White Screen & Fake FBI Virus

sclrd · April 19, 2013

I have a Toshiba Satelite 64bit. I have gotten a virus that wont let me access ANYTHING. Whenever I turn my computer on, i can log into my account, then my home screen will come up. Then the screen will freeze and a white screen will come up. About a minute later, a screen comes up claiming to be the FBI and demanding a ransom.

I used the Fadar Recovery Scan Tool x64, went through the "Repair My Computer" on the Advanced Boot screen to get to Command Prompt, typed in "f:\frst64.exe", and hit scan. Here is to log it gave me:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 18-04-2013

Ran by SYSTEM at 19-04-2013 17:04:37

Running from F:\

Windows 7 Home Premium (X64) OS Language: English(US)

The current controlset is ControlSet003

==================== Registry (Whitelisted) ===================

HKLM\...\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1713448 2009-03-18] (Synaptics Incorporated)

HKLM\...\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe [900096 2009-03-23] (TOSHIBA Corporation)

HKLM\...\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe [52600 2009-03-09] (TOSHIBA Corporation)

HKLM\...\Run: [smartFaceVWatcher] %ProgramFiles%\Toshiba\SmartFaceV\SmartFaceVWatcher.exe [236544 2009-03-24] (TOSHIBA Corporation)

HKLM\...\Run: [smoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe [518008 2008-12-18] (TOSHIBA Corporation)

HKLM\...\Run: [Teco] "%ProgramFiles%\TOSHIBA\TECO\Teco.exe" /r [1451520 2009-04-14] (TOSHIBA Corporation)

HKLM\...\Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe [1123840 2009-03-24] (TOSHIBA Corporation)

HKLM\...\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE [487264 2009-03-06] (TOSHIBA Corporation)

HKLM-x32\...\Run: [TWebCamera] "%ProgramFiles(x86)%\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun [x]

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [35760 2010-06-19] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [976832 2010-06-09] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2010-11-29] (Apple Inc.)

HKLM-x32\...\Run: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49152 2007-03-11] (Hewlett-Packard Co.)

HKLM-x32\...\Run: [Memeo Instant Backup] C:\Program Files (x86)\Memeo\AutoBackup\MemeoLauncher2.exe --silent --no_ui [136416 2011-01-24] (Memeo Inc.)

HKLM-x32\...\Run: [seagate Dashboard] C:\Program Files (x86)\Seagate\Seagate Dashboard\MemeoLauncher.exe --silent --no_ui [79112 2011-06-01] ()

HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-08-27] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421776 2012-09-09] (Apple Inc.)

HKU\creationmath\...\Run: [Google Update] "C:\Users\creationmath\AppData\Local\Google\Update\GoogleUpdate.exe" /c [133104 2009-09-02] (Google Inc.)

HKU\creationmath\...\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2009-07-21] (Google Inc.)

HKU\creationmath\...\Run: [Facebook Update] "C:\Users\creationmath\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver [138096 2012-07-13] (Facebook Inc.)

HKU\creationmath\...\Run: [skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun [18642024 2013-02-28] (Skype Technologies S.A.)

HKU\creationmath\...\Run: [DisplaySwitch] "C:\ProgramData\SystemRoot.exe" [32768 2013-04-17] (?????????? ??????????)

HKU\creationmath\...\Winlogon: [shell] explorer.exe,C:\Users\creationmath\AppData\Roaming\skype.dat [137728 2011-11-16] (Elemental Group)

Tcpip\Parameters: [DhcpNameServer] 10.0.0.1

Startup: C:\Users\creationmath\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ClearPlay Easy Updates.lnk

ShortcutTarget: ClearPlay Easy Updates.lnk -> C:\Program Files (x86)\ClearPlay\ClearPlay Easy Updates\ClearPlayEasyUpdates.exe (ClearPlay Inc.)

Startup: C:\Users\creationmath\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> (No File)

Startup: C:\Users\creationmath\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk

ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

==================== Services (Whitelisted) ===================

2 camsvc; C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCameraSrv.exe [20544 2009-04-16] (TOSHIBA)

2 FlipShare Service; "C:\Program Files (x86)\Flip Video\FlipShare\FlipShareService.exe" [451904 2009-02-17] ()

2 NIS; "C:\Program Files (x86)\Norton Internet Security\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe" /s "NIS" /m "C:\Program Files (x86)\Norton Internet Security\Norton Internet Security\Engine\18.7.2.3\diMaster.dll" /prefetch:1 [262584 2011-03-31] (Symantec Corporation)

3 Symantec RemoteAssist; "C:\Program Files (x86)\Common Files\Symantec Shared\Support Controls\ssrc.exe" [394704 2008-01-29] (Symantec, Inc.)

2 TNaviSrv; C:\Program Files (x86)\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe [83312 2009-03-30] (TOSHIBA Corporation)

2 N360; "C:\Program Files (x86)\Norton 360\Engine\3.5.2.11\ccSvcHst.exe" /s "N360" /m "C:\Program Files (x86)\Norton 360\Engine\3.5.2.11\diMaster.dll" /prefetch:1 [x]

==================== Drivers (Whitelisted) =====================

1 BHDrvx64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20130322.001\BHDrvx64.sys [1387608 2013-03-21] (Symantec Corporation)

1 ccHP; C:\Windows\System32\Drivers\N360x64\0305020.00B\ccHPx64.sys [583296 2009-08-22] (Symantec Corporation)

1 eeCtrl; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2012-08-12] (Symantec Corporation)

3 EraserUtilRebootDrv; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [138912 2012-10-13] (Symantec Corporation)

1 IDSVia64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20130412.001\IDSvia64.sys [513184 2013-03-29] (Symantec Corporation)

3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20130415.003\ENG64.SYS [126192 2013-04-01] (Symantec Corporation)

3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20130415.003\EX64.SYS [2087664 2013-04-01] (Symantec Corporation)

3 SRTSP; C:\Windows\System32\Drivers\NISx64\1207020.003\SRTSP64.SYS [744568 2011-03-30] (Symantec Corporation)

1 SRTSPX; C:\Windows\system32\drivers\NISx64\1207020.003\SRTSPX64.SYS [40568 2011-03-30] (Symantec Corporation)

0 SymDS; C:\Windows\System32\drivers\NISx64\1207020.003\SYMDS64.SYS [450680 2011-01-26] (Symantec Corporation)

0 SymEFA; C:\Windows\System32\drivers\NISx64\1207020.003\SYMEFA64.SYS [912504 2011-03-14] (Symantec Corporation)

3 SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [174200 2011-05-10] (Symantec Corporation)

1 SymIM; C:\Windows\System32\DRIVERS\SymIMv.sys [31280 2009-08-22] (Symantec Corporation)

1 SymIRON; C:\Windows\system32\drivers\NISx64\1207020.003\Ironx64.SYS [171128 2011-01-26] (Symantec Corporation)

1 SymNetS; C:\Windows\System32\Drivers\NISx64\1207020.003\SYMNETS.SYS [386168 2011-04-20] (Symantec Corporation)

3 USBTINSP; C:\Windows\System32\DRIVERS\tinspusb.sys [142848 2010-03-29] (Texas Instruments)

==================== NetSvcs (Whitelisted) ====================

==================== One Month Created Files and Folders ========

2013-04-19 15:23 - 2013-04-19 15:23 - 00000000 ____D C:\FRST

2013-04-17 19:28 - 2013-04-19 12:12 - 00000004 ____A C:\Users\creationmath\AppData\Roaming\skype.ini

2013-04-17 19:25 - 2013-04-17 19:25 - 00000000 ____A C:\Users\creationmath\msconfig.exe

2013-04-17 19:24 - 2013-04-17 19:24 - 00137728 ____A (Elemental Group) C:\Users\creationmath\jqs.exe

2013-04-17 19:24 - 2013-04-17 19:24 - 00000000 ____A C:\Users\creationmath\spoolsv.exe

2013-04-17 19:24 - 2013-04-17 19:24 - 00000000 ____A C:\Users\creationmath\java.exe

2013-04-17 19:24 - 2013-04-17 19:24 - 00000000 ____A C:\Users\creationmath\csrss.exe

2013-04-17 19:19 - 2013-04-17 19:19 - 00032768 ____A (?????????? ??????????) C:\ProgramData\SystemRoot.exe

2013-04-10 20:01 - 2013-02-21 22:57 - 17817088 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2013-04-10 20:01 - 2013-02-21 22:29 - 10925568 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll

2013-04-10 20:01 - 2013-02-21 22:27 - 02312704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll

2013-04-10 20:01 - 2013-02-21 22:21 - 01346560 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll

2013-04-10 20:01 - 2013-02-21 22:20 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll

2013-04-10 20:01 - 2013-02-21 22:19 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl

2013-04-10 20:01 - 2013-02-21 22:18 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll

2013-04-10 20:01 - 2013-02-21 22:17 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll

2013-04-10 20:01 - 2013-02-21 22:15 - 00816640 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll

2013-04-10 20:01 - 2013-02-21 22:15 - 00599040 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll

2013-04-10 20:01 - 2013-02-21 22:15 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe

2013-04-10 20:01 - 2013-02-21 22:14 - 00729088 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll

2013-04-10 20:01 - 2013-02-21 22:13 - 02147840 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll

2013-04-10 20:01 - 2013-02-21 22:13 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll

2013-04-10 20:01 - 2013-02-21 22:12 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb

2013-04-10 20:01 - 2013-02-21 22:09 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll

2013-04-10 20:01 - 2013-02-21 20:05 - 12324352 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-04-10 20:01 - 2013-02-21 19:47 - 09738752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-04-10 20:01 - 2013-02-21 19:46 - 01800704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-04-10 20:01 - 2013-02-21 19:38 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-04-10 20:01 - 2013-02-21 19:38 - 01104384 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-04-10 20:01 - 2013-02-21 19:37 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2013-04-10 20:01 - 2013-02-21 19:36 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll

2013-04-10 20:01 - 2013-02-21 19:35 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-04-10 20:01 - 2013-02-21 19:34 - 00717824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-04-10 20:01 - 2013-02-21 19:34 - 00420864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2013-04-10 20:01 - 2013-02-21 19:34 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2013-04-10 20:01 - 2013-02-21 19:33 - 00607744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-04-10 20:01 - 2013-02-21 19:32 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-04-10 20:01 - 2013-02-21 19:31 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-04-10 20:01 - 2013-02-21 19:31 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2013-04-10 20:01 - 2013-02-21 19:28 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-04-10 11:42 - 2013-02-14 22:08 - 00044032 ____A (Microsoft Corporation) C:\Windows\System32\tsgqec.dll

2013-04-10 11:42 - 2013-02-14 22:06 - 03717632 ____A (Microsoft Corporation) C:\Windows\System32\mstscax.dll

2013-04-10 11:42 - 2013-02-14 22:02 - 00158720 ____A (Microsoft Corporation) C:\Windows\System32\aaclient.dll

2013-04-10 11:42 - 2013-02-14 20:37 - 03217408 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll

2013-04-10 11:42 - 2013-02-14 20:34 - 00131584 ____A (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll

2013-04-10 11:42 - 2013-02-14 19:25 - 00036864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll

2013-04-10 11:41 - 2013-03-18 22:04 - 05550424 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe

2013-04-10 11:41 - 2013-03-18 21:46 - 00043520 ____A (Microsoft Corporation) C:\Windows\System32\csrsrv.dll

2013-04-10 11:41 - 2013-03-18 21:04 - 03968856 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe

2013-04-10 11:41 - 2013-03-18 21:04 - 03913560 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe

2013-04-10 11:41 - 2013-03-18 20:47 - 00006656 ____A (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll

2013-04-10 11:41 - 2013-03-18 19:06 - 00112640 ____A (Microsoft Corporation) C:\Windows\System32\smss.exe

2013-04-10 11:41 - 2013-03-01 22:04 - 01655656 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ntfs.sys

2013-04-10 11:41 - 2013-02-28 19:36 - 03153408 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys

2013-04-10 11:41 - 2013-01-23 22:01 - 00223752 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\fvevol.sys

2013-04-09 08:42 - 2013-04-09 08:42 - 00325504 ____A C:\Windows\Minidump\040913-41886-01.dmp

2013-03-25 17:11 - 2013-02-11 20:12 - 00019968 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\usb8023.sys

2013-03-20 10:07 - 2012-10-09 10:17 - 00226816 ____A (Microsoft Corporation) C:\Windows\System32\dhcpcore6.dll

2013-03-20 10:07 - 2012-10-09 10:17 - 00055296 ____A (Microsoft Corporation) C:\Windows\System32\dhcpcsvc6.dll

2013-03-20 10:07 - 2012-10-09 09:40 - 00193536 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcore6.dll

2013-03-20 10:06 - 2012-10-09 09:40 - 00044032 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcsvc6.dll

2013-03-20 10:06 - 2012-10-03 09:44 - 00303104 ____A (Microsoft Corporation) C:\Windows\System32\nlasvc.dll

2013-03-20 10:06 - 2012-10-03 09:44 - 00246272 ____A (Microsoft Corporation) C:\Windows\System32\netcorehc.dll

2013-03-20 10:06 - 2012-10-03 09:44 - 00216576 ____A (Microsoft Corporation) C:\Windows\System32\ncsi.dll

2013-03-20 10:06 - 2012-10-03 09:44 - 00070656 ____A (Microsoft Corporation) C:\Windows\System32\nlaapi.dll

2013-03-20 10:06 - 2012-10-03 09:44 - 00018944 ____A (Microsoft Corporation) C:\Windows\System32\netevent.dll

2013-03-20 10:06 - 2012-10-03 09:42 - 00569344 ____A (Microsoft Corporation) C:\Windows\System32\iphlpsvc.dll

2013-03-20 10:06 - 2012-10-03 08:42 - 00175104 ____A (Microsoft Corporation) C:\Windows\SysWOW64\netcorehc.dll

2013-03-20 10:06 - 2012-10-03 08:42 - 00156672 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll

2013-03-20 10:06 - 2012-10-03 08:42 - 00018944 ____A (Microsoft Corporation) C:\Windows\SysWOW64\netevent.dll

2013-03-20 10:06 - 2012-10-03 08:07 - 00045568 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpipreg.sys

2013-03-20 10:06 - 2012-08-22 10:12 - 00950128 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ndis.sys

2013-03-20 10:06 - 2012-08-21 13:01 - 00245760 ____A (Microsoft Corporation) C:\Windows\System32\OxpsConverter.exe

2013-03-20 10:06 - 2012-07-04 12:26 - 00041472 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\RNDISMP.sys

2013-03-20 10:06 - 2012-01-12 23:12 - 00052224 ____A (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll

2013-03-20 10:04 - 2012-11-22 19:13 - 00068608 ____A (Microsoft Corporation) C:\Windows\System32\taskhost.exe

2013-03-20 06:37 - 2013-03-20 06:37 - 00000000 ____D C:\Windows\System32\SPReview

==================== One Month Modified Files and Folders =======

2013-04-19 15:23 - 2013-04-19 15:23 - 00000000 ____D C:\FRST

2013-04-19 12:12 - 2013-04-17 19:28 - 00000004 ____A C:\Users\creationmath\AppData\Roaming\skype.ini

2013-04-19 12:11 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT

2013-04-19 12:11 - 2009-07-13 20:51 - 00333503 ____A C:\Windows\setupact.log

2013-04-19 12:06 - 2012-05-06 13:04 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-04-19 10:34 - 2011-08-22 03:42 - 00000000 ____D C:\Users\creationmath\AppData\Roaming\Dropbox

2013-04-19 10:20 - 2009-12-28 21:55 - 02066069 ____A C:\Windows\WindowsUpdate.log

2013-04-19 09:38 - 2011-08-22 03:44 - 00000000 ___RD C:\Users\creationmath\Dropbox

2013-04-17 19:25 - 2013-04-17 19:25 - 00000000 ____A C:\Users\creationmath\msconfig.exe

2013-04-17 19:25 - 2009-12-28 21:20 - 00000000 ____D C:\users\creationmath

2013-04-17 19:24 - 2013-04-17 19:24 - 00137728 ____A (Elemental Group) C:\Users\creationmath\jqs.exe

2013-04-17 19:24 - 2013-04-17 19:24 - 00000000 ____A C:\Users\creationmath\spoolsv.exe

2013-04-17 19:24 - 2013-04-17 19:24 - 00000000 ____A C:\Users\creationmath\java.exe

2013-04-17 19:24 - 2013-04-17 19:24 - 00000000 ____A C:\Users\creationmath\csrss.exe

2013-04-17 19:19 - 2013-04-17 19:19 - 00032768 ____A (?????????? ??????????) C:\ProgramData\SystemRoot.exe

2013-04-17 19:18 - 2012-11-05 10:17 - 00000000 ____D C:\Users\creationmath\AppData\Roaming\Skype

2013-04-17 19:01 - 2009-09-02 07:54 - 00000936 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-996969257-1409184644-1662884861-1000UA.job

2013-04-17 18:35 - 2011-08-25 15:24 - 00000956 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-996969257-1409184644-1662884861-1000UA.job

2013-04-17 12:01 - 2009-09-02 07:54 - 00000884 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-996969257-1409184644-1662884861-1000Core.job

2013-04-17 09:35 - 2011-08-25 15:23 - 00000934 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-996969257-1409184644-1662884861-1000Core.job

2013-04-17 06:22 - 2009-12-28 21:18 - 00011440 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-04-17 06:22 - 2009-12-28 21:18 - 00011440 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-04-16 11:27 - 2009-07-13 21:13 - 00785762 ____A C:\Windows\System32\PerfStringBackup.INI

2013-04-11 18:33 - 2009-07-13 20:45 - 00378408 ____A C:\Windows\System32\FNTCACHE.DAT

2013-04-10 20:05 - 2010-09-06 18:01 - 72702784 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe

2013-04-10 20:04 - 2009-07-06 20:03 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-04-10 19:57 - 2009-08-09 11:38 - 00000000 ____D C:\Users\creationmath\Documents\matthew's work

2013-04-09 08:42 - 2013-04-09 08:42 - 00325504 ____A C:\Windows\Minidump\040913-41886-01.dmp

2013-04-09 08:42 - 2012-11-29 15:38 - 00000000 ____D C:\Windows\Minidump

2013-04-09 08:41 - 2012-11-29 14:18 - 542349028 ____A C:\Windows\MEMORY.DMP

2013-04-09 05:24 - 2012-11-05 10:17 - 00000000 ___RD C:\Program Files (x86)\Skype

2013-04-09 05:24 - 2012-11-05 10:17 - 00000000 ____D C:\ProgramData\Skype

2013-04-02 05:01 - 2011-07-18 04:42 - 00000000 ____D C:\Users\creationmath\AppData\Roaming\Mozilla

2013-03-25 07:35 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache

2013-03-23 12:11 - 2010-12-08 11:01 - 00000000 ____D C:\Users\creationmath\AppData\Local\CrashDumps

2013-03-20 07:46 - 2009-12-28 21:42 - 00032486 ____A C:\Windows\PFRO.log

2013-03-20 07:35 - 2009-07-13 23:45 - 00000000 ____D C:\Program Files\Windows Journal

2013-03-20 07:35 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files\Windows Sidebar

2013-03-20 07:35 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files\Windows Portable Devices

2013-03-20 07:35 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files\Windows Photo Viewer

2013-03-20 07:35 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files\Windows Defender

2013-03-20 07:35 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files\DVD Maker

2013-03-20 07:35 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files (x86)\Windows Sidebar

2013-03-20 07:35 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files (x86)\Windows Portable Devices

2013-03-20 07:35 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer

2013-03-20 07:35 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\SysWOW64\sppui

2013-03-20 07:35 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\SysWOW64\Setup

2013-03-20 07:35 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\SysWOW64\oobe

2013-03-20 07:35 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\SysWOW64\migwiz

2013-03-20 07:35 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\SysWOW64\manifeststore

2013-03-20 07:35 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\SysWOW64\Dism

2013-03-20 07:35 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\SysWOW64\AdvancedInstallers

2013-03-20 07:35 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\sppui

2013-03-20 07:35 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\Setup

2013-03-20 07:35 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\oobe

2013-03-20 07:35 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\migwiz

2013-03-20 07:35 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\manifeststore

2013-03-20 07:35 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\Dism

2013-03-20 07:35 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\AdvancedInstallers

2013-03-20 07:35 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\servicing

2013-03-20 07:35 - 2009-07-13 19:20 - 00000000 ____D C:\Program Files\Common Files\System

2013-03-20 07:03 - 2009-07-13 18:36 - 00175616 ____A (Microsoft Corporation) C:\Windows\System32\msclmd.dll

2013-03-20 07:03 - 2009-07-13 18:36 - 00152576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msclmd.dll

2013-03-20 06:37 - 2013-03-20 06:37 - 00000000 ____D C:\Windows\System32\SPReview

2013-03-20 06:32 - 2009-12-28 18:36 - 00000000 ____D C:\Windows\System32\EventProviders

ZeroAccess:

C:\$Recycle.Bin\S-1-5-21-996969257-1409184644-1662884861-1000\$20d4a7f492fc78f5ea441fc18ca4d600

==================== Known DLLs (Whitelisted) =================

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK

HKLM\...\exefile\DefaultIcon: %1 => OK

HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

==================== Memory info ===========================

Percentage of memory in use: 15%

Total physical RAM: 3963.99 MB

Available physical RAM: 3364.98 MB

Total Pagefile: 3962.14 MB

Available Pagefile: 3363.23 MB

Total Virtual: 8192 MB

Available Virtual: 8191.91 MB

==================== Partitions =============================

1 Drive c: (TI100680V0E) (Fixed) (Total:286.58 GB) (Free:121.02 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

2 Drive d: (TOSHIBA SYSTEM VOLUME) (Fixed) (Total:1.46 GB) (Free:1.3 GB) NTFS

4 Drive f: () (Removable) (Total:0.96 GB) (Free:0.39 GB) FAT

5 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Disk ### Status Size Free Dyn Gpt

-------- ------------- ------- ------- --- ---

Disk 0 Online 298 GB 0 B

Disk 1 Online 980 MB 0 B

Partitions of Disk 0:

===============

Disk ID: 939F2AAC

Partition ### Type Size Offset

------------- ---------------- ------- -------

Partition 1 Recovery 1500 MB 1024 KB

Partition 2 Primary 286 GB 1501 MB

Partition 3 Primary 10 GB 288 GB

==================================================================================

Disk: 0

Partition 1

Type : 27

Hidden: Yes

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 2 D TOSHIBA SYS NTFS Partition 1500 MB Healthy Hidden

=========================================================

Disk: 0

Partition 2

Type : 07

Hidden: No

Active: Yes

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 1 C TI100680V0E NTFS Partition 286 GB Healthy

=========================================================

Disk: 0

Partition 3

Type : 17

Hidden: Yes

Active: No

There is no volume associated with this partition.

=========================================================

Partitions of Disk 1:

===============

Disk ID: B533462D

Partition ### Type Size Offset

------------- ---------------- ------- -------

Partition 1 Primary 979 MB 760 KB

==================================================================================

Disk: 1

Partition 1

Type : 06

Hidden: No

Active: No

Volume ### Ltr Label Fs Type Size Status Info

---------- --- ----------- ----- ---------- ------- --------- --------

* Volume 3 F FAT Removable 979 MB Healthy

=========================================================

============================== MBR Partition Table ==================

==============================

Partitions of Disk 0:

===============

Disk ID: 939F2AAC

Partition 1:

=========

Hex: 0020210027591ABF0008000000E02E00

Active: NO

Type: 27

Size: 1 GB

Partition 2:

=========

Hex: 80591BBF07FEFFFF00E82E000080D223

Active: YES

Type: 07 (NTFS)

Size: 287 GB

Partition 3:

=========

Hex: 00FEFFFF17FEFFFF0068012400804101

Active: NO

Type: 17

Size: 10 GB

==============================

Partitions of Disk 1:

===============

Disk ID: B533462D

Partition 1:

=========

Hex: 001809000611F1E3F0050000109A1E00

Active: NO

Type: 06

Size: 979 MB

Last Boot: 2013-04-09 09:48

==================== End Of Log =============================

What do I do now? Please Help!!!!!!

sclrd

gringo_pr · April 19, 2013

Hello sclrd

I would like to welcome you to the Malware Removal section of the forum.

Around here they call me Gringo and I will be glad to help you with your malware problems.

Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!

Please do not run any tools unless instructed to do so.
- We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
[*]Please do not attach logs or use code boxes, just copy and paste the text.
- Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
[*]Please read every post completely before doing anything.
- Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
[*]Please provide feedback about your experience as we go.
- A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the flash drive as fixlist.txt

 
HKU\creationmath\...\Run: [DisplaySwitch] "C:\ProgramData\SystemRoot.exe" [32768 2013-04-17] (?????????? ??????????)
HKU\creationmath\...\Winlogon: [Shell] explorer.exe,C:\Users\creationmath\AppData\Roaming\skype.dat [137728 2011-11-16] (Elemental Group)
C:\ProgramData\SystemRoot.exe
C:\Users\creationmath\msconfig.exe
C:\Users\creationmath\jqs.exe
C:\Users\creationmath\spoolsv.exe
C:\Users\creationmath\java.exe
C:\Users\creationmath\csrss.exe
C:\$Recycle.Bin\S-1-5-21-996969257-1409184644-1662884861-1000\$20d4a7f492fc78f5ea441fc18ca4d600

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options.

Run FRST again like we did before but this time press the Fix button just once and wait.

The tool will make a log on the flash drive (Fixlog.txt) please post it to your reply.

Also boot the computer into normal mode and let me know how things are looking.

Gringo

sclrd · April 20, 2013

<p>Thanks for getting back to me so fast! So I just did everything you said and here is the Fixlog.txt it gave me:</p>

<div>Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 18-04-2013</div>

<div>Ran by SYSTEM at 2013-04-20 19:30:20 Run:2</div>

<div>Running from F:\</div>

<div>HKEY_USERS\creationmath\Software\Microsoft\Windows\CurrentVersion\Run\\DisplaySwitch Value deleted successfully.</div>

<div>HKEY_USERS\creationmath\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell Value deleted successfully.</div>

<div>C:\ProgramData\SystemRoot.exe moved successfully.</div>

<div>C:\Users\creationmath\msconfig.exe moved successfully.</div>

<div>C:\Users\creationmath\jqs.exe moved successfully.</div>

<div>C:\Users\creationmath\spoolsv.exe moved successfully.</div>

<div>C:\Users\creationmath\java.exe moved successfully.</div>

<div>C:\Users\creationmath\csrss.exe moved successfully.</div>

<div>C:\$Recycle.Bin\S-1-5-21-996969257-1409184644-1662884861-1000\$20d4a7f492fc78f5ea441fc18ca4d600 moved successfully.</div>

<div>==== End of Fixlog ====</div>

<div>I just restarted my computer and it worked! Thanks so much. Now, what can I do to make sure it is gone and wont come back?</div>

<div>sclrd</div>

gringo_pr · April 21, 2013

Hello sclrd

These are the programs I would like you to run next, if you have any problems with these just skip it and move on to the next one.

-AdwCleaner-

Please download

AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Delete.
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next answer.
You can find the logfile at C:\AdwCleaner[s1].txt as well.

--RogueKiller--

Download & SAVE to your Desktop RogueKiller for 32bit or Roguekiller for 64bit
- Quit all programs that you may have started.
- Please disconnect any USB or external drives from the computer before you run this scan!
- For Vista or Windows 7, right-click and select "Run as Administrator to start"
- For Windows XP, double-click to start.
- Wait until Prescan has finished ...
- Then Click on "Scan" button
- Wait until the Status box shows "Scan Finished"
- click on "delete"
- Wait until the Status box shows "Deleting Finished"
- Click on "Report" and copy/paste the content of the Notepad into your next reply.
- The log should be found in RKreport[1].txt on your Desktop
- Exit/Close RogueKiller+

Gringo

gringo_pr · April 24, 2013

Greetings

I have not heard from you in a couple of days so I am coming by to check on you to see if you are having problems or you just need some more time.

Also to remind you that it is very important that we finish the process completely so as to not get reinfected. I will let you know when we are complete and I will ask to remove our tools

Gringo

gringo_pr · April 27, 2013

Hello

48 Hour bump

It has been more than 48 hours since my last post.

do you still need help with this?
do you need more time?
are you having problems following my instructions?
if after 48hrs you have not replied to this thread then it will have to be closed!

Gringo

Maurice Naggar · April 30, 2013

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Sign In

White Screen & Fake FBI Virus

Recommended Posts

sclrd

Link to post

Share on other sites

gringo_pr

Link to post

Share on other sites

sclrd

Link to post

Share on other sites

gringo_pr

Link to post

Share on other sites

gringo_pr

Link to post

Share on other sites

gringo_pr

Link to post

Share on other sites

Maurice Naggar

Link to post

Share on other sites

Recently Browsing 0 members

Browse

Activity

Personal

Business

Business Modules

Partners

Learn

Start here

Type of malware/attacks

How does it get on my computer?

Scams and grifts

Support

Important Information