im infected with trojan:js/medfos.b

earlcriggle · January 24, 2013

Every five minutes MSE informs me it is blocking a threat. No action needed. In history it identifies trojan:js/medfos.b as being quarantined every five minutes. I ran full scans with MSE and MBAM Pro. No difference.

MrCharlie · January 24, 2013

Welcome to the forum, please start at the link below:

http://forums.malwar...?showtopic=9573

Post back the 2 logs here.....DDS.txt and Attach.txt

<====><====><====><====><====><====><====><====>

Next.......

Please remove any usb or external drives from the computer before you run this scan!

Quit all running programs.

Please download and run RogueKiller to your desktop.

For Windows XP, double-click to start.

For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

MrC

Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

Please stick with me until I give you the "all clear".

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 24 hours, please send me a PM)

earlcriggle · January 24, 2013

DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.3.1

Run by Earl at 22:05:56 on 2013-01-23

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.309 [GMT -5:00]

.

AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

.

============== Running Processes ================

.

c:\Program Files\Microsoft Security Client\MsMpEng.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\SOS\SOSNF\sosnffsv.exe

C:\Program Files\SOS\SOSNF\sosnflsv.exe

C:\Program Files\SOS\SOSNF\sosnfusv.exe

C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\SweetIM\Messenger\SweetIM.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\system32\hkcmd.exe

C:\Program Files\Ask.com\Updater\Updater.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Program Files\W3i\InstallIQUpdater\InstallIQUpdater.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\WINDOWS\system32\SearchProtocolHost.exe

c:\Program Files\Microsoft Security Client\MpCmdRun.exe

C:\WINDOWS\system32\SearchProtocolHost.exe

C:\WINDOWS\system32\SearchFilterHost.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

C:\WINDOWS\system32\svchost.exe -k NetworkService

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\WINDOWS\system32\svchost.exe -k hpdevmgmt

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.com/ig?hl=en

mStart Page = hxxp://home.sweetim.com

uURLSearchHooks: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - <orphaned>

uURLSearchHooks: SweetIM ToolbarURLSearchHook Class: {EEE6C35D-6118-11DC-9C72-001320C79847} - c:\program files\sweetim\toolbars\internet explorer\mgHelper.dll

dURLSearchHooks: SweetIM ToolbarURLSearchHook Class: {EEE6C35D-6118-11DC-9C72-001320C79847} - c:\program files\sweetim\toolbars\internet explorer\mgHelper.dll

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned>

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Canon Easy-WebPrint EX BHO: {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - c:\program files\canon\easy-webprint ex\ewpexbho.dll

BHO: BFlix Toolbar: {a6bf16ab-42a1-4bc5-965d-5e407e449aaa} - c:\program files\bflixtoolbar\vmntemplateX.dll

BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\5.7.8313.1002\swg.dll

BHO: FrostWire Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\ask.com\GenericAskToolbar.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\oracle\javafx 2.0 runtime\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: SweetIM Toolbar Helper: {EEE6C35C-6118-11DC-9C72-001320C79847} - c:\program files\sweetim\toolbars\internet explorer\mgToolbarIE.dll

TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

TB: FrostWire Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\ask.com\GenericAskToolbar.dll

TB: SweetIM Toolbar for Internet Explorer: {EEE6C35B-6118-11DC-9C72-001320C79847} - c:\program files\sweetim\toolbars\internet explorer\mgToolbarIE.dll

TB: Canon Easy-WebPrint EX: {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - c:\program files\canon\easy-webprint ex\ewpexhlp.dll

TB: FrostWire Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\ask.com\GenericAskToolbar.dll

TB: BFlix Toolbar: {a6bf16ab-42a1-4bc5-965d-5e407e449aaa} - c:\program files\bflixtoolbar\vmntemplateX.dll

TB: SweetIM Toolbar for Internet Explorer: {EEE6C35B-6118-11DC-9C72-001320C79847} - c:\program files\sweetim\toolbars\internet explorer\mgToolbarIE.dll

TB: Canon Easy-WebPrint EX: {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - c:\program files\canon\easy-webprint ex\ewpexhlp.dll

TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

EB: Canon Easy-WebPrint EX: {21347690-EC41-4F9A-8887-1F4AEE672439} - c:\program files\canon\easy-webprint ex\ewpexhlp.dll

uRun: [MediaGet2] c:\documents and settings\earl\local settings\application data\mediaget2\mediaget.exe --minimized

uRun: [installIQUpdater] "c:\program files\w3i\installiqupdater\InstallIQUpdater.exe" /silent /autorun

mRun: [mshet] "c:\windows\system32\rundll32.exe" "c:\documents and settings\earl\application data\mshet.dll",BlockSetup

mRun: [tigpi] "c:\windows\system32\rundll32.exe" "c:\documents and settings\earl\application data\tigpi.dll",write_init_3

mRun: [sweetIM] c:\program files\sweetim\messenger\SweetIM.exe

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [instaLAN] "c:\program files\belkin\router setup and monitor\BelkinRouterMonitor.exe" startup

mRun: [igfxpers] c:\windows\system32\igfxpers.exe

mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe

mRun: [CanonSolutionMenu] c:\program files\canon\solutionmenu\CNSLMAIN.exe /logon

mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"

mRun: [ApnUpdater] "c:\program files\ask.com\updater\Updater.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey

mRun: [KernelFaultCheck] c:\windows\system32\dumprep 0 -k

dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t

dRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uPolicies-Explorer: NoDriveTypeAutoRun = dword:145

mPolicies-Explorer: NoDriveTypeAutoRun = dword:145

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

IE: Search the Web - c:\program files\sweetim\toolbars\internet explorer\resources\menuext.html

IE: {B30C9F17-BF16-481e-BAEA-44A86128E1B4} - c:\program files\freeyoutubetomp3turboconverter\ytmRunner.html

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

LSP: mswsock.dll

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1358897685687

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab

DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab

TCP: NameServer = 192.168.2.1

TCP: Interfaces\{34531A27-7EB9-4EA2-B199-FC3B8BA311B9} : DHCPNameServer = 192.168.2.1

Notify: igfxcui - igfxdev.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

.

============= SERVICES / DRIVERS ===============

.

R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2012-8-30 193552]

R1 MpKsl1a0f4c06;MpKsl1a0f4c06;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{a75e70bc-a3b4-4722-9565-3eb75fb6b6fc}\MpKsl1a0f4c06.sys [2013-1-23 29904]

R1 sosnf32;sosnf32;c:\windows\system32\drivers\sosnf32.sys [2011-7-26 49160]

R2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2012-10-30 398184]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-11-28 682344]

R2 SOSNFFSV;SOSNF Filter Service;c:\program files\sos\sosnf\sosnffsv.exe [2011-7-26 1130888]

R2 SOSNFLSV;SOSNF Logging Service;c:\program files\sos\sosnf\sosnflsv.exe [2011-7-26 2034056]

R2 sosnfusv;SOSNF Update Service;c:\program files\sos\sosnf\sosnfusv.exe [2011-7-26 1285000]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-11-28 21104]

S0 utgcvmfo;utgcvmfo;c:\windows\system32\drivers\sypktrqj.sys --> c:\windows\system32\drivers\sypktrqj.sys [?]

S1 aveyrpsw;aveyrpsw;\??\c:\windows\system32\drivers\aveyrpsw.sys --> c:\windows\system32\drivers\aveyrpsw.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S3 androidusb;ADB Interface Driver;c:\windows\system32\drivers\fxxandroidusb.sys [2010-3-30 25728]

S3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys [2013-1-21 35144]

S3 qcusbser;Qualcomm USB Device for Legacy Serial Communication;c:\windows\system32\drivers\fxx\qcusbser.sys [2010-3-30 103424]

S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2008-4-14 14336]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

UnknownUnknown MpKsl366ace02;MpKsl366ace02; [x]

.

=============== Created Last 30 ================

.

2013-01-24 00:16:46 29904 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{a75e70bc-a3b4-4722-9565-3eb75fb6b6fc}\MpKsl1a0f4c06.sys

2013-01-23 17:54:57 60872 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{a75e70bc-a3b4-4722-9565-3eb75fb6b6fc}\offreg.dll

2013-01-22 19:13:55 29904 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{a75e70bc-a3b4-4722-9565-3eb75fb6b6fc}\MpKsl366ace02.sys

2013-01-22 03:36:40 6991832 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{a75e70bc-a3b4-4722-9565-3eb75fb6b6fc}\mpengine.dll

2013-01-22 03:35:24 6991832 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll

2013-01-22 03:22:31 -------- d-----w- c:\program files\Microsoft Security Client

2013-01-22 00:57:43 35144 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys

2013-01-21 22:39:57 335360 ----a-w- c:\documents and settings\earl\application data\mshet.dll

2013-01-21 22:39:21 580096 ----a-w- c:\documents and settings\earl\application data\tigpi.dll

2013-01-01 15:33:32 -------- d-----w- c:\program files\HRBlock2012

.

==================== Find3M ====================

.

2012-12-22 22:59:35 201728 ----a-w- c:\windows\system32\PolarClock3.scr

2012-12-16 12:23:59 290560 ----a-w- c:\windows\system32\atmfd.dll

2012-12-14 21:49:28 21104 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-11-13 01:25:12 1866368 ----a-w- c:\windows\system32\win32k.sys

2012-11-06 02:01:39 1371648 ----a-w- c:\windows\system32\msxml6.dll

2012-11-02 02:02:42 375296 ----a-w- c:\windows\system32\dpnet.dll

2012-11-01 12:17:54 916992 ----a-w- c:\windows\system32\wininet.dll

2012-11-01 12:17:54 43520 ------w- c:\windows\system32\licmgr10.dll

2012-11-01 12:17:54 1469440 ------w- c:\windows\system32\inetcpl.cpl

2012-11-01 00:35:34 385024 ------w- c:\windows\system32\html.iec

.

============= FINISH: 22:07:13.32 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows XP Home Edition

Boot Device: \Device\HarddiskVolume1

Install Date: 7/18/2011 12:29:36 PM

System Uptime: 1/23/2013 2:43:09 PM (8 hours ago)

.

Motherboard: Dell Inc. | | 0JC474

Processor: Intel® Pentium® 4 CPU 2.80GHz | Microprocessor | 2793/800mhz

.

==== Disk Partitions =========================

.

A: is Removable

C: is FIXED (NTFS) - 112 GiB total, 51.083 GiB free.

F: is CDROM ()

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP490: 10/26/2012 3:09:12 PM - System Checkpoint

RP491: 10/27/2012 3:25:05 PM - System Checkpoint

RP492: 10/28/2012 5:01:37 PM - System Checkpoint

RP493: 10/30/2012 6:20:07 PM - System Checkpoint

RP494: 10/31/2012 6:46:14 PM - System Checkpoint

RP495: 11/1/2012 7:04:34 PM - System Checkpoint

RP496: 11/2/2012 11:56:57 PM - System Checkpoint

RP497: 11/3/2012 11:01:57 PM - System Checkpoint

RP498: 11/5/2012 1:47:35 PM - System Checkpoint

RP499: 11/6/2012 3:18:08 PM - System Checkpoint

RP500: 11/7/2012 4:17:12 PM - System Checkpoint

RP501: 11/8/2012 2:56:44 PM - Software Distribution Service 3.0

RP502: 11/9/2012 3:02:49 PM - System Checkpoint

RP503: 11/10/2012 11:03:18 PM - System Checkpoint

RP504: 11/12/2012 12:05:12 PM - Software Distribution Service 3.0

RP505: 11/13/2012 12:56:47 PM - System Checkpoint

RP506: 11/16/2012 8:29:25 PM - System Checkpoint

RP507: 11/18/2012 10:55:13 AM - System Checkpoint

RP508: 11/19/2012 11:12:21 AM - System Checkpoint

RP509: 11/21/2012 7:14:33 PM - System Checkpoint

RP510: 11/22/2012 10:05:54 PM - Software Distribution Service 3.0

RP511: 11/23/2012 10:56:46 PM - System Checkpoint

RP512: 11/25/2012 1:54:34 PM - System Checkpoint

RP513: 11/26/2012 6:59:18 PM - System Checkpoint

RP514: 11/27/2012 7:55:03 PM - System Checkpoint

RP515: 11/28/2012 8:46:07 PM - System Checkpoint

RP516: 12/1/2012 1:44:23 PM - System Checkpoint

RP517: 12/2/2012 1:55:44 PM - System Checkpoint

RP518: 12/3/2012 6:21:01 PM - System Checkpoint

RP519: 12/5/2012 3:34:51 PM - Software Distribution Service 3.0

RP520: 12/5/2012 4:03:04 PM - Software Distribution Service 3.0

RP521: 12/6/2012 7:30:05 PM - System Checkpoint

RP522: 12/7/2012 8:27:49 PM - Software Distribution Service 3.0

RP523: 12/9/2012 12:18:23 PM - Software Distribution Service 3.0

RP524: 12/10/2012 10:45:35 PM - System Checkpoint

RP525: 12/12/2012 1:06:57 PM - System Checkpoint

RP526: 12/17/2012 5:32:48 PM - System Checkpoint

RP527: 12/19/2012 12:48:58 PM - System Checkpoint

RP528: 12/22/2012 4:36:10 PM - System Checkpoint

RP529: 12/23/2012 6:55:17 PM - System Checkpoint

RP530: 12/25/2012 12:56:59 PM - System Checkpoint

RP531: 12/26/2012 9:53:56 PM - System Checkpoint

RP532: 12/27/2012 10:30:20 PM - System Checkpoint

RP533: 12/31/2012 10:15:33 AM - System Checkpoint

RP534: 1/1/2013 10:33:25 AM - Installed HR Block 2012.

RP535: 1/2/2013 8:44:38 PM - System Checkpoint

RP536: 1/3/2013 3:04:01 PM - Software Distribution Service 3.0

RP537: 1/6/2013 11:55:49 AM - System Checkpoint

RP538: 1/9/2013 3:50:15 PM - System Checkpoint

RP539: 1/13/2013 12:26:18 PM - System Checkpoint

RP540: 1/13/2013 11:08:59 PM - Software Distribution Service 3.0

RP541: 1/15/2013 8:22:52 PM - System Checkpoint

RP542: 1/18/2013 3:40:09 PM - System Checkpoint

RP543: 1/18/2013 11:12:11 PM - Software Distribution Service 3.0

RP544: 1/20/2013 12:35:17 AM - System Checkpoint

RP545: 1/21/2013 4:57:29 PM - System Checkpoint

RP546: 1/22/2013 5:35:29 PM - System Checkpoint

RP547: 1/23/2013 5:47:56 PM - System Checkpoint

.

==== Installed Programs ======================

.

32 Bit HP CIO Components Installer

Adobe AIR

Adobe Flash Player 11 ActiveX

Adobe Reader X (10.1.5)

Adobe Shockwave Player 11.6

AIM for Windows

Apple Application Support

Apple Mobile Device Support

Apple Software Update

Ask Toolbar

Audacity 1.3.14

Battlefield 1942

Battlefield 1942: Secret Weapons of WWII

Battlefield 1942: The Road To Rome

Belkin Setup and Router Monitor

BFlix Toolbar

Bonjour

BufferChm

Canon Easy-PhotoPrint EX

Canon Easy-WebPrint EX

Canon MP Navigator EX 1.0

Canon MX310 series

Canon My Printer

Canon Utilities Solution Menu

Conexant D850 56K V.9x DFVc Modem

Copy

Destination Component

DeviceDiscovery

DeviceManagementQFolder

DJ_AIO_03_F4200_ProductContext

DJ_AIO_03_F4200_Software

DJ_AIO_03_F4200_Software_Min

eSupportQFolder

Express Zip File Compression Software

F4200

F4200_Help

File Type Assistant

Free File Viewer 2011

Free YouTube to MP3 TURBO Converter 2012

GameSpy Arcade

Google SketchUp 8

Google Toolbar for Internet Explorer

Google Update Helper

GPBaseService

H&R Block Basic + Efile 2010

H&R Block Basic + Efile 2011

H&R Block Basic + Efile 2012

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Hotfix for Windows Media Format 11 SDK (KB929399)

Hotfix for Windows Media Player 11 (KB939683)

Hotfix for Windows XP (KB2443685)

Hotfix for Windows XP (KB2570791)

Hotfix for Windows XP (KB2633952)

Hotfix for Windows XP (KB2756822)

Hotfix for Windows XP (KB2779562)

Hotfix for Windows XP (KB915800-v4)

Hotfix for Windows XP (KB942288-v3)

Hotfix for Windows XP (KB952287)

Hotfix for Windows XP (KB954550-v5)

Hotfix for Windows XP (KB961118)

HP Deskjet F4200 All-In-One Driver Software 10.0 Rel .3

HP Imaging Device Functions 10.0

HP Solution Center 10.0

HPProductAssistant

InstallIQ Updater

Intel® Graphics Media Accelerator Driver

Intel® PRO Network Connections Drivers

IrfanView (remove only)

iTunes

Java Auto Updater

Java 6 Update 27

Java 7 Update 3

Java SE Development Kit 7 Update 3

JavaFX 2.0.3

JavaFX 2.0.3 SDK

jGRASP

Malwarebytes Anti-Malware version 1.70.0.1100

Media Go

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1 Security Update (KB2698023)

Microsoft .NET Framework 1.1 Security Update (KB2742597)

Microsoft .NET Framework 2.0 Service Pack 2

Microsoft .NET Framework 3.0 Service Pack 2

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 4 Client Profile

Microsoft Application Error Reporting

Microsoft Base Smart Card Cryptographic Service Provider Package

Microsoft Compression Client Pack 1.0 for Windows XP

Microsoft Kernel-Mode Driver Framework Feature Pack 1.5

Microsoft Security Client

Microsoft Security Essentials

Microsoft Silverlight

Microsoft User-Mode Driver Framework Feature Pack 1.0

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

NWZ-E460 WALKMAN Guide

Phone F USB Driver

PlayStation®Network Downloader

PlayStation®Store

PolarClock3 Screen Saver

Prism Video File Converter

PunkBuster for Battlefield 1942

Scan

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)

Security Update for Microsoft Windows (KB2564958)

Security Update for Windows Internet Explorer 8 (KB2510531)

Security Update for Windows Internet Explorer 8 (KB2530548)

Security Update for Windows Internet Explorer 8 (KB2544521)

Security Update for Windows Internet Explorer 8 (KB2559049)

Security Update for Windows Internet Explorer 8 (KB2586448)

Security Update for Windows Internet Explorer 8 (KB2618444)

Security Update for Windows Internet Explorer 8 (KB2647516)

Security Update for Windows Internet Explorer 8 (KB2675157)

Security Update for Windows Internet Explorer 8 (KB2699988)

Security Update for Windows Internet Explorer 8 (KB2722913)

Security Update for Windows Internet Explorer 8 (KB2744842)

Security Update for Windows Internet Explorer 8 (KB2761465)

Security Update for Windows Internet Explorer 8 (KB2799329)

Security Update for Windows Internet Explorer 8 (KB982381)

Security Update for Windows Media Player (KB2378111)

Security Update for Windows Media Player (KB952069)

Security Update for Windows Media Player (KB954155)

Security Update for Windows Media Player (KB973540)

Security Update for Windows Media Player (KB975558)

Security Update for Windows Media Player (KB978695)

Security Update for Windows Media Player 11 (KB954154)

Security Update for Windows Search 4 - KB963093

Security Update for Windows XP (KB2079403)

Security Update for Windows XP (KB2115168)

Security Update for Windows XP (KB2229593)

Security Update for Windows XP (KB2296011)

Security Update for Windows XP (KB2347290)

Security Update for Windows XP (KB2360937)

Security Update for Windows XP (KB2387149)

Security Update for Windows XP (KB2393802)

Security Update for Windows XP (KB2412687)

Security Update for Windows XP (KB2419632)

Security Update for Windows XP (KB2423089)

Security Update for Windows XP (KB2440591)

Security Update for Windows XP (KB2443105)

Security Update for Windows XP (KB2476490)

Security Update for Windows XP (KB2478960)

Security Update for Windows XP (KB2478971)

Security Update for Windows XP (KB2479943)

Security Update for Windows XP (KB2481109)

Security Update for Windows XP (KB2483185)

Security Update for Windows XP (KB2485663)

Security Update for Windows XP (KB2503665)

Security Update for Windows XP (KB2506212)

Security Update for Windows XP (KB2507618)

Security Update for Windows XP (KB2507938)

Security Update for Windows XP (KB2508272)

Security Update for Windows XP (KB2508429)

Security Update for Windows XP (KB2509553)

Security Update for Windows XP (KB2510581)

Security Update for Windows XP (KB2524375)

Security Update for Windows XP (KB2530548)

Security Update for Windows XP (KB2535512)

Security Update for Windows XP (KB2536276-v2)

Security Update for Windows XP (KB2536276)

Security Update for Windows XP (KB2544521)

Security Update for Windows XP (KB2544893-v2)

Security Update for Windows XP (KB2544893)

Security Update for Windows XP (KB2555917)

Security Update for Windows XP (KB2562937)

Security Update for Windows XP (KB2566454)

Security Update for Windows XP (KB2567053)

Security Update for Windows XP (KB2567680)

Security Update for Windows XP (KB2570222)

Security Update for Windows XP (KB2570947)

Security Update for Windows XP (KB2584146)

Security Update for Windows XP (KB2585542)

Security Update for Windows XP (KB2592799)

Security Update for Windows XP (KB2598479)

Security Update for Windows XP (KB2603381)

Security Update for Windows XP (KB2618451)

Security Update for Windows XP (KB2619339)

Security Update for Windows XP (KB2620712)

Security Update for Windows XP (KB2621440)

Security Update for Windows XP (KB2624667)

Security Update for Windows XP (KB2631813)

Security Update for Windows XP (KB2633171)

Security Update for Windows XP (KB2639417)

Security Update for Windows XP (KB2641653)

Security Update for Windows XP (KB2646524)

Security Update for Windows XP (KB2647518)

Security Update for Windows XP (KB2653956)

Security Update for Windows XP (KB2655992)

Security Update for Windows XP (KB2659262)

Security Update for Windows XP (KB2660465)

Security Update for Windows XP (KB2661637)

Security Update for Windows XP (KB2676562)

Security Update for Windows XP (KB2685939)

Security Update for Windows XP (KB2686509)

Security Update for Windows XP (KB2691442)

Security Update for Windows XP (KB2695962)

Security Update for Windows XP (KB2698365)

Security Update for Windows XP (KB2705219)

Security Update for Windows XP (KB2707511)

Security Update for Windows XP (KB2709162)

Security Update for Windows XP (KB2712808)

Security Update for Windows XP (KB2718523)

Security Update for Windows XP (KB2719985)

Security Update for Windows XP (KB2723135)

Security Update for Windows XP (KB2724197)

Security Update for Windows XP (KB2727528)

Security Update for Windows XP (KB2731847)

Security Update for Windows XP (KB2753842-v2)

Security Update for Windows XP (KB2757638)

Security Update for Windows XP (KB2758857)

Security Update for Windows XP (KB2761226)

Security Update for Windows XP (KB2770660)

Security Update for Windows XP (KB2779030)

Security Update for Windows XP (KB923561)

Security Update for Windows XP (KB923789)

Security Update for Windows XP (KB941569)

Security Update for Windows XP (KB946648)

Security Update for Windows XP (KB950762)

Security Update for Windows XP (KB950974)

Security Update for Windows XP (KB951376-v2)

Security Update for Windows XP (KB952004)

Security Update for Windows XP (KB952954)

Security Update for Windows XP (KB954459)

Security Update for Windows XP (KB956572)

Security Update for Windows XP (KB956744)

Security Update for Windows XP (KB956802)

Security Update for Windows XP (KB956844)

Security Update for Windows XP (KB958644)

Security Update for Windows XP (KB959426)

Security Update for Windows XP (KB960803)

Security Update for Windows XP (KB960859)

Security Update for Windows XP (KB961501)

Security Update for Windows XP (KB969059)

Security Update for Windows XP (KB970430)

Security Update for Windows XP (KB971657)

Security Update for Windows XP (KB972270)

Security Update for Windows XP (KB973507)

Security Update for Windows XP (KB973869)

Security Update for Windows XP (KB973904)

Security Update for Windows XP (KB974112)

Security Update for Windows XP (KB974318)

Security Update for Windows XP (KB974392)

Security Update for Windows XP (KB974571)

Security Update for Windows XP (KB975025)

Security Update for Windows XP (KB975467)

Security Update for Windows XP (KB975560)

Security Update for Windows XP (KB975562)

Security Update for Windows XP (KB975713)

Security Update for Windows XP (KB977816)

Security Update for Windows XP (KB977914)

Security Update for Windows XP (KB978338)

Security Update for Windows XP (KB978542)

Security Update for Windows XP (KB978601)

Security Update for Windows XP (KB978706)

Security Update for Windows XP (KB979309)

Security Update for Windows XP (KB979482)

Security Update for Windows XP (KB979687)

Security Update for Windows XP (KB980436)

Security Update for Windows XP (KB981322)

Security Update for Windows XP (KB981997)

Security Update for Windows XP (KB982132)

Security Update for Windows XP (KB982665)

SigmaTel Audio

SolutionCenter

Status

SweetIM for Messenger 3.6

SweetIM Toolbar for Internet Explorer 4.2

Switch Sound File Converter

swMSM

Toolbox

TrayApp

UnloadSupport

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Microsoft Windows (KB971513)

Update for Windows Internet Explorer 8 (KB2447568)

Update for Windows XP (KB2345886)

Update for Windows XP (KB2467659)

Update for Windows XP (KB2492386)

Update for Windows XP (KB2541763)

Update for Windows XP (KB2607712)

Update for Windows XP (KB2616676)

Update for Windows XP (KB2641690)

Update for Windows XP (KB2661254-v2)

Update for Windows XP (KB2718704)

Update for Windows XP (KB2736233)

Update for Windows XP (KB2749655)

Update for Windows XP (KB898461)

Update for Windows XP (KB951978)

Update for Windows XP (KB955759)

Update for Windows XP (KB968389)

Update for Windows XP (KB971029)

Update for Windows XP (KB971737)

Update for Windows XP (KB973687)

Update for Windows XP (KB973815)

WavePad Sound Editor

WebFldrs XP

WebReg

Windows Genuine Advantage Validation Tool (KB892130)

Windows Internet Explorer 8

Windows Management Framework Core

Windows Media Format 11 runtime

Windows Media Player 11

Windows Search 4.0

Yahoo! Software Update

.

==== Event Viewer Messages From Past Week ========

.

1/23/2013 4:21:00 PM, error: Schedule [7901] - The At34.job command failed to start due to the following error: %%2147942402

1/23/2013 3:21:02 PM, error: Schedule [7901] - The At32.job command failed to start due to the following error: %%2147942402

1/23/2013 2:54:43 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.143.494.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.9103.0 Error code: 0x80244004 Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.

1/23/2013 2:45:52 PM, error: Service Control Manager [7022] - The HP CUE DeviceDiscovery Service service hung on starting.

1/23/2013 2:45:15 PM, error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service.

1/23/2013 2:21:00 PM, error: Schedule [7901] - The At30.job command failed to start due to the following error: %%2147942402

1/23/2013 12:57:13 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: PCIIde

1/23/2013 1:21:00 PM, error: Schedule [7901] - The At28.job command failed to start due to the following error: %%2147942402

1/23/2013 1:05:04 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.143.494.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.9103.0 Error code: 0x8024402c Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.

.

==== End Of File ===========================

earlcriggle · January 24, 2013

RogueKiller V8.4.3 [Jan 21 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version

Started in : Normal mode

User : Earl [Admin rights]

Mode : Scan -- Date : 01/23/2013 23:27:21

¤¤¤ Bad processes : 2 ¤¤¤

[DLL] rundll32.exe -- C:\WINDOWS\system32\rundll32.exe : C:\Documents and Settings\Earl\Application Data\mshet.dll -> KILLED [TermProc]

[DLL] rundll32.exe -- C:\WINDOWS\system32\rundll32.exe : C:\Documents and Settings\Earl\Application Data\tigpi.dll -> KILLED [TermProc]

¤¤¤ Registry Entries : 3 ¤¤¤

[RUN][sUSP PATH] HKLM\[...]\Run : mshet ("C:\WINDOWS\system32\rundll32.exe" "C:\Documents and Settings\Earl\Application Data\mshet.dll",BlockSetup) -> FOUND

[RUN][sUSP PATH] HKLM\[...]\Run : tigpi ("C:\WINDOWS\system32\rundll32.exe" "C:\Documents and Settings\Earl\Application Data\tigpi.dll",write_init_3) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

[ZeroAccess][FOLDER] U : C:\RECYCLER\S-1-5-18\$aea972c73b8d020600f2feff46f41df7\U --> FOUND

[ZeroAccess][FOLDER] U : C:\RECYCLER\S-1-5-21-746137067-1060284298-1177238915-1004\$aea972c73b8d020600f2feff46f41df7\U --> FOUND

[ZeroAccess][FOLDER] L : C:\RECYCLER\S-1-5-18\$aea972c73b8d020600f2feff46f41df7\L --> FOUND

[ZeroAccess][FOLDER] L : C:\RECYCLER\S-1-5-21-746137067-1060284298-1177238915-1004\$aea972c73b8d020600f2feff46f41df7\L --> FOUND

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ Infection : ZeroAccess ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\WINDOWS\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST3120213AS +++++

--- User ---

[MBR] 396e31a4651a11478da6377714dff4fc

[bSP] 9429db1394845d4aed9f5b3b2aac80fd : Windows XP MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 114463 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[1]_S_01232013_02d2327.txt >>

RKreport[1]_S_01232013_02d2327.txt

MrCharlie · January 24, 2013

Please read the following information first.

You're infected with Rootkit.ZeroAccess, a BackDoor Trojan.
BACKDOOR WARNING
------------------------------
One or more of the identified infections is known to use a backdoor.
This allows hackers to remotely control your computer, steal critical system information and download and execute files.
I would advice you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.
Though the infection has been identified and because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:
How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
http://www.dslreports.com/faq/10451
When Should I Format, How Should I Reinstall
http://www.dslreports.com/faq/10063
I will try my best to clean this machine but I can't guarantee that it will be 100% secure afterwards.
Let me know what you decide to do. If you decide to go through with the cleanup, please proceed with the following steps.

-----------------------------------------

Run RogueKiller again and click Scan

When the scan completes > click on the Registry tab

Put a check next to all of these and uncheck the rest: (if found)

[RUN][sUSP PATH] HKLM\[...]\Run : mshet ("C:\WINDOWS\system32\rundll32.exe" "C:\Documents and Settings\Earl\Application Data\mshet.dll",BlockSetup) -> FOUND
[RUN][sUSP PATH] HKLM\[...]\Run : tigpi ("C:\WINDOWS\system32\rundll32.exe" "C:\Documents and Settings\Earl\Application Data\tigpi.dll",write_init_3) -> FOUND

Now click Delete on the right hand column under Options

-------------

Next click on the Files tab and put a check next to these and uncheck the rest. (if found)

[ZeroAccess][FOLDER] U : C:\RECYCLER\S-1-5-18\$aea972c73b8d020600f2feff46f41df7\U --> FOUND
[ZeroAccess][FOLDER] U : C:\RECYCLER\S-1-5-21-746137067-1060284298-1177238915-1004\$aea972c73b8d020600f2feff46f41df7\U --> FOUND
[ZeroAccess][FOLDER] L : C:\RECYCLER\S-1-5-18\$aea972c73b8d020600f2feff46f41df7\L --> FOUND
[ZeroAccess][FOLDER] L : C:\RECYCLER\S-1-5-21-746137067-1060284298-1177238915-1004\$aea972c73b8d020600f2feff46f41df7\L --> FOUND

Now click Delete on the right hand column under Options

-------------

Next click on the Processes tab and put a check next to these and uncheck the rest. (if found)

[DLL] rundll32.exe -- C:\WINDOWS\system32\rundll32.exe : C:\Documents and Settings\Earl\Application Data\mshet.dll -> KILLED [TermProc]
[DLL] rundll32.exe -- C:\WINDOWS\system32\rundll32.exe : C:\Documents and Settings\Earl\Application Data\tigpi.dll -> KILLED [TermProc]

Now click Delete on the right hand column under Options

-------------

Next.............

Please create a new system restore point before running Malwarebytes Anti-Rootkit if you can.

MBAR tutorial

Download Malwarebytes Anti-Rootkit from HERE

Unzip the contents to a folder in a convenient location.
Open the folder where the contents were unzipped and run mbar.exe
Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
Click on the Cleanup button to remove any threats and reboot if prompted to do so.
Wait while the system shuts down and the cleanup process is performed.
Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt

To attach a log if needed:

Bottom right corner of this page.

New window that comes up.

~~~~~~~~~~~~~~~~~~~~~~~

Note:

If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:

Internet access

Windows Update

Windows Firewall

If there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot.

Verify that your system is now functioning normally.

MrC

earlcriggle · January 25, 2013

I've done as you instructed and here are the two antirootkit logs.

mbar-log-2013-01-25 (01-14-04).txt

system-log.txt

MrCharlie · January 25, 2013

Well Done, lets run ComboFix to clear up any leftovers.

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

earlcriggle · January 25, 2013

Sorry. I think I got ahead of myself. After sending the Log files I realized I hadn't rud a second scan. I started that and then noticed MSE flaging another action like it was doing before but this time when I look in History to see what it found it said tTojan;Win32/Medfos.X and the a minute later Trojan:Win32/Medfos.B

MrCharlie · January 25, 2013

Please run a second scan then.....MrC

earlcriggle · January 26, 2013

Well, the second scan says im clean but security essentials is quarantining threats.

Trojan:Win32/Medfos.X,

Trojan:Win32/Medfos.B,

VirTool:Win32/CeInject,

PWS:Win32/Fareit,

Exploit:Java/CVE-2013-0422

MrCharlie · January 26, 2013

OK, you have multiple infections on the computer and I'm not done cleaning them all up.

If MSE finds an infected file, let it do its job.

-----------------------------

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

MrC

earlcriggle · January 26, 2013

_{Thanks. Here is the log (JRT.txt)}

JRT.txt

MrCharlie · January 26, 2013

We missed running ComboFix, please run it:

http://forums.malwarebytes.org/index.php?showtopic=121572&view=findpost&p=639150

MrC

earlcriggle · January 26, 2013

In following the instructions for combofix I find that when I try to disable my firewall I get the message, "Due to an unidentified problem, windows cannot display windows firewall" Should I just close antiviruses and run combofix?

MrCharlie · January 26, 2013

Yes, MrC

earlcriggle · January 26, 2013

I turned off real time protection in MSE and diabled malwarebytes antimalware and doubleclicked combofix.exe. instead of a blue screen with Please wait, combofix is preparing to run, I got a black windo on which some text scrolled and then it closed and nothing more appeared.

MrCharlie · January 26, 2013

Try it like this......

Delete your copy of ComboFix. Grab a fresh copy and save it to your Desktop, but do not run it yet.

Please reboot to Safe Mode (tap the F8 key just before Windows starts to load and select the Safe Mode option from the menu).

Click Start --> Run, and enter this command exactly as shown: (copy and paste)

"%userprofile%\desktop\combofix.exe" /nombr

See if it will run successfully now. MrC

earlcriggle · January 26, 2013

Do I shut down protection software when I try it like this?

MrCharlie · January 26, 2013

Yes....MrC

earlcriggle · January 26, 2013

I tried it the way you said. I get a nox that says "Windows cannot find 'C:\Documents' Make sure you....... even though i'm entering %userprofile%\desktop\combofix.exe/nombr.

earlcriggle · January 26, 2013

also I have a window called Microsoft security essentials and everything is now on but I also have a window called microsoft security center that says microsoft security essentials is turned off

MrCharlie · January 26, 2013

Rename ComboFix.exe to NoMbr.exe and run it.

MrC

earlcriggle · January 26, 2013

_{also, microsoft security essentials says it's on but microsoft security center says microsoft security essentials is turned off.}

earlcriggle · January 26, 2013

renane and run it in safe mode or regular

MrCharlie · January 26, 2013

Try in regular first then safe mode if needed. MrC

im infected with trojan:js/medfos.b

Recommended Posts

Link to post

Share on other sites

Top Posters In This Topic

Popular Days

Top Posters In This Topic

Popular Days

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information