Help for complete novice!..."Trojan:Win32/Sirefef"

Kentpumas1980 · May 29, 2013

Hi All...

...if someone could help a complete IT novice, it would be much appreciated.

Recently tried logging on to Facebook only to see a message which says "Account blocked for sending SPAM, please enter your details to confirm your identity". This included credit card details so seemed all kinds of dodgy to me. I can still log into Facebook on other devices to, such as my work PC and tablet. Ran a check on the laptop (a HP Mini) and it discovered the virus Trojan:Win32/Sirefef. Despite clicking "remove" it doesn't go anywhere and keeps being found when I check again.

A quick Google search later and I'm reading all kinds of bad news about Trojan:Win32/Sirefef. Found some guidance but most of it baffled me to be honest. Can anyone walk me through how to remove it or am I better of taking the laptop to an expert?

Thanks in advance folks!

gringo_pr · May 30, 2013

Hello Kentpumas1980

I would like to welcome you to the Malware Removal section of the forum.

Around here they call me Gringo and I will be glad to help you with your malware problems.

Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!

Please do not run any tools unless instructed to do so.
- We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
[*]Please do not attach logs or use code boxes, just copy and paste the text.
- Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
[*]Please read every post completely before doing anything.
- Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
[*]Please provide feedback about your experience as we go.
- A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

I need to get some reports to get a base to start from so I need you to run these programs first.

-Download DDS-

Please download DDS from one of the links below and save it to your desktop:

Download DDS and save it to your desktop

Link1
Link2
Link3

Double-Click on dds.scr and a command window will appear. This is normal.
Shortly after two logs will appear:
- DDS.txt
- Attach.txt
[*]A window will open instructing you save & post the logs
[*]Save the logs to a convenient place such as your desktop
[*]Copy the contents of both logs & post in your next reply

Gringo

Kentpumas1980 · May 30, 2013

Hi Gringo...many thanks for the reply, very much appreciated!

In work today so I'll get on to this as soon as I can (hopefully this evening)

gringo_pr · May 30, 2013

Not a problem and I will be here

Gringo

Kentpumas1980 · May 30, 2013

Hi Gringo...have the two logs...will post them in next two replies

Kentpumas1980 · May 30, 2013

DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 8.0.7600.16930

Run by Marie at 18:53:55 on 2013-05-30

.

============== Running Processes ================

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_5576240ee6baaa25\STacSV.exe

C:\Windows\system32\WLANExt.exe

C:\Windows\system32\conhost.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_5576240ee6baaa25\aestsrv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

C:\SPLASH.SYS\config\DVMExportService.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files\IDT\WDM\sttray.exe

C:\Program Files\Hewlett-Packard\HP QuickSync\QuickSync.exe

C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe

C:\Program Files\Hp\HP Software Update\hpwuschd2.exe

C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Hewlett-Packard\HP CloudDrive\zumodrive.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

C:\Program Files\Hewlett-Packard\HP QuickSync\jre\bin\javaw.exe

C:\Users\Marie\AppData\Local\svcxdcl32.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe

C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Hewlett-Packard\Shared\hpqToaster.exe

C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe

C:\Windows\system32\Macromed\Flash\FlashUtil32_11_7_700_202_ActiveX.exe

C:\Windows\system32\msfeedssync.exe

C:\Program Files\Internet Explorer\IELowutil.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\wuauclt.exe

C:\Windows\SoftwareDistribution\Download\Install\WU-IE9-Windows7-x86.exe

C:\Windows\TEMP\IE98027.tmp\IE9-support\ienrcore.exe

C:\Windows\system32\dism.exe

C:\Windows\system32\conhost.exe

C:\Windows\TEMP\8605465D-B35D-423B-B6EB-01D425E44A94\dismhost.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\wermgr.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\system32\svchost.exe -k bthsvcs

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\System32\svchost.exe -k secsvcs

C:\Windows\System32\svchost.exe -k swprv

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.co.uk/

uURLSearchHooks: BitTorrentBar Toolbar: {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - c:\program files\bittorrentbar\prxtbBitT.dll

mURLSearchHooks: BitTorrentBar Toolbar: {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - c:\program files\bittorrentbar\prxtbBitT.dll

BHO: MSS+ Identifier: {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - c:\program files\mcafee security scan\3.0.318\McAfeeMSS_IE.dll

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Symantec NCO BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -

BHO: Symantec Intrusion Prevention: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -

BHO: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll

BHO: BitTorrentBar Toolbar: {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - c:\program files\bittorrentbar\prxtbBitT.dll

BHO: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\5.7.8313.1002\swg.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll

TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -

TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

TB: BitTorrentBar Toolbar: {88C7F2AA-F93F-432C-8F0E-B7D85967A527} - c:\program files\bittorrentbar\prxtbBitT.dll

TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -

TB: BitTorrentBar Toolbar: {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - c:\program files\bittorrentbar\prxtbBitT.dll

TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

uRun: [Google Update] "c:\users\marie\appdata\local\google\update\GoogleUpdate.exe" /c

uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [svc2dll] c:\users\marie\appdata\local\svcxdcl32.exe

uRun: [Feihbyhosy] c:\users\marie\appdata\roaming\avtio\uropa.exe

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe

mRun: [iAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe

mRun: [sysTrayApp] c:\program files\idt\wdm\sttray.exe

mRun: [HP] c:\program files\hewlett-packard\hp quicksync\QuickSync.exe

mRun: [QlbCtrl.exe] c:\program files\hewlett-packard\hp quick launch buttons\QlbCtrl.exe /Start

mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe

mRun: [WirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe

mRun: [ZumoDrive] "c:\program files\hewlett-packard\hp clouddrive\ZumoLauncher.lnk"

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: E&xport to Microsoft Excel - c:\progra~1\mif5ba~1\office12\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html

IE: Send image to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm

IE: Send page to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie.htm

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm

DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} - hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx

DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: NameServer = 192.168.0.1

TCP: Interfaces\{753AD84E-8580-4C1A-B437-A547A59BB80C} : DHCPNameServer = 192.168.0.1

TCP: Interfaces\{753AD84E-8580-4C1A-B437-A547A59BB80C}\2456C6B696E6F5033454134324 : DHCPNameServer = 192.168.2.1

TCP: Interfaces\{753AD84E-8580-4C1A-B437-A547A59BB80C}\35B4958353239363 : DHCPNameServer = 192.168.0.1

TCP: Interfaces\{753AD84E-8580-4C1A-B437-A547A59BB80C}\4224C45554C494748445351342 : DHCPNameServer = 192.168.1.1

TCP: Interfaces\{753AD84E-8580-4C1A-B437-A547A59BB80C}\6796277696E6022627F616462616E646 : DHCPNameServer = 192.168.1.1

TCP: Interfaces\{753AD84E-8580-4C1A-B437-A547A59BB80C}\F42716E67656F5022343633302355636572756 : DHCPNameServer = 192.168.1.1

Notify: igfxcui - igfxdev.dll

SSODL: WebCheck - <orphaned>

.

============= SERVICES / DRIVERS ===============

.

R? b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0

R? clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86

R? McComponentHostService;McAfee Security Scan Component Host Service

R? netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit

R? NIS;Norton Internet Security

R? RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader

R? RTL8167;Realtek 8167 NT Driver

R? SrvHsfHDA;SrvHsfHDA

R? SrvHsfV92;SrvHsfV92

R? SrvHsfWinac;SrvHsfWinac

R? yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller

S? AESTFilters;Andrea ST Filters Service

S? BHDrvx86;BHDrvx86

S? btwl2cap;Bluetooth L2CAP Service

S? ccHP;Symantec Hash Provider

S? Com4QLBEx;Com4QLBEx

S? DVMIO;DVMIO

S? DvmMDES;DeviceVM Meta Data Export Service

S? EraserUtilRebootDrv;EraserUtilRebootDrv

S? IDSVix86;IDSVix86

S? SymDS;Symantec Data Store

S? SymEFA;Symantec Extended File Attributes

S? SymIRON;Symantec Iron Driver

S? SYMTDIv;Symantec Vista Network Dispatch Driver

.

=============== Created Last 30 ================

.

2013-05-30 07:19:28 -------- d-sh--w- C:\found.000

2013-05-29 21:32:27 60872 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{af7e2325-7453-4f2e-9257-c759789e5b8a}\offreg.dll

2013-05-28 17:06:14 7016152 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{af7e2325-7453-4f2e-9257-c759789e5b8a}\mpengine.dll

2013-05-26 09:31:01 -------- d-----w- c:\users\marie\appdata\roaming\Mylosa

2013-05-26 09:31:01 -------- d-----w- c:\users\marie\appdata\roaming\Loegih

2013-05-26 09:31:01 -------- d-----w- c:\users\marie\appdata\roaming\Avtio

2013-05-03 17:04:01 123904 ----a-w- c:\users\marie\appdata\local\svcxdcl32.exe

2013-05-03 17:03:42 123904 ----a-w- c:\users\marie\3652319.exe

.

==================== Find3M ====================

.

2013-05-16 19:49:49 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2013-05-16 19:49:49 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-05-02 01:06:08 238872 ------w- c:\windows\system32\MpSigStub.exe

2013-04-12 13:58:11 1210728 ----a-w- c:\windows\system32\drivers\ntfs.sys

2013-03-19 05:06:09 3958120 ----a-w- c:\windows\system32\ntkrnlpa.exe

2013-03-19 05:06:09 3902312 ----a-w- c:\windows\system32\ntoskrnl.exe

2013-03-19 04:54:22 38912 ----a-w- c:\windows\system32\csrsrv.dll

2013-03-19 02:50:03 69632 ----a-w- c:\windows\system32\smss.exe

.

=================== ROOTKIT ====================

.

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net

Windows 6.1.7600 Disk: ST925041 rev.0006 -> Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0

.

device: opened successfully

user: MBR read successfully

.

Disk trace:

called modules: >>UNKNOWN [0x81C08000]<< >>UNKNOWN [0x86C1D000]<< >>UNKNOWN [0x87998000]<< >>UNKNOWN [0x86ACE000]<< >>UNKNOWN [0x82018000]<< >>UNKNOWN [0x86E0E000]<<

_asm { DEC EBP; POP EDX; NOP ; ADD [EBX], AL; ADD [EAX], AL; ADD [EAX+EAX], AL; ADD [EAX], AL; }

1 ntkrnlpa!IofCallDriver[0x81C43718] -> \Device\Harddisk0\DR0[0x85470448]

\Driver\Disk[0x84A41C20] -> IRP_MJ_CREATE -> 0x86C2139F

3 [0x86C2159E] -> ntkrnlpa!IofCallDriver[0x81C43718] -> [0x84A44958]

\Driver\ACPI[0x83D0A7C0] -> IRP_MJ_CREATE -> 0x86AD74AA

5 [0x86AD73B2] -> ntkrnlpa!IofCallDriver[0x81C43718] -> \Device\Ide\IAAStorageDevice-0[0x849FE028]

\Driver\iaStor[0x84A27708] -> IRP_MJ_CREATE -> 0x86E5292E

kernel: MBR read successfully

_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; MOV ES, AX; MOV DS, AX; MOV SI, SP; MOV DI, 0x600; MOV CX, 0x200; CLD ; REP MOVSB ; JMP FAR 0x0:0x660; }

user & kernel MBR OK

copy of MBR has been found in sector 2 !

Warning: possible TDL3 rootkit infection !

.

============= FINISH: 19:04:12.75 ===============

Kentpumas1980 · May 30, 2013

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Starter

Boot Device: \Device\HarddiskVolume1

Install Date: 26/04/2010 12:55:20

System Uptime: 30/05/2013 18:43:24 (1 hours ago)

.

Motherboard: Hewlett-Packard | | 3660

Processor: Intel® Atom CPU N450 @ 1.66GHz | CPU | 1332/667mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 221 GiB total, 174.987 GiB free.

D: is FIXED (NTFS) - 11 GiB total, 1.92 GiB free.

E: is FIXED (FAT32) - 0 GiB total, 0.09 GiB free.

.

==== Disabled Device Manager Items =============

.

==== Installed Programs ======================

.

Update for Microsoft Office 2007 (KB2508958)

Acrobat.com

ActiveCheck component for HP Active Support Library

Adobe AIR

Adobe Flash Player 11 ActiveX

Adobe Reader 9.2 MUI

Adobe Shockwave Player

Apple Application Support

Apple Mobile Device Support

Apple Software Update

ArcSoft WebCam Companion 3

AVS Update Manager 1.0

AVS Video Converter 6

BitTorrent

BitTorrentBar Toolbar

Broadcom 802.11 Wireless LAN Adapter

Compatibility Pack for the 2007 Office system

ESU for Microsoft Windows 7

Free RAR Extract Frog

Google Chrome

Google Toolbar for Internet Explorer

Google Update Helper

HP CloudDrive

HP Customer Experience Enhancements

HP Games

HP Integrated Module with Bluetooth wireless technology

HP Quick Launch Buttons

HP QuickSync

HP QuickWeb

HP Setup

HP Support Assistant

HP Update

HP User Guides 0169

HP Wireless Assistant

HPAsset component for HP Active Support Library

IDT Audio

Intel® Graphics Media Accelerator Driver

Intel® Matrix Storage Manager

iTunes

Java 6 Update 15

JNLP

Junk Mail filter update

McAfee Security Scan Plus

Microsoft .NET Framework 4 Client Profile

Microsoft Application Error Reporting

Microsoft Choice Guard

Microsoft Office 2007 Service Pack 3 (SP3)

Microsoft Office Excel MUI (English) 2007

Microsoft Office Home and Student 2007

Microsoft Office OneNote MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office PowerPoint Viewer 2007 (English)

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Suite Activation Assistant

Microsoft Office Word MUI (English) 2007

Microsoft Search Enhancement Pack

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Works

MSVCRT

Norton Internet Security

QLBCASL

QuickTime

Realtek Ethernet Controller Driver For Windows Vista and Later

Realtek USB 2.0 Card Reader

Recovery Manager

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)

Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687499) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2760416) 32-Bit Edition

Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition

Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition

Security Update for Microsoft Office Word 2007 (KB2760421) 32-Bit Edition

Synaptics Pointing Device Driver

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

Update for Microsoft Office 2007 Help for Common Features (KB963673)

Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition

Update for Microsoft Office Excel 2007 Help (KB963678)

Update for Microsoft Office OneNote 2007 Help (KB963670)

Update for Microsoft Office Powerpoint 2007 Help (KB963669)

Update for Microsoft Office Script Editor Help (KB963671)

Update for Microsoft Office Word 2007 Help (KB963665)

Windows Driver Package - Broadcom Bluetooth (06/15/2009 6.2.0.9000)

Windows Driver Package - Broadcom Bluetooth (07/30/2009 6.2.0.9405)

Windows Driver Package - Broadcom HIDClass (07/28/2009 6.2.0.9800)

Windows Live Communications Platform

Windows Live Essentials

Windows Live Mail

Windows Live Photo Gallery

Windows Live Sign-in Assistant

Windows Live Sync

Windows Live Upload Tool

Windows Live Writer

WinPcap 4.1.2

.

==== End Of File ===========================

gringo_pr · May 31, 2013

Hello Kentpumas1980

These are the programs I would like you to run next, if you have any problems with one of these just skip it and move on to the next one.

-AdwCleaner-

Please download AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Delete.
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next answer.
You can find the logfile at C:\AdwCleaner[s1].txt as well.

-Junkware-Removal-Tool-

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

When they are complete let me have the two reports and let me know how things are running.

Gringo

Kentpumas1980 · May 31, 2013

Thanks....will get these done over the weekend :-D

gringo_pr · May 31, 2013

no problem and see you then

gringo

Kentpumas1980 · May 31, 2013

Hi Gringo....spurred by post pub beers, I thought I'd make a start....AdwCleaner Report first...

Kentpumas1980 · May 31, 2013

# AdwCleaner v2.301 - Logfile created 05/31/2013 at 22:04:24

# Updated 16/05/2013 by Xplode

# Operating system : Windows 7 Starter (32 bits)

# User : Marie - MARIE-PC

# Boot Mode : Normal

# Running from : C:\Users\Marie\Desktop\AdwCleaner.exe

# Option [Delete]

***** [services] *****

Stopped & Deleted : DvmMDES

***** [Files / Folders] *****

File Deleted : C:\user.js

File Deleted : C:\Users\Marie\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.conduit.com_0.localstorage

File Deleted : C:\Users\Marie\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.conduit.com_0.localstorage-journal

Folder Deleted : C:\Program Files\BitTorrentBar

Folder Deleted : C:\Program Files\Conduit

Folder Deleted : C:\ProgramData\InstallMate

Folder Deleted : C:\ProgramData\Premium

Folder Deleted : C:\ProgramData\wxDfast

Folder Deleted : C:\Users\Kerry\AppData\LocalLow\BitTorrentBar

Folder Deleted : C:\Users\Kerry\AppData\LocalLow\Conduit

Folder Deleted : C:\Users\Kerry\AppData\LocalLow\PriceGong

Folder Deleted : C:\Users\Marie\AppData\Local\Conduit

Folder Deleted : C:\Users\Marie\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhfdcmehmjcclgopdodkjdicohagipid

Folder Deleted : C:\Users\Marie\AppData\LocalLow\BitTorrentBar

Folder Deleted : C:\Users\Marie\AppData\LocalLow\Conduit

Folder Deleted : C:\Users\Marie\AppData\LocalLow\incredibar.com

Folder Deleted : C:\Users\Marie\AppData\LocalLow\PriceGong

Folder Deleted : C:\Users\Marie\AppData\LocalLow\wxDfast

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\BitTorrentBar

Key Deleted : HKCU\Software\AppDataLow\Software\Conduit

Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong

Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar

Key Deleted : HKCU\Software\AppDataLow\Toolbar

Key Deleted : HKCU\Software\BitTorrentBar

Key Deleted : HKCU\Software\IM

Key Deleted : HKCU\Software\ImInstaller

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{258C9770-1713-4021-8D7E-1F184A2BD754}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{336D0C35-8A85-403A-B9D2-65C292C39087}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{88C7F2AA-F93F-432C-8F0E-B7D85967A527}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F9639E4A-801B-4843-AEE3-03D9DA199E77}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{32804100-B238-45F4-B15E-C5A2F2F7400B}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{336D0C35-8A85-403A-B9D2-65C292C39087}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{88C7F2AA-F93F-432C-8F0E-B7D85967A527}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BDEA95CF-F0E6-41E0-BD3D-B00F39A4E939}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9639E4A-801B-4843-AEE3-03D9DA199E77}

Key Deleted : HKLM\Software\BitTorrentBar

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{32804100-B238-45F4-B15E-C5A2F2F7400B}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{88C7F2AA-F93F-432C-8F0E-B7D85967A527}

Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2790392

Key Deleted : HKLM\Software\Conduit

Key Deleted : HKLM\Software\DeviceVM

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\mhfdcmehmjcclgopdodkjdicohagipid

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3499221D-C2A8-4DCE-9E0C-E49E05371598}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A078F691-9C07-4AF2-BF43-35E79EECF8B7}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E4099B3E-8F87-42C2-9199-3C2AEF643D51}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\incredibar_install_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\incredibar_install_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{88C7F2AA-F93F-432C-8F0E-B7D85967A527}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{32804100-B238-45F4-B15E-C5A2F2F7400B}

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\063A857434EDED11A893800002C0A966

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BitTorrentBar Toolbar

Key Deleted : HKLM\Software\Web Assistant

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{88C7F2AA-F93F-432C-8F0E-B7D85967A527}]

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{88C7F2AA-F93F-432C-8F0E-B7D85967A527}]

Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{88C7F2AA-F93F-432C-8F0E-B7D85967A527}]

Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{88C7F2AA-F93F-432C-8F0E-B7D85967A527}]

Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\extensions [{336D0C35-8A85-403a-B9D2-65C292C39087}]

***** [internet Browsers] *****

-\\ Internet Explorer v8.0.7600.16930

[OK] Registry is clean.

-\\ Google Chrome v27.0.1453.94

File : C:\Users\Marie\AppData\Local\Google\Chrome\User Data\Default\Preferences

Deleted [l.8] : homepage = "hxxp://mystart.incredibar.com/mb139?a=6PQDgkoipm&i=26",

Deleted [l.12] : urls_to_restore_on_startup = [ "hxxp://mystart.incredibar.com/mb139?a=6PQDgkoipm&i=26" ]

Deleted [l.37] : icon_url = "hxxp://mystart.incredibar.com/mb139/favicon.ico",

Deleted [l.40] : keyword = "mystart.incredibar.com/mb139",

Deleted [l.43] : search_url = "hxxp://mystart.incredibar.com/mb139/?loc=IB_DS&search={searchTerms}&a=6PQDgkoip[...]

Deleted [l.1537] : homepage = "hxxp://mystart.incredibar.com/mb139?a=6PQDgkoipm&i=26",

Deleted [l.1819] : urls_to_restore_on_startup = [ "hxxp://mystart.incredibar.com/mb139?a=6PQDgkoipm&i=26" ]

*************************

AdwCleaner[s1].txt - [299 octets] - [31/05/2013 22:03:30]

AdwCleaner[s2].txt - [6912 octets] - [31/05/2013 22:04:24]

########## EOF - C:\AdwCleaner[s2].txt - [6972 octets] ##########

Kentpumas1980 · May 31, 2013

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 4.9.4 (05.06.2013:1)

OS: Windows 7 Starter x86

Ran by Marie on 31/05/2013 at 22:25:52.27

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] "HKEY_CURRENT_USER\Software\Microsoft\internet explorer\internetregistry\registry\user\S-1-5-21-331010734-319307521-2344063168-1000\software\web assistant"

~~~ Files

~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\optimizerpro"

Successfully deleted: [Empty Folder] C:\Users\Marie\appdata\local\{fcf8e3fa-4cc2-e4f4-4cac-a291aefc1eb0}

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 31/05/2013 at 22:32:00.23

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Kentpumas1980 · May 31, 2013

And to update the System and Security review via the Control Panel doesn't appear to be picking up on Trojan:Win32 anymore, though it says Windows Defender is not switched on.

Also, Facebook is still not letting me logging on and is bringing up the "Your account is blocked...enter your card details" screen.

gringo_pr · June 1, 2013

Hello Kentpumas1980

I Would like you to do the following.

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.

Link 1
Link 2
Link 3

1. Close any open browsers or any other programs that are open.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following
Log from Combofix
let me know of any problems you may have had
How is the computer doing now?

Gringo

Kentpumas1980 · June 1, 2013

Slight problem...I have Norton Internet Security and it won't open up to allow me to turn it off (not sure if this is because of the virus). My McAfee Security Scan Plus doesn't open either. I'll try running Combofix anyway...

Kentpumas1980 · June 1, 2013

ComboFix 13-06-01.01 - Marie 01/06/2013 17:49:38.1.2 - x86

Microsoft Windows 7 Starter 6.1.7600.0.1252.44.1033.18.987.271 [GMT 1:00]

Running from: c:\users\Marie\Desktop\ComboFix.exe

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\$recycle.bin\S-1-5-21-331010734-319307521-2344063168-1000\$fcf8e3fa4cc2e4f44caca291aefc1eb0\@

c:\$recycle.bin\S-1-5-21-331010734-319307521-2344063168-1000\$fcf8e3fa4cc2e4f44caca291aefc1eb0\n

c:\$recycle.bin\S-1-5-21-331010734-319307521-2344063168-1000\$fcf8e3fa4cc2e4f44caca291aefc1eb0\U\00000001.@

c:\$recycle.bin\S-1-5-21-331010734-319307521-2344063168-1000\$fcf8e3fa4cc2e4f44caca291aefc1eb0\U\80000000.@

c:\$recycle.bin\S-1-5-21-331010734-319307521-2344063168-1000\$fcf8e3fa4cc2e4f44caca291aefc1eb0\U\800000cb.@

c:\users\Marie\3652319.exe

c:\users\Marie\Appdata\local\svcxdcl32.exe

c:\users\Marie\AppData\Local\Temp\libsqlitejdbc-2534903792670468471.lib

c:\users\Marie\AppData\Local\Temp\swt-gdip-win32-3448.dll

c:\users\Marie\AppData\Local\Temp\swt-win32-3448.dll

c:\users\Marie\AppData\Local\Temp\WindowsAPI.dll

c:\users\Marie\AppData\Roaming\Avtio

c:\users\Marie\AppData\Roaming\Avtio\uropa.exe

c:\users\Marie\AppData\Roaming\Loegih

c:\users\Marie\AppData\Roaming\Loegih\ofrix.rui

c:\windows\WindowsUpdate.log

.

((((((((((((((((((((((((( Files Created from 2013-05-01 to 2013-06-01 )))))))))))))))))))))))))))))))

.

2013-06-01 17:16 . 2013-06-01 17:16 -------- d-----w- c:\users\Kerry\AppData\Local\temp

2013-06-01 17:16 . 2013-06-01 17:16 -------- d-----w- c:\users\Default\AppData\Local\temp

2013-06-01 17:16 . 2013-06-01 17:16 -------- d-----w- c:\users\ADMINI~1\AppData\Local\temp

2013-06-01 16:33 . 2013-06-01 16:33 60872 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{73E76BE3-DBD5-4053-9140-38EE3BEDC292}\offreg.dll

2013-05-31 21:25 . 2013-05-31 21:25 -------- d-----w- c:\windows\ERUNT

2013-05-31 21:25 . 2013-05-31 21:25 -------- d-----w- C:\JRT

2013-05-31 20:44 . 2012-06-02 04:51 134000 ----a-w- c:\windows\system32\drivers\ksecpkg.sys

2013-05-31 20:44 . 2012-06-02 04:50 369336 ----a-w- c:\windows\system32\drivers\cng.sys

2013-05-31 20:44 . 2012-06-02 04:51 67440 ----a-w- c:\windows\system32\drivers\ksecdd.sys

2013-05-31 20:44 . 2012-06-02 04:48 225280 ----a-w- c:\windows\system32\schannel.dll

2013-05-31 20:44 . 2012-02-15 05:44 826368 ----a-w- c:\windows\system32\rdpcore.dll

2013-05-31 20:44 . 2012-02-15 04:22 24064 ----a-w- c:\windows\system32\drivers\tdtcp.sys

2013-05-30 18:08 . 2012-11-09 04:49 2048 ----a-w- c:\windows\system32\tzres.dll

2013-05-30 07:19 . 2013-05-30 07:19 -------- d-----w- C:\found.000

2013-05-26 09:31 . 2013-06-01 16:08 -------- d-----w- c:\users\Marie\AppData\Roaming\Mylosa

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-05-16 19:49 . 2012-04-24 17:52 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2013-05-16 19:49 . 2012-04-24 17:52 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2013-05-02 01:06 . 2010-06-26 18:44 238872 ------w- c:\windows\system32\MpSigStub.exe

2013-04-12 13:58 . 2013-04-24 22:00 1210728 ----a-w- c:\windows\system32\drivers\ntfs.sys

2013-03-19 05:06 . 2013-04-10 17:24 3958120 ----a-w- c:\windows\system32\ntkrnlpa.exe

2013-03-19 05:06 . 2013-04-10 17:24 3902312 ----a-w- c:\windows\system32\ntoskrnl.exe

2013-03-19 04:54 . 2013-04-10 17:24 38912 ----a-w- c:\windows\system32\csrsrv.dll

2013-03-19 02:50 . 2013-04-10 17:24 69632 ----a-w- c:\windows\system32\smss.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00Zecter]

@="{D25B32FE-CB96-491A-98FF-AD59DA382D69}"

[HKEY_CLASSES_ROOT\CLSID\{D25B32FE-CB96-491A-98FF-AD59DA382D69}]

2009-10-29 01:18 661504 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\01Zecter]

@="{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}"

[HKEY_CLASSES_ROOT\CLSID\{EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5}]

2009-10-29 01:18 661504 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\02Zecter]

@="{B3C78E40-6B64-47C3-AE34-60B770881EB8}"

[HKEY_CLASSES_ROOT\CLSID\{B3C78E40-6B64-47C3-AE34-60B770881EB8}]

2009-10-29 01:18 661504 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\03Zecter]

@="{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}"

[HKEY_CLASSES_ROOT\CLSID\{622AFE52-33F6-4D9F-9966-E0BC52D7D69D}]

2009-10-29 01:18 661504 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\04Zecter]

@="{855156F0-2A0F-11DE-8C30-0800200C9A66}"

[HKEY_CLASSES_ROOT\CLSID\{855156F0-2A0F-11DE-8C30-0800200C9A66}]

2009-10-29 01:18 661504 ----a-w- c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-07-25 39408]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-10-16 141848]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-10-16 173592]

"Persistence"="c:\windows\system32\igfxpers.exe" [2009-10-16 150552]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-11-03 1594664]

"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]

"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-10-12 495708]

"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2009-08-20 322104]

"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]

"WirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2009-09-01 499768]

"ZumoDrive"="c:\program files\Hewlett-Packard\HP CloudDrive\ZumoLauncher.lnk" [2010-04-26 2038]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]

.

c:\users\Marie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-9-4 795936]

McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.318\SSScheduler.exe [2013-2-5 272248]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

R2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\17.9.0.12\ccSvcHst.exe [x]

R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [x]

R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.0.318\McCHSvc.exe [x]

R3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [x]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]

R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x]

R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [x]

R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [x]

R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [x]

R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [x]

S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1109000.00C\SYMDS.SYS [x]

S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1109000.00C\SYMEFA.SYS [x]

S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20100619.001\BHDrvx86.sys [x]

S1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1109000.00C\ccHPx86.sys [x]

S1 DVMIO;DVMIO;c:\splash.sys\config\dvmio.sys [x]

S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100622.001\IDSvix86.sys [x]

S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1109000.00C\Ironx86.SYS [x]

S1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\System32\Drivers\NIS\1109000.00C\SYMTDIV.SYS [x]

S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_5576240ee6baaa25\aestsrv.exe [x]

S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [x]

S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]

S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [x]

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - WS2IFSL

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc

.

Contents of the 'Scheduled Tasks' folder

.

2013-06-01 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-24 19:49]

.

2013-06-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-25 21:54]

.

2013-06-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-25 21:54]

.

2013-05-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-331010734-319307521-2344063168-1000Core.job

- c:\users\Marie\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-18 21:46]

.

2013-06-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-331010734-319307521-2344063168-1000UA.job

- c:\users\Marie\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-18 21:46]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.co.uk/

IE: E&xport to Microsoft Excel - c:\progra~1\MIF5BA~1\Office12\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html

IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

TCP: DhcpNameServer = 192.168.0.1

.

- - - - ORPHANS REMOVED - - - -

.

HKCU-Run-Svc2dll - c:\users\Marie\AppData\Local\svcxdcl32.exe

HKCU-Run-Feihbyhosy - c:\users\Marie\AppData\Roaming\Avtio\uropa.exe

SafeBoot-Wdf01000.sys

AddRemove-NIS - c:\program files\NortonInstaller\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS\A5E82D02\17.8.0.5\InstStub.exe

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS]

"ImagePath"="\"c:\program files\Norton Internet Security\Engine\17.9.0.12\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\17.9.0.12\diMaster.dll\" /prefetch:1"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'Explorer.exe'(2744)

c:\program files\Hewlett-Packard\HP CloudDrive\ShellExt.dll

c:\program files\WIDCOMM\Bluetooth Software\btncopy.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_5576240ee6baaa25\STacSV.exe

c:\windows\system32\WLANExt.exe

c:\windows\system32\conhost.exe

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\WIDCOMM\Bluetooth Software\btwdins.exe

c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

c:\windows\system32\taskhost.exe

c:\windows\system32\conhost.exe

c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe

c:\program files\Windows Media Player\wmpnetwk.exe

.

**************************************************************************

.

Completion time: 2013-06-01 18:36:29 - machine was rebooted

ComboFix-quarantined-files.txt 2013-06-01 17:36

.

Pre-Run: 188,286,586,880 bytes free

Post-Run: 190,261,055,488 bytes free

.

- - End Of File - - 41ECE5A8C4B7C504895A52DFCA713824

Kentpumas1980 · June 1, 2013

Possible result here! :-)

Tried logging on to Facebook and success, it logged me in without asking for ID and card details. Norton Internet Security wouldn't open though...it said "Unable to open this Norton product. Please restart your computer". Did that but no joy.

McAfee opened though when it didn't before.

Kentpumas1980 · June 1, 2013

....did a review of the laptops status, and the only "important" entry under "Security" said that no antivirus software found on the computer...do you recommend any?

gringo_pr · June 2, 2013

Hello Kentpumas1980

At this time I would like you to run this script for me and it is a good time to check out the computer to see if there is anything else that needs to be addressed.

:Run CFScript:

Please start by opening Notepad and copy/paste the text in the box into the window:

ClearJavaCache::

Save it to your desktop as CFScript.txt

Referring to the picture above, drag CFScript.txt into ComboFix.exe

This will let ComboFix run again.

Restart if you have to.

Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following

report from Combofix
let me know of any problems you may have had
How is the computer doing now after running the script?

Gringo

Kentpumas1980 · June 2, 2013

Thanks Gringo...next report follows:

Kentpumas1980 · June 2, 2013

ComboFix 13-06-01.01 - Marie 02/06/2013 12:07:52.2.2 - x86

Microsoft Windows 7 Starter 6.1.7600.0.1252.44.1033.18.987.249 [GMT 1:00]

Running from: c:\users\Marie\Desktop\ComboFix.exe

Command switches used :: c:\users\Marie\Desktop\CFScript.txt

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\users\Marie\AppData\Local\Temp\libsqlitejdbc-5816161741674188895.lib

c:\users\Marie\AppData\Local\Temp\swt-gdip-win32-3448.dll

c:\users\Marie\AppData\Local\Temp\swt-win32-3448.dll

c:\users\Marie\AppData\Local\Temp\WindowsAPI.dll

.

((((((((((((((((((((((((( Files Created from 2013-05-02 to 2013-06-02 )))))))))))))))))))))))))))))))

.

2013-06-02 11:31 . 2013-06-02 11:31 -------- d-----w- c:\users\Kerry\AppData\Local\temp

2013-06-02 11:31 . 2013-06-02 11:31 -------- d-----w- c:\users\Default\AppData\Local\temp

2013-06-02 11:31 . 2013-06-02 11:31 -------- d-----w- c:\users\ADMINI~1\AppData\Local\temp