FBI MoneyPak infection Despite Malwarebytes Pro running

smmaher1 · May 16, 2013

Got the MoneyPak infection. Had Malwarebytes Pro version 1.75 running. Screen is locked is Safe mode as well. Please help remove this.

Ran FRST from Command Prompt. Results are:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-05-2013

Ran by SYSTEM on 16-05-2013 12:20:14

Running from I:\

Windows 7 Home Premium (X64) OS Language: English(US)

Internet Explorer Version 9

Boot Mode: Recovery

The current controlset is ControlSet001

ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE [x]

HKLM-x32\...\RunOnce: [*EvtMgr32] C:\Windows\{14002840-1705-1636-2817-3B3D01000B04}.exe [315392 2013-05-14] (Macecraft Software)

HKLM\...\Winlogon: [shell] C:\Windows\{14002840-1705-1636-2817-3B3D01000B04}.exe [315392 2013-05-14] (Macecraft Software)

Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)

HKLM-x32\...\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [254896 2012-09-17] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [641664 2012-04-05] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [selectRebates] C:\Program Files (x86)\SelectRebates\SelectRebates.exe [x]

HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-10-25] (Apple Inc.)

HKLM-x32\...\Run: [Nikon Message Center 2] C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe -s [619008 2010-05-25] (Nikon Corporation)

HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [152392 2013-02-20] (Apple Inc.)

HKLM-x32\...\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r [2252800 2009-08-28] (VIA)

HKLM-x32\...\Run: [EEventManager] "C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe" [1058400 2011-10-31] (SEIKO EPSON CORPORATION)

HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-01-28] (Apple Inc.)

HKLM-x32\...\Run: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-09-27] (Apple Inc.)

HKLM-x32\...\Run: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe" aml [10752 2012-02-20] ()

HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [946352 2012-12-02] (Adobe Systems Incorporated)

HKU\Roehm\...\RunOnce: [*EvtMgr32] C:\Windows\{14002840-1705-1636-2817-3B3D01000B04}.exe [315392 2013-05-14] (Macecraft Software)

HKU\Roehm\...\Policies\system: [LogonHoursAction] 2

HKU\Roehm\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

HKU\Roehm\...\Winlogon: [shell] C:\Windows\{14002840-1705-1636-2817-3B3D01000B04}.exe [315392 2013-05-14] (Macecraft Software) <==== ATTENTION

HKU\tempadmin\...\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2010-07-05] (Google Inc.)

HKU\tempadmin\...\RunOnce: [*NPE] "C:\Users\tempadmin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H3RUAW3S\NPE.exe" /POSTADVSCAN [2986440 2013-05-16] (Symantec Corporation)

HKU\tempadmin\...\Policies\system: [LogonHoursAction] 2

HKU\tempadmin\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

HKU\tempadmin2\...\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2010-07-05] (Google Inc.)

HKU\tempadmin2\...\Policies\system: [LogonHoursAction] 2

HKU\tempadmin2\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

Startup: C:\ProgramData\Start Menu\Programs\Startup\Logitech SetPoint.lnk

ShortcutTarget: Logitech SetPoint.lnk -> C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)

==================== Services (Whitelisted) =================

S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-04-05] (Advanced Micro Devices, Inc.)

S2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-11] (Seiko Epson Corporation)

S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

S2 MSSQL$APEX2005; c:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)

S3 MSSQL$MSSMLBIZ; c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

S2 AODDriver4.01; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [53888 2012-03-05] (Advanced Micro Devices)

S2 AODDriver4.1; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [53888 2012-03-05] (Advanced Micro Devices)

S1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13368 2009-04-05] ()

S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

S3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-15] ()

S3 rt61x64; C:\Windows\System32\DRIVERS\WMP54Gv41x64.sys [446304 2010-04-07] (Ralink Technology, Corp.)

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-05-16 12:19 - 2013-05-16 12:19 - 00000000 ____D C:\FRST

2013-05-16 09:37 - 2013-05-16 09:39 - 00000000 ____D C:\Ekit

2013-05-16 09:31 - 2013-05-16 09:31 - 00000000 ____D C:\moneypak

2013-05-16 08:24 - 2013-05-16 08:24 - 00000020 ___SH C:\Users\virusremover\ntuser.ini

2013-05-16 08:24 - 2013-05-16 08:24 - 00000000 ____D C:\users\virusremover

2013-05-16 08:24 - 2010-07-07 14:38 - 00000000 ____D C:\Users\virusremover\AppData\Roaming\Apple Computer

2013-05-16 08:24 - 2010-07-07 14:38 - 00000000 ____D C:\Users\virusremover\AppData\Local\Apple Computer

2013-05-16 08:24 - 2010-07-06 05:37 - 00000000 ____D C:\Users\virusremover\AppData\Roaming\Macromedia

2013-05-16 08:24 - 2010-07-02 11:26 - 00000000 ____D C:\Users\virusremover\AppData\Local\Microsoft Help

2013-05-16 08:00 - 2013-05-14 11:30 - 00315392 ___SH (Macecraft Software) C:\Windows\{14002840-1705-1636-2817-3B3D01000B04}.exe

2013-05-16 07:56 - 2013-05-16 08:13 - 00000000 ____D C:\Users\tempadmin\AppData\Local\NPE

2013-05-16 07:56 - 2013-05-16 07:56 - 00000000 ____D C:\ProgramData\Norton

2013-05-16 07:53 - 2013-05-16 07:55 - 00000000 ____D C:\Users\tempadmin\AppData\Roaming\Google

2013-05-16 07:53 - 2013-05-16 07:53 - 00000000 ____D C:\Users\tempadmin\AppData\Roaming\Adobe

2013-05-16 07:53 - 2013-05-16 07:53 - 00000000 ____D C:\Users\tempadmin\AppData\Local\Google

2013-05-16 07:44 - 2013-05-16 07:44 - 00000000 ____D C:\Users\tempadmin2\AppData\Roaming\Google

2013-05-16 07:44 - 2013-05-16 07:44 - 00000000 ____D C:\Users\tempadmin2\AppData\Local\VirtualStore

2013-05-16 07:44 - 2013-05-16 07:44 - 00000000 ____D C:\Users\tempadmin2\AppData\Local\Google

2013-05-16 07:43 - 2013-05-16 07:43 - 00000000 ____D C:\Users\tempadmin2\AppData\Roaming\Adobe

2013-05-16 07:37 - 2013-05-16 07:37 - 00000000 ____D C:\Users\tempadmin2\AppData\Roaming\Malwarebytes

2013-05-16 07:36 - 2013-05-16 07:36 - 00000632 _RASH C:\Users\tempadmin2\ntuser.pol

2013-05-16 07:35 - 2013-05-16 08:19 - 00000000 ____D C:\users\tempadmin2

2013-05-16 07:35 - 2013-05-16 07:35 - 00000020 ___SH C:\Users\tempadmin2\ntuser.ini

2013-05-16 07:35 - 2010-07-07 14:38 - 00000000 ____D C:\Users\tempadmin2\AppData\Roaming\Apple Computer

2013-05-16 07:35 - 2010-07-07 14:38 - 00000000 ____D C:\Users\tempadmin2\AppData\Local\Apple Computer

2013-05-16 07:35 - 2010-07-06 05:37 - 00000000 ____D C:\Users\tempadmin2\AppData\Roaming\Macromedia

2013-05-16 07:35 - 2010-07-02 11:26 - 00000000 ____D C:\Users\tempadmin2\AppData\Local\Microsoft Help

2013-05-16 07:33 - 2013-05-16 07:33 - 00000000 ____D C:\Users\tempadmin\AppData\Local\Apple

2013-05-16 07:27 - 2013-05-16 07:27 - 00000000 ____D C:\Users\tempadmin\AppData\Local\VirtualStore

2013-05-16 07:08 - 2013-05-16 07:24 - 00000632 _RASH C:\Users\tempadmin\ntuser.pol

2013-05-16 07:04 - 2013-05-16 07:32 - 00000000 ____D C:\users\tempadmin

2013-05-16 07:04 - 2013-05-16 07:04 - 00000020 ___SH C:\Users\tempadmin\ntuser.ini

2013-05-16 07:04 - 2010-07-07 14:38 - 00000000 ____D C:\Users\tempadmin\AppData\Roaming\Apple Computer

2013-05-16 07:04 - 2010-07-07 14:38 - 00000000 ____D C:\Users\tempadmin\AppData\Local\Apple Computer

2013-05-16 07:04 - 2010-07-06 05:37 - 00000000 ____D C:\Users\tempadmin\AppData\Roaming\Macromedia

2013-05-16 07:04 - 2010-07-02 11:26 - 00000000 ____D C:\Users\tempadmin\AppData\Local\Microsoft Help

2013-05-16 06:40 - 2013-05-16 06:40 - 00000000 ____D C:\Windows\pss

2013-05-14 11:43 - 2013-05-16 07:00 - 00778488 ____A C:\Windows\ntbtlog.txt.bak

2013-05-09 16:45 - 2011-04-20 01:03 - 00120320 ____A (SEIKO EPSON CORPORATION) C:\Windows\System32\E_ILMIBE.DLL

2013-05-09 16:45 - 2011-04-20 01:03 - 00120320 ____A (SEIKO EPSON CORPORATION) C:\Windows\System32\E_ILMIBA.DLL

2013-05-09 16:45 - 2011-03-15 01:03 - 00083968 ____A (SEIKO EPSON CORPORATION) C:\Windows\System32\E_ID4BIBE.DLL

2013-05-09 16:45 - 2011-03-15 01:03 - 00083968 ____A (SEIKO EPSON CORPORATION) C:\Windows\System32\E_ID4BIBA.DLL

2013-05-09 16:45 - 2007-04-09 23:06 - 00010752 ____A (SEIKO EPSON CORP.) C:\Windows\System32\E_GCINST.DLL

2013-05-05 13:24 - 2013-05-05 13:24 - 00000000 ____D C:\Users\Roehm\Desktop\Muscle 2

2013-04-24 07:12 - 2013-04-12 06:45 - 01656680 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ntfs.sys

2013-04-17 21:07 - 2013-04-17 21:07 - 00000000 ____A C:\Users\Roehm\java.exe

2013-04-17 21:07 - 2013-04-17 21:07 - 00000000 ____A C:\Users\Roehm\googleupdate.exe

==================== One Month Modified Files and Folders =======

2013-05-16 12:19 - 2013-05-16 12:19 - 00000000 ____D C:\FRST

2013-05-16 09:39 - 2013-05-16 09:37 - 00000000 ____D C:\Ekit

2013-05-16 09:31 - 2013-05-16 09:31 - 00000000 ____D C:\moneypak

2013-05-16 09:27 - 2010-07-01 01:52 - 01472211 ____A C:\Windows\WindowsUpdate.log

2013-05-16 09:21 - 2009-07-13 20:45 - 00015008 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-05-16 09:21 - 2009-07-13 20:45 - 00015008 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-05-16 09:19 - 2011-07-25 09:57 - 00000370 ____A C:\Windows\Tasks\At1.job

2013-05-16 09:15 - 2012-11-12 18:35 - 00646114 ____A C:\Windows\setupact.log

2013-05-16 09:14 - 2010-07-05 04:44 - 00000892 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-05-16 09:14 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT

2013-05-16 08:24 - 2013-05-16 08:24 - 00000020 ___SH C:\Users\virusremover\ntuser.ini

2013-05-16 08:24 - 2013-05-16 08:24 - 00000000 ____D C:\users\virusremover

2013-05-16 08:19 - 2013-05-16 07:35 - 00000000 ____D C:\users\tempadmin2

2013-05-16 08:14 - 2012-04-08 08:22 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-05-16 08:13 - 2013-05-16 07:56 - 00000000 ____D C:\Users\tempadmin\AppData\Local\NPE

2013-05-16 08:10 - 2012-04-08 08:22 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2013-05-16 08:10 - 2011-06-11 07:30 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-05-16 07:56 - 2013-05-16 07:56 - 00000000 ____D C:\ProgramData\Norton

2013-05-16 07:55 - 2013-05-16 07:53 - 00000000 ____D C:\Users\tempadmin\AppData\Roaming\Google

2013-05-16 07:53 - 2013-05-16 07:53 - 00000000 ____D C:\Users\tempadmin\AppData\Roaming\Adobe

2013-05-16 07:53 - 2013-05-16 07:53 - 00000000 ____D C:\Users\tempadmin\AppData\Local\Google

2013-05-16 07:50 - 2012-12-27 07:47 - 00017944 ____A C:\Windows\PFRO.log

2013-05-16 07:49 - 2010-07-01 00:56 - 00000000 ____D C:\users\Roehm

2013-05-16 07:44 - 2013-05-16 07:44 - 00000000 ____D C:\Users\tempadmin2\AppData\Roaming\Google

2013-05-16 07:44 - 2013-05-16 07:44 - 00000000 ____D C:\Users\tempadmin2\AppData\Local\VirtualStore

2013-05-16 07:44 - 2013-05-16 07:44 - 00000000 ____D C:\Users\tempadmin2\AppData\Local\Google

2013-05-16 07:43 - 2013-05-16 07:43 - 00000000 ____D C:\Users\tempadmin2\AppData\Roaming\Adobe

2013-05-16 07:38 - 2010-07-05 04:44 - 00000896 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-05-16 07:37 - 2013-05-16 07:37 - 00000000 ____D C:\Users\tempadmin2\AppData\Roaming\Malwarebytes

2013-05-16 07:36 - 2013-05-16 07:36 - 00000632 _RASH C:\Users\tempadmin2\ntuser.pol

2013-05-16 07:35 - 2013-05-16 07:35 - 00000020 ___SH C:\Users\tempadmin2\ntuser.ini

2013-05-16 07:33 - 2013-05-16 07:33 - 00000000 ____D C:\Users\tempadmin\AppData\Local\Apple

2013-05-16 07:32 - 2013-05-16 07:04 - 00000000 ____D C:\users\tempadmin

2013-05-16 07:27 - 2013-05-16 07:27 - 00000000 ____D C:\Users\tempadmin\AppData\Local\VirtualStore

2013-05-16 07:24 - 2013-05-16 07:08 - 00000632 _RASH C:\Users\tempadmin\ntuser.pol

2013-05-16 07:19 - 2013-05-16 06:40 - 00000000 ____D C:\Windows\pss

2013-05-16 07:04 - 2013-05-16 07:04 - 00000020 ___SH C:\Users\tempadmin\ntuser.ini

2013-05-16 07:00 - 2013-05-14 11:43 - 00778488 ____A C:\Windows\ntbtlog.txt.bak

2013-05-14 11:30 - 2013-05-16 08:00 - 00315392 ___SH (Macecraft Software) C:\Windows\{14002840-1705-1636-2817-3B3D01000B04}.exe

2013-05-14 09:00 - 2012-05-21 16:11 - 00000260 ____A C:\Windows\Tasks\RGames Updater.job

2013-05-14 06:23 - 2009-07-13 21:32 - 00000000 ____D C:\Windows\System32\FxsTmp

2013-05-09 16:46 - 2012-11-12 11:16 - 00000930 ____A C:\Users\Public\Desktop\EPSON Scan.lnk

2013-05-05 13:24 - 2013-05-05 13:24 - 00000000 ____D C:\Users\Roehm\Desktop\Muscle 2

2013-05-02 00:06 - 2010-07-02 08:48 - 00278800 ____N (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe

2013-04-27 12:19 - 2010-08-05 20:52 - 00000000 ____D C:\Users\Roehm\Documents\Excel

2013-04-27 12:17 - 2009-07-13 21:13 - 00930562 ____A C:\Windows\System32\PerfStringBackup.INI

2013-04-24 11:03 - 2013-02-20 08:07 - 00001009 ____A C:\Users\Public\Desktop\TeamViewer 8.lnk

2013-04-17 21:07 - 2013-04-17 21:07 - 00000000 ____A C:\Users\Roehm\java.exe

2013-04-17 21:07 - 2013-04-17 21:07 - 00000000 ____A C:\Users\Roehm\googleupdate.exe

Other Malware:

===========

C:\Users\Roehm\googleupdate.exe

C:\Users\Roehm\java.exe

C:\ProgramData\ntuser.dat

C:\Windows\Tasks\At1.job

==================== Known DLLs (Whitelisted) ================

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK

HKLM\...\exefile\DefaultIcon: %1 => OK

HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

Restore point made on: 2013-05-01 01:00:24

Restore point made on: 2013-05-02 01:00:28

Restore point made on: 2013-05-02 19:55:39

Restore point made on: 2013-05-02 22:37:10

Restore point made on: 2013-05-03 21:44:08

Restore point made on: 2013-05-05 01:00:33

Restore point made on: 2013-05-05 21:40:54

Restore point made on: 2013-05-06 20:00:33

Restore point made on: 2013-05-07 21:08:50

Restore point made on: 2013-05-08 22:19:28

Restore point made on: 2013-05-09 20:09:03

Restore point made on: 2013-05-10 20:42:56

Restore point made on: 2013-05-11 20:49:23

Restore point made on: 2013-05-11 21:45:30

Restore point made on: 2013-05-12 20:55:15

Restore point made on: 2013-05-13 10:10:58

Restore point made on: 2013-05-14 01:00:36

Restore point made on: 2013-05-16 07:28:39

==================== Memory info ===========================

Percentage of memory in use: 10%

Total physical RAM: 8191.18 MB

Available physical RAM: 7349.61 MB

Total Pagefile: 8189.32 MB

Available Pagefile: 7339.22 MB

Total Virtual: 8192 MB

Available Virtual: 8191.88 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.56 GB) (Free:294.86 GB) NTFS (Disk=0 Partition=2)

Drive d: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS (Disk=1 Partition=1) ==>[system with boot components (obtained from reading drive)]

Drive e: (250GB) (Fixed) (Total:232.88 GB) (Free:147.28 GB) NTFS (Disk=2 Partition=1)

Drive g: () (Fixed) (Total:465.56 GB) (Free:301.9 GB) NTFS (Disk=1 Partition=2)

Drive h: (May 16 2013) (CDROM) (Total:0.26 GB) (Free:0 GB) UDF

Drive i: (New Volume) (Fixed) (Total:465.76 GB) (Free:103.15 GB) NTFS (Disk=3 Partition=1)

Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Drive y: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS (Disk=0 Partition=1) ==>[system with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: CFE381B2)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=466 GB) - (Type=07 NTFS)

========================================================

Disk: 1 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 1AAE4C3A)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=466 GB) - (Type=07 NTFS)

========================================================

Disk: 2 (MBR Code: Windows XP) (Size: 233 GB) (Disk ID: A4B9E081)

Partition 1: (Not Active) - (Size=233 GB) - (Type=07 NTFS)

========================================================

Disk: 3 (MBR Code: Windows XP) (Size: 466 GB) (Disk ID: 7F3CBBF7)

Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)

Last Boot: 2013-05-13 22:33

==================== End Of Log ============================

MrCharlie · May 16, 2013

Looking at it now.....MrC

MrCharlie · May 16, 2013

OK, here you go......this should get you going:

Please download the attached fixlist.txt and copy it to your flashdrive.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options. (as you did before)

Run FRST64 or FRST (which ever one you're using) and press the Fix button just once and wait.

The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

See if the computer boots normally now.

MrC

smmaher1 · May 16, 2013

MrC,

Wow, thanks for the fast response!!! I have attached the requested logfile. I rebooted normally and have my desktop back.

Scott

Fixlog.txt

MrCharlie · May 16, 2013

Good, it's important to run a couple of more scans to ensure you're clean of malware and adware:

Download Malwarebytes Anti-Rootkit from HERE

Unzip the contents to a folder in a convenient location.
Open the folder where the contents were unzipped and run mbar.exe
Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
Click on the Cleanup button to remove any threats and reboot if prompted to do so.
Wait while the system shuts down and the cleanup process is performed.
Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt

To attach a log if needed:

Bottom right corner of this page.

New window that comes up.

~~~~~~~~~~~~~~~~~~~~~~~

Note:

If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:

Internet access

Windows Update

Windows Firewall

If there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot. It's located in the Plugins folder which is in the MBAR folder.

Just run fixdamage.exe.

Verify that your system is now functioning normally.

MrC

smmaher1 · May 16, 2013

MrC,

I have downloaded the MBAR files and extracted them, however I get an "open with" box when trying to run the .exe file. I am also getting the "open with" box when trying to open things like Internet Explorer, Chrome, and other program files.

Please advise.

MrCharlie · May 16, 2013

You can download and run rkill: (there's different versions with .com .scr)

http://www.bleepingcomputer.com/download/rkill/

Find one that runs. MrC

smmaher1 · May 16, 2013

Got RKill to run using .com version. Ran MBAR afterwards, both logs attached

Scott

Rkill.txt

system-log.txt

MrCharlie · May 16, 2013

I wonder why you had that problem because your FRST scan shows them OK:

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

-------------------------------------------------------

Next.......

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingc...to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

smmaher1 · May 16, 2013

MrC

At the very beginning of this I tried to run MBAM in safe mode and it detected items, but i think they were just tracking cookies. I will include that log too.

Combofix log included as well

scott

combofixlog.txt

mbam-log-2013-05-16 (08-58-02).txt

MrCharlie · May 16, 2013

Looks Good......

Lets check for any adware while you're here:

Please download AdwCleaner from here and save it on your Desktop.

AdwCleaner is a reliable removal tool for Adware, Foistware, toolbars and potentially unwanted programs.
AdwCleaner is a tool that deletes :
· Adwares (software ads)
· PUP/LPI (Potentially Undesirable Program)
· Toolbars
· Hijacker (Hijack of the browser's homepage)
It works with a Search and Deletion method. It can be easily uninstalled using the "Uninstall" mode.

Right-click on adwcleaner.exe and select Run As Administrator (for XP just double click) to launch the application.
Now click on the Search tab.
Please post the contents of the log-file created in your next post.

Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.

Note:

Please look over what was found......especially any folders, we're going to permanently delete it all in the next step....if there's something you may want to keep...please let me know and I'll explain to why it shouldn't be on your system.

If you see AVG Secure Search being targeted for deletion, Here's Why and Here. You can always Reinstall it.

Please note that Antivir Webguard uses ASK Toolbar as part of its web security. If you remove ASK by using Adwcleaner, Antivir Webguard will no longer work properly. Therefore, if you use this program please use the instructions below to access the options screen where you should enable /DisableAskDetections before using AdwCleaner.
You can click on the question mark (?) in the upper left corner of the program and then click on Options. You will then be presented with a dialog where you can disable various detections. These options are described below:
/DisableAskDetection - This option disables Ask Toolbar detection.

MrC

smmaher1 · May 16, 2013

AdwCleaner Log

AdwCleanerR1.txt

MrCharlie · May 16, 2013

Some adware found....lets clear it out.....

Please re-run AdwCleaner
Click on Delete button.
Confirm each time with OK if asked.
Your computer will be rebooted automatically. A text file will open after the restart. Please post the content of that logfile in your reply.

Note: You can find the logfile at C:\AdwCleaner[sn].txt as well - n is the order number.

Then......

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt.
Please Post the contents of that document.
Do Not Attach It!!!

MrC

smmaher1 · May 16, 2013

# AdwCleaner v2.301 - Logfile created 05/16/2013 at 17:27:57

# Updated 16/05/2013 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

# User : Roehm - ROEHM-PC

# Boot Mode : Normal

# Running from : C:\Users\Roehm\Desktop\adwcleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider

Key Deleted : HKCU\Software\AppDataLow\Software\I Want This

Key Deleted : HKCU\Software\InstalledBrowserExtensions

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\I Want This_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\I Want This_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow [*.crossrider.com]

Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]

***** [internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16576

[OK] Registry is clean.

-\\ Google Chrome v26.0.1410.64

File : C:\Users\Roehm\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [2432 octets] - [16/05/2013 17:09:14]

AdwCleaner[R2].txt - [2492 octets] - [16/05/2013 17:27:48]

AdwCleaner[s1].txt - [2323 octets] - [16/05/2013 17:27:57]

Results of screen317's Security Check version 0.99.63

Windows 7 Service Pack 1 x64 (UAC is enabled)

Internet Explorer 9

``````````````Antivirus/Firewall Check:``````````````

Windows Firewall Enabled!

WMI entry may not exist for antivirus; attempting automatic update.

`````````Anti-malware/Other Utilities Check:`````````

Malwarebytes Anti-Malware version 1.75.0.1300

Java 6 Update 37

Java version out of Date!

Adobe Flash Player 11.7.700.202

Adobe Reader 10.1.6 Adobe Reader out of Date!

Google Chrome 26.0.1410.43

Google Chrome 26.0.1410.64

````````Process Check: objlist.exe by Laurent````````

Malwarebytes Anti-Malware mbamservice.exe

Malwarebytes Anti-Malware mbamgui.exe

Microsoft Small Business Business Contact Manager BcmSqlStartupSvc.exe

Malwarebytes' Anti-Malware mbamscheduler.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C: 0%

````````````````````End of Log``````````````````````

MrCharlie · May 17, 2013

Out dated programs on the system are vulnerable to malware.

Please update or uninstall them:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Java™ 6 Update 37 <---please uninstall from your add/remove programs

Java version out of Date! <-------Download and install the latest version from Here

Uncheck the box to install the Ask toolbar!!! and any other free "stuff".

------------------------------------------

Adobe Reader 10.1.6 Adobe Reader out of Date! <---please check for an update if available or uninstall and download and install Foxit Reader which is less vulnerable to malware and much better than Adobe. Don't install any toolbars that may come with it (ASK Toolbar).

----------------------------------------

Google Chrome 26.0.1410.43 <-----OLD

Google Chrome 26.0.1410.64 <-----OK

You have old versions of Google Chrome on the system.

Please download and run OldChromeRemover.

@Windows Vista/Windows 7-8 users must use “Run As Administrator.”

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

A little clean up to do....

Please Uninstall ComboFix: (if you used it)

Press the Windows logo key + R to bring up the "run box"

Copy and paste next command in the field:

ComboFix /uninstall

Make sure there's a space between Combofix and /

Then hit enter.

This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point

(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall)

---------------------------------

If you used DeFogger to disable your CD Emulation drivers, please re-enable them.

-------------------------------

Please download OTC to your desktop.

http://oldtimer.geekstogo.com/OTC.exe

Double-click OTC to run it. (Vista and up users, please right click on OTC and select "Run as an Administrator")

Click on the CleanUp! button and follow the prompts.

(If you get a warning from your firewall or other security programs regarding OTC attempting to contact the Internet, please allow the connection.)

You will be asked to reboot the machine to finish the Cleanup process, choose Yes.

After the reboot all the tools we used should be gone.

Note: Some more recently created tools may not yet be removed by OTC. Feel free to manually delete any tools it leaves behind.

Any other programs or logs you can manually delete.

IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST, MBAR, etc....AdwCleaner > just run the program and click uninstall.

-------------------------------

Any questions...please post back.

If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.

Take a look at My Preventive Maintenance to avoid being infected again.

Good Luck and Thanks for using the forum, MrC

LDTate · May 17, 2013

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

FBI MoneyPak infection Despite Malwarebytes Pro running

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information