Jump to content

I'm infected with Trojan.0Access

jefftx
 Share

Recommended Posts

jefftx

jefftx

Posted
Posted

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 8/30/2012 12:12:32 AM

System Uptime: 5/23/2013 3:47:03 AM (32 hours ago)

.

Motherboard: Hewlett-Packard | | 30ED

Processor: Intel® Pentium® Dual CPU T2390 @ 1.86GHz | CPU | 1867/533mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 175 GiB total, 74.571 GiB free.

D: is FIXED (NTFS) - 11 GiB total, 1.982 GiB free.

E: is CDROM ()

F: is Removable

.

==== Disabled Device Manager Items =============

.

Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}

Description: ElRawDisk

Device ID: ROOT\LEGACY_ELRAWDISK\0000

Manufacturer:

Name: ElRawDisk

PNP Device ID: ROOT\LEGACY_ELRAWDISK\0000

Service: ElRawDisk

.

==== System Restore Points ===================

.

RP214: 5/19/2013 1:24:56 AM - Windows Update

RP216: 5/19/2013 3:00:19 AM - Windows Update

RP218: 5/21/2013 7:05:38 PM - Windows Update

RP220: 5/22/2013 3:00:52 AM - Windows Update

RP222: 5/23/2013 3:00:12 AM - Windows Update

RP224: 5/24/2013 3:00:35 AM - Windows Update

RP226: 5/24/2013 5:38:24 AM - Windows Defender Checkpoint

.

==== Installed Programs ======================

.

7-Zip 9.22beta

Adobe Flash Player 11 ActiveX

Adobe Flash Player 11 Plugin

Adobe Reader 9.5.4

ArcSoft Print Creations

ArcSoft Print Creations - Album Page

ArcSoft Print Creations - Funhouse

ArcSoft Print Creations - Greeting Card

ArcSoft Print Creations - Photo Book

ArcSoft Print Creations - Photo Calendar

ArcSoft Print Creations - Scrapbook

ArcSoft Print Creations - Slimline Card

Audacity 2.0.2

Bing Bar

Canon MP495 series MP Drivers

CCleaner

CCScore

Cisco EAP-FAST Module

Cisco LEAP Module

Cisco PEAP Module

CleanGenius 3.0.6

Conexant HD Audio

D3DX10

Dropbox

ESSBrwr

ESSCDBK

ESScore

ESSgui

ESSini

ESSPCD

ESSPDock

ESSTOOLS

essvatgt

EVEREST Ultimate Edition v5.50

fflink

Freenet_2

GCH Guitar academy

GigaTribe 3.04.009

GuitarCourses.ws Fretboard Trainer 1.2

GuitarCourses.ws Fretboard Trainer Bonus Lesson

HP Quick Launch Buttons

Intel® Graphics Media Accelerator Driver

IObit Malware Fighter

iolo technologies' System Mechanic

JamVOX

Java 7 Update 17

Kingsoft Antivirus 2012

Kodak EasyShare software

LADSPA_plugins-win-0.4.15

Malwarebytes Anti-Malware version 1.75.0.1300

Media Cope 3.4

Microsoft .NET Framework 1.1

Microsoft .NET Framework 4 Client Profile

Microsoft Choice Guard

Microsoft Mouse and Keyboard Center

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Sync Framework Runtime Native v1.0 (x86)

Microsoft Sync Framework Services Native v1.0 (x86)

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Web Publishing Wizard 1.52

Microsoft XNA Framework Redistributable 4.0

Mozilla Firefox 20.0.1 (x86 en-US)

Mozilla Maintenance Service

MSVCRT

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MusicBee 2.0

netbrdg

OfotoXMI

PokerStars.net

PrintMaster Platinum 18

QLBCASL

QuickTime

Ralink RT2870 Wireless LAN Card

RealDownloader

Samsung New PC Studio

SAMSUNG USB Driver for Mobile Phones

SFR

SHASTA

skin0001

SKINXSDK

Spotify

staticcr

Strongvault Online Backup

Sweet Home 3D version 3.7

Syncrosoft License Control

ToneLabSE SoundEditor for Windows

ToneLabST USB-MIDI Driver Setup for Windows

tooltips

Toolwiz Care

TuneUp Utilities Language Pack (en-US)

VLC media player 2.0.5

Voxal Voice Changer

VPRINTOL

Windows Live Communications Platform

Windows Live Essentials

Windows Live Movie Maker

Windows Live Photo Gallery

Windows Live Sign-in Assistant

Windows Live Sync

Windows Live Toolbar

Windows Live Upload Tool

WIRELESS

Wise Care 365 version 2.14

Wise Disk Cleaner 7.71

Wise Registry Cleaner 7.68

Yahoo! Messenger

Yahoo! Software Update

Yahoo! Toolbar

.

==== Event Viewer Messages From Past Week ========

.

5/24/2013 3:41:10 AM, Error: Schannel [36888] - The following fatal alert was generated: 40. The internal error state is 107.

5/24/2013 3:41:10 AM, Error: Schannel [36874] - An SSL 3.0 connection request was received from a remote client application, but none of the

cipher suites supported by the client application are supported by the server. The SSL connection request has failed.

5/24/2013 3:01:10 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update

with error 0x80070643: Windows 7 Service Pack 1 (KB976932).

5/24/2013 11:14:00 AM, Error: Microsoft-Windows-SharedAccess_NAT [31004] - The DNS proxy agent was unable to allocate 0 bytes of memory. This

may indicate that the system is low on virtual memory, or that the memory manager has encountered an internal error.

5/24/2013 10:52:08 AM, Error: Microsoft-Windows-HAL [12] - The platform firmware has corrupted memory across the previous system power

transition. Please check for updated firmware for your system.

5/23/2013 3:27:57 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: ElRawDisk

5/23/2013 3:27:56 AM, Error: Service Control Manager [7000] - The WebcamMax, WDM Video Capture service failed to start due to the following

error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

5/23/2013 3:22:07 AM, Error: Service Control Manager [7043] - The Windows Update service did not shut down properly after receiving a

preshutdown control.

.

==== End Of File ===========================

Internet Explorer: 9.0.8112.16476 BrowserJavaVersion: 10.17.2

Run by cjb at 11:17:26 on 2013-05-24

Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.3062.1524 [GMT -5:00]

.

AV: Kingsoft Antivirus System Defense *Enabled/Updated* {B6A51389-A795-5AC9-13BA-F569D73F3FE8}

SP: Kingsoft Antivirus System Defense *Enabled/Updated* {0DC4F26D-81AF-5547-290A-CE1BACB87555}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: IObit Malware Fighter *Disabled/Updated* {A751AC20-3B48-5237-898A-78C4436BB78D}

.

============== Running Processes ================

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

c:\program files\kingsoft\kingsoft antivirus\kxescore.exe

C:\Windows\System32\spoolsv.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe

C:\Windows\System32\alg.exe

C:\Windows\System32\WUDFHost.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Windows\system32\taskhost.exe

C:\Program Files\kingsoft\kingsoft antivirus\kxetray.exe

C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe

C:\Windows\system32\wuauclt.exe

C:\Program Files\ToolwizCareFree\ToolwizCares.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\ToolwizCareFree\ToolwizTools.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Windows\explorer.exe

C:\Windows\system32\taskmgr.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Windows\System32\svchost.exe -k secsvcs

.

============== Pseudo HJT Report ===============

.

uStart Page = www.yahoo.com

mStart Page = www.yahoo.com

mDefault_Page_URL = hxxp://www.yahoo.com/?ilc=8

uURLSearchHooks: YTNavAssistPlugin Class: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll

uURLSearchHooks: <No Name>: - LocalServer32 - <no file>

mURLSearchHooks: {855F3B16-6D32-4fe6-8A56-BBB695989046} - <orphaned>

mURLSearchHooks: <No Name>: - LocalServer32 - <no file>

BHO: RealNetworks Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\programdata\realnetworks

\realdownloader\browserplugins\ie\rndlbrowserrecordplugin.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll

BHO: Advanced SystemCare Browser Protection: {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} - <no file>

TB: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll

uRun: [spotify Web Helper] "c:\users\cjb\appdata\roaming\spotify\data\SpotifyWebHelper.exe"

uRun: [CleanGeniusTray] "c:\program files\cleangenius 3\CleanGeniusTray.exe" -startup

mRun: [kxesc] "c:\program files\kingsoft\kingsoft antivirus\kxetray.exe" -autorun

mRunOnce: [Malwarebytes Anti-Malware (cleanup)] rundll32.exe "c:\programdata\malwarebytes\malwarebytes' anti-malware

\cleanup.dll",ProcessCleanupScript

dRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\FlashUtil32_11_3_300_271_ActiveX.exe -update activex

StartupFolder: c:\users\cjb\appdata\roaming\microsoft\windows\start menu\programs\startup\Update.vbs

uPolicies-Explorer: NoDriveTypeAutoRun = dword:221

mPolicies-Explorer: NoDriveTypeAutoRun = dword:145

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

mPolicies-System: SynchronousMachineGroupPolicy = dword:1

mPolicies-System: SynchronousUserGroupPolicy = dword:1

mPolicies-Windows\System: AllowBlockingAppsAtShutdown = dword:1

IE: Speak Text - c:\program files\media cope\extensions\speak text\7.html

IE: Upload to Facebook - <no file>

IE: View Full Screen - Best Fit - c:\program files\media cope\extensions\wifv\0.html

IE: View Full Screen - Cut Fit Bottom Right - c:\program files\media cope\extensions\wifv\2.html

IE: View Full Screen - Cut Fit Equal - c:\program files\media cope\extensions\wifv\3.html

IE: View Full Screen - Cut Fit Top Left - c:\program files\media cope\extensions\wifv\1.html

IE: View Full Screen - Stretch Fit - c:\program files\media cope\extensions\wifv\4.html

.

INFO: HKCU has more than 50 listed domains.

If you wish to scan all of them, select the 'Force scan all domains' option.

.

DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} - hxxp://www.superadblocker.com/activex/sabspx.cab

TCP: NameServer = 207.243.120.10 207.243.120.20 192.168.1.1

TCP: Interfaces\{19CC927B-D97D-4A9E-A573-4C71AC6D1E96} : DHCPNameServer = 207.243.120.10 207.243.120.20 192.168.1.1

TCP: Interfaces\{19CC927B-D97D-4A9E-A573-4C71AC6D1E96}\8496C656D616E6 : DHCPNameServer = 207.243.120.10 207.243.120.20

TCP: Interfaces\{8C3A1B08-5000-4FDB-807D-CF49FA5F7D41} : DHCPNameServer = 207.243.120.10 207.243.120.20 192.168.1.1

TCP: Interfaces\{8C3A1B08-5000-4FDB-807D-CF49FA5F7D41}\36F62616C647D2F636F6E6E65627 : DHCPNameServer = 4.2.2.2 8.8.8.8

TCP: Interfaces\{8C3A1B08-5000-4FDB-807D-CF49FA5F7D41}\8496C656D616E6 : DHCPNameServer = 207.243.120.10 207.243.120.20

TCP: Interfaces\{8C3A1B08-5000-4FDB-807D-CF49FA5F7D41}\E4544574541425 : DHCPNameServer = 192.168.1.1

TCP: Interfaces\{AEF844BA-36D1-4C6F-B0DA-E351E7DF99D5} : DHCPNameServer = 207.243.120.10 207.243.120.20 192.168.1.1

TCP: Interfaces\{B80D73A0-E3D5-41B6-8C1E-1F1D3325E6F3} : DHCPNameServer = 207.243.120.10 207.243.120.20 192.168.1.1

TCP: Interfaces\{B80D73A0-E3D5-41B6-8C1E-1F1D3325E6F3}\4414E4E495D20534F5E4564777F627B6 : DHCPNameServer = 192.168.1.1

TCP: Interfaces\{B80D73A0-E3D5-41B6-8C1E-1F1D3325E6F3}\45D2D4F62696C65602D69745F657368615020353 : DHCPNameServer = 192.168.43.1

TCP: Interfaces\{B80D73A0-E3D5-41B6-8C1E-1F1D3325E6F3}\94E44554C4C494E45445 : DHCPNameServer = 192.168.2.1

TCP: Interfaces\{B80D73A0-E3D5-41B6-8C1E-1F1D3325E6F3}\E4544574541425 : DHCPNameServer = 192.168.1.1

Notify: igfxcui - igfxdev.dll

SSODL: WebCheck - <orphaned>

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\users\cjb\appdata\roaming\mozilla\firefox\profiles\pf3w9cnm.default-1353658392495\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3284024&SearchSource=3&q={searchTerms}

&CUI=UN35193696604262309

FF - prefs.js: browser.search.selectedEngine - VisualBee V.1 Customized Web Search

FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT3284024&SearchSource=13&CUI=UN35193696604262309

FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3284024&SearchSource=2&CUI=UN35193696604262309&UM=UM_ID&q=

FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll

FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll

FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll

FF - plugin: c:\programdata\realnetworks\realdownloader\browserplugins\mozillaplugins\nprndlchromebrowserrecordext.dll

FF - plugin: c:\programdata\realnetworks\realdownloader\browserplugins\mozillaplugins\nprndlhtml5videoshim.dll

FF - plugin: c:\programdata\realnetworks\realdownloader\browserplugins\npdlplugin.dll

FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_7_700_169.dll

FF - plugin: c:\windows\system32\npDeployJava1.dll

FF - plugin: c:\windows\system32\npmproxy.dll

.

---- FIREFOX POLICIES ----

FF - user.js: network.http.pipelining.maxrequests - 8

FF - user.js: network.http.request.max-start-delay - 0

FF - user.js: network.http.max-connections - 48

FF - user.js: network.http.max-connections-per-server - 16

FF - user.js: network.http.max-persistent-connections-per-proxy - 16

FF - user.js: network.http.max-persistent-connections-per-server - 8

FF - user.js: browser.turbo.enabled - true

FF - user.js: browser.display.show_image_placeholders - true

FF - user.js: browser.chrome.favicons - false

FF - user.js: browser.urlbar.autocomplete.enabled - true

FF - user.js: browser.cache.memory.capacity - 65536

FF - user.js: content.notify.ontimer - true

FF - user.js: content.interrupt.parsing - true

FF - user.js: content.max.tokenizing.time - 2250000

FF - user.js: content.switch.threshold - 750000

FF - user.js: plugin.expose_full_path - true

FF - user.js: ui.submenuDelay - 0

.

============= SERVICES / DRIVERS ===============

.

R0 BTOWSVF;BTOWSVF;c:\windows\system32\drivers\BTOWSVF.sys [2013-4-21 44928]

R0 kavbootc;kavbootc;c:\windows\system32\drivers\kavbootc.sys [2012-8-30 27240]

R0 KSafeDISK;KSafeDISK;c:\windows\system32\drivers\KSafeDISK.sys [2013-4-21 48640]

R1 BTOWSFF;BTOWSFF;c:\windows\system32\drivers\BTOWSFF.sys [2013-4-21 27648]

R1 ElRawDisk;ElRawDisk;c:\windows\system32\drivers\ElRawDsk.sys [2013-5-23 26248]

R1 KDHacker;KDHacker;c:\program files\kingsoft\kingsoft antivirus\security\kxescan\kdhacker.sys [2012-8-30 125784]

R2 kisknl;kisknl;c:\windows\system32\drivers\kisknl.sys [2012-8-30 164728]

R2 kxescore;Kingsoft Core Service;c:\program files\kingsoft\kingsoft antivirus\kxescore.exe [2012-8-30 123992]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-11-18 701512]

R2 PDFsFilter;PDFsFilter;c:\windows\system32\drivers\PDFsFilter.sys [2012-10-30 68464]

R2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files\realnetworks\realdownloader

\rndlresolversvc.exe [2012-8-9 38608]

R2 StorSvc;Storage Service;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992]

R3 ioloSystemService;iolo System Service;c:\program files\iolo\common\lib\ioloServiceManager.exe [2013-5-22 1072664]

R3 ksapi;ksapi;c:\windows\system32\drivers\ksapi.sys [2012-8-30 82264]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-11-18 22856]

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2013-5-24 40776]

R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\drivers\VSTAZL3.SYS [2009-7-13 207360]

R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\drivers\VSTDPV3.SYS [2009-7-13 980992]

R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\drivers\VSTCNXT3.SYS [2009-7-13 661504]

R3 voxaldriver;Voxal Filter Driver 2.10.00;c:\windows\system32\drivers\voxaldriverx86.sys [2013-2-14 42576]

R4 KUsbGuard;KUsbGuard;c:\program files\kingsoft\kingsoft antivirus\kusbquery.sys [2012-9-11 14200]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe

[2010-3-18 130384]

S2 WCMVCAM;WebcamMax, WDM Video Capture;c:\windows\system32\drivers\wcmvcam.sys [2012-4-15 1068216]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]

S3 FileMonitor;FileMonitor;c:\program files\iobit\iobit malware fighter\drivers\win7_x86\FileMonitor.sys [2013-2-12 20336]

S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.Sys [2012-11-3 36608]

S3 netr28u;RT2870 USB Extensible Wireless LAN Card Driver;c:\windows\system32\drivers\netr28u.sys [2012-12-4 856928]

S3 RegFilter;RegFilter;c:\program files\iobit\iobit malware fighter\drivers\win7_x86\RegFilter.sys [2013-2-12 30640]

S3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM);c:\windows\system32\drivers\sscebus.sys [2012-11-3 98560]

S3 sscemdfl;SAMSUNG Mobile Modem V2 Filter;c:\windows\system32\drivers\sscemdfl.sys [2012-11-3 14848]

S3 sscemdm;SAMSUNG Mobile Modem V2 Drivers;c:\windows\system32\drivers\sscemdm.sys [2012-11-3 123648]

S3 SynasUSB;SynasUSB;c:\windows\system32\drivers\synasUSB.sys [2013-3-12 23288]

S3 UrlFilter;UrlFilter;c:\program files\iobit\iobit malware fighter\drivers\win7_x86\UrlFilter.sys [2013-2-12 19832]

S3 VASDeviceDrm;Virtual Audio Streaming with Drm (WDM);c:\windows\system32\drivers\vasdDev.sys [2012-12-8 1451312]

S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2012-9-4 1343400]

S3 WsAudioDevice_383;WsAudioDevice_383;c:\windows\system32\drivers\WsAudioDevice_383.sys [2012-9-7 16640]

S4 Com4QLBEx;Com4QLBEx;c:\program files\hewlett-packard\hp quick launch buttons\Com4QLBEx.exe [2012-9-3 227896]

S4 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2012-11-3 238952]

S4 IMFservice;IMF Service;c:\program files\iobit\iobit malware fighter\IMFsrv.exe [2012-10-11 821592]

S4 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2012-11-18 418376]

S4 RalinkRegistryWriter;Ralink Registry Writer;c:\program files\ralink\common\RaRegistry.exe [2012-12-4 193888]

.

=============== Created Last 30 ================

.

2013-05-24 13:05:17 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2013-05-24 11:22:33 54016 ----a-w- c:\windows\system32\drivers\tflq.sys

2013-05-24 08:00:42 -------- d-----w- C:\174f3b2bead34a105f6f3266e1361a48

2013-05-23 10:18:57 60872 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{30e015fc-2bd1-49f0-8043-

0bb31fd7fc89}\offreg.dll

2013-05-23 08:29:55 26248 ----a-w- c:\windows\system32\drivers\ElRawDsk.sys

2013-05-23 08:00:24 -------- d-----w- C:\900e04d6e6dcfe836b

2013-05-23 04:07:08 83456 ---ha-w- C:\wifv.exe

2013-05-23 04:07:08 340480 ---ha-w- C:\Speak Text.exe

2013-05-23 04:07:04 579576 ----a-w- c:\windows\system32\Codejock.SkinFramework.v15.0.1.ocx

2013-05-23 04:07:03 211456 ----a-w- c:\windows\system32\MediaCopeShellM.dll

2013-05-23 04:07:01 211456 ----a-w- c:\windows\system32\MediaCopeShellS.dll

2013-05-23 04:07:01 -------- d-----w- c:\program files\Media Cope

2013-05-22 08:00:59 -------- d-----w- C:\6746e963838c373a8cf822b03ddd3b89

2013-05-22 00:05:49 -------- d-----w- C:\105009d7215d76f8fd

2013-05-21 12:17:11 7016152 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{30e015fc-2bd1-49f0-8043-

0bb31fd7fc89}\mpengine.dll

2013-05-19 04:42:25 1210728 ----a-w- c:\windows\system32\drivers\ntfs.sys

2013-05-18 03:39:48 50 ----a-w- c:\users\cjb\appdata\roaming\Update.bat

2013-05-18 03:39:48 112 ----a-w- c:\users\cjb\appdata\roaming\microsoft\windows\start menu\programs\startup\Update.vbs

.

==================== Find3M ====================

.

2013-05-22 05:08:38 41616 ----a-w- c:\windows\system32\iolobtdfg.exe

2013-05-22 05:08:30 23568 ----a-w- c:\windows\system32\smrgdf.exe

2013-05-22 04:48:08 2097472 ----a-w- c:\windows\system32\Incinerator32.dll

2013-05-02 07:06:08 238872 ------w- c:\windows\system32\MpSigStub.exe

2013-04-21 23:39:06 48640 ----a-w- c:\windows\system32\drivers\KSafeDISK.sys

2013-04-21 23:39:05 27648 ----a-w- c:\windows\system32\drivers\BTOWSFF.sys

2013-04-21 23:39:04 44928 ----a-w- c:\windows\system32\drivers\BTOWSVF.sys

2013-04-21 20:42:07 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2013-04-21 20:42:07 691592 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-04-07 03:52:11 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll

2013-04-07 03:52:09 861088 ----a-w- c:\windows\system32\npDeployJava1.dll

2013-04-07 03:52:09 782240 ----a-w- c:\windows\system32\deployJava1.dll

2013-04-04 19:50:32 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2013-03-19 05:06:09 3958120 ----a-w- c:\windows\system32\ntkrnlpa.exe

2013-03-19 05:06:09 3902312 ----a-w- c:\windows\system32\ntoskrnl.exe

2013-03-19 04:54:22 38912 ----a-w- c:\windows\system32\csrsrv.dll

2013-03-19 02:50:03 69632 ----a-w- c:\windows\system32\smss.exe

2013-03-01 03:11:14 2345984 ----a-w- c:\windows\system32\win32k.sys

.

============= FINISH: 11:18:20.92 ===============

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Welcome to the forum.

Please remove any usb or external drives from the computer before you run this scan!

Please download and run RogueKiller 32 Bit to your desktop.

RogueKiller 64 Bit <---use this one for 64 bit systems

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

(please don't put logs in code or quotes)

P2P Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

MrC

Note:

Please read all of my instructions completely including these.

Make sure you're subscribed to this topic:
Click on the
Follow This Topic Button
(at the top right of this page), make sure that the
Receive notification
box is checked and that it is set to
Instantly

Removing malware can be unpredictable
...things can go very wrong!
Backup
any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive

<+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

<+>The removal of malware isn't instantaneous, please be patient.

<+>Please stick with me until I give you the "all clear" and
Please don't waste my time by leaving before that
.

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 24 hours, please send me a PM)

Link to post
Share on other sites
jefftx

jefftx

Posted
  • Author
Posted

RogueKiller V8.5.4 [Mar 18 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7600 ) 32 bits version

Started in : Normal mode

User : cjb [Admin rights]

Mode : Scan -- Date : 05/24/2013 16:12:07

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 6 ¤¤¤

[TASK][sUSP PATH] EasyShare Registration Task.job : C:\Windows\System32\rundll32.exe C:\ProgramData\Kodak\EasyShareSetup\$Registration\Registration_7.9.20.1.sxt _RegistrationOffer@16 [7] -> FOUND

[TASK][sUSP PATH] EasyShare Registration Task : C:\Windows\System32\rundll32.exe C:\ProgramData\Kodak\EasyShareSetup\$Registration\Registration_7.9.20.1.sxt _RegistrationOffer@16 [7] -> FOUND

[TASK][sUSP PATH] Test TimeTrigger : C:\Users\cjb\AppData\Local\Temp\Runner.exe C:\Users\cjb\AppData\Local\Temp\DNS.exe [x] -> FOUND

[HJ SMENU] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

[ZeroAccess][FILE] @ : C:\$recycle.bin\S-1-5-21-1280333628-3599997341-138837843-1001\$233eeb25beb6b223ef74c3cc12d09ce4\@ [-] --> FOUND

[ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-21-1280333628-3599997341-138837843-1001\$233eeb25beb6b223ef74c3cc12d09ce4\U --> FOUND

[ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-21-1280333628-3599997341-138837843-1001\$233eeb25beb6b223ef74c3cc12d09ce4\L --> FOUND

¤¤¤ Driver : [LOADED] ¤¤¤

SSDT[93] : NtCreateUserProcess @ 0x82E605B3 -> HOOKED (\??\C:\Windows\system32\drivers\kisknl.sys @ 0x96E368DA)

¤¤¤ Infection : ZeroAccess ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST9200827AS ATA Device +++++

--- User ---

[MBR] 06aac3649d40f3ad19918d2021715ee8

[bSP] 8a595458ebe0c10a2eced05f7200374b : Windows 7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 179005 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 366603300 | Size: 11774 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[1]_S_05242013_02d1612.txt >>

RKreport[1]_S_05242013_02d1612.txt

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Some info on the infection.......

You're infected with Rootkit.ZeroAccess, a BackDoor Trojan also.

BACKDOOR WARNING

------------------------------

One or more of the identified infections is known to use a backdoor.

This allows hackers to remotely control your computer, steal critical system information and download and execute files.

I would advice you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the infection has been identified and because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

http://www.dslreports.com/faq/10451

When Should I Format, How Should I Reinstall

http://www.dslreports.com/faq/10063

I will try my best to clean this machine but I can't guarantee that it will be 100% secure afterwards.

Let me know what you decide to do. If you decide to go through with the cleanup, please proceed with the following steps.

-----------------------------------------

Run RogueKiller again and click Scan

When the scan completes > click on the Files tab

Put a check next to all of these and uncheck the rest: (if found)

[ZeroAccess][FILE] @ : C:\$recycle.bin\S-1-5-21-1280333628-3599997341-138837843-1001\$233eeb25beb6b223ef74c3cc12d09ce4\@ [-] --> FOUND

[ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-21-1280333628-3599997341-138837843-1001\$233eeb25beb6b223ef74c3cc12d09ce4\U --> FOUND

[ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-21-1280333628-3599997341-138837843-1001\$233eeb25beb6b223ef74c3cc12d09ce4\L --> FOUND

Now click Delete on the right hand column under Options

----------------------------------------------------------------------

Next:

Download Malwarebytes Anti-Rootkit from HERE

  • Unzip the contents to a folder in a convenient location.
  • Open the folder where the contents were unzipped and run mbar.exe
  • Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
  • Click on the Cleanup button to remove any threats and reboot if prompted to do so.
  • Wait while the system shuts down and the cleanup process is performed.
  • Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  • When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt

To attach a log if needed:

Bottom right corner of this page.

more-reply-options.jpg

New window that comes up.

choose-files1.jpg

~~~~~~~~~~~~~~~~~~~~~~~

Note:

If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:

Internet access

Windows Update

Windows Firewall

If there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot. It's located in the Plugins folder which is in the MBAR folder.

Just run fixdamage.exe.

Verify that your system is now functioning normally.

MrC

Link to post
Share on other sites
jefftx

jefftx

Posted
  • Author
Posted

Malwarebytes Anti-Rootkit BETA 1.05.0.1001

© Malwarebytes Corporation 2011-2012

OS version: 6.1.7600 Windows 7 x86

Account is Administrative

Internet Explorer version: 9.0.8112.16421

File system is: NTFS

Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED

CPU speed: 1.862000 GHz

Memory total: 3210756096, free: 1941180416

------------ Kernel report ------------

05/24/2013 16:39:58

------------ Loaded modules -----------

\SystemRoot\system32\ntkrnlpa.exe

\SystemRoot\system32\halmacpi.dll

\SystemRoot\system32\kdcom.dll

\SystemRoot\system32\mcupdate_GenuineIntel.dll

\SystemRoot\system32\PSHED.dll

\SystemRoot\system32\BOOTVID.dll

\SystemRoot\system32\CLFS.SYS

\SystemRoot\system32\CI.dll

\SystemRoot\System32\drivers\tflq.sys

\SystemRoot\System32\drivers\hxddpw.sys

\SystemRoot\system32\drivers\Wdf01000.sys

\SystemRoot\system32\drivers\WDFLDR.SYS

\SystemRoot\system32\DRIVERS\ACPI.sys

\SystemRoot\system32\DRIVERS\WMILIB.SYS

\SystemRoot\system32\DRIVERS\msisadrv.sys

\SystemRoot\system32\DRIVERS\pci.sys

\SystemRoot\system32\DRIVERS\vdrvroot.sys

\SystemRoot\system32\drivers\kavbootc.sys

\SystemRoot\System32\drivers\partmgr.sys

\SystemRoot\system32\DRIVERS\compbatt.sys

\SystemRoot\system32\DRIVERS\BATTC.SYS

\SystemRoot\system32\DRIVERS\volmgr.sys

\SystemRoot\System32\drivers\volmgrx.sys

\SystemRoot\system32\DRIVERS\intelide.sys

\SystemRoot\system32\DRIVERS\PCIIDEX.SYS

\SystemRoot\System32\drivers\mountmgr.sys

\SystemRoot\system32\DRIVERS\atapi.sys

\SystemRoot\system32\DRIVERS\ataport.SYS

\SystemRoot\system32\DRIVERS\msahci.sys

\SystemRoot\system32\drivers\amdxata.sys

\SystemRoot\system32\drivers\fltmgr.sys

\SystemRoot\system32\drivers\fileinfo.sys

\SystemRoot\System32\Drivers\Ntfs.sys

\SystemRoot\System32\Drivers\msrpc.sys

\SystemRoot\System32\Drivers\ksecdd.sys

\SystemRoot\System32\Drivers\cng.sys

\SystemRoot\System32\drivers\pcw.sys

\SystemRoot\System32\Drivers\Fs_Rec.sys

\SystemRoot\system32\drivers\ndis.sys

\SystemRoot\system32\drivers\NETIO.SYS

\SystemRoot\System32\Drivers\ksecpkg.sys

\SystemRoot\System32\drivers\tcpip.sys

\SystemRoot\System32\drivers\fwpkclnt.sys

\SystemRoot\system32\DRIVERS\vmstorfl.sys

\SystemRoot\system32\drivers\volsnap.sys

\SystemRoot\System32\Drivers\spldr.sys

\SystemRoot\System32\drivers\rdyboost.sys

\SystemRoot\System32\Drivers\mup.sys

\SystemRoot\system32\Drivers\KSafeDISK.sys

\SystemRoot\System32\drivers\hwpolicy.sys

\SystemRoot\System32\DRIVERS\fvevol.sys

\SystemRoot\system32\DRIVERS\disk.sys

\SystemRoot\system32\DRIVERS\CLASSPNP.SYS

\SystemRoot\system32\Drivers\BTOWSVF.sys

\SystemRoot\system32\DRIVERS\cdrom.sys

\??\C:\Windows\system32\Drivers\BTOWSFF.sys

\SystemRoot\System32\Drivers\Null.SYS

\SystemRoot\System32\Drivers\Beep.SYS

\SystemRoot\System32\drivers\vga.sys

\SystemRoot\System32\drivers\VIDEOPRT.SYS

\SystemRoot\System32\drivers\watchdog.sys

\SystemRoot\System32\DRIVERS\RDPCDD.sys

\SystemRoot\system32\drivers\rdpencdd.sys

\SystemRoot\system32\drivers\rdprefmp.sys

\SystemRoot\System32\Drivers\Msfs.SYS

\SystemRoot\System32\Drivers\Npfs.SYS

\SystemRoot\system32\DRIVERS\tdx.sys

\SystemRoot\system32\DRIVERS\TDI.SYS

\SystemRoot\system32\drivers\afd.sys

\??\c:\program files\kingsoft\kingsoft antivirus\security\kxescan\kdhacker.sys

\SystemRoot\System32\DRIVERS\netbt.sys

\SystemRoot\system32\DRIVERS\wfplwf.sys

\SystemRoot\system32\DRIVERS\pacer.sys

\SystemRoot\system32\DRIVERS\vwififlt.sys

\SystemRoot\system32\DRIVERS\netbios.sys

\SystemRoot\system32\DRIVERS\wanarp.sys

\SystemRoot\system32\DRIVERS\termdd.sys

\SystemRoot\system32\DRIVERS\rdbss.sys

\SystemRoot\system32\drivers\nsiproxy.sys

\SystemRoot\system32\DRIVERS\mssmbios.sys

\??\C:\Windows\system32\drivers\ElRawDsk.sys

\SystemRoot\System32\drivers\discache.sys

\SystemRoot\system32\drivers\csc.sys

\SystemRoot\System32\Drivers\dfsc.sys

\SystemRoot\system32\DRIVERS\blbdrive.sys

\SystemRoot\system32\DRIVERS\tunnel.sys

\SystemRoot\system32\DRIVERS\intelppm.sys

\SystemRoot\system32\DRIVERS\CmBatt.sys

\SystemRoot\system32\DRIVERS\cpqbttn.sys

\SystemRoot\system32\DRIVERS\HIDCLASS.SYS

\SystemRoot\system32\DRIVERS\HIDPARSE.SYS

\SystemRoot\system32\DRIVERS\wmiacpi.sys

\SystemRoot\system32\DRIVERS\igdkmd32.sys

\SystemRoot\System32\drivers\dxgkrnl.sys

\SystemRoot\System32\drivers\dxgmms1.sys

\SystemRoot\system32\DRIVERS\HDAudBus.sys

\SystemRoot\system32\DRIVERS\athr.sys

\SystemRoot\system32\DRIVERS\vwifibus.sys

\SystemRoot\system32\DRIVERS\usbuhci.sys

\SystemRoot\system32\DRIVERS\USBPORT.SYS

\SystemRoot\system32\DRIVERS\usbehci.sys

\SystemRoot\system32\DRIVERS\Rtnicxp.sys

\SystemRoot\system32\DRIVERS\i8042prt.sys

\SystemRoot\system32\DRIVERS\HpqKbFiltr.sys

\SystemRoot\system32\DRIVERS\kbdclass.sys

\SystemRoot\system32\DRIVERS\mouclass.sys

\SystemRoot\system32\DRIVERS\CompositeBus.sys

\SystemRoot\system32\DRIVERS\msiscsi.sys

\SystemRoot\system32\DRIVERS\storport.sys

\SystemRoot\system32\DRIVERS\AgileVpn.sys

\SystemRoot\system32\DRIVERS\rasl2tp.sys

\SystemRoot\system32\DRIVERS\ndistapi.sys

\SystemRoot\system32\DRIVERS\ndiswan.sys

\SystemRoot\system32\DRIVERS\raspppoe.sys

\SystemRoot\system32\DRIVERS\raspptp.sys

\SystemRoot\system32\DRIVERS\rassstp.sys

\SystemRoot\system32\DRIVERS\rdpbus.sys

\SystemRoot\system32\DRIVERS\swenum.sys

\SystemRoot\system32\DRIVERS\ks.sys

\SystemRoot\system32\DRIVERS\umbus.sys

\SystemRoot\system32\DRIVERS\kbdhid.sys

\SystemRoot\system32\DRIVERS\usbhub.sys

\SystemRoot\System32\Drivers\NDProxy.SYS

\SystemRoot\system32\drivers\CHDRT32.sys

\SystemRoot\system32\drivers\portcls.sys

\SystemRoot\system32\drivers\drmk.sys

\SystemRoot\system32\DRIVERS\voxaldriverx86.sys

\SystemRoot\system32\DRIVERS\VSTAZL3.SYS

\SystemRoot\system32\DRIVERS\VSTDPV3.SYS

\SystemRoot\system32\DRIVERS\VSTCNXT3.SYS

\SystemRoot\system32\drivers\modem.sys

\SystemRoot\system32\DRIVERS\USBSTOR.SYS

\SystemRoot\system32\DRIVERS\USBD.SYS

\SystemRoot\system32\DRIVERS\hidusb.sys

\SystemRoot\system32\DRIVERS\usbccgp.sys

\SystemRoot\system32\DRIVERS\mouhid.sys

\SystemRoot\system32\DRIVERS\snp2uvc.sys

\SystemRoot\system32\DRIVERS\STREAM.SYS

\SystemRoot\system32\DRIVERS\sncduvc.SYS

\SystemRoot\System32\win32k.sys

\SystemRoot\System32\drivers\Dxapi.sys

\SystemRoot\System32\Drivers\crashdmp.sys

\SystemRoot\System32\Drivers\dump_dumpata.sys

\SystemRoot\System32\Drivers\dump_msahci.sys

\SystemRoot\System32\Drivers\dump_dumpfve.sys

\SystemRoot\system32\DRIVERS\monitor.sys

\SystemRoot\System32\TSDDD.dll

\SystemRoot\System32\cdd.dll

\SystemRoot\system32\drivers\luafv.sys

\??\C:\Windows\system32\drivers\kisknl.sys

\??\C:\Windows\system32\drivers\mbam.sys

\SystemRoot\system32\DRIVERS\PDFsFilter.sys

\SystemRoot\system32\DRIVERS\lltdio.sys

\SystemRoot\system32\DRIVERS\nwifi.sys

\SystemRoot\system32\DRIVERS\ndisuio.sys

\SystemRoot\system32\DRIVERS\rspndr.sys

\SystemRoot\system32\DRIVERS\vwifimp.sys

\SystemRoot\system32\drivers\HTTP.sys

\SystemRoot\system32\DRIVERS\bowser.sys

\SystemRoot\System32\drivers\mpsdrv.sys

\SystemRoot\system32\DRIVERS\mrxsmb.sys

\SystemRoot\system32\DRIVERS\mrxsmb10.sys

\SystemRoot\system32\DRIVERS\mrxsmb20.sys

\SystemRoot\system32\drivers\peauth.sys

\SystemRoot\System32\Drivers\secdrv.SYS

\SystemRoot\System32\DRIVERS\srvnet.sys

\SystemRoot\System32\drivers\tcpipreg.sys

\SystemRoot\System32\DRIVERS\srv2.sys

\SystemRoot\System32\DRIVERS\srv.sys

\SystemRoot\System32\drivers\ipnat.sys

\SystemRoot\system32\drivers\WudfPf.sys

\SystemRoot\system32\DRIVERS\WUDFRd.sys

\??\C:\Windows\system32\drivers\ksapi.sys

\SystemRoot\system32\DRIVERS\asyncmac.sys

\??\C:\Program Files\kingsoft\kingsoft antivirus\kusbquery.sys

\??\C:\Windows\system32\drivers\TrueSight.sys

\??\C:\Windows\system32\drivers\mbamchameleon.sys

\??\C:\Windows\system32\drivers\mbamswissarmy.sys

\Windows\System32\ntdll.dll

\Windows\System32\smss.exe

\Windows\System32\apisetschema.dll

----------- End -----------

<<<1>>>

Upper Device Name: \Device\Harddisk1\DR1

Upper Device Object: 0xffffffff86bd6030

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\00000082\

Lower Device Object: 0xffffffff86c14030

Lower Device Driver Name: \Driver\USBSTOR\

Driver name found: USBSTOR

Initialization returned 0x0

Load Function returned 0x0

<<<1>>>

Upper Device Name: \Device\Harddisk0\DR0

Upper Device Object: 0xffffffff8638d030

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\Ide\IdeDeviceP2T0L0-4\

Lower Device Object: 0xffffffff8627d030

Lower Device Driver Name: \Driver\atapi\

Driver name found: atapi

Initialization returned 0x0

Port sub-driver loaded: \??\C:\Windows\System32\drivers\ataport.sys (0x0)

Load Function returned 0x0

Initializing...

Done!

<<<2>>>

Device number: 0, partition: 1

Physical Sector Size: 512

Drive: 0, DevicePointer: 0xffffffff8638d030, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xffffffff8638c1a0, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xffffffff8638d030, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

DevicePointer: 0xffffffff855e8aa8, DeviceName: Unknown, DriverName: \Driver\ACPI\

DevicePointer: 0xffffffff8627d030, DeviceName: \Device\Ide\IdeDeviceP2T0L0-4\, DriverName: \Driver\atapi\

------------ End ----------

Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

Upper DeviceData: 0xffffffffb2930fa8, 0xffffffff8638d030, 0xffffffff85fb4048

Lower DeviceData: 0xffffffffc2458c20, 0xffffffff8627d030, 0xffffffff85c1e9c8

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Scanning directory: C:\Windows\system32\drivers...

<<<2>>>

Device number: 0, partition: 1

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Done!

Drive 0

Scanning MBR on drive 0...

Inspecting partition table:

MBR Signature: 55AA

Disk Signature: FD02FD02

Partition information:

Partition 0 type is Primary (0x7)

Partition is ACTIVE.

Partition starts at LBA: 63 Numsec = 366603237

Partition file system is NTFS

Partition is bootable

Partition 1 type is Primary (0x7)

Partition is NOT ACTIVE.

Partition starts at LBA: 366603300 Numsec = 24113565

Partition 2 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Disk Size: 200049647616 bytes

Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-62-390701968-390721968)...

Physical Sector Size: 0

Drive: 1, DevicePointer: 0xffffffff86bd6030, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xffffffff86bd6968, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xffffffff86bd6030, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\

DevicePointer: 0xffffffff86c14030, DeviceName: \Device\00000082\, DriverName: \Driver\USBSTOR\

------------ End ----------

Done!

Performing system, memory and registry scan...

Infected: HKCU\SOFTWARE\CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} --> [Hijack.Trojan.Siredef.C]

Infected: c:\$Recycle.Bin\S-1-5-21-1280333628-3599997341-138837843-1001\$233eeb25beb6b223ef74c3cc12d09ce4 --> [Trojan.Siredef.C]

Done!

Scan finished

Creating System Restore point...

Scheduling clean up...

<<<2>>>

Device number: 0, partition: 1

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Executing an action fixdamage.exe...

Success!

Removal successful. No system shutdown is required.

=======================================

---------------------------------------

Malwarebytes Anti-Rootkit BETA 1.05.0.1001

© Malwarebytes Corporation 2011-2012

OS version: 6.1.7600 Windows 7 x86

Account is Administrative

Internet Explorer version: 9.0.8112.16421

File system is: NTFS

Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED

CPU speed: 1.862000 GHz

Memory total: 3210756096, free: 1888563200

------------ Kernel report ------------

05/24/2013 17:12:58

------------ Loaded modules -----------

\SystemRoot\system32\ntkrnlpa.exe

\SystemRoot\system32\halmacpi.dll

\SystemRoot\system32\kdcom.dll

\SystemRoot\system32\mcupdate_GenuineIntel.dll

\SystemRoot\system32\PSHED.dll

\SystemRoot\system32\BOOTVID.dll

\SystemRoot\system32\CLFS.SYS

\SystemRoot\system32\CI.dll

\SystemRoot\System32\drivers\tflq.sys

\SystemRoot\System32\drivers\hxddpw.sys

\SystemRoot\system32\drivers\Wdf01000.sys

\SystemRoot\system32\drivers\WDFLDR.SYS

\SystemRoot\system32\DRIVERS\ACPI.sys

\SystemRoot\system32\DRIVERS\WMILIB.SYS

\SystemRoot\system32\DRIVERS\msisadrv.sys

\SystemRoot\system32\DRIVERS\pci.sys

\SystemRoot\system32\DRIVERS\vdrvroot.sys

\SystemRoot\system32\drivers\kavbootc.sys

\SystemRoot\System32\drivers\partmgr.sys

\SystemRoot\system32\DRIVERS\compbatt.sys

\SystemRoot\system32\DRIVERS\BATTC.SYS

\SystemRoot\system32\DRIVERS\volmgr.sys

\SystemRoot\System32\drivers\volmgrx.sys

\SystemRoot\system32\DRIVERS\intelide.sys

\SystemRoot\system32\DRIVERS\PCIIDEX.SYS

\SystemRoot\System32\drivers\mountmgr.sys

\SystemRoot\system32\DRIVERS\atapi.sys

\SystemRoot\system32\DRIVERS\ataport.SYS

\SystemRoot\system32\DRIVERS\msahci.sys

\SystemRoot\system32\drivers\amdxata.sys

\SystemRoot\system32\drivers\fltmgr.sys

\SystemRoot\system32\drivers\fileinfo.sys

\SystemRoot\System32\Drivers\Ntfs.sys

\SystemRoot\System32\Drivers\msrpc.sys

\SystemRoot\System32\Drivers\ksecdd.sys

\SystemRoot\System32\Drivers\cng.sys

\SystemRoot\System32\drivers\pcw.sys

\SystemRoot\System32\Drivers\Fs_Rec.sys

\SystemRoot\system32\drivers\ndis.sys

\SystemRoot\system32\drivers\NETIO.SYS

\SystemRoot\System32\Drivers\ksecpkg.sys

\SystemRoot\System32\drivers\tcpip.sys

\SystemRoot\System32\drivers\fwpkclnt.sys

\SystemRoot\system32\DRIVERS\vmstorfl.sys

\SystemRoot\system32\drivers\volsnap.sys

\SystemRoot\System32\Drivers\spldr.sys

\SystemRoot\System32\drivers\rdyboost.sys

\SystemRoot\System32\Drivers\mup.sys

\SystemRoot\system32\Drivers\KSafeDISK.sys

\SystemRoot\System32\drivers\hwpolicy.sys

\SystemRoot\System32\DRIVERS\fvevol.sys

\SystemRoot\system32\DRIVERS\disk.sys

\SystemRoot\system32\DRIVERS\CLASSPNP.SYS

\SystemRoot\system32\Drivers\BTOWSVF.sys

\SystemRoot\system32\DRIVERS\cdrom.sys

\??\C:\Windows\system32\Drivers\BTOWSFF.sys

\SystemRoot\System32\Drivers\Null.SYS

\SystemRoot\System32\Drivers\Beep.SYS

\SystemRoot\System32\drivers\vga.sys

\SystemRoot\System32\drivers\VIDEOPRT.SYS

\SystemRoot\System32\drivers\watchdog.sys

\SystemRoot\System32\DRIVERS\RDPCDD.sys

\SystemRoot\system32\drivers\rdpencdd.sys

\SystemRoot\system32\drivers\rdprefmp.sys

\SystemRoot\System32\Drivers\Msfs.SYS

\SystemRoot\System32\Drivers\Npfs.SYS

\SystemRoot\system32\DRIVERS\tdx.sys

\SystemRoot\system32\DRIVERS\TDI.SYS

\SystemRoot\system32\drivers\afd.sys

\??\c:\program files\kingsoft\kingsoft antivirus\security\kxescan\kdhacker.sys

\SystemRoot\System32\DRIVERS\netbt.sys

\SystemRoot\system32\DRIVERS\wfplwf.sys

\SystemRoot\system32\DRIVERS\pacer.sys

\SystemRoot\system32\DRIVERS\vwififlt.sys

\SystemRoot\system32\DRIVERS\netbios.sys

\SystemRoot\system32\DRIVERS\wanarp.sys

\SystemRoot\system32\DRIVERS\termdd.sys

\SystemRoot\system32\DRIVERS\rdbss.sys

\SystemRoot\system32\drivers\nsiproxy.sys

\SystemRoot\system32\DRIVERS\mssmbios.sys

\??\C:\Windows\system32\drivers\ElRawDsk.sys

\SystemRoot\System32\drivers\discache.sys

\SystemRoot\system32\drivers\csc.sys

\SystemRoot\System32\Drivers\dfsc.sys

\SystemRoot\system32\DRIVERS\blbdrive.sys

\SystemRoot\system32\DRIVERS\tunnel.sys

\SystemRoot\system32\DRIVERS\intelppm.sys

\SystemRoot\system32\DRIVERS\CmBatt.sys

\SystemRoot\system32\DRIVERS\cpqbttn.sys

\SystemRoot\system32\DRIVERS\HIDCLASS.SYS

\SystemRoot\system32\DRIVERS\HIDPARSE.SYS

\SystemRoot\system32\DRIVERS\wmiacpi.sys

\SystemRoot\system32\DRIVERS\igdkmd32.sys

\SystemRoot\System32\drivers\dxgkrnl.sys

\SystemRoot\System32\drivers\dxgmms1.sys

\SystemRoot\system32\DRIVERS\HDAudBus.sys

\SystemRoot\system32\DRIVERS\athr.sys

\SystemRoot\system32\DRIVERS\vwifibus.sys

\SystemRoot\system32\DRIVERS\usbuhci.sys

\SystemRoot\system32\DRIVERS\USBPORT.SYS

\SystemRoot\system32\DRIVERS\usbehci.sys

\SystemRoot\system32\DRIVERS\Rtnicxp.sys

\SystemRoot\system32\DRIVERS\i8042prt.sys

\SystemRoot\system32\DRIVERS\HpqKbFiltr.sys

\SystemRoot\system32\DRIVERS\kbdclass.sys

\SystemRoot\system32\DRIVERS\mouclass.sys

\SystemRoot\system32\DRIVERS\CompositeBus.sys

\SystemRoot\system32\DRIVERS\msiscsi.sys

\SystemRoot\system32\DRIVERS\storport.sys

\SystemRoot\system32\DRIVERS\AgileVpn.sys

\SystemRoot\system32\DRIVERS\rasl2tp.sys

\SystemRoot\system32\DRIVERS\ndistapi.sys

\SystemRoot\system32\DRIVERS\ndiswan.sys

\SystemRoot\system32\DRIVERS\raspppoe.sys

\SystemRoot\system32\DRIVERS\raspptp.sys

\SystemRoot\system32\DRIVERS\rassstp.sys

\SystemRoot\system32\DRIVERS\rdpbus.sys

\SystemRoot\system32\DRIVERS\swenum.sys

\SystemRoot\system32\DRIVERS\ks.sys

\SystemRoot\system32\DRIVERS\umbus.sys

\SystemRoot\system32\DRIVERS\kbdhid.sys

\SystemRoot\system32\DRIVERS\usbhub.sys

\SystemRoot\System32\Drivers\NDProxy.SYS

\SystemRoot\system32\drivers\CHDRT32.sys

\SystemRoot\system32\drivers\portcls.sys

\SystemRoot\system32\drivers\drmk.sys

\SystemRoot\system32\DRIVERS\voxaldriverx86.sys

\SystemRoot\system32\DRIVERS\VSTAZL3.SYS

\SystemRoot\system32\DRIVERS\VSTDPV3.SYS

\SystemRoot\system32\DRIVERS\VSTCNXT3.SYS

\SystemRoot\system32\drivers\modem.sys

\SystemRoot\system32\DRIVERS\USBSTOR.SYS

\SystemRoot\system32\DRIVERS\USBD.SYS

\SystemRoot\system32\DRIVERS\hidusb.sys

\SystemRoot\system32\DRIVERS\usbccgp.sys

\SystemRoot\system32\DRIVERS\mouhid.sys

\SystemRoot\system32\DRIVERS\snp2uvc.sys

\SystemRoot\system32\DRIVERS\STREAM.SYS

\SystemRoot\system32\DRIVERS\sncduvc.SYS

\SystemRoot\System32\win32k.sys

\SystemRoot\System32\drivers\Dxapi.sys

\SystemRoot\System32\Drivers\crashdmp.sys

\SystemRoot\System32\Drivers\dump_dumpata.sys

\SystemRoot\System32\Drivers\dump_msahci.sys

\SystemRoot\System32\Drivers\dump_dumpfve.sys

\SystemRoot\system32\DRIVERS\monitor.sys

\SystemRoot\System32\TSDDD.dll

\SystemRoot\System32\cdd.dll

\SystemRoot\system32\drivers\luafv.sys

\??\C:\Windows\system32\drivers\kisknl.sys

\??\C:\Windows\system32\drivers\mbam.sys

\SystemRoot\system32\DRIVERS\PDFsFilter.sys

\SystemRoot\system32\DRIVERS\lltdio.sys

\SystemRoot\system32\DRIVERS\nwifi.sys

\SystemRoot\system32\DRIVERS\ndisuio.sys

\SystemRoot\system32\DRIVERS\rspndr.sys

\SystemRoot\system32\DRIVERS\vwifimp.sys

\SystemRoot\system32\drivers\HTTP.sys

\SystemRoot\system32\DRIVERS\bowser.sys

\SystemRoot\System32\drivers\mpsdrv.sys

\SystemRoot\system32\DRIVERS\mrxsmb.sys

\SystemRoot\system32\DRIVERS\mrxsmb10.sys

\SystemRoot\system32\DRIVERS\mrxsmb20.sys

\SystemRoot\system32\drivers\peauth.sys

\SystemRoot\System32\Drivers\secdrv.SYS

\SystemRoot\System32\DRIVERS\srvnet.sys

\SystemRoot\System32\drivers\tcpipreg.sys

\SystemRoot\System32\DRIVERS\srv2.sys

\SystemRoot\System32\DRIVERS\srv.sys

\SystemRoot\System32\drivers\ipnat.sys

\SystemRoot\system32\drivers\WudfPf.sys

\SystemRoot\system32\DRIVERS\WUDFRd.sys

\??\C:\Windows\system32\drivers\ksapi.sys

\SystemRoot\system32\DRIVERS\asyncmac.sys

\??\C:\Program Files\kingsoft\kingsoft antivirus\kusbquery.sys

\??\C:\Windows\system32\drivers\TrueSight.sys

\??\C:\Windows\system32\drivers\mbamchameleon.sys

\??\C:\Windows\system32\drivers\mbamswissarmy.sys

\Windows\System32\ntdll.dll

\Windows\System32\smss.exe

\Windows\System32\apisetschema.dll

----------- End -----------

<<<1>>>

Upper Device Name: \Device\Harddisk1\DR1

Upper Device Object: 0xffffffff86bd6030

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\00000082\

Lower Device Object: 0xffffffff86c14030

Lower Device Driver Name: \Driver\USBSTOR\

Device already Exists: 0xffffffff85cc5290

<<<1>>>

Upper Device Name: \Device\Harddisk0\DR0

Upper Device Object: 0xffffffff8638d030

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\Ide\IdeDeviceP2T0L0-4\

Lower Device Object: 0xffffffff8627d030

Lower Device Driver Name: \Driver\atapi\

Device already Exists: 0xffffffff85c1e9c8

Initializing...

Done!

<<<2>>>

Device number: 0, partition: 1

Physical Sector Size: 512

Drive: 0, DevicePointer: 0xffffffff8638d030, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xffffffff8638c1a0, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xffffffff8638d030, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

DevicePointer: 0xffffffff855e8aa8, DeviceName: Unknown, DriverName: \Driver\ACPI\

DevicePointer: 0xffffffff8627d030, DeviceName: \Device\Ide\IdeDeviceP2T0L0-4\, DriverName: \Driver\atapi\

------------ End ----------

Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

Upper DeviceData: 0xffffffff8af32478, 0xffffffff8638d030, 0xffffffff85fb4048

Lower DeviceData: 0xffffffff97777778, 0xffffffff8627d030, 0xffffffff85c1e9c8

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Scanning directory: C:\Windows\system32\drivers...

<<<2>>>

Device number: 0, partition: 1

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Done!

Drive 0

Scanning MBR on drive 0...

Inspecting partition table:

MBR Signature: 55AA

Disk Signature: FD02FD02

Partition information:

Partition 0 type is Primary (0x7)

Partition is ACTIVE.

Partition starts at LBA: 63 Numsec = 366603237

Partition file system is NTFS

Partition is bootable

Partition 1 type is Primary (0x7)

Partition is NOT ACTIVE.

Partition starts at LBA: 366603300 Numsec = 24113565

Partition 2 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Disk Size: 200049647616 bytes

Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-62-390701968-390721968)...

Physical Sector Size: 0

Drive: 1, DevicePointer: 0xffffffff86bd6030, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xffffffff86bd6968, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xffffffff86bd6030, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\

DevicePointer: 0xffffffff86c14030, DeviceName: \Device\00000082\, DriverName: \Driver\USBSTOR\

------------ End ----------

Done!

Performing system, memory and registry scan...

Done!

Scan finished

=======================================

Malwarebytes Anti-Rootkit BETA 1.05.0.1001

www.malwarebytes.org

Database version: v2013.03.22.01

Windows 7 x86 NTFS

Internet Explorer 9.0.8112.16421

cjb :: CJB-PC [administrator]

5/24/2013 4:57:59 PM

mbar-log-2013-05-24 (16-57-59).txt

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P

Scan options disabled:

Objects scanned: 26833

Time elapsed: 17 minute(s), 47 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 1

HKCU\SOFTWARE\CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} (Hijack.Trojan.Siredef.C) -> Delete on reboot.

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 1

c:\$Recycle.Bin\S-1-5-21-1280333628-3599997341-138837843-1001\$233eeb25beb6b223ef74c3cc12d09ce4 (Trojan.Siredef.C) -> Delete on reboot.

Files Detected: 0

(No malicious items detected)

(end)

Malwarebytes Anti-Rootkit BETA 1.05.0.1001

www.malwarebytes.org

Database version: v2013.03.22.01

Windows 7 x86 NTFS

Internet Explorer 9.0.8112.16421

cjb :: CJB-PC [administrator]

5/24/2013 5:29:43 PM

mbar-log-2013-05-24 (17-29-43).txt

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P

Scan options disabled:

Objects scanned: 26842

Time elapsed: 16 minute(s), 34 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

I am checking functionality now looking good so far, i truly appreciate your help

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Don't worry about Windows Update for now.

Next:

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

Link to post
Share on other sites
jefftx

jefftx

Posted
  • Author
Posted

ComboFix 13-05-24.01 - cjb 05/24/2013 18:25:19.1.2 - x86

Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.3062.1513 [GMT -5:00]

Running from: c:\users\cjb\Desktop\ComboFix.exe

AV: Kingsoft Antivirus System Defense *Disabled/Updated* {B6A51389-A795-5AC9-13BA-F569D73F3FE8}

SP: IObit Malware Fighter *Disabled/Updated* {A751AC20-3B48-5237-898A-78C4436BB78D}

SP: Kingsoft Antivirus System Defense *Disabled/Updated* {0DC4F26D-81AF-5547-290A-CE1BACB87555}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\programdata\Download and Sa

c:\programdata\Download and Sa\509e5d4765d0e.ocx

c:\programdata\Download and Sa\509e5d4765d47.html

c:\programdata\Download and Sa\509e5d4765d7f.js

c:\programdata\Download and Sa\bbidfgbpefccaedhclolmacoiifijbbk.crx

c:\programdata\Download and Sa\data\509e5d4765d7f.js

c:\programdata\Download and Sa\data\jsondb.js

c:\programdata\Download and Sa\settings.ini

c:\users\cjb\AppData\Roaming\mdinc.dll

c:\users\cjb\rgvzyybnxqwnwhlfxugnjqg.exe

c:\windows\system32\Temp

c:\windows\system32\URTTemp

c:\windows\system32\URTTemp\regtlib.exe

.

.

((((((((((((((((((((((((( Files Created from 2013-04-24 to 2013-05-24 )))))))))))))))))))))))))))))))

.

.

2013-05-24 23:08 . 2013-05-24 23:08 -------- d-----w- C:\7509b43c34ba07d9f72f2d10fa08

2013-05-24 22:47 . 2013-05-24 22:47 -------- d-----w- C:\583c598c880622a852

2013-05-24 21:20 . 2013-05-24 21:20 60872 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{30E015FC-2BD1-49F0-8043-0BB31FD7FC89}\offreg.dll

2013-05-24 21:10 . 2013-05-24 21:10 15616 ----a-w- c:\windows\system32\drivers\TrueSight.sys

2013-05-24 08:00 . 2013-05-24 08:00 -------- d-----w- C:\174f3b2bead34a105f6f3266e1361a48

2013-05-23 08:29 . 2012-08-02 16:21 26248 ----a-w- c:\windows\system32\drivers\ElRawDsk.sys

2013-05-23 08:00 . 2013-05-23 08:00 -------- d-----w- C:\900e04d6e6dcfe836b

2013-05-23 04:07 . 2010-09-20 16:36 340480 ---ha-w- C:\Speak Text.exe

2013-05-23 04:07 . 2009-11-04 23:20 83456 ---ha-w- C:\wifv.exe

2013-05-23 04:07 . 2011-02-08 19:58 579576 ----a-w- c:\windows\system32\Codejock.SkinFramework.v15.0.1.ocx

2013-05-23 04:07 . 2010-09-10 21:38 211456 ----a-w- c:\windows\system32\MediaCopeShellM.dll

2013-05-23 04:07 . 2013-05-23 04:07 -------- d-----w- c:\program files\Media Cope

2013-05-23 04:07 . 2010-09-10 21:37 211456 ----a-w- c:\windows\system32\MediaCopeShellS.dll

2013-05-22 08:00 . 2013-05-22 08:01 -------- d-----w- C:\6746e963838c373a8cf822b03ddd3b89

2013-05-22 00:06 . 2013-05-23 08:30 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\CrashDumps

2013-05-22 00:05 . 2013-05-22 00:05 -------- d-----w- C:\105009d7215d76f8fd

2013-05-21 12:17 . 2013-05-13 06:19 7016152 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{30E015FC-2BD1-49F0-8043-0BB31FD7FC89}\mpengine.dll

2013-05-19 04:42 . 2013-04-12 13:58 1210728 ----a-w- c:\windows\system32\drivers\ntfs.sys

2013-05-18 03:39 . 2013-05-18 03:39 50 ----a-w- c:\users\cjb\AppData\Roaming\Update.bat

2013-05-18 03:39 . 2013-05-18 03:39 112 ----a-w- c:\users\cjb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.vbs

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-05-22 05:08 . 2012-10-31 01:27 41616 ----a-w- c:\windows\system32\iolobtdfg.exe

2013-05-22 05:08 . 2012-10-31 01:27 23568 ----a-w- c:\windows\system32\smrgdf.exe

2013-05-22 04:48 . 2012-10-31 01:27 2097472 ----a-w- c:\windows\system32\Incinerator32.dll

2013-05-02 07:06 . 2012-08-30 06:06 238872 ------w- c:\windows\system32\MpSigStub.exe

2013-04-21 23:39 . 2013-04-21 23:39 48640 ----a-w- c:\windows\system32\drivers\KSafeDISK.sys

2013-04-21 23:39 . 2013-04-21 23:39 27648 ----a-w- c:\windows\system32\drivers\BTOWSFF.sys

2013-04-21 23:39 . 2013-04-21 23:39 44928 ----a-w- c:\windows\system32\drivers\BTOWSVF.sys

2013-04-21 20:42 . 2012-08-30 05:49 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2013-04-21 20:42 . 2012-08-30 05:49 691592 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-04-07 03:52 . 2013-04-07 03:52 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll

2013-04-07 03:52 . 2012-09-25 08:54 861088 ----a-w- c:\windows\system32\npDeployJava1.dll

2013-04-07 03:52 . 2012-09-25 08:54 782240 ----a-w- c:\windows\system32\deployJava1.dll

2013-04-04 19:50 . 2012-11-18 10:45 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2013-03-19 05:06 . 2013-04-19 10:38 3958120 ----a-w- c:\windows\system32\ntkrnlpa.exe

2013-03-19 05:06 . 2013-04-19 10:38 3902312 ----a-w- c:\windows\system32\ntoskrnl.exe

2013-03-19 04:54 . 2013-04-19 10:38 38912 ----a-w- c:\windows\system32\csrsrv.dll

2013-03-19 02:50 . 2013-04-19 10:38 69632 ----a-w- c:\windows\system32\smss.exe

2013-03-01 03:11 . 2013-04-19 10:38 2345984 ----a-w- c:\windows\system32\win32k.sys

2013-04-17 08:12 . 2013-04-17 08:11 263064 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files\Yahoo!\Companion\Installs\cpn1\yt.dll" [2012-06-11 1524056]

.

[HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}]

[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin.1]

[HKEY_CLASSES_ROOT\TypeLib\{003028C2-EA1C-4676-A316-B5CB50917002}]

[HKEY_CLASSES_ROOT\yt.YTNavAssistPlugin]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 129272 ----a-w- c:\users\cjb\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 129272 ----a-w- c:\users\cjb\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2012-11-13 23:32 129272 ----a-w- c:\users\cjb\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Spotify Web Helper"="c:\users\cjb\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2013-05-07 1105408]

"CleanGeniusTray"="c:\program files\CleanGenius 3\CleanGeniusTray.exe" [2012-11-05 505768]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"kxesc"="c:\program files\kingsoft\kingsoft antivirus\kxetray.exe" [2012-10-10 1595056]

.

c:\users\cjb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Update.vbs [2013-5-17 112]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"SynchronousMachineGroupPolicy"= 1 (0x1)

"SynchronousUserGroupPolicy"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0iolobtdfg c:\windows\system32\0autocheck turegopt

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\IMFservice]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ioloSystemService]

@="Service"

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Event Reminder.lnk]

backup=c:\windows\pss\Event Reminder.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]

backup=c:\windows\pss\Kodak EasyShare software.lnk.CommonStartup

backupExtension=.CommonStartup

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ApnUpdater

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WebcamMaxAutoRun

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2012-12-03 07:35 946352 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2012-12-19 14:39 41208 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcSoft Connection Service]

2010-10-28 00:17 207424 ----a-w- c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CleanGeniusTray]

2012-11-05 15:50 505768 ----a-w- c:\program files\CleanGenius 3\CleanGeniusTray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]

2012-05-25 10:25 6595928 ----a-w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify]

2013-05-07 04:38 4573184 ----a-w- c:\users\cjb\AppData\Roaming\Spotify\spotify.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify Web Helper]

2013-05-07 04:38 1105408 ----a-w- c:\users\cjb\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"Spotify Web Helper"="c:\users\cjb\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"QlbCtrl.exe"=c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start

"Persistence"=c:\windows\system32\igfxpers.exe

"HotKeysCmds"=c:\windows\system32\hkcmd.exe

"IgfxTray"=c:\windows\system32\igfxtray.exe

.

R2 WCMVCAM;WebcamMax, WDM Video Capture;c:\windows\system32\DRIVERS\wcmvcam.sys [x]

R3 cpuz136;cpuz136;c:\windows\TEMP\cpuz136\cpuz136_x32.sys [x]

R3 dc3d;MS Hardware Device Detection Driver;c:\windows\system32\DRIVERS\dc3d.sys [x]

R3 FileMonitor;FileMonitor;c:\program files\IObit\IObit Malware Fighter\Drivers\win7_x86\FileMonitor.sys [x]

R3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [x]

R3 ioloSystemService;iolo System Service;c:\program files\iolo\Common\Lib\ioloServiceManager.exe [x]

R3 netr28u;RT2870 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr28u.sys [x]

R3 RegFilter;RegFilter;c:\program files\IObit\IObit Malware Fighter\drivers\win7_x86\regfilter.sys [x]

R3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM);c:\windows\system32\DRIVERS\sscebus.sys [x]

R3 sscemdfl;SAMSUNG Mobile Modem V2 Filter;c:\windows\system32\DRIVERS\sscemdfl.sys [x]

R3 sscemdm;SAMSUNG Mobile Modem V2 Drivers;c:\windows\system32\DRIVERS\sscemdm.sys [x]

R3 SynasUSB;SynasUSB;c:\windows\system32\drivers\SynasUSB.sys [x]

R3 UrlFilter;UrlFilter;c:\program files\IObit\IObit Malware Fighter\drivers\win7_x86\UrlFilter.sys [x]

R3 VASDeviceDrm;Virtual Audio Streaming with Drm (WDM);c:\windows\system32\drivers\vasdDev.sys [x]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]

R3 WsAudioDevice_383;WsAudioDevice_383;c:\windows\system32\drivers\WsAudioDevice_383.sys [x]

R4 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [x]

R4 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [x]

R4 IMFservice;IMF Service;c:\program files\IObit\IObit Malware Fighter\IMFsrv.exe [x]

R4 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]

S0 BTOWSVF;BTOWSVF;c:\windows\system32\Drivers\BTOWSVF.sys [x]

S0 kavbootc;kavbootc;c:\windows\system32\drivers\kavbootc.sys [x]

S0 KSafeDISK;KSafeDISK;c:\windows\system32\Drivers\KSafeDISK.sys [x]

S1 BTOWSFF;BTOWSFF;c:\windows\system32\Drivers\BTOWSFF.sys [x]

S1 ElRawDisk;ElRawDisk;c:\windows\system32\drivers\ElRawDsk.sys [x]

S1 KDHacker;KDHacker;c:\program files\kingsoft\kingsoft antivirus\security\kxescan\kdhacker.sys [x]

S2 kisknl;kisknl;c:\windows\system32\drivers\kisknl.sys [x]

S2 kxescore;Kingsoft Core Service;c:\program files\kingsoft\kingsoft antivirus\kxescore.exe [x]

S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x]

S2 PDFsFilter;PDFsFilter;c:\windows\system32\DRIVERS\PDFsFilter.sys [x]

S2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files\RealNetworks\RealDownloader\rndlresolversvc.exe [x]

S3 ksapi;ksapi;c:\windows\system32\drivers\ksapi.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [x]

S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [x]

S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [x]

S3 voxaldriver;Voxal Filter Driver 2.10.00;c:\windows\system32\DRIVERS\voxaldriverx86.sys [x]

S4 KUsbGuard;KUsbGuard;c:\program files\kingsoft\kingsoft antivirus\kusbquery.sys [x]

.

.

Contents of the 'Scheduled Tasks' folder

.

2013-04-21 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-30 20:42]

.

2013-02-26 c:\windows\Tasks\Wise Care 365.job

- c:\program files\Wise\Wise Care 365\WiseTray.exe [2012-09-03 00:49]

.

.

------- Supplementary Scan -------

.

uStart Page = www.yahoo.com

mStart Page = www.yahoo.com

IE: Speak Text - c:\program files\Media Cope\Extensions\Speak Text\7.html

IE: Upload to Facebook

IE: View Full Screen - Best Fit - c:\program files\Media Cope\Extensions\wifv\0.html

IE: View Full Screen - Cut Fit Bottom Right - c:\program files\Media Cope\Extensions\wifv\2.html

IE: View Full Screen - Cut Fit Equal - c:\program files\Media Cope\Extensions\wifv\3.html

IE: View Full Screen - Cut Fit Top Left - c:\program files\Media Cope\Extensions\wifv\1.html

IE: View Full Screen - Stretch Fit - c:\program files\Media Cope\Extensions\wifv\4.html

TCP: DhcpNameServer = 207.243.120.10 207.243.120.20 192.168.1.1

FF - ProfilePath - c:\users\cjb\AppData\Roaming\Mozilla\Firefox\Profiles\pf3w9cnm.default-1353658392495\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3284024&SearchSource=3&q={searchTerms}&CUI=UN35193696604262309

FF - prefs.js: browser.search.selectedEngine - VisualBee V.1 Customized Web Search

FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT3284024&SearchSource=13&CUI=UN35193696604262309

FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3284024&SearchSource=2&CUI=UN35193696604262309&UM=UM_ID&q=

FF - user.js: network.http.pipelining.maxrequests - 8

FF - user.js: network.http.request.max-start-delay - 0

FF - user.js: network.http.max-connections - 48

FF - user.js: network.http.max-connections-per-server - 16

FF - user.js: network.http.max-persistent-connections-per-proxy - 16

FF - user.js: network.http.max-persistent-connections-per-server - 8

FF - user.js: browser.turbo.enabled - true

FF - user.js: browser.display.show_image_placeholders - true

FF - user.js: browser.chrome.favicons - false

FF - user.js: browser.urlbar.autocomplete.enabled - true

FF - user.js: browser.cache.memory.capacity - 65536

FF - user.js: content.notify.ontimer - true

FF - user.js: content.interrupt.parsing - true

FF - user.js: content.max.tokenizing.time - 2250000

FF - user.js: content.switch.threshold - 750000

FF - user.js: plugin.expose_full_path - true

FF - user.js: ui.submenuDelay - 0

.

- - - - ORPHANS REMOVED - - - -

.

HKU-Default-RunOnce-FlashPlayerUpdate - c:\windows\system32\Macromed\Flash\FlashUtil32_11_3_300_271_ActiveX.exe

SafeBoot-Wdf01000.sys

MSConfigStartUp-ICQ - c:\program files\ICQ7.5\ICQ.exe

AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe

AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe

AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe

AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe

AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe

AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe

AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe

AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe

AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe

AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe

AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe

AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe

AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe

AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe

AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe

AddRemove-21_Searsburg - c:\program files\Samsung\USB Drivers\21_Searsburg\Uninstall.exe

AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe

.

.

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]

@Denied: (2) (LocalSystem)

"{EF99BD32-C1FB-11D2-892F-0090271D4F88}"=hex:51,66,7a,6c,4c,1d,38,12,5c,be,8a,

eb,c9,8f,bc,54,f6,39,43,d0,22,43,0b,9c

"{0BDA0769-FD72-49F4-9266-E1FB004F4D8F}"=hex:51,66,7a,6c,4c,1d,38,12,07,04,c9,

0f,40,b3,9a,0c,ed,70,a2,bb,05,11,09,9b

"{0055C089-8582-441B-A0BF-17B458C2A3A8}"=hex:51,66,7a,6c,4c,1d,38,12,e7,c3,46,

04,b0,cb,75,01,df,a9,54,f4,5d,9c,e7,bc

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]

@Denied: (2) (LocalSystem)

"Timestamp"=hex:b0,4d,78,00,67,d0,cd,01

.

[HKEY_USERS\S-1-5-21-1280333628-3599997341-138837843-1001_Classes\CLSID\{5992bcb3-e29b-42ec-99ce-d895f358dffe}]

@Denied: (Full) (Everyone)

@Allowed: (Read) (RestrictedCode)

"Model"=dword:00000163

"Therad"=dword:00000022

"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,

38,95,44,75,07,18,dd,fb,11,42,94,27,b7,99,0d,2a,ba,05,1a,a2,02,c9,3e,9b,f9,\

.

[HKEY_USERS\S-1-5-21-1280333628-3599997341-138837843-1001_Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]

@Denied: (Full) (Everyone)

@Allowed: (Read) (RestrictedCode)

"scansk"=hex(0):2a,8f,a1,54,7f,43,40,52,49,1f,8b,5b,ff,9c,7d,75,60,79,94,1d,e3,

ec,c4,47,a6,52,31,ae,5f,35,7f,79,27,3a,3b,40,28,31,6b,3b,00,00,00,00,00,00,\

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_169_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_169_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*]

@="?????????????????? v1"

.

[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*1*\CLSID]

@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"

.

[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*]

@="?????????????????? v2"

.

[HKEY_LOCAL_MACHINE\software\Classes\VideoLAN.VLCPlugin.*2*\CLSID]

@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'Explorer.exe'(8188)

c:\program files\kingsoft\kingsoft antivirus\kwsui.dll

c:\program files\kingsoft\kingsoft antivirus\kswebshield.dll

c:\users\cjb\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll

c:\program files\kingsoft\kingsoft antivirus\ktaskbar.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\taskhost.exe

c:\windows\System32\rundll32.exe

c:\windows\System32\WUDFHost.exe

c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe

c:\windows\system32\conhost.exe

c:\windows\system32\conhost.exe

c:\windows\system32\javaw.exe

c:\windows\system32\sppsvc.exe

.

**************************************************************************

.

Completion time: 2013-05-24 18:45:11 - machine was rebooted

ComboFix-quarantined-files.txt 2013-05-24 23:45

.

Pre-Run: 78,351,626,240 bytes free

Post-Run: 79,465,877,504 bytes free

.

- - End Of File - - 53B0AA9250212DBB6DAEE332E8022C57

i just recvd a note from this hacker threatening me if i remove the virus

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

i just recvd a note from this hacker threatening me if i remove the virus

By e-mail??

---------------------

Do you know what this file is for: Update.vbs

It's in your Startup Folder:

c:\users\cjb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.vbs

StartupFolder: c:\users\cjb\appdata\roaming\microsoft\windows\start menu\programs\startup\Update.vbs

--------------------------------------------------

Please download AdwCleaner from here and save it on your Desktop.

AdwCleaner is a reliable removal tool for Adware, Foistware, toolbars and potentially unwanted programs.

AdwCleaner is a tool that deletes :

· Adwares (software ads)

· PUP/LPI (Potentially Undesirable Program)

· Toolbars

· Hijacker (Hijack of the browser's homepage)

It works with a Search and Deletion method. It can be easily uninstalled using the "Uninstall" mode.

  1. Right-click on adwcleaner.exe and select Run As Administrator (for XP just double click) to launch the application.
  2. Now click on the Search tab.
  3. Please post the contents of the log-file created in your next post.

Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.

Note:

Please look over what was found......especially any folders, we're going to permanently delete it all in the next step....if there's something you may want to keep...please let me know and I'll explain to why it shouldn't be on your system.

If you see AVG Secure Search being targeted for deletion, Here's Why and Here. You can always Reinstall it.

Please note that Antivir Webguard uses ASK Toolbar as part of its web security. If you remove ASK by using Adwcleaner, Antivir Webguard will no longer work properly. Therefore, if you use this program please use the instructions below to access the options screen where you should enable /DisableAskDetections before using AdwCleaner.

You can click on the question mark (?) in the upper left corner of the program and then click on Options. You will then be presented with a dialog where you can disable various detections. These options are described below:

/DisableAskDetection - This option disables Ask Toolbar detection.

MrC

Link to post
Share on other sites
jefftx

jefftx

Posted
  • Author
Posted

AdwCleaner v2.301 - Logfile created 05/24/2013 at 19:13:46

# Updated 16/05/2013 by Xplode

# Operating system : Windows 7 Professional (32 bits)

# User : cjb - CJB-PC

# Boot Mode : Normal

# Running from : C:\Users\cjb\Desktop\adwcleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

File Deleted : C:\END

File Deleted : C:\Users\cjb\AppData\Roaming\Mozilla\Firefox\Profiles\pf3w9cnm.default-1353658392495\searchplugins\Conduit.xml

File Deleted : C:\Users\cjb\AppData\Roaming\Mozilla\Firefox\Profiles\pf3w9cnm.default-1353658392495\searchplugins\icqplugin.xml

File Deleted : C:\Users\cjb\AppData\Roaming\Mozilla\Firefox\Profiles\pf3w9cnm.default-1353658392495\searchplugins\icqplugin-1.xml

File Deleted : C:\Users\cjb\AppData\Roaming\Mozilla\Firefox\Profiles\pf3w9cnm.default-1353658392495\searchplugins\icqplugin-2.xml

Folder Deleted : C:\Program Files\Common Files\Speedbit

Folder Deleted : C:\Program Files\Conduit

Folder Deleted : C:\Program Files\SearchPredict

Folder Deleted : C:\ProgramData\APN

Folder Deleted : C:\ProgramData\ICQ\ICQToolbar

Folder Deleted : C:\ProgramData\InstallMate

Folder Deleted : C:\ProgramData\Premium

Folder Deleted : C:\ProgramData\SoftSafe

Folder Deleted : C:\ProgramData\Speedbit

Folder Deleted : C:\ProgramData\visualbee

Folder Deleted : C:\Users\cjb\AppData\Local\Conduit

Folder Deleted : C:\Users\cjb\AppData\Local\Ilivid Player

Folder Deleted : C:\Users\cjb\AppData\Local\visualbeeexe

Folder Deleted : C:\Users\cjb\AppData\LocalLow\Conduit

Folder Deleted : C:\Users\cjb\AppData\LocalLow\Download and Sa

Folder Deleted : C:\Users\cjb\AppData\LocalLow\Toolbar4

Folder Deleted : C:\Users\cjb\AppData\Roaming\Mozilla\Firefox\Profiles\pf3w9cnm.default-1353658392495\CT3284024

Folder Deleted : C:\Users\cjb\AppData\Roaming\Mozilla\Firefox\Profiles\pf3w9cnm.default-1353658392495\extensions\{7aeae561-714b-45f6-ace3-4a8aed6e227b}

Folder Deleted : C:\Users\cjb\AppData\Roaming\Mozilla\Firefox\Profiles\pf3w9cnm.default-1353658392495\Smartbar

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\Conduit

Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes

Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider

Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong

Key Deleted : HKCU\Software\AppDataLow\Software\Smart Suggestor

Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar

Key Deleted : HKCU\Software\Conduit

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{603C4CC9-5DC6-4C44-873F-8281509DF953}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{7F4EFF06-7032-458E-AE16-1C1D8255C28A}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKCU\Software\Softonic

Key Deleted : HKLM\Software\APN

Key Deleted : HKLM\Software\AskToolbar

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4CE516A7-F7AC-4628-B411-8F886DC5733E}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{628F3201-34D0-49C0-BB9A-82A26AEFB291}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\TbCommonUtils.DLL

Key Deleted : HKLM\SOFTWARE\Classes\AppID\TbHelper.EXE

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKLM\Software\Conduit

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{603C4CC9-5DC6-4C44-873F-8281509DF953}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\FunmoodsSetup_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\FunmoodsSetup_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CFE535C35F99574E8340BFA75BF92C2

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\120DFADEB50841F408F04D2A278F9509

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2BDF3E992C0908741B7C11F4B4E0F775

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6B3BC4CF5ECE1F54BBA174C13A1AB907

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B5BAE2ED018083A4C8DA86D6E3F4B024

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BEABAA33A5E68374DBF197F2A00CD011

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CB61AF52AD64B6B45930BE969F316720

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E

Key Deleted : HKLM\Software\SpeedBit

Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]

Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{855F3B16-6D32-4FE6-8A56-BBB695989046}]

Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [searchpredict@speedbit.com]

***** [internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16476

Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - ICQ Search] = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd --> hxxp://www.google.com

-\\ Mozilla Firefox v20.0.1 (en-US)

File : C:\Users\cjb\AppData\Roaming\Mozilla\Firefox\Profiles\pf3w9cnm.default-1353658392495\prefs.js

C:\Users\cjb\AppData\Roaming\Mozilla\Firefox\Profiles\pf3w9cnm.default-1353658392495\user.js ... Deleted !

Deleted : user_pref("CT3284024.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");

Deleted : user_pref("CT3284024.FF19Solved", "true");

Deleted : user_pref("CT3284024.FirstTime", "true");

Deleted : user_pref("CT3284024.FirstTimeFF3", "true");

Deleted : user_pref("CT3284024.LoginRevertSettingsEnabled", true);

Deleted : user_pref("CT3284024.RevertSettingsEnabled", true);

Deleted : user_pref("CT3284024.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT328[...]

Deleted : user_pref("CT3284024.UserID", "UN35193696604262309");

Deleted : user_pref("CT3284024.addressBarTakeOverEnabledInHidden", "true");

Deleted : user_pref("CT3284024.autoDisableScopes", 0);

Deleted : user_pref("CT3284024.browser.search.defaultthis.engineName", "true");

Deleted : user_pref("CT3284024.defaultSearch", "true");

Deleted : user_pref("CT3284024.enableAlerts", "always");

Deleted : user_pref("CT3284024.enableFix404ByUser", "FALSE");

Deleted : user_pref("CT3284024.enableSearchFromAddressBar", "true");

Deleted : user_pref("CT3284024.firstTimeDialogOpened", "true");

Deleted : user_pref("CT3284024.fixPageNotFoundError", "true");

Deleted : user_pref("CT3284024.fixPageNotFoundErrorByUser", "true");

Deleted : user_pref("CT3284024.fixPageNotFoundErrorInHidden", "true");

Deleted : user_pref("CT3284024.fixUrls", true);

Deleted : user_pref("CT3284024.installDate", "12/2/2013 7:01:01");

Deleted : user_pref("CT3284024.installId", "120122");

Deleted : user_pref("CT3284024.installType", "conduitnsisintegration");

Deleted : user_pref("CT3284024.isCheckedStartAsHidden", true);

Deleted : user_pref("CT3284024.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");

Deleted : user_pref("CT3284024.isFirstTimeToolbarLoading", "false");

Deleted : user_pref("CT3284024.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");

Deleted : user_pref("CT3284024.keyword", "true");

Deleted : user_pref("CT3284024.lastNewTabSettings", "{\"isEnabled\":true,\"newTabUrl\":\"hxxp://search.conduit[...]

Deleted : user_pref("CT3284024.lastVersion", "10.14.42.7");

Deleted : user_pref("CT3284024.mam_gk_installer_preapproved.enc", "ZmFsc2U=");

Deleted : user_pref("CT3284024.migrateAppsAndComponents", true);

Deleted : user_pref("CT3284024.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"hxxp%[...]

Deleted : user_pref("CT3284024.newSettings", "{\"dataType\":\"boolean\",\"data\":\"true\"}");

Deleted : user_pref("CT3284024.openThankYouPage", "false");

Deleted : user_pref("CT3284024.openUninstallPage", "true");

Deleted : user_pref("CT3284024.revertSettingsEnabled", "false");

Deleted : user_pref("CT3284024.searchInNewTabEnabledByUser", "true");

Deleted : user_pref("CT3284024.searchInNewTabEnabledInHidden", "true");

Deleted : user_pref("CT3284024.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");

Deleted : user_pref("CT3284024.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[...]

Deleted : user_pref("CT3284024.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\[...]

Deleted : user_pref("CT3284024.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[...]

Deleted : user_pref("CT3284024.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[...]

Deleted : user_pref("CT3284024.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[...]

Deleted : user_pref("CT3284024.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[...]

Deleted : user_pref("CT3284024.serviceLayer_services_login_10.14.42.7_lastUpdate", "1369110542608");

Deleted : user_pref("CT3284024.serviceLayer_services_serviceMap_lastUpdate", "1369110542223");

Deleted : user_pref("CT3284024.serviceLayer_services_toolbarSettings_lastUpdate", "1369110543562");

Deleted : user_pref("CT3284024.serviceLayer_services_translation_lastUpdate", "1369110542486");

Deleted : user_pref("CT3284024.settingsINI", true);

Deleted : user_pref("CT3284024.shouldFirstTimeDialog", "false");

Deleted : user_pref("CT3284024.smartbar.CTID", "CT3284024");

Deleted : user_pref("CT3284024.smartbar.Uninstall", "0");

Deleted : user_pref("CT3284024.smartbar.homepage", "true");

Deleted : user_pref("CT3284024.smartbar.toolbarName", "VisualBee V.1 ");

Deleted : user_pref("CT3284024.startPage", "true");

Deleted : user_pref("CT3284024.toolbarBornServerTime", "17-3-2013");

Deleted : user_pref("CT3284024.toolbarCurrentServerTime", "21-5-2013");

Deleted : user_pref("CT3284024_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\"[...]

Deleted : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3284024&SearchSource=1[...]

Deleted : user_pref("Smartbar.ConduitSearchEngineList", "VisualBee V.1 Customized Web Search");

Deleted : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3284024[...]

Deleted : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "hxxp://search.icq.com/search/afe_results.php?ch_[...]

Deleted : user_pref("Smartbar.keywordURLSelectedCTID", "CT3284024");

Deleted : user_pref("browser.search.defaultthis.engineName", "VisualBee V.1 Customized Web Search");

Deleted : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3284024&Sea[...]

Deleted : user_pref("browser.search.selectedEngine", "VisualBee V.1 Customized Web Search");

Deleted : user_pref("browser.startup.homepage", "hxxp://search.conduit.com/?ctid=CT3284024&SearchSource=13&CUI[...]

Deleted : user_pref("extensions.SmartSuggestor.aid", "20049");

Deleted : user_pref("extensions.SmartSuggestor.ppi", true);

Deleted : user_pref("extensions.SmartSuggestor.uid", "a9ac95ce5b21f6be317ac0c4f93d4beb");

Deleted : user_pref("icqtoolbar.allowSendURL", false);

Deleted : user_pref("icqtoolbar.engineVerified", false);

Deleted : user_pref("icqtoolbar.geolastmodified", 1359628637);

Deleted : user_pref("icqtoolbar.hiddenElements", "itb_options");

Deleted : user_pref("icqtoolbar.icqgeo", 1);

Deleted : user_pref("icqtoolbar.installTime", "1359628637");

Deleted : user_pref("icqtoolbar.installsource", "1");

Deleted : user_pref("icqtoolbar.newtab_state", "1");

Deleted : user_pref("icqtoolbar.numberOfSearches", 0);

Deleted : user_pref("icqtoolbar.previousFFVersion", "17.0.1");

Deleted : user_pref("icqtoolbar.skip_default_search", "no");

Deleted : user_pref("icqtoolbar.uniqueID", "135771786813577166331358233168744");

Deleted : user_pref("icqtoolbar.usageStatstTimestamp", 1359628641);

Deleted : user_pref("icqtoolbar.version", "1.4.7");

Deleted : user_pref("icqtoolbar.voucherHideClicks", 0);

Deleted : user_pref("icqtoolbar.voucherMoreLinkClicks", 0);

Deleted : user_pref("icqtoolbar.voucherRedeemClicks", 0);

Deleted : user_pref("icqtoolbar.voucherWasShown", 0);

Deleted : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3284024&SearchSource=2&CU[...]

Deleted : user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?ctid=CT3284024&SearchSource=13[...]

Deleted : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT[...]

Deleted : user_pref("smartbar.machineId", "KDST/BXTNSEFU1MLZ1L3BKKA70KW1PBF7EZKQXSJ71H2029GAGVIURNR8ST987KIFHK[...]

Deleted : user_pref("smartbar.originalHomepage", "hxxp://www.yahoo.com/?ilc=8");

Deleted : user_pref("smartbar.originalSearchAddressUrl", "hxxp://search.icq.com/search/afe_results.php?ch_id=a[...]

Deleted : user_pref("smartbar.originalSearchEngine", "ICQ Search");

-\\ Google Chrome v [unable to get version]

File : C:\Users\cjb\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [16737 octets] - [24/05/2013 19:11:53]

AdwCleaner[s1].txt - [16876 octets] - [24/05/2013 19:13:46]

########## EOF - C:\AdwCleaner[s1].txt - [16937 octets] ##########

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

You have to answer my questions.

you said:

i just recvd a note from this hacker threatening me if i remove the virus

Did you get this by e-mail??

---------------------

Do you know what this file is for?? Update.vbs

It's in your Startup Folder:

c:\users\cjb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.vbs

StartupFolder: c:\users\cjb\appdata\roaming\microsoft\windows\start menu\programs\startup\Update.vbs

MrC

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

3rd time I'm asking this..........

Do you know what this file is for?? Update.vbs

It's in your Startup Folder:

c:\users\cjb\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.vbs

StartupFolder: c:\users\cjb\appdata\roaming\microsoft\windows\start menu\programs\startup\Update.vbs

MrC

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

OK.......

Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select Show in Results List and Check for removal.

Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.

Make sure that everything is checked, and click Remove Selected.

Please let me know how computer is running now, MrC

Link to post
Share on other sites
Maurice Naggar

Maurice Naggar

Posted
Posted

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.

  I accept