FBI moneypak virus

jahmik · June 16, 2013

Well.. apparently im just the latest in a string of fbi related viruses.. earlier today my nephew was browsing the internet (probably looking at the same thing all 14 year old boys look at while on the web) and downloaded a virus to my pc.. he claimed it happened when he opened a file he downloaded called HDVideo.

I went through all the normal things (trying to run in safe mode and trying to restore it using system repair) the virus stops both, so after a bit of googling i stumbled upon this gym of a website. Many users have been successful in removing this virus between the use of Fabar Recovery Scan Tool. However, each user is directed by some shinning knight to input a unique command prompt thing.. since id like to -not- fry my computer.. i would deeply appreciate if anyone would be kind enough to help me.

Also, i have already ran the scan and saved the log if that helps at all and can post it at request.

Thanks in advance,

Jahmik

D-FRED-BROWN · June 16, 2013

Hello jahmik and welcome to Malwarebytes!

Please post the scan log if you have it ready, and we'll take it from there.

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Note:

Please make sure you are subscribed to this topic: Click on the "Follow This Topic" Button (at the top right of this page), make sure that the "Receive notification" box is checked and that it is set to "Instantly"

-------> Your topic will be closed if you haven't replied within 3 days! <--------

(If I don't respond within 24 hours, please send me a PM)

-DFB

jahmik · June 16, 2013

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-06-2013

Ran by SYSTEM on 16-06-2013 14:22:12

Running from H:\

Windows 7 Home Premium (X64) OS Language: English(US)

Internet Explorer Version 9

Boot Mode: Recovery

The current controlset is ControlSet001

ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [synTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2837288 2011-10-13] (Synaptics Incorporated)

HKLM\...\Run: [setDefault] C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [44880 2011-12-19] (Hewlett-Packard Development Company, L.P.)

HKLM\...\Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [444904 2012-09-20] (Adobe Systems Incorporated)

HKLM\...\Run: [sysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe [1425408 2012-09-14] (IDT, Inc.)

HKLM\...\RunOnce: [*Restore] C:\Windows\system32\rstrui.exe /RUNONCE [296960 2010-11-20] (Microsoft Corporation)

HKLM-x32\...\Run: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [630912 2012-01-26] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [946352 2012-12-02] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [HPOSD] C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [HP CoolSense] C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe -byrunkey [1343904 2012-11-05] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [AdobeCS6ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin [1075296 2013-04-24] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2904984 2011-09-05] (Adobe Systems Inc.)

HKLM-x32\...\Run: [PrivitizeVPN] C:\Program Files (x86)\PrivitizeVPN\PrivitizeVPN.exe /autorun [196784 2012-09-10] (OOO Industry)

HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-11-28] (Apple Inc.)

HKLM-x32\...\Run: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY [4408368 2013-04-28] (AVG Technologies CZ, s.r.o.)

HKLM-x32\...\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [252848 2012-07-03] (Sun Microsystems, Inc.)

HKLM-x32\...\Run: [] [x]

HKU\jahmik\...\Run: [Google Update] "C:\Users\jahmik\AppData\Local\Google\Update\GoogleUpdate.exe" /c [116648 2012-08-23] (Google Inc.)

HKU\jahmik\...\Run: [ApplePhotoStreams] C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59280 2012-09-10] (Apple Inc.)

HKU\jahmik\...\Run: [MusicManager] "C:\Users\jahmik\AppData\Local\Programs\Google\MusicManager\MusicManager.exe" [7331840 2013-04-23] (Google Inc.)

Startup: C:\Users\jahmik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk

ShortcutTarget: MagicDisc.lnk -> C:\Program Files (x86)\MagicDisc\MagicDisc.exe (MagicISO, Inc.)

Startup: C:\Users\jahmik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Deskjet 1050 J410 series.lnk

ShortcutTarget: Monitor Ink Alerts - HP Deskjet 1050 J410 series.lnk -> C:\Program Files\HP\HP Deskjet 1050 J410 series\bin\HPStatusBL.dll (Hewlett-Packard Co.)

Startup: C:\Users\jahmik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk

ShortcutTarget: Rainmeter.lnk -> C:\Program Files\Rainmeter\Rainmeter.exe ()

==================== Services (Whitelisted) =================

S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-01-26] (Advanced Micro Devices, Inc.)

S2 avgfws; C:\Program Files (x86)\AVG\AVG2013\avgfws.exe [1428472 2013-04-10] (AVG Technologies CZ, s.r.o.)

S2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [4937264 2013-05-13] (AVG Technologies CZ, s.r.o.)

S2 avgwd; C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [283136 2013-04-18] (AVG Technologies CZ, s.r.o.)

S3 Disc Soft Bus Service; C:\Program Files (x86)\DAEMON Tools Ultra\DiscSoftBusService.exe [580672 2013-03-06] (Disc Soft Ltd)

S2 FPLService; C:\Program Files (x86)\HP SimplePass\TrueSuiteService.exe [1641768 2013-02-07] (HP)

S2 HPAuto; C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe [682040 2011-02-16] (Hewlett-Packard)

S3 TrueService; C:\Program Files\Common Files\AuthenTec\TrueService.exe [401856 2013-01-07] (AuthenTec, Inc.)

S2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe [2148216 2012-08-23] (AVG)

S2 valWBFPolicyService; C:\Windows\system32\valWBFPolicyService.exe [28160 2012-09-05] ()

S2 Browser Manager; C:\ProgramData\Browser Manager\2.6.1123.78\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe [x]

==================== Drivers (Whitelisted) ====================

S0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [31360 2012-01-18] (Advanced Micro Devices, Inc.)

S2 AODDriver4.1; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [55936 2011-11-13] (Advanced Micro Devices)

S2 APXACC; C:\Windows\System32\DRIVERS\appexDrv.sys [189760 2012-02-05] (AppEx Networks Corporation)

S1 Avgfwfd; C:\Windows\System32\DRIVERS\avgfwd6a.sys [50296 2012-09-04] (AVG Technologies CZ, s.r.o.)

S1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [246072 2013-03-28] (AVG Technologies CZ, s.r.o.)

S0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [71480 2013-02-08] (AVG Technologies CZ, s.r.o.)

S1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [206136 2013-02-08] (AVG Technologies CZ, s.r.o.)

S0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [311096 2013-02-08] (AVG Technologies CZ, s.r.o.)

S0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [116536 2013-02-08] (AVG Technologies CZ, s.r.o.)

S0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [45880 2013-02-08] (AVG Technologies CZ, s.r.o.)

S1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [240952 2013-03-20] (AVG Technologies CZ, s.r.o.)

S3 dtscsibus; C:\Windows\System32\DRIVERS\dtscsibus.sys [29696 2013-03-24] (Disc Soft Ltd)

S3 RSP2STOR; C:\Windows\System32\DRIVERS\RtsP2Stor.sys [266896 2012-10-26] (Realtek Semiconductor Corp.)

S3 SmbDrv; C:\Windows\system32\drivers\Smb_driver.sys [20016 2011-10-13] (Synaptics Incorporated)

S3 TuneUpUtilitiesDrv; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver64.sys [11880 2012-07-04] (TuneUp Software)

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-06-16 14:21 - 2013-06-16 14:21 - 00000000 ____D C:\FRST

2013-06-16 06:20 - 2013-06-16 06:20 - 00072501 ____A C:\Users\jahmik\Downloads\video_hd (2).zip

2013-06-16 06:20 - 2013-06-16 06:20 - 00072501 ____A C:\Users\jahmik\Downloads\video_hd (1).zip

2013-06-16 06:19 - 2013-06-16 12:08 - 00000000 ____D C:\Users\jahmik\Downloads\video_hd

2013-06-16 06:18 - 2013-06-16 06:18 - 00072501 ____A C:\Users\jahmik\Downloads\video_hd.zip

2013-06-15 19:59 - 2013-06-15 19:59 - 01185739 ____A C:\Users\jahmik\Downloads\0601309.mov

2013-06-15 10:25 - 2013-06-15 10:25 - 00042289 ____A C:\Users\jahmik\Downloads\[kickass.to]supernatural.season.6.complete.hdtv.xvid.mp3 (1).torrent

2013-06-14 16:42 - 2013-06-14 16:42 - 00014672 ____A C:\Users\jahmik\Downloads\[kickass.to]kopps.2003.dvdrip.swe.multi.sub.vex.torrent

2013-06-14 11:43 - 2013-06-14 11:43 - 00042289 ____A C:\Users\jahmik\Downloads\[kickass.to]supernatural.season.6.complete.hdtv.xvid.mp3.torrent

2013-06-14 11:42 - 2013-06-14 11:42 - 00022253 ____A C:\Users\jahmik\Downloads\[kickass.to]supernatural.season.7.complete.s07e01.s07e23.torrent

2013-06-14 11:40 - 2013-06-14 11:40 - 00243152 ____A C:\Users\jahmik\Downloads\[kickass.to]supernatural.season.5.complete.x264.mkv.by.riddlera.torrent

2013-06-13 19:47 - 2013-06-13 19:47 - 00011183 ____A C:\Users\jahmik\Downloads\[kickass.to]an.evening.with.kevin.smith.2002.dvdrip.xvid.retro.torrent

2013-06-13 16:20 - 2013-06-13 16:20 - 00017028 ____A C:\Users\jahmik\Downloads\[kickass.to]the.a.team.extended.2010.720p.brrip.x264.800mb.yify.torrent

2013-06-13 14:06 - 2013-06-13 14:06 - 00038664 ____A C:\Users\jahmik\Downloads\[kickass.to]da.vincis.demons.s01e08.web.dl.xvid.fum.ettv.torrent

2013-06-11 23:15 - 2013-06-11 23:15 - 06653248 ____A C:\Users\jahmik\Downloads\SCUDownloader.exe

2013-06-11 23:15 - 2013-06-11 23:15 - 00074703 ____A C:\Windows\SysWOW64\mfc45.dat

2013-06-11 23:15 - 2013-06-11 23:15 - 00001179 ____A C:\Users\jahmik\Desktop\System Checkup.lnk

2013-06-11 23:15 - 2013-06-11 23:15 - 00000000 ____D C:\ProgramData\iolo

2013-06-11 23:15 - 2013-06-11 23:15 - 00000000 ____D C:\ProgramData\Application Data\iolo

2013-06-11 23:15 - 2013-06-11 23:15 - 00000000 ____D C:\Program Files (x86)\iolo

2013-06-06 12:21 - 2013-06-06 12:21 - 00000000 ____D C:\Users\jahmik\AppData\Roaming\Mozilla

2013-06-03 15:47 - 2013-06-03 15:47 - 00748816 ____A (Reimage®) C:\Users\jahmik\Downloads\eFixPro.exe

2013-05-22 16:16 - 2013-05-22 16:16 - 00207160 ____A C:\Users\jahmik\Downloads\Gym_Class_Heroes_Stereo_Hearts_feat_Adam_Levine_[2011_Single][MJN].exe

2013-05-18 18:55 - 2013-05-18 18:55 - 00000000 ___RD C:\Program Files (x86)\Skype

2013-05-18 00:27 - 2013-04-04 22:52 - 02242048 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll

2013-05-18 00:27 - 2013-04-04 22:52 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll

2013-05-18 00:27 - 2013-04-04 22:52 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe

2013-05-18 00:27 - 2013-04-04 22:50 - 19231232 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2013-05-18 00:27 - 2013-04-04 22:50 - 15404032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll

2013-05-18 00:27 - 2013-04-04 22:50 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll

2013-05-18 00:27 - 2013-04-04 22:50 - 02647552 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll

2013-05-18 00:27 - 2013-04-04 22:50 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll

2013-05-18 00:27 - 2013-04-04 22:50 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll

2013-05-18 00:27 - 2013-04-04 22:50 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll

2013-05-18 00:27 - 2013-04-04 22:50 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll

2013-05-18 00:27 - 2013-04-04 22:50 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll

2013-05-18 00:27 - 2013-04-04 22:50 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll

2013-05-18 00:27 - 2013-04-04 22:50 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll

2013-05-18 00:27 - 2013-04-04 21:28 - 01767424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-05-18 00:27 - 2013-04-04 21:28 - 01130496 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-05-18 00:27 - 2013-04-04 21:26 - 14323712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-05-18 00:27 - 2013-04-04 21:26 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-05-18 00:27 - 2013-04-04 21:26 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-05-18 00:27 - 2013-04-04 21:26 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-05-18 00:27 - 2013-04-04 21:26 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-05-18 00:27 - 2013-04-04 21:26 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-05-18 00:27 - 2013-04-04 21:26 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-05-18 00:27 - 2013-04-04 21:26 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-05-18 00:27 - 2013-04-04 21:26 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-05-18 00:27 - 2013-04-04 21:26 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-05-18 00:27 - 2013-04-04 21:26 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-05-18 00:27 - 2013-04-04 20:43 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb

2013-05-18 00:27 - 2013-04-04 20:29 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-05-18 00:27 - 2013-04-04 19:51 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe

2013-05-18 00:27 - 2013-04-04 19:38 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

==================== One Month Modified Files and Folders =======

2013-06-16 14:21 - 2013-06-16 14:21 - 00000000 ____D C:\FRST

2013-06-16 12:34 - 2012-12-27 10:00 - 00000000 ____D C:\ProgramData\MFAData

2013-06-16 12:34 - 2012-12-27 10:00 - 00000000 ____D C:\ProgramData\Application Data\MFAData

2013-06-16 12:34 - 2012-08-24 09:01 - 00000000 ____D C:\Users\jahmik\AppData\Roaming\vlc

2013-06-16 12:34 - 2012-08-23 11:42 - 00000000 ____D C:\Users\jahmik\AppData\Roaming\uTorrent

2013-06-16 12:34 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache

2013-06-16 12:34 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\AppCompat

2013-06-16 12:34 - 2009-07-13 19:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared

2013-06-16 12:33 - 2012-03-09 18:08 - 00000000 ____D C:\Windows\SysWOW64\Macromed

2013-06-16 12:33 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\registration

2013-06-16 12:32 - 2012-08-23 13:45 - 00000000 ____D C:\Users\jahmik\AppData\Local\Adobe

2013-06-16 12:08 - 2013-06-16 06:19 - 00000000 ____D C:\Users\jahmik\Downloads\video_hd

2013-06-16 10:17 - 2012-08-23 11:12 - 00000000 ____D C:\users\jahmik

2013-06-16 10:17 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT

2013-06-16 10:17 - 2009-07-13 20:51 - 00085462 ____A C:\Windows\setupact.log