does not exist.

Checking ImagePath: ATTENTION!=====> Unable to open MpsSvc registry key. The service key does not exist.

Checking ServiceDll: ATTENTION!=====> Unable to open MpsSvc registry key. The service key does not exist.

bfe Service is not running. Checking service configuration:

Checking Start type: ATTENTION!=====> Unable to open bfe registry key. The service key does not exist.

Checking ImagePath: ATTENTION!=====> Unable to open bfe registry key. The service key does not exist.

Checking ServiceDll: ATTENTION!=====> Unable to open bfe registry key. The service key does not exist.

Firewall Disabled Policy:

==================

System Restore:

============

System Restore Disabled Policy:

========================

Action Center:

============

wscsvc Service is not running. Checking service configuration:

Checking Start type: ATTENTION!=====> Unable to open wscsvc registry key. The service key does not exist.

Checking ImagePath: ATTENTION!=====> Unable to open wscsvc registry key. The service key does not exist.

Checking ServiceDll: ATTENTION!=====> Unable to open wscsvc registry key. The service key does not exist.

Windows Update:

============

wuauserv Service is not running. Checking service configuration:

Checking Start type: ATTENTION!=====> Unable to open wuauserv registry key. The service key does not exist.

Checking ImagePath: ATTENTION!=====> Unable to open wuauserv registry key. The service key does not exist.

Checking ServiceDll: ATTENTION!=====> Unable to open wuauserv registry key. The service key does not exist.

BITS Service is not running. Checking service configuration:

Checking Start type: ATTENTION!=====> Unable to open BITS registry key. The service key does not exist.

Checking ImagePath: ATTENTION!=====> Unable to open BITS registry key. The service key does not exist.

Checking ServiceDll: ATTENTION!=====> Unable to open BITS registry key. The service key does not exist.

Windows Autoupdate Disabled Policy:

============================

Windows Defender:

==============

WinDefend Service is not running. Checking service configuration:

Checking Start type: ATTENTION!=====> Unable to open WinDefend registry key. The service key does not exist.

Checking ImagePath: ATTENTION!=====> Unable to open WinDefend registry key. The service key does not exist.

Checking ServiceDll: ATTENTION!=====> Unable to open WinDefend registry key. The service key does not exist.

Windows Defender Disabled Policy:

==========================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]

"DisableAntiSpyware"=DWORD:1

Other Services:

==============

Checking Start type of SharedAccess: ATTENTION!=====> Unable to retrieve start type of SharedAccess. The value does not exist.

Checking ImagePath of SharedAccess: ATTENTION!=====> Unable to retrieve ImagePath of SharedAccess. The value does not exist.

Checking ServiceDll of SharedAccess: ATTENTION!=====> Unable to open SharedAccess registry key. The service key does not exist.

File Check:

========

C:\Windows\System32\nsisvc.dll => MD5 is legit

C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit

C:\Windows\System32\dhcpcore.dll => MD5 is legit

C:\Windows\System32\drivers\afd.sys => MD5 is legit

C:\Windows\System32\drivers\tdx.sys => MD5 is legit

C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit

C:\Windows\System32\dnsrslvr.dll => MD5 is legit

C:\Windows\System32\mpssvc.dll => MD5 is legit

C:\Windows\System32\bfe.dll => MD5 is legit

C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit

C:\Windows\System32\SDRSVC.dll => MD5 is legit

C:\Windows\System32\vssvc.exe => MD5 is legit

C:\Windows\System32\wscsvc.dll => MD5 is legit

C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit

C:\Windows\System32\wuaueng.dll => MD5 is legit

C:\Windows\System32\qmgr.dll => MD5 is legit

C:\Windows\System32\es.dll => MD5 is legit

C:\Windows\System32\cryptsvc.dll => MD5 is legit

C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit

C:\Windows\System32\ipnathlp.dll => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

**** End of log ****

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Download all of these reg files to your desktop:

http://download.blee...es/7/MpsSvc.reg

http://download.blee...vices/7/BFE.reg

http://download.blee...es/7/mpsdrv.reg

http://download.blee.../7/wuauserv.reg

http://download.blee...ices/7/BITS.reg

Double click on each one and allow it to merge into the registry.

Reboot and click on the link below:

http://support.micro...iagnostic/en-us

Click on "Run Now" allow the fix to run.

~~~~~~~~~~~~

Click on the link below:

http://support.microsoft.com/kb/971058

Click on "Run Now" allow the fix to run.

Reboot and let me know,,,,MrC

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.