Remnants from Ransom Removal

jimthom · July 4, 2013

I was infected with the Ransom Trojan. I had Malwarebytes Pro running at the time but I still got infected. I ran Malwarebytes in safe mode with the latest update and it didn't detect it. I then ran Kapersky rescue disk and that removed it, but when booting the computer (win7/pro) I get an error which I believe originates from the run.bat or start.bat? calling on a dll that no longer exists because it was part of the Ransom Trojan. The dll is called by SupportApp.bat. Is there a log I can view that tells me what is happening during boot-up? Can the boot instructions be edited?

Thank you, Jim

Maniac · July 4, 2013

Hello jimthom and :welcome: ! My name is Maniac and I will be glad to help you solve your malware problem.

Please note:

If you are a paying customer, you have the privilege to contact the help desk at Consumer Support. If you choose this option to get help, please let me know.
I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
Make sure you read all of the instructions and fixes thoroughly before continuing with them.
Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.
Do not perform any kind of scanning and fixing without my instructions. If you want to proceed on your own, please let me know.

For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.

For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

Restart the computer.
As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
Use the arrow keys to select the Repair your computer menu item.
Select English as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:

Insert the installation disc.
Restart your computer.
If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
Click Repair your computer.
Select English as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

- Startup Repair
  System Restore
  Windows Complete PC Restore
  Windows Memory Diagnostic Tool
  Command Prompt
Select Command Prompt
In the command window type in notepad and press Enter.
The notepad opens. Under File menu select Open.
Select "Computer" and find your flash drive letter and close the notepad.
In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
Note: Replace letter e with the drive letter of your flash drive.
The tool will start to run.
When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

jimthom · July 6, 2013

Thank you Maniac, I'll get srated straight away.

Cheers, Jim

jimthom · July 6, 2013

I didn't get very far, Maniac. Windows was preloaded so no disk and 'F8' only gives me a choice of boot devices (HD/DVD).. I do have a bootable disk that has the drivers and acces to the command prompt. Will that do?

Thanks, Jim

jimthom · July 6, 2013

Hi Maniac;

This is the txt file saved by FRST:

Thanks, Jim

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-07-2013
Ran by SYSTEM on 06-07-2013 14:27:07
Running from G:\
Windows 7 Professional (X64) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Acronis Scheduler2 Service] "C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe" [390720 2011-02-01] (Acronis)
HKLM-x32\...\Winlogon: [shell] C:\PROGRA~3\irinz6q.bat [x ] ()
HKLM-x32\...\Run: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [113288 2010-04-27] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [ASUS Easy Update] C:\Program Files (x86)\ASUS\ASUS Easy Update\ALU.exe [195200 2009-12-30] (ASUSTeK Computer Inc.)
HKLM-x32\...\Run: [Google Desktop Search] "C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" /startup [30192 2013-03-15] (Google)
HKLM-x32\...\Run: [TrueImageMonitor.exe] "C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe" [5550984 2011-09-22] (Acronis)
HKLM-x32\...\Run: [sAOB Monitor] C:\Program Files (x86)\Acronis\TrueImageHome\OnlineBackupStandalone\TrueImageMonitor.exe [2536760 2011-09-21] (Acronis)
HKLM-x32\...\Run: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY [4408368 2013-04-28] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe" [2236080 2013-06-26] ()
HKLM-x32\...\Run: [ASUSWebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.143.296\AsusWSPanel.exe /S [740736 2012-08-03] (ASUS Cloud Corporation)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
AppInit_DLLs-x32: c:\progra~3\browse~1\25976~1.107\{c16c1~1\mngr.dll c:\progra~2\google\google~1\go36f4~1.dll [123392 2013-03-15] (Google)
Startup: C:\ProgramData\Start Menu\Programs\Startup\LaunchMate.lnk
ShortcutTarget: LaunchMate.lnk -> C:\Program Files (x86)\LaunchMate\LnchMate.exe (TDRWare)
Startup: C:\Users\Jim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\regmonstd.lnk
ShortcutTarget: regmonstd.lnk -> C:\PROGRA~3\q6zniri.dat (No File)

==================== Services (Whitelisted) =================

S3 ASOVPNHelper; C:\Program Files (x86)\Astrill\ASOvpnSvc.exe [434928 2012-05-25] (Astrill)
S3 ASProxy; C:\Program Files (x86)\Astrill\ASProxy.exe [1918888 2013-02-18] (Astrill)
S2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [4937264 2013-05-13] (AVG Technologies CZ, s.r.o.)
S2 avgwd; C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [283136 2013-04-17] (AVG Technologies CZ, s.r.o.)
S3 GoogleDesktopManager-051210-111108; C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [30192 2013-03-15] (Google)
S2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-03] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-03] (Malwarebytes Corporation)
S2 SCM_Service; C:\Windows\SysWOW64\WinService.exe [180224 2007-07-16] ()
S2 vToolbarUpdater15.3.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe [1598128 2013-06-26] (AVG Secure Search)

==================== Drivers (Whitelisted) ====================

S2 ASInsHelp; C:\Windows\SysWow64\drivers\AsInsHelp64.sys [11832 2008-01-04] ()
S2 ASInsHelp; C:\Windows\SysWow64\drivers\AsInsHelp64.sys [11832 2008-01-04] ()
S1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2009-08-04] ()
S1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2009-08-04] ()
S1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-06] ()
S1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-06] ()
S3 asvpndrv; C:\Windows\System32\DRIVERS\asvpndrv.sys [31744 2012-02-29] (Astrill)
S1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [246072 2013-03-28] (AVG Technologies CZ, s.r.o.)
S0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [71480 2013-02-07] (AVG Technologies CZ, s.r.o.)
S1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [206136 2013-02-07] (AVG Technologies CZ, s.r.o.)
S0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [311096 2013-02-07] (AVG Technologies CZ, s.r.o.)
S0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [116536 2013-02-07] (AVG Technologies CZ, s.r.o.)
S0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [45880 2013-02-07] (AVG Technologies CZ, s.r.o.)
S1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [240952 2013-03-20] (AVG Technologies CZ, s.r.o.)
S1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [45856 2013-06-26] (AVG Technologies)
S3 EST_BusEnum; C:\Windows\System32\DRIVERS\GenBus.sys [29696 2009-10-05] ( )
S3 EST_Server; C:\Windows\System32\DRIVERS\GenHC.sys [199168 2009-10-05] ( )
S3 IT9135BDA; C:\Windows\System32\Drivers\IT9135BDA.sys [164736 2012-09-30] (ITE )
S3 ITECIRfilter; C:\Windows\System32\DRIVERS\ITECIRfilter.sys [28264 2011-03-21] (ITE Tech. Inc. )
S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [33096 2012-05-08] ()
S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [33096 2012-05-08] ()
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-03] (Malwarebytes Corporation)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-03] (Malwarebytes Corporation)
S3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-21] ()
S3 NUS_Bus; C:\Windows\System32\DRIVERS\NUS_Bus.sys [30208 2010-01-27] (Elite Silicon Technology Inc.)
S3 RTL8187; C:\Windows\System32\DRIVERS\wg111v2.sys [340992 2007-12-25] (NETGEAR Inc.)
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-07-06 14:26 - 2013-07-06 14:26 - 00000000 ____D C:\FRST
2013-07-05 18:10 - 2013-07-05 18:10 - 00002549 ____A C:\Users\Jim\Desktop\Remnants from Ransom Removal - Malware Removal Help - Malwarebytes Forum.url
2013-07-04 20:09 - 2013-07-04 20:10 - 00006866 ____A C:\Users\Jim\Documents\cc_20130705_140944.reg
2013-07-04 19:57 - 2013-07-04 19:57 - 00001274 ____A C:\Windows\PFRO.log
2013-07-04 19:49 - 2013-07-04 19:49 - 00000000 ____D C:\Users\Jim\AppData\Roaming\OpenCandy
2013-07-04 19:33 - 2013-07-04 19:35 - 03469871 ____A (LIGHTNING UK!) C:\Users\Jim\Downloads\SetupImgBurn_2.5.8.0.exe
2013-07-04 19:23 - 2013-07-04 19:23 - 00043456 ____A C:\Users\Jim\Downloads\base_file_2.5.8.0.zip
2013-06-30 21:16 - 2013-06-30 21:15 - 00263592 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-06-30 21:15 - 2013-06-30 21:15 - 00175016 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-06-30 21:15 - 2013-06-30 21:15 - 00175016 ____A (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-06-30 21:15 - 2013-06-30 21:15 - 00096168 ____A (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-06-28 17:09 - 2013-06-28 17:09 - 00064768 ____A C:\Users\Jim\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-28 17:08 - 2013-07-05 20:12 - 00001456 ____A C:\Windows\setupact.log
2013-06-28 17:08 - 2013-06-28 17:08 - 00297656 ____A C:\Windows\System32\FNTCACHE.DAT
2013-06-28 17:08 - 2013-06-28 17:08 - 00000000 ____A C:\Windows\setuperr.log
2013-06-27 04:19 - 2013-06-28 12:35 - 00000014 ____A C:\ProgramData\irinz6q.bat
2013-06-27 04:19 - 2013-06-27 16:15 - 95023320 ___AT C:\ProgramData\irinz6q.pad
2013-06-27 04:19 - 2013-06-27 16:15 - 00000000 ____A C:\ProgramData\kjhy64.txt
2013-06-27 04:19 - 2013-06-27 04:19 - 00000153 ____A C:\ProgramData\irinz6q.reg
2013-06-25 18:18 - 2013-06-25 19:17 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-06-25 04:55 - 2013-06-25 04:55 - 00000000 ____D C:\Program Files (x86)\Auslogics
2013-06-24 21:38 - 2013-07-05 14:58 - 00018471 ____A C:\Users\Jim\Documents\Blood Pressure.ods
2013-06-19 01:56 - 2013-07-05 15:08 - 00013969 ____A C:\Users\Jim\Documents\Forecast Data 3 days.ods
2013-06-17 21:42 - 2013-06-17 21:42 - 00000308 ____A C:\Users\Jim\Desktop\Home Oasis Kitchen & Bath Checkout.url
2013-06-16 04:57 - 2013-06-16 04:57 - 00051646 ____A C:\Users\Jim\Documents\cc_20130616_225704.reg
2013-06-11 19:19 - 2013-06-11 20:28 - 09089416 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2013-06-11 15:01 - 2013-05-16 20:05 - 17824768 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-11 15:01 - 2013-05-16 19:27 - 10926080 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-11 15:01 - 2013-05-16 19:09 - 02312704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-11 15:01 - 2013-05-16 19:02 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-11 15:01 - 2013-05-16 19:02 - 01346560 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-11 15:01 - 2013-05-16 19:01 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-11 15:01 - 2013-05-16 19:00 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-11 15:01 - 2013-05-16 18:58 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-11 15:01 - 2013-05-16 18:56 - 00599040 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-11 15:01 - 2013-05-16 18:56 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-11 15:01 - 2013-05-16 18:55 - 00816640 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-11 15:01 - 2013-05-16 18:54 - 00729088 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-11 15:01 - 2013-05-16 18:53 - 02147840 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-11 15:01 - 2013-05-16 18:51 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-11 15:01 - 2013-05-16 18:51 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-11 15:01 - 2013-05-16 18:46 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-11 15:01 - 2013-05-16 15:08 - 12329984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-11 15:01 - 2013-05-16 14:49 - 09738752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-11 15:01 - 2013-05-16 14:39 - 01800704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-11 15:01 - 2013-05-16 14:28 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-11 15:01 - 2013-05-16 14:28 - 01104384 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-11 15:01 - 2013-05-16 14:27 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-06-11 15:01 - 2013-05-16 14:26 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-06-11 15:01 - 2013-05-16 14:23 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-11 15:01 - 2013-05-16 14:21 - 00717824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-11 15:01 - 2013-05-16 14:21 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-06-11 15:01 - 2013-05-16 14:20 - 00420864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-06-11 15:01 - 2013-05-16 14:19 - 00607744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-11 15:01 - 2013-05-16 14:17 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-11 15:01 - 2013-05-16 14:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-06-11 15:01 - 2013-05-16 14:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-11 15:01 - 2013-05-16 14:12 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-11 14:45 - 2013-05-12 21:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-11 14:45 - 2013-05-12 21:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-11 14:45 - 2013-05-12 21:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-11 14:45 - 2013-05-12 21:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-11 14:45 - 2013-05-12 20:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-11 14:45 - 2013-05-12 20:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-11 14:45 - 2013-05-12 20:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-11 14:45 - 2013-05-12 19:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-11 14:45 - 2013-05-12 19:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-11 14:45 - 2013-05-12 19:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-11 14:44 - 2013-05-09 21:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-11 14:44 - 2013-05-09 19:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-11 14:44 - 2013-05-07 22:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-11 14:44 - 2013-04-25 21:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-11 14:44 - 2013-04-25 20:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-11 14:44 - 2013-04-25 15:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-11 14:44 - 2013-04-16 23:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-11 14:44 - 2013-04-16 22:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-11 14:44 - 2013-03-31 14:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-08 03:18 - 2013-07-05 20:12 - 00000350 ____A C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job

==================== One Month Modified Files and Folders =======

2013-07-06 14:26 - 2013-07-06 14:26 - 00000000 ____D C:\FRST
2013-07-05 20:15 - 2011-05-17 16:23 - 02056482 ____A C:\Windows\WindowsUpdate.log
2013-07-05 20:15 - 2009-07-13 20:45 - 00015408 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-05 20:15 - 2009-07-13 20:45 - 00015408 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-05 20:12 - 2013-06-28 17:08 - 00001456 ____A C:\Windows\setupact.log
2013-07-05 20:12 - 2013-06-08 03:18 - 00000350 ____A C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job
2013-07-05 20:12 - 2013-06-03 00:06 - 00000350 ____A C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job
2013-07-05 20:12 - 2011-12-10 18:10 - 00000888 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-05 20:12 - 2011-05-20 16:20 - 00000437 ____A C:\Windows\System32\Drivers\etc\hosts.ics
2013-07-05 20:12 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-05 19:17 - 2012-06-11 07:29 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-05 19:10 - 2011-12-10 18:10 - 00000892 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-05 18:30 - 2009-07-13 21:13 - 00738832 ____A C:\Windows\System32\PerfStringBackup.INI
2013-07-05 18:10 - 2013-07-05 18:10 - 00002549 ____A C:\Users\Jim\Desktop\Remnants from Ransom Removal - Malware Removal Help - Malwarebytes Forum.url
2013-07-05 15:18 - 2011-07-03 00:58 - 00000000 ____D C:\ProgramData\opencpn
2013-07-05 15:08 - 2013-06-19 01:56 - 00013969 ____A C:\Users\Jim\Documents\Forecast Data 3 days.ods
2013-07-05 14:58 - 2013-06-24 21:38 - 00018471 ____A C:\Users\Jim\Documents\Blood Pressure.ods
2013-07-05 14:34 - 2011-05-18 02:24 - 00000000 ____D C:\ProgramData\MFAData
2013-07-05 04:39 - 2011-06-07 23:02 - 00000000 ____D C:\Users\Jim\AppData\Roaming\Skype
2013-07-04 20:10 - 2013-07-04 20:09 - 00006866 ____A C:\Users\Jim\Documents\cc_20130705_140944.reg
2013-07-04 19:57 - 2013-07-04 19:57 - 00001274 ____A C:\Windows\PFRO.log
2013-07-04 19:49 - 2013-07-04 19:49 - 00000000 ____D C:\Users\Jim\AppData\Roaming\OpenCandy
2013-07-04 19:35 - 2013-07-04 19:33 - 03469871 ____A (LIGHTNING UK!) C:\Users\Jim\Downloads\SetupImgBurn_2.5.8.0.exe
2013-07-04 19:23 - 2013-07-04 19:23 - 00043456 ____A C:\Users\Jim\Downloads\base_file_2.5.8.0.zip
2013-07-03 21:11 - 2012-02-18 13:08 - 00000000 ____D C:\Windows\pss
2013-07-03 19:57 - 2013-01-06 19:33 - 00000000 ____D C:\Program Files (x86)\SupportAppCB
2013-07-03 14:02 - 2011-05-19 05:21 - 00000272 ____A C:\Users\Jim\Documents\spider.sav
2013-06-30 22:11 - 2012-09-05 22:45 - 00000000 ____D C:\Users\Jim\AppData\Local\Avg2013
2013-06-30 21:23 - 2012-09-05 23:10 - 00000000 ____D C:\Program Files (x86)\Java
2013-06-30 21:15 - 2013-06-30 21:16 - 00263592 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-06-30 21:15 - 2013-06-30 21:15 - 00175016 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-06-30 21:15 - 2013-06-30 21:15 - 00175016 ____A (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-06-30 21:15 - 2013-06-30 21:15 - 00096168 ____A (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-06-30 21:15 - 2012-09-05 23:11 - 00867240 ____A (Oracle Corporation) C:\Windows\SysWOW64\npdeployJava1.dll
2013-06-30 21:15 - 2011-05-20 20:43 - 00789416 ____A (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-06-28 17:09 - 2013-06-28 17:09 - 00064768 ____A C:\Users\Jim\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-28 17:08 - 2013-06-28 17:08 - 00297656 ____A C:\Windows\System32\FNTCACHE.DAT
2013-06-28 17:08 - 2013-06-28 17:08 - 00000000 ____A C:\Windows\setuperr.log
2013-06-28 15:56 - 2011-07-15 17:10 - 00000000 ____D C:\Users\Jim\AppData\Roaming\uTorrent
2013-06-28 12:35 - 2013-06-27 04:19 - 00000014 ____A C:\ProgramData\irinz6q.bat
2013-06-27 20:50 - 2012-09-05 22:55 - 00000000 ____D C:\ProgramData\AVG Secure Search
2013-06-27 16:15 - 2013-06-27 04:19 - 95023320 ___AT C:\ProgramData\irinz6q.pad
2013-06-27 16:15 - 2013-06-27 04:19 - 00000000 ____A C:\ProgramData\kjhy64.txt
2013-06-27 04:19 - 2013-06-27 04:19 - 00000153 ____A C:\ProgramData\irinz6q.reg
2013-06-26 23:27 - 2012-09-05 22:54 - 00045856 ____A (AVG Technologies) C:\Windows\System32\Drivers\avgtpx64.sys
2013-06-26 23:27 - 2012-09-05 22:54 - 00000000 ____D C:\Program Files (x86)\AVG Secure Search
2013-06-25 19:17 - 2013-06-25 18:18 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-06-25 15:18 - 2009-07-13 23:44 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-06-25 04:55 - 2013-06-25 04:55 - 00000000 ____D C:\Program Files (x86)\Auslogics
2013-06-21 04:29 - 2011-08-01 01:31 - 00000000 ____D C:\Users\Jim\AppData\Local\Mirillis
2013-06-20 01:21 - 2011-07-15 17:12 - 00000000 ____D C:\Program Files (x86)\uTorrent
2013-06-18 02:38 - 2013-06-01 15:05 - 00013451 ____A C:\Users\Jim\Documents\Forecast Data.ods
2013-06-17 21:42 - 2013-06-17 21:42 - 00000308 ____A C:\Users\Jim\Desktop\Home Oasis Kitchen & Bath Checkout.url
2013-06-16 04:57 - 2013-06-16 04:57 - 00051646 ____A C:\Users\Jim\Documents\cc_20130616_225704.reg
2013-06-15 05:20 - 2011-05-20 19:50 - 00000000 ____D C:\Program Files\CCleaner
2013-06-14 14:28 - 2009-07-13 21:08 - 00032562 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-13 14:24 - 2011-06-07 23:01 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-06-13 14:24 - 2011-06-07 23:01 - 00000000 ____D C:\ProgramData\Skype
2013-06-11 20:29 - 2012-04-02 04:21 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-11 20:29 - 2011-05-27 18:10 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-11 20:28 - 2013-06-11 19:19 - 09089416 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2013-06-11 14:56 - 2011-05-17 03:58 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe

Files to move or delete:
====================
C:\Users\Jim\AppData\Roaming\skype.ini
C:\ProgramData\irinz6q.bat
C:\ProgramData\irinz6q.pad
C:\ProgramData\irinz6q.reg

==================== Known DLLs (Whitelisted) ================

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

Restore point made on: 2013-07-04 19:53:07

==================== Memory info ===========================

Percentage of memory in use: 15%
Total physical RAM: 4095.24 MB
Available physical RAM: 3448.89 MB
Total Pagefile: 4093.39 MB
Available Pagefile: 3442.36 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: (WIN7) (Fixed) (Total:80 GB) (Free:30.91 GB) NTFS (Disk=0 Partition=2) ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATA) (Fixed) (Total:203.05 GB) (Free:188.26 GB) NTFS (Disk=0 Partition=3)
Drive g: () (Removable) (Total:0.1 GB) (Free:0.1 GB) FAT (Disk=2 Partition=1)
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 05DA1A21)
Partition 1: (Not Active) - (Size=15 GB) - (Type=1B)
Partition 2: (Active) - (Size=80 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=203 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=39 MB) - (Type=EF)

========================================================
Disk: 2 (Size: 100 MB) (Disk ID: CD37E914)
Partition 1: (Active) - (Size=100 MB) - (Type=06)

LastRegBack: 2013-05-03 22:36

==================== End Of Log ============================

jimthom · July 6, 2013

Hi Maniac;

I can see the offending item at the end of the Registry whitelisted log:

ShortcutTarget: regmonstd.lnk -> C:\PROGRA~3\q6zniri.dat (No File)

Cheers, Jim

Maniac · July 6, 2013

Open Notepad (Start => All Programs => Accessories => Notepad). Please copy the entire contents of the code box below. (To do this highlight the contents of the box, right click on it and select copy. Right-click in the open Notepad and select Paste). Save it on the flashdrive as fixlist.txt

HKLM-x32\...\Winlogon: [shell] C:\PROGRA~3\irinz6q.bat [x ] ()
ShortcutTarget: regmonstd.lnk -> C:\PROGRA~3\q6zniri.dat (No File)
2013-06-27 04:19 - 2013-06-28 12:35 - 00000014 ____A C:\ProgramData\irinz6q.bat
2013-06-27 04:19 - 2013-06-27 16:15 - 95023320 ___AT C:\ProgramData\irinz6q.pad
2013-06-27 04:19 - 2013-06-27 16:15 - 00000000 ____A C:\ProgramData\kjhy64.txt
2013-06-27 04:19 - 2013-06-27 04:19 - 00000153 ____A C:\ProgramData\irinz6q.reg
C:\Users\Jim\AppData\Roaming\skype.ini

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system

Now please enter System Recovery Options then select Command Prompt

Run FRST (or FRST64 if you have the 64bit version) and press the Fix button just once and wait.

The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

Reboot Normally.

jimthom · July 7, 2013

Thanks Maniac, here is the text file from the lixlog:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 04-07-2013
Ran by SYSTEM at 2013-07-07 16:34:33 Run:1
Running from G:\
Boot Mode: Recovery
==============================================

HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value was restored successfully.
C:\PROGRA~3\q6zniri.dat not found.
C:\ProgramData\irinz6q.bat => Moved successfully.
C:\ProgramData\irinz6q.pad => Moved successfully.
C:\ProgramData\kjhy64.txt => Moved successfully.
C:\ProgramData\irinz6q.reg => Moved successfully.
C:\Users\Jim\AppData\Roaming\skype.ini => Moved successfully.

==== End of Fixlog ====

Maniac · July 7, 2013

Please try to boot in Normal mode and let me know.

jimthom · July 7, 2013

Maniac; when I boot normally there is still the error message regarding 'file not found' from, I think:

Startup: C:\Users\Jim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\regmonstd.lnk
ShortcutTarget: regmonstd.lnk -> C:\PROGRA~3\q6zniri.dat (No File)

Can I now just delete the entire folder C:\Users\Jim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup?

I can also disable it with CCleaner so it doesn't run at startup.

Thanks, Jim

jimthom · July 8, 2013

Sorry, forgot to mention that there are files in the that startup folder:

desktop.ini, regmonstd

Maniac · July 8, 2013

Please generate a new fresh FRST log file.

jimthom · July 8, 2013

Here it is:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-07-2013
Ran by SYSTEM on 08-07-2013 22:52:15
Running from G:\
Windows 7 Professional (X64) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Acronis Scheduler2 Service] "C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe" [390720 2011-02-01] (Acronis)
HKLM-x32\...\Run: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [113288 2010-04-27] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [ASUS Easy Update] C:\Program Files (x86)\ASUS\ASUS Easy Update\ALU.exe [195200 2009-12-30] (ASUSTeK Computer Inc.)
HKLM-x32\...\Run: [Google Desktop Search] "C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe" /startup [30192 2013-03-15] (Google)
HKLM-x32\...\Run: [TrueImageMonitor.exe] "C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe" [5550984 2011-09-22] (Acronis)
HKLM-x32\...\Run: [sAOB Monitor] C:\Program Files (x86)\Acronis\TrueImageHome\OnlineBackupStandalone\TrueImageMonitor.exe [2536760 2011-09-21] (Acronis)
HKLM-x32\...\Run: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY [4408368 2013-04-28] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe" [2236080 2013-06-26] ()
HKLM-x32\...\Run: [ASUSWebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.143.296\AsusWSPanel.exe /S [740736 2012-08-03] (ASUS Cloud Corporation)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
AppInit_DLLs-x32: c:\progra~3\browse~1\25976~1.107\{c16c1~1\mngr.dll c:\progra~2\google\google~1\go36f4~1.dll [123392 2013-03-15] (Google)
Startup: C:\ProgramData\Start Menu\Programs\Startup\LaunchMate.lnk
ShortcutTarget: LaunchMate.lnk -> C:\Program Files (x86)\LaunchMate\LnchMate.exe (TDRWare)
Startup: C:\Users\Jim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\regmonstd.lnk
ShortcutTarget: regmonstd.lnk -> C:\PROGRA~3\q6zniri.dat (No File)

==================== Services (Whitelisted) =================

S3 ASOVPNHelper; C:\Program Files (x86)\Astrill\ASOvpnSvc.exe [434928 2012-05-25] (Astrill)
S3 ASProxy; C:\Program Files (x86)\Astrill\ASProxy.exe [1918888 2013-02-18] (Astrill)
S2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe [4937264 2013-05-13] (AVG Technologies CZ, s.r.o.)
S2 avgwd; C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe [283136 2013-04-17] (AVG Technologies CZ, s.r.o.)
S3 GoogleDesktopManager-051210-111108; C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktop.exe [30192 2013-03-15] (Google)
S2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-03] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-03] (Malwarebytes Corporation)
S2 SCM_Service; C:\Windows\SysWOW64\WinService.exe [180224 2007-07-16] ()
S2 vToolbarUpdater15.3.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe [1598128 2013-06-26] (AVG Secure Search)

==================== Drivers (Whitelisted) ====================

S2 ASInsHelp; C:\Windows\SysWow64\drivers\AsInsHelp64.sys [11832 2008-01-04] ()
S2 ASInsHelp; C:\Windows\SysWow64\drivers\AsInsHelp64.sys [11832 2008-01-04] ()
S1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2009-08-04] ()
S1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2009-08-04] ()
S1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-06] ()
S1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-06] ()
S3 asvpndrv; C:\Windows\System32\DRIVERS\asvpndrv.sys [31744 2012-02-29] (Astrill)
S1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [246072 2013-03-28] (AVG Technologies CZ, s.r.o.)
S0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [71480 2013-02-07] (AVG Technologies CZ, s.r.o.)
S1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [206136 2013-02-07] (AVG Technologies CZ, s.r.o.)
S0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [311096 2013-02-07] (AVG Technologies CZ, s.r.o.)
S0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [116536 2013-02-07] (AVG Technologies CZ, s.r.o.)
S0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [45880 2013-02-07] (AVG Technologies CZ, s.r.o.)
S1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [240952 2013-03-20] (AVG Technologies CZ, s.r.o.)
S1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [45856 2013-06-26] (AVG Technologies)
S3 EST_BusEnum; C:\Windows\System32\DRIVERS\GenBus.sys [29696 2009-10-05] ( )
S3 EST_Server; C:\Windows\System32\DRIVERS\GenHC.sys [199168 2009-10-05] ( )
S3 IT9135BDA; C:\Windows\System32\Drivers\IT9135BDA.sys [164736 2012-09-30] (ITE )
S3 ITECIRfilter; C:\Windows\System32\DRIVERS\ITECIRfilter.sys [28264 2011-03-21] (ITE Tech. Inc. )
S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [33096 2012-05-08] ()
S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [33096 2012-05-08] ()
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-03] (Malwarebytes Corporation)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-03] (Malwarebytes Corporation)
S3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-21] ()
S3 NUS_Bus; C:\Windows\System32\DRIVERS\NUS_Bus.sys [30208 2010-01-27] (Elite Silicon Technology Inc.)
S3 RTL8187; C:\Windows\System32\DRIVERS\wg111v2.sys [340992 2007-12-25] (NETGEAR Inc.)
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-07-08 03:29 - 2013-07-08 03:30 - 00009212 ____A C:\Users\Jim\Documents\Offshore.ods
2013-07-06 14:26 - 2013-07-06 14:26 - 00000000 ____D C:\FRST
2013-07-05 18:10 - 2013-07-05 18:10 - 00002549 ____A C:\Users\Jim\Desktop\Remnants from Ransom Removal - Malware Removal Help - Malwarebytes Forum.url
2013-07-04 20:09 - 2013-07-04 20:10 - 00006866 ____A C:\Users\Jim\Documents\cc_20130705_140944.reg
2013-07-04 19:57 - 2013-07-04 19:57 - 00001274 ____A C:\Windows\PFRO.log
2013-07-04 19:49 - 2013-07-04 19:49 - 00000000 ____D C:\Users\Jim\AppData\Roaming\OpenCandy
2013-07-04 19:33 - 2013-07-04 19:35 - 03469871 ____A (LIGHTNING UK!) C:\Users\Jim\Downloads\SetupImgBurn_2.5.8.0.exe
2013-07-04 19:23 - 2013-07-04 19:23 - 00043456 ____A C:\Users\Jim\Downloads\base_file_2.5.8.0.zip
2013-06-30 21:16 - 2013-06-30 21:15 - 00263592 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-06-30 21:15 - 2013-06-30 21:15 - 00175016 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-06-30 21:15 - 2013-06-30 21:15 - 00175016 ____A (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-06-30 21:15 - 2013-06-30 21:15 - 00096168 ____A (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-06-28 17:09 - 2013-06-28 17:09 - 00064768 ____A C:\Users\Jim\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-28 17:08 - 2013-07-08 04:42 - 00001960 ____A C:\Windows\setupact.log
2013-06-28 17:08 - 2013-06-28 17:08 - 00297656 ____A C:\Windows\System32\FNTCACHE.DAT
2013-06-28 17:08 - 2013-06-28 17:08 - 00000000 ____A C:\Windows\setuperr.log
2013-06-25 18:18 - 2013-06-25 19:17 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-06-25 04:55 - 2013-06-25 04:55 - 00000000 ____D C:\Program Files (x86)\Auslogics
2013-06-24 21:38 - 2013-07-07 21:25 - 00019412 ____A C:\Users\Jim\Documents\Blood Pressure.ods
2013-06-19 01:56 - 2013-07-05 15:08 - 00013969 ____A C:\Users\Jim\Documents\Forecast Data 3 days.ods
2013-06-17 21:42 - 2013-06-17 21:42 - 00000308 ____A C:\Users\Jim\Desktop\Home Oasis Kitchen & Bath Checkout.url
2013-06-16 04:57 - 2013-06-16 04:57 - 00051646 ____A C:\Users\Jim\Documents\cc_20130616_225704.reg
2013-06-11 19:19 - 2013-06-11 20:28 - 09089416 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2013-06-11 15:01 - 2013-05-16 20:05 - 17824768 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-11 15:01 - 2013-05-16 19:27 - 10926080 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-11 15:01 - 2013-05-16 19:09 - 02312704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-11 15:01 - 2013-05-16 19:02 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-11 15:01 - 2013-05-16 19:02 - 01346560 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-11 15:01 - 2013-05-16 19:01 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-11 15:01 - 2013-05-16 19:00 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-11 15:01 - 2013-05-16 18:58 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-11 15:01 - 2013-05-16 18:56 - 00599040 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-11 15:01 - 2013-05-16 18:56 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-11 15:01 - 2013-05-16 18:55 - 00816640 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-11 15:01 - 2013-05-16 18:54 - 00729088 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-11 15:01 - 2013-05-16 18:53 - 02147840 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-11 15:01 - 2013-05-16 18:51 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-11 15:01 - 2013-05-16 18:51 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-11 15:01 - 2013-05-16 18:46 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-11 15:01 - 2013-05-16 15:08 - 12329984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-11 15:01 - 2013-05-16 14:49 - 09738752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-11 15:01 - 2013-05-16 14:39 - 01800704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-11 15:01 - 2013-05-16 14:28 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-11 15:01 - 2013-05-16 14:28 - 01104384 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-11 15:01 - 2013-05-16 14:27 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-06-11 15:01 - 2013-05-16 14:26 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-06-11 15:01 - 2013-05-16 14:23 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-11 15:01 - 2013-05-16 14:21 - 00717824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-11 15:01 - 2013-05-16 14:21 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-06-11 15:01 - 2013-05-16 14:20 - 00420864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-06-11 15:01 - 2013-05-16 14:19 - 00607744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-11 15:01 - 2013-05-16 14:17 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-11 15:01 - 2013-05-16 14:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-06-11 15:01 - 2013-05-16 14:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-11 15:01 - 2013-05-16 14:12 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-11 14:45 - 2013-05-12 21:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-11 14:45 - 2013-05-12 21:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-11 14:45 - 2013-05-12 21:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-11 14:45 - 2013-05-12 21:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-11 14:45 - 2013-05-12 20:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-11 14:45 - 2013-05-12 20:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-11 14:45 - 2013-05-12 20:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-11 14:45 - 2013-05-12 19:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-11 14:45 - 2013-05-12 19:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-11 14:45 - 2013-05-12 19:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-11 14:44 - 2013-05-09 21:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-11 14:44 - 2013-05-09 19:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-11 14:44 - 2013-05-07 22:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-11 14:44 - 2013-04-25 21:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-11 14:44 - 2013-04-25 20:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-11 14:44 - 2013-04-25 15:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-11 14:44 - 2013-04-16 23:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-11 14:44 - 2013-04-16 22:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-11 14:44 - 2013-03-31 14:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-08 03:18 - 2013-07-08 04:42 - 00000350 ____A C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job

==================== One Month Modified Files and Folders =======

2013-07-08 04:46 - 2011-05-17 16:23 - 01058728 ____A C:\Windows\WindowsUpdate.log
2013-07-08 04:46 - 2009-07-13 20:45 - 00015408 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-08 04:46 - 2009-07-13 20:45 - 00015408 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-08 04:43 - 2011-05-20 16:20 - 00000437 ____A C:\Windows\System32\Drivers\etc\hosts.ics
2013-07-08 04:42 - 2013-06-28 17:08 - 00001960 ____A C:\Windows\setupact.log
2013-07-08 04:42 - 2013-06-08 03:18 - 00000350 ____A C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job
2013-07-08 04:42 - 2013-06-03 00:06 - 00000350 ____A C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job
2013-07-08 04:42 - 2011-12-10 18:10 - 00000888 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-08 04:42 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-08 04:17 - 2012-06-11 07:29 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-08 04:10 - 2011-12-10 18:10 - 00000892 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-08 04:08 - 2011-06-07 23:02 - 00000000 ____D C:\Users\Jim\AppData\Roaming\Skype
2013-07-08 03:30 - 2013-07-08 03:29 - 00009212 ____A C:\Users\Jim\Documents\Offshore.ods
2013-07-07 23:59 - 2011-05-18 02:24 - 00000000 ____D C:\ProgramData\MFAData
2013-07-07 21:25 - 2013-06-24 21:38 - 00019412 ____A C:\Users\Jim\Documents\Blood Pressure.ods
2013-07-06 23:20 - 2009-07-13 21:13 - 00738832 ____A C:\Windows\System32\PerfStringBackup.INI
2013-07-06 22:05 - 2012-02-18 13:08 - 00000000 ____D C:\Windows\pss
2013-07-06 14:26 - 2013-07-06 14:26 - 00000000 ____D C:\FRST
2013-07-06 02:19 - 2011-07-03 00:58 - 00000000 ____D C:\ProgramData\opencpn
2013-07-05 18:10 - 2013-07-05 18:10 - 00002549 ____A C:\Users\Jim\Desktop\Remnants from Ransom Removal - Malware Removal Help - Malwarebytes Forum.url
2013-07-05 15:08 - 2013-06-19 01:56 - 00013969 ____A C:\Users\Jim\Documents\Forecast Data 3 days.ods
2013-07-04 20:10 - 2013-07-04 20:09 - 00006866 ____A C:\Users\Jim\Documents\cc_20130705_140944.reg
2013-07-04 19:57 - 2013-07-04 19:57 - 00001274 ____A C:\Windows\PFRO.log
2013-07-04 19:49 - 2013-07-04 19:49 - 00000000 ____D C:\Users\Jim\AppData\Roaming\OpenCandy
2013-07-04 19:35 - 2013-07-04 19:33 - 03469871 ____A (LIGHTNING UK!) C:\Users\Jim\Downloads\SetupImgBurn_2.5.8.0.exe
2013-07-04 19:23 - 2013-07-04 19:23 - 00043456 ____A C:\Users\Jim\Downloads\base_file_2.5.8.0.zip
2013-07-03 19:57 - 2013-01-06 19:33 - 00000000 ____D C:\Program Files (x86)\SupportAppCB
2013-07-03 14:02 - 2011-05-19 05:21 - 00000272 ____A C:\Users\Jim\Documents\spider.sav
2013-06-30 22:11 - 2012-09-05 22:45 - 00000000 ____D C:\Users\Jim\AppData\Local\Avg2013
2013-06-30 21:23 - 2012-09-05 23:10 - 00000000 ____D C:\Program Files (x86)\Java
2013-06-30 21:15 - 2013-06-30 21:16 - 00263592 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-06-30 21:15 - 2013-06-30 21:15 - 00175016 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-06-30 21:15 - 2013-06-30 21:15 - 00175016 ____A (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-06-30 21:15 - 2013-06-30 21:15 - 00096168 ____A (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-06-30 21:15 - 2012-09-05 23:11 - 00867240 ____A (Oracle Corporation) C:\Windows\SysWOW64\npdeployJava1.dll
2013-06-30 21:15 - 2011-05-20 20:43 - 00789416 ____A (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-06-28 17:09 - 2013-06-28 17:09 - 00064768 ____A C:\Users\Jim\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-28 17:08 - 2013-06-28 17:08 - 00297656 ____A C:\Windows\System32\FNTCACHE.DAT
2013-06-28 17:08 - 2013-06-28 17:08 - 00000000 ____A C:\Windows\setuperr.log
2013-06-28 15:56 - 2011-07-15 17:10 - 00000000 ____D C:\Users\Jim\AppData\Roaming\uTorrent
2013-06-27 20:50 - 2012-09-05 22:55 - 00000000 ____D C:\ProgramData\AVG Secure Search
2013-06-26 23:27 - 2012-09-05 22:54 - 00045856 ____A (AVG Technologies) C:\Windows\System32\Drivers\avgtpx64.sys
2013-06-26 23:27 - 2012-09-05 22:54 - 00000000 ____D C:\Program Files (x86)\AVG Secure Search
2013-06-25 19:17 - 2013-06-25 18:18 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-06-25 15:18 - 2009-07-13 23:44 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-06-25 04:55 - 2013-06-25 04:55 - 00000000 ____D C:\Program Files (x86)\Auslogics
2013-06-21 04:29 - 2011-08-01 01:31 - 00000000 ____D C:\Users\Jim\AppData\Local\Mirillis
2013-06-20 01:21 - 2011-07-15 17:12 - 00000000 ____D C:\Program Files (x86)\uTorrent
2013-06-18 02:38 - 2013-06-01 15:05 - 00013451 ____A C:\Users\Jim\Documents\Forecast Data.ods
2013-06-17 21:42 - 2013-06-17 21:42 - 00000308 ____A C:\Users\Jim\Desktop\Home Oasis Kitchen & Bath Checkout.url
2013-06-16 04:57 - 2013-06-16 04:57 - 00051646 ____A C:\Users\Jim\Documents\cc_20130616_225704.reg
2013-06-15 05:20 - 2011-05-20 19:50 - 00000000 ____D C:\Program Files\CCleaner
2013-06-14 14:28 - 2009-07-13 21:08 - 00032562 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-13 14:24 - 2011-06-07 23:01 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-06-13 14:24 - 2011-06-07 23:01 - 00000000 ____D C:\ProgramData\Skype
2013-06-11 20:29 - 2012-04-02 04:21 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-11 20:29 - 2011-05-27 18:10 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-11 20:28 - 2013-06-11 19:19 - 09089416 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2013-06-11 14:56 - 2011-05-17 03:58 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe

==================== Known DLLs (Whitelisted) ================

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

==================== Memory info ===========================

Percentage of memory in use: 15%
Total physical RAM: 4095.24 MB
Available physical RAM: 3450.04 MB
Total Pagefile: 4093.39 MB
Available Pagefile: 3436.92 MB
Total Virtual: 8192 MB
Available Virtual: 8191.86 MB

==================== Drives ================================

Drive c: (WIN7) (Fixed) (Total:80 GB) (Free:32.75 GB) NTFS (Disk=0 Partition=2) ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATA) (Fixed) (Total:203.05 GB) (Free:188.26 GB) NTFS (Disk=0 Partition=3)
Drive f: (CD_ROM) (CDROM) (Total:0.19 GB) (Free:0 GB) CDFS
Drive g: () (Removable) (Total:0.1 GB) (Free:0.1 GB) FAT (Disk=2 Partition=1)
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 05DA1A21)
Partition 1: (Not Active) - (Size=15 GB) - (Type=1B)
Partition 2: (Active) - (Size=80 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=203 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=39 MB) - (Type=EF)

========================================================
Disk: 2 (Size: 100 MB) (Disk ID: CD37E914)
Partition 1: (Active) - (Size=100 MB) - (Type=06)

LastRegBack: 2013-05-03 22:36

==================== End Of Log ============================

Thanks Maniac

Maniac · July 8, 2013

Open Notepad (Start => All Programs => Accessories => Notepad). Please copy the entire contents of the code box below. (To do this highlight the contents of the box, right click on it and select copy. Right-click in the open Notepad and select Paste). Save it on the flashdrive as fixlist.txt

ShortcutTarget: regmonstd.lnk -> C:\PROGRA~3\q6zniri.dat (No File)

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system

Now please enter System Recovery Options then select Command Prompt

Run FRST (or FRST64 if you have the 64bit version) and press the Fix button just once and wait.

The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

Reboot Normally.

jimthom · July 8, 2013

Maniac, the error message still appears on normal booting:

Rundll

There was a problem starting c:\PROGRA~3\q6zniri.dat

The specified module could not be found

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 04-07-2013
Ran by SYSTEM at 2013-07-09 08:43:52 Run:2
Running from F:\
Boot Mode: Recovery
==============================================

C:\PROGRA~3\q6zniri.dat not found.

==== End of Fixlog ====

Maniac · July 9, 2013

Please generate a new fresh FRST log file.

jimthom · July 9, 2013

The new one Maniac:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-07-2013
Ran by SYSTEM on 09-07-2013 22:45:56
Running from F:\
Windows 7 Professional (X64) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Recovery