Department of Justice MoneyPak - Windows 7

kkm2 · May 24, 2013

Hello, I'm I'm a new member so I apologize if this is not the best way to ask for help but I have recently become infected with this Department of Justice MoneyPak ransomware on my Windows 7 system and for the life of me cannot remove it. I have a Farbar recovery scan report if that's useful. Can someone help me out? Thank you.

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-05-2013

Ran by SYSTEM on 24-05-2013 07:20:49

Running from G:\

Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)

Internet Explorer Version 9

Boot Mode: Recovery

The current controlset is ControlSet001

ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [secure Applicayion] C:\Program Files\Acer\Acer Theft Shield\USecuAppClient.exe [258664 2012-03-23] ()

HKLM\...\Run: [instantUpdate] C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuDaemon.exe [124520 2012-04-06] ()

HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [12476520 2012-04-10] (Realtek Semiconductor)

HKLM\...\Run: [RtHDVBg_Dolby] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE4 [1158248 2012-03-08] (Realtek Semiconductor)

HKLM\...\Run: [ETDCtrl] %ProgramFiles%\Elantech\ETDCtrl.exe [2816336 2012-03-19] (ELAN Microelectronics Corp.)

HKLM\...\Run: [AtherosBtStack] "C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe" [1020576 2012-02-28] (Atheros Commnucations)

HKLM\...\Run: [AthBtTray] "C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe" [800416 2012-02-28] (Atheros Commnucations)

HKLM\...\Run: [Power Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1829768 2012-02-07] (Acer Incorporated)

HKLM-x32\...\RunOnce: [Z1] cmd /c "C:\Users\kkm\AppData\Local\Temp\Rar$EXa0.217\mbar\mbar.exe" /cleanup /s [1398856 2013-03-22] (Malwarebytes Corporation)

HKLM-x32\...\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey [1532992 2013-03-13] (McAfee, Inc.)

HKLM-x32\...\Run: [suiteTray] "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [341360 2011-09-20] (Egis Technology Inc.)

HKLM-x32\...\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-01] (Symantec Corporation)

HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [backupManagerTray] "C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe" -h -k [296984 2012-01-05] (NTI Corporation)

HKLM-x32\...\Run: [Dolby Home Theater v4] "C:\Dolby PCEE4\pcee4.exe" -autostart [506712 2011-06-01] (Dolby Laboratories Inc.)

HKLM-x32\...\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe [1105488 2012-03-23] (Dritek System Inc.)

HKLM-x32\...\Run: [uSB3MON] "C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [291608 2012-02-26] (Intel Corporation)

HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-01-28] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [152392 2013-02-20] (Apple Inc.)

HKLM-x32\...\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [252848 2012-07-03] (Sun Microsystems, Inc.)

HKU\kkm\...\Run: [spotify Web Helper] "C:\Users\kkm\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [1105408 2013-05-18] (Spotify Ltd)

Startup: C:\ProgramData\Start Menu\Programs\Startup\Acer VCM.lnk

ShortcutTarget: Acer VCM.lnk -> C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe (Acer Incorporated)

Startup: C:\ProgramData\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk

ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe (McAfee, Inc.)

Startup: C:\Users\kkm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk

ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 333 W Evelyn Ave. Mountain View, CA 94041)

Startup: C:\Users\kkm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Launchy ()

Startup: C:\Users\kkm\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk

ShortcutTarget: Send to OneNote.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)

==================== Services (Whitelisted) =================

S2 ExpressCache; C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe [79664 2012-02-17] (Diskeeper Corporation)

S2 FFSOpzSvc; C:\Program Files\Sleep Memory Optimizer\FFSService.exe [141192 2011-09-17] (Acer Incorporated)

S2 Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [127320 2012-03-14] ()

S3 irstrtsv; C:\Windows\SysWOW64\irstrtsv.exe [192856 2012-03-14] (Intel Corporation)

S2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [162648 2012-03-14] (Intel Corporation)

S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

S2 McAfee SiteAdvisor Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)

S3 McAWFwk; c:\PROGRA~1\mcafee\msc\mcawfwk.exe [225216 2011-01-28] (McAfee, Inc.)

S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)

S2 McMPFSvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)

S2 mcmscsvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)

S2 McNaiAnn; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)

S2 McNASvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)

S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [384048 2013-02-25] (McAfee, Inc.)

S4 McOobeSv; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)

S2 McProxy; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)

S2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [241456 2013-02-19] (McAfee, Inc.)

S2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [218760 2013-02-19] (McAfee, Inc.)

S2 mfevtp; C:\Windows\system32\mfevtps.exe [182752 2013-02-19] (McAfee, Inc.)

S2 MSK80Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)

S2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)

S2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256536 2012-01-05] (NTI Corporation)

S2 OfficeSvc; C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [1871032 2013-03-14] (Microsoft Corporation)

S2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [260640 2010-01-29] (Acer Incorporated)

S2 SpyHunter 4 Service; C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [1025408 2013-05-07] (Enigma Software Group USA, LLC.)

S2 USecuAppSvc; C:\Program Files\Acer\Acer Theft Shield\USecuAppSvc.exe [237160 2012-03-23] ()

==================== Drivers (Whitelisted) ====================

S3 athr; C:\Windows\System32\DRIVERS\athrx.sys [3545088 2012-02-29] (Qualcomm Atheros Communications, Inc.)

S3 cfwids; C:\Windows\System32\drivers\cfwids.sys [70112 2013-02-19] (McAfee, Inc.)

S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] ()

S1 excfs; C:\Windows\System32\DRIVERS\excfs.sys [23344 2012-02-17] (Diskeeper Corporation)

S0 excsd; C:\Windows\System32\DRIVERS\excsd.sys [92976 2012-02-17] (Diskeeper Corporation)

S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [196440 2012-04-20] (McAfee, Inc.)

S3 irstrtdv; C:\Windows\System32\DRIVERS\irstrtdv.sys [26504 2012-03-14] (Intel Corporation)

S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [179280 2013-02-19] (McAfee, Inc.)

S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [309840 2013-02-19] (McAfee, Inc.)

S3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [515968 2013-02-19] (McAfee, Inc.)

S0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [771536 2013-02-19] (McAfee, Inc.)

S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [106552 2013-02-19] (McAfee, Inc.)

S0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [340216 2013-02-19] (McAfee, Inc.)

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-05-24 07:20 - 2013-05-24 07:20 - 00000000 ____D C:\FRST

2013-05-23 18:01 - 2013-05-23 18:01 - 00001063 ____A C:\Users\Public\Desktop\FileASSASSIN.lnk

2013-05-23 18:01 - 2013-05-23 18:01 - 00000000 ____D C:\Program Files (x86)\FileASSASSIN

2013-05-23 17:51 - 2013-05-23 17:51 - 00006512 ____N C:\bootsqm.dat

2013-05-23 14:33 - 2013-05-23 14:33 - 00002258 ____A C:\Users\kkm\Desktop\SpyHunter.lnk

2013-05-23 14:33 - 2013-05-23 14:33 - 00000000 ____D C:\Windows\BCD5545077AC4347B24F654B1189F8D4.TMP

2013-05-23 14:33 - 2013-05-23 14:33 - 00000000 ____D C:\sh4ldr

2013-05-23 14:33 - 2013-05-23 14:33 - 00000000 ____D C:\Program Files\Enigma Software Group

2013-05-23 14:33 - 2012-06-22 08:01 - 00022704 ____A C:\Windows\System32\Drivers\EsgScanner.sys

2013-05-23 14:29 - 2013-05-23 14:29 - 00728960 ____A (Enigma Software Group USA, LLC.) C:\Users\kkm\Downloads\SpyHunter-Installer.exe

2013-05-23 12:50 - 2013-05-23 12:50 - 00000000 __ASH C:\DkHyperbootSync

2013-05-23 10:16 - 2013-05-23 10:26 - 00000000 ____D C:\ProgramData\HitmanPro

2013-05-20 16:44 - 2013-05-20 16:44 - 00000065 ____A C:\Users\kkm\Desktop\malware.txt

2013-05-20 16:39 - 2013-05-20 16:40 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\kkm\Downloads\mbam-consumer.exe

2013-05-20 15:30 - 2013-05-20 15:34 - 00421603 ____A C:\Users\kkm\Desktop\Group Meeting 5-21.pptx

2013-05-20 11:26 - 2013-05-20 15:39 - 00010042 ____A C:\Users\kkm\Desktop\group meeting 5-21.xlsx

2013-05-19 17:44 - 2013-05-19 17:44 - 10690345 ____A C:\Users\kkm\Downloads\VIDEO0018.3gp

2013-05-19 12:21 - 2013-05-19 12:21 - 00288837 ____A C:\Users\kkm\Downloads\851 final version (1).pptx

2013-05-19 07:48 - 2013-05-19 07:48 - 00000000 ____D C:\Program Files (x86)\Lux

2013-05-19 07:37 - 2013-05-19 07:48 - 79901531 ____A (Sillysoft Games ) C:\Users\kkm\Downloads\LuxDeluxSetup.exe

2013-05-18 08:32 - 2013-05-23 03:47 - 00000000 ___HD C:\Users\Public\Documents\Report

2013-05-16 03:24 - 2013-05-16 03:24 - 00000000 ____D C:\89745e524c96c8c1cd70

2013-05-16 03:19 - 2013-04-04 22:52 - 02242048 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll

2013-05-16 03:19 - 2013-04-04 22:52 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll

2013-05-16 03:19 - 2013-04-04 22:52 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe

2013-05-16 03:19 - 2013-04-04 22:50 - 19231232 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2013-05-16 03:19 - 2013-04-04 22:50 - 15404032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll

2013-05-16 03:19 - 2013-04-04 22:50 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll

2013-05-16 03:19 - 2013-04-04 22:50 - 02647552 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll

2013-05-16 03:19 - 2013-04-04 22:50 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll

2013-05-16 03:19 - 2013-04-04 22:50 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll

2013-05-16 03:19 - 2013-04-04 22:50 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll

2013-05-16 03:19 - 2013-04-04 22:50 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll

2013-05-16 03:19 - 2013-04-04 22:50 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll

2013-05-16 03:19 - 2013-04-04 22:50 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll

2013-05-16 03:19 - 2013-04-04 22:50 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll

2013-05-16 03:19 - 2013-04-04 21:28 - 01767424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-05-16 03:19 - 2013-04-04 21:28 - 01130496 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-05-16 03:19 - 2013-04-04 21:26 - 14323712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-05-16 03:19 - 2013-04-04 21:26 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-05-16 03:19 - 2013-04-04 21:26 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-05-16 03:19 - 2013-04-04 21:26 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-05-16 03:19 - 2013-04-04 21:26 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-05-16 03:19 - 2013-04-04 21:26 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-05-16 03:19 - 2013-04-04 21:26 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-05-16 03:19 - 2013-04-04 21:26 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-05-16 03:19 - 2013-04-04 21:26 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-05-16 03:19 - 2013-04-04 21:26 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-05-16 03:19 - 2013-04-04 21:26 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-05-16 03:19 - 2013-04-04 20:43 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb

2013-05-16 03:19 - 2013-04-04 20:29 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-05-16 03:19 - 2013-04-04 19:51 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe

2013-05-16 03:19 - 2013-04-04 19:38 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-05-15 16:31 - 2013-05-15 16:32 - 00000000 ____D C:\Program Files (x86)\TuneUpMedia

2013-05-15 16:30 - 2013-05-17 15:03 - 00000000 ____D C:\Users\kkm\AppData\Roaming\TuneUpMedia

2013-05-15 16:30 - 2013-05-15 18:01 - 00000000 ____D C:\ProgramData\TuneUpMedia

2013-05-15 16:29 - 2013-05-15 16:30 - 35780008 ____A (TuneUp Media, Inc.) C:\Users\kkm\Downloads\TuneUpInst-2.4.6.4.exe

2013-05-15 04:23 - 2013-04-09 19:30 - 03153920 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys

2013-05-15 04:23 - 2013-03-18 21:53 - 00230400 ____A (Microsoft Corporation) C:\Windows\System32\wwansvc.dll

2013-05-15 04:23 - 2013-03-18 21:53 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\wwanprotdim.dll

2013-05-15 04:23 - 2013-02-26 22:02 - 00111448 ____A (Microsoft Corporation) C:\Windows\System32\consent.exe

2013-05-15 04:23 - 2013-02-26 21:52 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll

2013-05-15 04:23 - 2013-02-26 21:52 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\shdocvw.dll

2013-05-15 04:23 - 2013-02-26 21:48 - 01930752 ____A (Microsoft Corporation) C:\Windows\System32\authui.dll

2013-05-15 04:23 - 2013-02-26 21:47 - 00070144 ____A (Microsoft Corporation) C:\Windows\System32\appinfo.dll

2013-05-15 04:23 - 2013-02-26 20:55 - 12872704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2013-05-15 04:23 - 2013-02-26 20:55 - 00180224 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll

2013-05-15 04:23 - 2013-02-26 20:49 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll

2013-05-13 06:24 - 2013-05-13 06:24 - 00426080 ____A (windows7download.com) C:\Users\kkm\Downloads\dhaatu_installer.exe

2013-05-12 10:06 - 2013-05-12 10:06 - 00000000 ____D C:\Users\kkm\Documents\OneNote Notebooks

2013-05-09 10:59 - 2013-05-09 10:59 - 00000000 ____D C:\Users\kkm\AppData\Local\{50C4BDA9-B52E-4833-B699-FE1DD0352D28}

2013-05-09 10:57 - 2013-05-09 10:57 - 00000000 ____D C:\Users\kkm\AppData\Local\{B08E33C0-4609-41CD-825B-D2521FD1B20A}

2013-05-09 10:57 - 2013-05-09 10:57 - 00000000 ____D C:\Users\kkm\AppData\Local\{4F10273A-4393-44E4-A6D6-71F3E3E1DCE1}

2013-05-09 06:01 - 2013-05-09 06:01 - 00000000 ____D C:\Users\kkm\Documents\Polymers w, Olivia

2013-05-09 05:56 - 2013-05-10 11:31 - 00000000 ____D C:\Users\kkm\Documents\Diels-Alder

2013-05-08 08:32 - 2013-05-08 08:32 - 00000000 ____D C:\Users\kkm\AppData\Roaming\Malwarebytes

2013-05-08 08:31 - 2013-05-23 14:17 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-05-08 08:31 - 2013-05-08 08:31 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-05-08 08:31 - 2013-04-04 10:50 - 00025928 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys

2013-05-08 08:30 - 2013-05-08 08:30 - 10284816 ____A (Malwarebytes Corporation ) C:\Users\kkm\Downloads\mbam-setup.exe

2013-05-08 08:28 - 2013-05-08 08:29 - 00003350 ____A C:\Users\kkm\Desktop\Rkill.txt

2013-05-08 08:28 - 2013-05-08 08:28 - 01752992 ____A (Bleeping Computer, LLC) C:\Users\kkm\Downloads\rkill.exe

2013-05-08 08:28 - 2013-05-08 08:28 - 00000000 ____D C:\Users\kkm\Desktop\rkill

2013-05-08 08:25 - 2013-05-08 08:25 - 00000000 ____D C:\TDSSKiller_Quarantine

2013-05-08 08:23 - 2013-05-08 08:23 - 02237968 ____A (Kaspersky Lab ZAO) C:\Users\kkm\Downloads\tdsskiller.exe

2013-05-08 08:12 - 2013-05-08 08:12 - 00280232 ____A C:\Windows\Minidump\050813-15350-01.dmp

2013-05-07 17:30 - 2013-05-08 08:12 - 487460330 ____A C:\Windows\MEMORY.DMP

2013-05-07 17:30 - 2013-05-08 08:12 - 00000000 ____D C:\Windows\Minidump

2013-05-07 17:30 - 2013-05-07 17:30 - 00280232 ____A C:\Windows\Minidump\050713-13400-01.dmp

2013-05-07 17:26 - 2013-05-07 17:26 - 00011139 ____A C:\jqs.exe

2013-05-06 11:30 - 2013-05-06 11:30 - 00207287 ____A C:\Users\kkm\Desktop\KM 5-7-13.pptx

2013-05-03 15:58 - 2013-05-03 15:58 - 00006354 ____A C:\Windows\SysWOW64\PerfStringBackup.TMP

2013-05-03 15:57 - 2013-05-03 15:57 - 00560312 ____A (Microsoft Corporation) C:\Users\kkm\Downloads\Setup.X86.en-US_OutlookRetail_a12c9233-7e7b-4343-805a-3b5fc698ed94_TX_PR_ (1).exe

2013-05-03 15:42 - 2013-05-03 15:42 - 00560312 ____A (Microsoft Corporation) C:\Users\kkm\Downloads\Setup.X86.en-US_OutlookRetail_a12c9233-7e7b-4343-805a-3b5fc698ed94_TX_PR_.exe

2013-05-03 15:19 - 2013-05-03 15:19 - 00011369 ____A C:\Users\kkm\Downloads\0912455FF8770CF3EE47DC565DF211736AFC07E0.torrent

2013-05-03 15:17 - 2013-05-03 15:17 - 00012862 ____A C:\Users\kkm\Downloads\[torrent.cd].Microsoft_Office_2010_OUTLOOK_Activated_Genuine.torrent

2013-05-03 15:12 - 2013-05-03 15:14 - 294027264 ____A C:\Users\kkm\Downloads\Microsoft Office Outlook 2010 x86 332bit.iso

2013-05-03 11:14 - 2013-05-03 11:14 - 00305162 ____A C:\Users\kkm\Desktop\851 final version, no like for reals.pptx

2013-05-03 10:11 - 2013-05-03 10:11 - 00309506 ____A C:\Users\kkm\Downloads\851 final version.pptx

2013-05-02 12:25 - 2013-05-02 12:25 - 00288837 ____A C:\Users\kkm\Desktop\851 final version.pptx

2013-05-02 09:25 - 2013-05-02 12:18 - 00288838 ____A C:\Users\kkm\Desktop\851 ver. 2.pptx

2013-05-02 08:55 - 2013-05-02 08:55 - 00143567 ____A C:\Users\kkm\Downloads\851 Literature Presentation.pptx

2013-05-01 07:40 - 2013-05-01 07:40 - 00176128 ____A C:\Users\kkm\Downloads\CEM255-SS-2013.xls

2013-04-29 16:35 - 2013-04-29 16:35 - 00000000 ____D C:\Users\kkm\Downloads\Microsoft Outlook 2010

2013-04-25 18:40 - 2013-04-26 14:41 - 00639305 ____A C:\Users\kkm\Desktop\wulff synthesis ppt.pptx

2013-04-25 11:11 - 2013-04-25 11:11 - 00000000 ____D C:\Program Files (x86)\ChemBioDraw

2013-04-25 11:10 - 2013-04-25 11:33 - 00000000 ____D C:\Users\kkm\AppData\Roaming\GetRightToGo

2013-04-25 11:10 - 2013-04-25 11:10 - 01417953 ____A (PerkinElmer,Inc) C:\Users\kkm\Downloads\CBOU_Downloader.exe

2013-04-24 03:53 - 2013-04-12 06:45 - 01656680 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ntfs.sys

==================== One Month Modified Files and Folders =======

2013-05-24 07:20 - 2013-05-24 07:20 - 00000000 ____D C:\FRST

2013-05-24 03:08 - 2009-07-13 21:13 - 00804030 ____A C:\Windows\System32\PerfStringBackup.INI

2013-05-23 18:26 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT

2013-05-23 18:26 - 2009-07-13 20:51 - 00047574 ____A C:\Windows\setupact.log

2013-05-23 18:17 - 2013-03-08 16:38 - 00000888 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-05-23 18:15 - 2012-05-04 00:11 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-05-23 18:01 - 2013-05-23 18:01 - 00001063 ____A C:\Users\Public\Desktop\FileASSASSIN.lnk

2013-05-23 18:01 - 2013-05-23 18:01 - 00000000 ____D C:\Program Files (x86)\FileASSASSIN

2013-05-23 17:51 - 2013-05-23 17:51 - 00006512 ____N C:\bootsqm.dat

2013-05-23 17:02 - 2012-05-23 02:31 - 01088598 ____A C:\Windows\WindowsUpdate.log

2013-05-23 16:38 - 2013-03-08 16:38 - 00000892 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-05-23 14:33 - 2013-05-23 14:33 - 00002258 ____A C:\Users\kkm\Desktop\SpyHunter.lnk

2013-05-23 14:33 - 2013-05-23 14:33 - 00000000 ____D C:\Windows\BCD5545077AC4347B24F654B1189F8D4.TMP

2013-05-23 14:33 - 2013-05-23 14:33 - 00000000 ____D C:\sh4ldr

2013-05-23 14:33 - 2013-05-23 14:33 - 00000000 ____D C:\Program Files\Enigma Software Group

2013-05-23 14:29 - 2013-05-23 14:29 - 00728960 ____A (Enigma Software Group USA, LLC.) C:\Users\kkm\Downloads\SpyHunter-Installer.exe

2013-05-23 14:21 - 2013-03-09 04:29 - 00000000 ____D C:\users\kkm

2013-05-23 14:17 - 2013-05-08 08:31 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-05-23 14:17 - 2013-04-14 08:59 - 00000000 ____D C:\ProgramData\McAfee Security Scan

2013-05-23 14:17 - 2013-03-17 09:38 - 00000000 ___RD C:\Users\kkm\SkyDrive

2013-05-23 14:17 - 2013-03-10 16:51 - 00000000 ____D C:\Program Files\WinRAR

2013-05-23 14:17 - 2013-03-08 20:12 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2013-05-23 14:17 - 2013-03-08 20:12 - 00000000 ____D C:\Program Files\iTunes

2013-05-23 14:17 - 2013-03-08 20:12 - 00000000 ____D C:\Program Files (x86)\iTunes

2013-05-23 14:17 - 2013-03-08 20:09 - 00000000 ____D C:\Program Files (x86)\QuickTime

2013-05-23 14:17 - 2013-03-08 20:06 - 00000000 ____D C:\Program Files\Bonjour

2013-05-23 14:17 - 2013-03-08 20:06 - 00000000 ____D C:\Program Files (x86)\Bonjour

2013-05-23 14:17 - 2013-03-08 20:06 - 00000000 ____D C:\Program Files (x86)\Apple Software Update

2013-05-23 14:17 - 2013-03-08 17:08 - 00000000 ____D C:\Users\kkm\AppData\Roaming\Launchy

2013-05-23 14:17 - 2012-05-23 03:25 - 00000000 ____D C:\Program Files\Smart Timer

2013-05-23 14:17 - 2012-05-23 03:20 - 00000000 ____D C:\Program Files\Sleep Memory Optimizer

2013-05-23 14:17 - 2012-05-23 03:03 - 00000000 ____D C:\ProgramData\Atheros

2013-05-23 14:17 - 2012-05-23 02:50 - 00000000 ____D C:\Program Files (x86)\Bluetooth Suite

2013-05-23 14:17 - 2012-05-23 02:48 - 00000000 ____D C:\Program Files\Elantech

2013-05-23 14:17 - 2012-05-23 02:43 - 00000000 ____D C:\Program Files (x86)\Launch Manager

2013-05-23 14:17 - 2012-05-23 02:39 - 00000000 ____D C:\Dolby PCEE4

2013-05-23 14:17 - 2012-05-04 00:05 - 00000000 ____D C:\Program Files\EgisTec IPS

2013-05-23 14:17 - 2012-05-04 00:05 - 00000000 ____D C:\Program Files (x86)\EgisTec MyWinLocker

2013-05-23 14:17 - 2012-05-04 00:03 - 00000000 ____D C:\Windows\en

2013-05-23 14:17 - 2012-05-04 00:01 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2013-05-23 14:17 - 2010-11-20 23:16 - 00000000 ___RD C:\Users\Public\Recorded TV

2013-05-23 14:17 - 2009-07-13 21:32 - 00000000 ____D C:\Windows\System32\restore

2013-05-23 14:17 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files\Windows Sidebar

2013-05-23 14:17 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\servicing

2013-05-23 14:17 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache

2013-05-23 14:17 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\IME

2013-05-23 14:17 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\Cursors

2013-05-23 14:16 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\registration

2013-05-23 12:50 - 2013-05-23 12:50 - 00000000 __ASH C:\DkHyperbootSync

2013-05-23 11:44 - 2009-07-13 20:45 - 00016976 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-05-23 11:44 - 2009-07-13 20:45 - 00016976 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-05-23 10:26 - 2013-05-23 10:16 - 00000000 ____D C:\ProgramData\HitmanPro

2013-05-23 03:47 - 2013-05-18 08:32 - 00000000 ___HD C:\Users\Public\Documents\Report

2013-05-22 17:51 - 2013-04-13 05:23 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-05-22 17:51 - 2013-03-09 09:08 - 00000000 ____D C:\Users\kkm\Desktop\Get in shape

2013-05-22 13:41 - 2013-03-09 21:03 - 00000000 ____D C:\Users\kkm\Documents\Bluetooth Folder

2013-05-20 16:44 - 2013-05-20 16:44 - 00000065 ____A C:\Users\kkm\Desktop\malware.txt

2013-05-20 16:40 - 2013-05-20 16:39 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\kkm\Downloads\mbam-consumer.exe

2013-05-20 15:39 - 2013-05-20 11:26 - 00010042 ____A C:\Users\kkm\Desktop\group meeting 5-21.xlsx

2013-05-20 15:34 - 2013-05-20 15:30 - 00421603 ____A C:\Users\kkm\Desktop\Group Meeting 5-21.pptx

2013-05-20 05:54 - 2013-03-08 20:32 - 00000000 ____D C:\Program Files (x86)\Opera

2013-05-19 17:44 - 2013-05-19 17:44 - 10690345 ____A C:\Users\kkm\Downloads\VIDEO0018.3gp

2013-05-19 12:21 - 2013-05-19 12:21 - 00288837 ____A C:\Users\kkm\Downloads\851 final version (1).pptx

2013-05-19 07:48 - 2013-05-19 07:48 - 00000000 ____D C:\Program Files (x86)\Lux

2013-05-19 07:48 - 2013-05-19 07:37 - 79901531 ____A (Sillysoft Games ) C:\Users\kkm\Downloads\LuxDeluxSetup.exe

2013-05-18 05:00 - 2013-03-09 14:17 - 00000000 ____D C:\Users\kkm\AppData\Roaming\Spotify

2013-05-18 04:41 - 2013-03-09 14:17 - 00000000 ____D C:\Users\kkm\AppData\Local\Spotify

2013-05-17 15:03 - 2013-05-15 16:30 - 00000000 ____D C:\Users\kkm\AppData\Roaming\TuneUpMedia

2013-05-16 15:10 - 2013-03-08 20:36 - 00000000 ____D C:\Users\kkm\AppData\Local\CrashDumps

2013-05-16 15:07 - 2009-07-13 20:45 - 00449664 ____A C:\Windows\System32\FNTCACHE.DAT

2013-05-16 03:29 - 2010-11-20 19:47 - 00035198 ____A C:\Windows\PFRO.log

2013-05-16 03:24 - 2013-05-16 03:24 - 00000000 ____D C:\89745e524c96c8c1cd70

2013-05-16 03:24 - 2013-03-17 04:34 - 75016696 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe

2013-05-15 18:01 - 2013-05-15 16:30 - 00000000 ____D C:\ProgramData\TuneUpMedia

2013-05-15 16:32 - 2013-05-15 16:31 - 00000000 ____D C:\Program Files (x86)\TuneUpMedia

2013-05-15 16:32 - 2013-03-08 21:46 - 00000000 ____D C:\Users\kkm\AppData\Roaming\Mozilla

2013-05-15 16:30 - 2013-05-15 16:29 - 35780008 ____A (TuneUp Media, Inc.) C:\Users\kkm\Downloads\TuneUpInst-2.4.6.4.exe

2013-05-15 08:39 - 2012-05-04 00:11 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2013-05-15 08:39 - 2012-05-04 00:11 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-05-13 06:24 - 2013-05-13 06:24 - 00426080 ____A (windows7download.com) C:\Users\kkm\Downloads\dhaatu_installer.exe

2013-05-12 10:06 - 2013-05-12 10:06 - 00000000 ____D C:\Users\kkm\Documents\OneNote Notebooks

2013-05-10 11:31 - 2013-05-09 05:56 - 00000000 ____D C:\Users\kkm\Documents\Diels-Alder

2013-05-09 10:59 - 2013-05-09 10:59 - 00000000 ____D C:\Users\kkm\AppData\Local\{50C4BDA9-B52E-4833-B699-FE1DD0352D28}

2013-05-09 10:57 - 2013-05-09 10:57 - 00000000 ____D C:\Users\kkm\AppData\Local\{B08E33C0-4609-41CD-825B-D2521FD1B20A}

2013-05-09 10:57 - 2013-05-09 10:57 - 00000000 ____D C:\Users\kkm\AppData\Local\{4F10273A-4393-44E4-A6D6-71F3E3E1DCE1}

2013-05-09 06:01 - 2013-05-09 06:01 - 00000000 ____D C:\Users\kkm\Documents\Polymers w, Olivia

2013-05-08 08:32 - 2013-05-08 08:32 - 00000000 ____D C:\Users\kkm\AppData\Roaming\Malwarebytes

2013-05-08 08:31 - 2013-05-08 08:31 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-05-08 08:30 - 2013-05-08 08:30 - 10284816 ____A (Malwarebytes Corporation ) C:\Users\kkm\Downloads\mbam-setup.exe

2013-05-08 08:29 - 2013-05-08 08:28 - 00003350 ____A C:\Users\kkm\Desktop\Rkill.txt

2013-05-08 08:28 - 2013-05-08 08:28 - 01752992 ____A (Bleeping Computer, LLC) C:\Users\kkm\Downloads\rkill.exe

2013-05-08 08:28 - 2013-05-08 08:28 - 00000000 ____D C:\Users\kkm\Desktop\rkill

2013-05-08 08:25 - 2013-05-08 08:25 - 00000000 ____D C:\TDSSKiller_Quarantine

2013-05-08 08:23 - 2013-05-08 08:23 - 02237968 ____A (Kaspersky Lab ZAO) C:\Users\kkm\Downloads\tdsskiller.exe

2013-05-08 08:12 - 2013-05-08 08:12 - 00280232 ____A C:\Windows\Minidump\050813-15350-01.dmp

2013-05-08 08:12 - 2013-05-07 17:30 - 487460330 ____A C:\Windows\MEMORY.DMP

2013-05-08 08:12 - 2013-05-07 17:30 - 00000000 ____D C:\Windows\Minidump

2013-05-08 05:04 - 2013-04-07 03:57 - 00000000 ____D C:\Users\kkm\Desktop\BBC Planet Earth 2006

2013-05-07 17:30 - 2013-05-07 17:30 - 00280232 ____A C:\Windows\Minidump\050713-13400-01.dmp

2013-05-07 17:26 - 2013-05-07 17:26 - 00011139 ____A C:\jqs.exe

2013-05-06 11:30 - 2013-05-06 11:30 - 00207287 ____A C:\Users\kkm\Desktop\KM 5-7-13.pptx

2013-05-04 12:08 - 2009-07-13 19:20 - 00000000 __RHD C:\Users\Public\Libraries

2013-05-03 15:58 - 2013-05-03 15:58 - 00006354 ____A C:\Windows\SysWOW64\PerfStringBackup.TMP

2013-05-03 15:58 - 2013-03-17 09:22 - 00000000 ____D C:\Program Files\Microsoft Office 15

2013-05-03 15:57 - 2013-05-03 15:57 - 00560312 ____A (Microsoft Corporation) C:\Users\kkm\Downloads\Setup.X86.en-US_OutlookRetail_a12c9233-7e7b-4343-805a-3b5fc698ed94_TX_PR_ (1).exe

2013-05-03 15:53 - 2013-03-09 19:42 - 00000000 ____D C:\Program Files (x86)\utorrent

2013-05-03 15:53 - 2013-03-09 04:29 - 00113856 ____A C:\Users\kkm\AppData\Local\GDIPFONTCACHEV1.DAT

2013-05-03 15:52 - 2013-03-09 19:40 - 00000000 ____D C:\Users\kkm\AppData\Roaming\uTorrent

2013-05-03 15:43 - 2013-03-08 20:35 - 00796420 ____A C:\Windows\SysWOW64\PerfStringBackup.INI

2013-05-03 15:42 - 2013-05-03 15:42 - 00560312 ____A (Microsoft Corporation) C:\Users\kkm\Downloads\Setup.X86.en-US_OutlookRetail_a12c9233-7e7b-4343-805a-3b5fc698ed94_TX_PR_.exe

2013-05-03 15:19 - 2013-05-03 15:19 - 00011369 ____A C:\Users\kkm\Downloads\0912455FF8770CF3EE47DC565DF211736AFC07E0.torrent

2013-05-03 15:17 - 2013-05-03 15:17 - 00012862 ____A C:\Users\kkm\Downloads\[torrent.cd].Microsoft_Office_2010_OUTLOOK_Activated_Genuine.torrent

2013-05-03 15:15 - 2012-05-23 03:08 - 00001024 ___RH C:\Users\Public\Documents\NTILiveUpdateV9.dll

2013-05-03 15:15 - 2012-05-23 03:07 - 00001024 ___RH C:\Users\Public\Documents\NTIMMV9Acer.dll

2013-05-03 15:14 - 2013-05-03 15:12 - 294027264 ____A C:\Users\kkm\Downloads\Microsoft Office Outlook 2010 x86 332bit.iso

2013-05-03 11:14 - 2013-05-03 11:14 - 00305162 ____A C:\Users\kkm\Desktop\851 final version, no like for reals.pptx

2013-05-03 10:11 - 2013-05-03 10:11 - 00309506 ____A C:\Users\kkm\Downloads\851 final version.pptx

2013-05-02 12:25 - 2013-05-02 12:25 - 00288837 ____A C:\Users\kkm\Desktop\851 final version.pptx

2013-05-02 12:18 - 2013-05-02 09:25 - 00288838 ____A C:\Users\kkm\Desktop\851 ver. 2.pptx

2013-05-02 08:55 - 2013-05-02 08:55 - 00143567 ____A C:\Users\kkm\Downloads\851 Literature Presentation.pptx

2013-05-01 07:40 - 2013-05-01 07:40 - 00176128 ____A C:\Users\kkm\Downloads\CEM255-SS-2013.xls

2013-04-29 16:35 - 2013-04-29 16:35 - 00000000 ____D C:\Users\kkm\Downloads\Microsoft Outlook 2010

2013-04-26 14:41 - 2013-04-25 18:40 - 00639305 ____A C:\Users\kkm\Desktop\wulff synthesis ppt.pptx

2013-04-25 11:33 - 2013-04-25 11:10 - 00000000 ____D C:\Users\kkm\AppData\Roaming\GetRightToGo

2013-04-25 11:11 - 2013-04-25 11:11 - 00000000 ____D C:\Program Files (x86)\ChemBioDraw

2013-04-25 11:10 - 2013-04-25 11:10 - 01417953 ____A (PerkinElmer,Inc) C:\Users\kkm\Downloads\CBOU_Downloader.exe

==================== Known DLLs (Whitelisted) ================

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll

[2010-11-20 19:24] - [2012-11-29 20:53] - 0869376 ____A (Microsoft Corporation) 3CC4B067E361765E44D9BD3CC26E5DB4

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK

HKLM\...\exefile\DefaultIcon: %1 => OK

HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

Restore point made on: 2013-05-23 02:43:23

Restore point made on: 2013-05-23 12:50:44

==================== Memory info ===========================

Percentage of memory in use: 13%

Total physical RAM: 5980.36 MB

Available physical RAM: 5186.13 MB

Total Pagefile: 5978.56 MB

Available Pagefile: 5182.72 MB

Total Virtual: 8192 MB

Available Virtual: 8191.88 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:449.66 GB) (Free:346.49 GB) NTFS (Disk=1 Partition=3)

Drive e: (PQSERVICE) (Fixed) (Total:16 GB) (Free:0.73 GB) NTFS (Disk=1 Partition=1)

Drive g: (CENTON USB) (Removable) (Total:1.88 GB) (Free:1.46 GB) FAT (Disk=2 Partition=1)

Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Drive y: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS (Disk=1 Partition=2) ==>[system with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 19 GB) (Disk ID: 9BB78D53)

Partition 1: (Not Active) - (Size=4 GB) - (Type=84)

Partition 2: (Not Active) - (Size=15 GB) - (Type=73)

========================================================

Disk: 1 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 7CF3A700)

Partition 1: (Not Active) - (Size=16 GB) - (Type=27)

Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=450 GB) - (Type=07 NTFS)

========================================================

Disk: 2 (Size: 2 GB) (Disk ID: 00000000)

Partition 1: (Active) - (Size=2 GB) - (Type=06)

Last Boot: 2013-05-23 11:54

==================== End Of Log ============================

MrCharlie · May 24, 2013

Looking at it now......MrC

MrCharlie · May 24, 2013

Run FRST again and type the following into the search box:

User32.dll

[*]Now press the Search button

[*]When the search is complete, search.txt will also be written to your USB

[*]Type exit and reboot the computer normally

[*]Please copy and paste the log in your reply.( Search.txt)

MrC

kkm2 · May 24, 2013

Thank you so much for your help Mr. Charlie. Here is the result of my search:

Farbar Recovery Scan Tool (x64) Version: 24-05-2013

Ran by SYSTEM at 2013-05-24 11:37:22

Running from G:\

Boot Mode: Recovery

================== Search: "User32.dll" ===================

C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll

[2010-11-20 19:24] - [2010-11-20 19:24] - 0833024 ____A (Microsoft Corporation) 5E0DB2D8B2750543CD2EBB9EA8E6CDD3

C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll

[2010-11-20 19:24] - [2010-11-20 19:24] - 1008128 ____A (Microsoft Corporation) FE70103391A64039A921DBFFF9C7AB1B

C:\Windows\SysWOW64\user32.dll

[2010-11-20 19:24] - [2012-11-29 20:53] - 0869376 ____A (Microsoft Corporation) 3CC4B067E361765E44D9BD3CC26E5DB4

C:\Windows\System32\user32.dll

[2010-11-20 19:24] - [2010-11-20 19:24] - 1008128 ____A (Microsoft Corporation) FE70103391A64039A921DBFFF9C7AB1B

====== End Of Search ======

MrCharlie · May 24, 2013

I'm not seeing the malware or any load points for it, give this a try though:

Please download the attached fixlist.txt and copy it to your flashdrive.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options. (as you did before)

Run FRST64 or FRST (which ever one you're using) and press the Fix button just once and wait.

The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

See if the computer boots normally now ........MrC

kkm2 · May 24, 2013

Here is the fixlog. I'm still seeing the blocked computer message upon normal start up. The fact that the malware isn't leaving traces is a bit disconcerting. There isn't any way I could have ruined or hidden any load points by trying routine malware removal methods is there? No, probably not.

Farbar Recovery Scan Tool (x64) Version: 24-05-2013

Ran by SYSTEM at 2013-05-24 11:37:22

Running from G:\

Boot Mode: Recovery

================== Search: "User32.dll" ===================

C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll

[2010-11-20 19:24] - [2010-11-20 19:24] - 0833024 ____A (Microsoft Corporation) 5E0DB2D8B2750543CD2EBB9EA8E6CDD3

C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll

[2010-11-20 19:24] - [2010-11-20 19:24] - 1008128 ____A (Microsoft Corporation) FE70103391A64039A921DBFFF9C7AB1B

C:\Windows\SysWOW64\user32.dll

[2010-11-20 19:24] - [2012-11-29 20:53] - 0869376 ____A (Microsoft Corporation) 3CC4B067E361765E44D9BD3CC26E5DB4

C:\Windows\System32\user32.dll

[2010-11-20 19:24] - [2010-11-20 19:24] - 1008128 ____A (Microsoft Corporation) FE70103391A64039A921DBFFF9C7AB1B

====== End Of Search ======

MrCharlie · May 24, 2013

You posted the wrong log, I need to see the Fixlog.txt.

What methods did you try??

Are you seeing the FBI screen when you boot or it just won't boot?

When you run FRST, what account are you logging in to??

MrC

kkm2 · May 24, 2013

Oh how dumb of me, here's the proper log. As far as methods, I ran malwarebytes which didn't find anything, then I tried googling a list of malware load points and deleted two that seemed suspicious. However, most people who claimed to have this virus pointed to various files attributed to the bug that I never saw on my computer. I tried a system restore as well but that failed.

When I boot normally I can sign into my account with my password but it will immediately take me to the Department of Justice prompt that talks about paying $300 to MoneyPak. Everything appears normal when I boot into any of the safe modes however.

When I run frst I log into my KKM account. Should I try the homegroup account instead?

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 24-05-2013

Ran by SYSTEM at 2013-05-24 13:27:10 Run:1

Running from G:\

Boot Mode: Recovery

==============================================

DEFAULT hive was successfully copied to System32\config\HiveBackup

DEFAULT hive was successfully restored from registry back up.

SAM hive was successfully copied to System32\config\HiveBackup

SAM hive was successfully restored from registry back up.

SECURITY hive was successfully copied to System32\config\HiveBackup

SECURITY hive was successfully restored from registry back up.

SOFTWARE hive was successfully copied to System32\config\HiveBackup

SOFTWARE hive was successfully restored from registry back up.

SYSTEM hive was successfully copied to System32\config\HiveBackup

SYSTEM hive was successfully restored from registry back up.

==== End of Fixlog ====

MrCharlie · May 24, 2013

If you can boot into safe mode then run this scan:

Please download and run RogueKiller 32 Bit to your desktop.

RogueKiller 64 Bit <---use this one for 64 bit systems

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

(please don't put logs in code or quotes)

MrC

kkm2 · May 24, 2013

Ok, I didn't attempt to fix anything and after running RougeKiller this is the report:

RogueKiller V8.5.4 _x64_ [Mar 18 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Safe mode with network support

User : kkm [Admin rights]

Mode : Scan -- Date : 05/24/2013 17:33:03

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 14 ¤¤¤

[HJPOL] HKLM\[...]\System : DisableTaskMgr (0) -> FOUND

[HJPOL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND

[HJ] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND

[HJPOL] HKLM\[...]\Wow6432Node\System : DisableTaskMgr (0) -> FOUND

[HJPOL] HKLM\[...]\Wow6432Node\System : DisableRegistryTools (0) -> FOUND

[HJ] HKLM\[...]\Wow6432Node\System : ConsentPromptBehaviorAdmin (0) -> FOUND

[HJ] HKLM\[...]\System : EnableLUA (0) -> FOUND

[HJ] HKLM\[...]\Wow6432Node\System : EnableLUA (0) -> FOUND

[HJ DESK] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

[HJ DESK] HKCU\[...]\ClassicStartMenu : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND

[HJ DESK] HKCU\[...]\NewStartPanel : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

[sCREENSV][sUSP PATH] HKCU\[...]\Desktop (C:\Windows\WLXPGSS.SCR) [7] -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD5000LPVT-22G33T0 +++++

--- User ---

[MBR] 70a4b4cdfea7e9eeb039ae6c2e44850b

[bSP] d9bc1e84082633bba2a171499a6d75d1 : Windows 7/8 MBR Code

Partition table:

0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 16384 Mo

1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 33556480 | Size: 100 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 33761280 | Size: 460454 Mo

User = LL1 ... OK!

User = LL2 ... OK!

+++++ PhysicalDrive1: SATA SSD +++++

--- User ---

[MBR] 0daac7660687061c8f525f0ff4e31425

[bSP] 5e2b217f40b9ae4a061dbda588c24d68 : Windows 7/8 MBR Code

Partition table:

0 - [XXXXXX] OS/2-HIBER (0x84) [HIDDEN!] Offset (sectors): 2048 | Size: 4096 Mo

1 - [XXXXXX] UNKNOWN (0x73) [VISIBLE] Offset (sectors): 8392704 | Size: 14987 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[1]_S_05242013_02d1733.txt >>

RKreport[1]_S_05242013_02d1733.txt

MrCharlie · May 24, 2013

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingc...to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

kkm2 · May 24, 2013

So I've tried running combofix but after stage 30 or so the malware steps in and the Department of Justice prompt appears again even though I am in safe mode. I can't get a report as combofix doesn't finish. I'll do what I can to get combofix to complete it's processes but it's not looking promising.

MrCharlie · May 24, 2013

If you can't get ComboFix to run....

Download a fresh copy of FRST into a folder and you can run it from there.

Click Scan and it will produce a log in that folder.

MrC

kkm2 · May 24, 2013

I was unsuccessful in getting ComboFix to finish but I could run FRST from a folder on my desktop. It gave me two reports, here is the main log:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-05-2013 03

Ran by kkm (administrator) on 24-05-2013 19:15:30

Running from C:\Users\kkm\Desktop\frst

Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)

Internet Explorer Version 9

Boot Mode: Safe Mode (with Networking)

==================== Processes (Whitelisted) =================

(McAfee, Inc.) C:\Windows\system32\mfevtps.exe

(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe

(McAfee, Inc.) C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Farbar) C:\Users\kkm\Desktop\frst\FRST64.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [secure Applicayion] C:\Program Files\Acer\Acer Theft Shield\USecuAppClient.exe [258664 2012-03-23] ()

HKLM\...\Run: [instantUpdate] C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuDaemon.exe [124520 2012-04-06] ()

HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [12476520 2012-04-10] (Realtek Semiconductor)

HKLM\...\Run: [RtHDVBg_Dolby] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE4 [1158248 2012-03-09] (Realtek Semiconductor)

HKLM\...\Run: [ETDCtrl] %ProgramFiles%\Elantech\ETDCtrl.exe [2816336 2012-03-19] (ELAN Microelectronics Corp.)

HKLM\...\Run: [AtherosBtStack] "C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe" [1020576 2012-02-28] (Atheros Commnucations)

HKLM\...\Run: [AthBtTray] "C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe" [800416 2012-02-28] (Atheros Commnucations)

HKLM\...\Run: [Power Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1829768 2012-02-07] (Acer Incorporated)

HKCU\...\Run: [spotify Web Helper] "C:\Users\kkm\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [1105408 2013-05-18] (Spotify Ltd)