Mb found rootkit & trojan, computer crashing often

Xiduth · July 25, 2013

Just to clear things up, this is different from my laptop and the post HERE. Ok, lets move on.

So this PC has been giving me problems since my little sister has been using it. I haven't really used the computer till recently, it's been gathering dust because of the headaches its been giving me. I found out about malwarebytes, and ran the scanner, and got rid of a lot of malware I didn't know about. Thankfully I hadn't used this computer for anything security wise/personal. These are what MB cleared off my computer, be warned, its not for the faint of heart:

Registry Keys Detected: 4
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{BEAC7DC8-E106-4C6A-931E-5A42E7362883} (Adware.GameVance) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{BEAC7DC8-E106-4C6A-931E-5A42E7362883} (Adware.GameVance) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\CLASSES\CLSID\{42AEDC87-2188-41FD-B9A3-0C966FEABEC1}\INPROCSERVER32 (Trojan.Zaccess) -> Quarantined and deleted successfully.

Registry Values Detected: 1
HKCU\SOFTWARE\CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32| (Trojan.Zaccess) -> Data: C:\Users\Jhon\AppData\Local\{f801c6f4-18a7-4cce-d235-b433dd906697}\n. -> Quarantined and deleted successfully.

Registry Data Items Detected: 1
HKCR\regfile\shell\open\command| (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and repaired successfully.

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Windows\assembly\GAC\Desktop.ini (Trojan.0access) -> Quarantined and deleted successfully.

After a full scan, I found even more:

Files Detected: 6
C:\Users\Jhon\AppData\Local\{f801c6f4-18a7-4cce-d235-b433dd906697}\U\000000cb.@ (Rootkit.0Access) -> Quarantined and deleted successfully.
C:\Users\Jhon\AppData\Local\{f801c6f4-18a7-4cce-d235-b433dd906697}\U\00000004.@ (Rootkit.Zaccess) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\DRM\C3E4.tmp (Trojan.Agent.EXPD1) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\DRM\C1DB.tmp (Trojan.Agent.EXPD1) -> Quarantined and deleted successfully.
C:\Users\Jhon\AppData\Local\{f801c6f4-18a7-4cce-d235-b433dd906697}\U\00000008.@ (Trojan.Dropper.BCMiner) -> Quarantined and deleted successfully.
C:\Users\Jhon\AppData\Local\{f801c6f4-18a7-4cce-d235-b433dd906697}\U\80000000.@ (Trojan.Small) -> Quarantined and deleted successfully.

However, now it is saying that it is blocking:

95.211.194.79

Type: outgoing

Port: 59372

Process: svchost.exe

And it is saying this a lot. I'm thinking there is still remnants of an infection here and I was wondering if anyone could help me clean this computer.

DDS (Ver_2012-11-20.01) - NTFS_x86

Internet Explorer: 8.0.7600.17006 BrowserJavaVersion: 10.25.2

Run by Jhon at 10:08:43 on 2013-07-25

.

============== Running Processes ================

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\System32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\AVG\AVG10\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe

C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\loggingserver.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\AVG Secure Search\vprot.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Windows\system32\SearchIndexer.exe

C:\Users\Jhon\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Users\Jhon\AppData\Local\Google\Chrome\Application\chrome.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\system32\wuauclt.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe -k hpdevmgmt

C:\Windows\System32\svchost.exe -k HPZ12

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\system32\svchost.exe -k HPService

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\System32\svchost.exe -k WerSvcGroup

.

============== Pseudo HJT Report ===============

.

uSearch Bar = Preserve

uURLSearchHooks: {A3BC75A2-1F87-4686-AA43-5347D756017C} - <orphaned>

dURLSearchHooks: {A3BC75A2-1F87-4686-AA43-5347D756017C} - <orphaned>

BHO: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - c:\program files\avg\avg10\avgssie.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll

BHO: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - c:\program files\avg secure search\15.2.0.5\AVG Secure Search_toolbar.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll

BHO: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll

TB: <No Name>: {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - LocalServer32 - <no file>

TB: AVG Security Toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - c:\program files\avg secure search\15.2.0.5\AVG Secure Search_toolbar.dll

EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll

uRun: [Google Update] "c:\users\jhon\appdata\local\google\update\GoogleUpdate.exe" /c

mRun: [vProt] "c:\program files\avg secure search\vprot.exe"

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

dRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\FlashUtil10k_ActiveX.exe -update activex

uPolicies-Explorer: NoDriveTypeAutoRun = dword:255

mPolicies-Explorer: NoDriveTypeAutoRun = dword:255

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll

TCP: NameServer = 192.168.1.1

TCP: Interfaces\{D5923959-5239-43FB-906C-D776B33DDD90} : DHCPNameServer = 192.168.1.1

TCP: Interfaces\{E21997EF-0D24-4E8F-B488-64A90FE16DEF} : DHCPNameServer = 192.168.1.1

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll

Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\common files\avg secure search\viprotocolinstaller\15.2.0\ViProtocol.dll

SSODL: WebCheck - <orphaned>

.

============= SERVICES / DRIVERS ===============

.

=============== File Associations ===============

.

.vbe: <filetype is not registered>

FileExt: .vbs: VBSFile - HKCR\Unknown\Shell=c:\windows\system32\rundll32.exe c:\windows\system32\shell32.dll,OpenAs_RunDLL %1 [userChoice] [default=openas]

.

=============== Created Last 30 ================

.

2013-07-25 03:06:50 -------- d-sh--w- C:\$RECYCLE.BIN

2013-07-25 03:04:48 -------- d-s---w- C:\ComboFix

2013-07-25 01:01:46 -------- d-----w- c:\users\jhon\Buried614_Cache

2013-07-25 00:22:23 -------- d-----w- c:\users\jhon\.soulsplit2

2013-07-25 00:01:27 -------- d-----w- C:\.soulsplit2

2013-07-24 23:58:01 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll

2013-07-23 22:25:36 768512 ----a-w- c:\windows\system32\localspl.dll

2013-07-23 03:16:27 98816 ----a-w- c:\windows\sed.exe

2013-07-23 03:16:27 256000 ----a-w- c:\windows\PEV.exe

2013-07-23 03:16:27 208896 ----a-w- c:\windows\MBR.exe

2013-07-22 23:18:43 -------- d-----w- c:\users\jhon\appdata\roaming\Malwarebytes

2013-07-22 23:17:38 -------- d-----w- c:\programdata\Malwarebytes

2013-07-22 23:17:37 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2013-07-22 23:17:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2013-07-22 23:17:26 -------- d-----w- c:\users\jhon\appdata\local\Programs

2013-07-08 00:00:08 -------- d-----w- c:\users\jhon\validuscache

.

==================== Find3M ====================

.

2013-07-24 23:56:58 867240 ----a-w- c:\windows\system32\npDeployJava1.dll

2013-07-24 23:56:58 789416 ----a-w- c:\windows\system32\deployJava1.dll

2013-06-01 10:40:11 37664 ----a-w- c:\windows\system32\drivers\avgtpx86.sys

.

=================== ROOTKIT ====================

.

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net

Windows 6.1.7600 Disk: WDC_WD16 rev.10.0 -> Harddisk0\DR0 ->

.

device: opened successfully

user: MBR read successfully

.

Disk trace:

called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll >>UNKNOWN [0x8689B4B1]<<

_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x868a293c]; MOV EAX, [0x868a2ab0]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }

1 ntkrnlpa!IofCallDriver[0x82C49458] -> \Device\Harddisk0\DR0[0x8651C888]

3 CLASSPNP[0x837D759E] -> ntkrnlpa!IofCallDriver[0x82C49458] -> [0x859DFF08]

5 ACPI[0x833B33B2] -> ntkrnlpa!IofCallDriver[0x82C49458] -> \00000079[0x859DF9D0]

\Driver\nvstor[0x8686FCE8] -> IRP_MJ_CREATE -> 0x8689B4B1

kernel: MBR read successfully

_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; MOV ES, AX; MOV DS, AX; MOV SI, 0x7c00; MOV DI, 0x600; MOV CX, 0x200; CLD ; REP MOVSB ; PUSH AX; PUSH 0x61c; RETF ; STI ; MOV CX, 0x4; MOV BP, 0x7be; CMP BYTE [bP+0x0], 0x0; }

detected disk devices:

\Device\00000079 -> \??\SCSI#Disk&Ven_WDC_WD16&Prod_00JS-08NCB1#4&2a9db3b6&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found

detected hooks:

user & kernel MBR OK

Warning: possible TDL3 rootkit infection !

.

============= FINISH: 10:13:39.85 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

==== Disk Partitions =========================

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

No restore point in system.

.

==== Installed Programs ======================

.

32 Bit HP CIO Components Installer

Adobe Download Assistant

Adobe Download Manager

Adobe Flash Player 10 ActiveX

Adobe Reader 9.5.2

Adobe Shockwave Player 11.5

Apple Mobile Device Support

Apple Software Update

ATI Catalyst Install Manager

AVG 2011

AVG 2012

AVG Security Toolbar

Bonjour

BufferChm

CCleaner

Compatibility Pack for the 2007 Office system

Copy

Destinations

DeviceDiscovery

DJ_AIO_06_F4500_SW_MIN

F4500

Google Chrome

Google Talk Plugin

GPBaseService2

HP Customer Participation Program 14.0

HP Deskjet F4500 All-in-One Driver Software 14.0 Rel. 6

HP Imaging Device Functions 14.0

HP Smart Web Printing 4.60

HP Solution Center 14.0

HP Update

HPPhotoGadget

HPProductAssistant

HPSSupply

HyperCam

Java 7 Update 25

Java Auto Updater

Java DB 10.5.3.0

Java SE Development Kit 7 Update 25

JavaFX 2.1.1

JavaFX 2.1.1 SDK

Logitech Vid HD

Logitech Webcam Software Driver Package

Malwarebytes Anti-Malware version 1.75.0.1300

MarketResearch

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Extended

Microsoft .NET Framework 4 Multi-Targeting Pack

Microsoft Application Error Reporting

Microsoft Help Viewer 1.0

Microsoft IntelliPoint 8.2

Microsoft Office PowerPoint Viewer 2007 (English)

Microsoft Office Word Viewer 2003

Microsoft SQL Server Compact 3.5 SP2 ENU

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

MSVCRT Redists

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Network

OGA Notifier 2.0.0048.0

Scan

Security Update for CAPICOM (KB931906)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Security Update for Microsoft .NET Framework 4 Extended (KB2416472)

Security Update for Microsoft .NET Framework 4 Extended (KB2487367)

Security Update for Microsoft .NET Framework 4 Extended (KB2656351)

Shop for HP Supplies

Skype™ 5.1

SmartWebPrinting

SolutionCenter

Status

Toolbox

TrayApp

Update for Microsoft .NET Framework 4 Client Profile (KB2473228)

WebReg

Windows Media Player Firefox Plugin

WinRAR archiver

.

==== End Of File ===========================

MrCharlie · July 25, 2013

Welcome to the forum.

Please download and run RogueKiller 32 Bit to your desktop.

RogueKiller 64 Bit <---use this one for 64 bit systems

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

(please don't put logs in code or quotes)

P2P/Piracy Warning:

1. If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
2. If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

MrC

Note:

Please read all of my instructions completely including these.

Make sure you're subscribed to this topic: Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly

Removing malware can be unpredictable...unlikely but things can go very wrong! Backup any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive

<+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

<+>The removal of malware isn't instantaneous, please be patient.

<+>Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that.

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 24 hours, please send me a PM)

Xiduth · July 25, 2013

Thank you for the fast response. I downloaded RK and moved it to my desktop. However, when I ran as administrator, RK just disappeared. It wasn't in the recycle bin or anywhere. I re-downloaded it, but now it says I don't have permission to move it to the desktop, which has never happened before.

Xiduth · July 25, 2013

Sorry for the double but it also won't allow me to update windows if that helps.

MrCharlie · July 25, 2013

Please read the directions carefully so you don't end up deleting something that is good!!

If in doubt about an entry....please ask or choose Skip!!!!

Don't Delete anything unless instructed to!

If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose

Skip and click on Continue

If a suspicious object is detected, the default action will be Skip, click on Continue

Please note that TDSSKiller can be run in safe mode if needed.

Here's a video that explains how to run it if needed:

How To Run TDSSKiller

Please download the latest version of TDSSKiller from HERE and save it to your Desktop.

Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.
Put a checkmark beside loaded modules.
A reboot will be needed to apply the changes. Do it.
TDSSKiller will launch automatically after the reboot. Also your computer may seem very slow and unusable. This is normal. Give it enough time to load your background programs.
Then click on Change parameters in TDSSKiller.
Check all boxes then click OK.
Click the Start Scan button.
The scan should take no longer than 2 minutes.
If a suspicious object is detected, the default action will be Skip, click on Continue.

Any entries like this: \Device\Harddisk0\DR0 ( TDSS File System ) - please choose Skip.
If in doubt about an entry....please ask or choose Skip
If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.

Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here. There may be 3 logs > so post or attach all of them.
Sometimes these logs can be very large, in that case please attach it or zip it up and attach it.

Here's a summary of what to do if you would like to print it out:

If in doubt about an entry....please ask or choose Skip

Don't Delete anything unless instructed to!

If a suspicious object is detected, the default action will be Skip, click on Continue

If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose

Skip and click on Continue

Any entries like this: \Device\Harddisk0\DR0 ( TDSS File System ) - please choose Skip.

If malicious objects are found, they will show in the Scan results and offer three (3) options.

Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.

Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

~~~~~~~~~~~~~~~~~~~~

You can attach the logs if they're too long:

Bottom right corner of this page.

New window that comes up.

MrC

Xiduth · July 25, 2013

Thank you again MrC,

It came up with an entry I'm not sure about, however it says its high risk:

Rootkit.Boot.Pihar

\Device\Harddisk0\DR0

It shows 2 of the \Device\Harddisk0\DR0, one of them as shown above and the other as the TDSS File System. Do I still leave it as skip? Im confused as whether to leave all of them as skip or certain ones as Copy to Quarantine.

Xiduth · July 25, 2013

I read as you had stated above, leave all of the /device/harddisk0/dr0 as skip, however I just wanted to confirm whether to skip/cure. Clearing up the above post.

MrCharlie · July 25, 2013

Rootkit.Boot.Pihar <---Cure

TDSS File System <----Skip

MrC

Xiduth · July 25, 2013

Thank you again.

TDSSKiller.2.8.18.0_25.07.2013_12.31.54_log.txt TDSSKiller.2.8.18.0_25.07.2013_12.21.38_log.txt TDSSKiller.2.8.18.0_25.07.2013_12.12.49_log.txt

MrCharlie · July 25, 2013

Now you can delete the TDSS File System:

Run TDSSKiller again and choose Delete for this one only: (no need to post the log)

13:07:51.0980 2800 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user
13:07:51.0980 2800 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip

---------------------------------------

Next:

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

Xiduth · July 25, 2013

ComboFix 13-07-25.02 - Jhon 07/25/2013 14:35:01.2.2 - x86

Running from: c:\users\Jhon\Desktop\ComboFix.exe

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\users\Jhon\AppData\Roaming\193334A8D1A6415994998556736BDFE0.dat

c:\users\Jhon\AppData\Roaming\AdVantage

c:\users\Jhon\AppData\Roaming\RSBot.db

c:\users\Jhon\WINDOWS

c:\users\Jhon\WINDOWS\crc32.crc

c:\windows\system32\3500_256.dll

c:\windows\system32\bin

c:\windows\system32\frapsvid.dll

c:\windows\XSxS

.

((((((((((((((((((((((((( Files Created from 2013-06-26 to 2013-07-26 )))))))))))))))))))))))))))))))

.

2013-07-26 02:43 . 2013-07-26 02:43 -------- d-----w- c:\users\Jhon\AppData\Local\temp

2013-07-26 02:43 . 2013-07-26 02:43 -------- d-----w- c:\users\Default\AppData\Local\temp

2013-07-26 02:12 . 2013-07-26 02:12 -------- d-----w- c:\program files\AVG Secure Search

2013-07-25 00:01 . 2013-07-25 00:05 -------- d-----w- C:\.soulsplit2

2013-07-24 23:58 . 2013-07-24 23:56 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll

2013-07-23 22:25 . 2012-05-14 04:37 768512 ----a-w- c:\windows\system32\localspl.dll

2013-07-22 23:18 . 2013-07-22 23:18 -------- d-----w- c:\users\Jhon\AppData\Roaming\Malwarebytes

2013-07-22 23:17 . 2013-07-22 23:17 -------- d-----w- c:\programdata\Malwarebytes

2013-07-22 23:17 . 2013-07-22 23:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2013-07-22 23:17 . 2013-04-05 02:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys

2013-07-22 23:17 . 2013-07-22 23:17 -------- d-----w- c:\users\Jhon\AppData\Local\Programs

2013-07-08 00:00 . 2013-07-08 00:00 -------- d-----w- c:\users\Jhon\validuscache

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-07-24 23:56 . 2012-05-26 15:04 867240 ----a-w- c:\windows\system32\npDeployJava1.dll

2013-07-24 23:56 . 2010-07-19 23:59 789416 ----a-w- c:\windows\system32\deployJava1.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil10k_ActiveX.exe" [2006-04-09 232912]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux1"=wdmaud.drv

.

SafeBoot registry key needs repairs. This machine cannot enter Safe Mode.

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system]

@="Driver Group"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys]

@="Driver"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]

@="DiskDrive"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]

@="Hdc"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]

@="Keyboard"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]

@="Mouse"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]

@="System"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]

@="Volume"

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2012-07-11 19:00 919008 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2012-07-31 11:20 38872 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]

2012-08-28 09:32 59280 ----a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG_TRAY]

2011-09-10 14:28 2338656 ----a-w- c:\program files\AVG\AVG10\avgtray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]

2009-11-19 00:13 54576 ----a-w- c:\program files\HP\HP Software Update\hpwuschd2.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelliPoint]

2011-08-01 23:56 1821576 ----a-w- c:\program files\Microsoft IntelliPoint\ipoint.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vProt]

2013-07-26 02:12 218440 ------w- c:\program files\AVG Secure Search\vprot.exe

.

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-05 701512]

R3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\AVG\AVG10\Toolbar\ToolbarBroker.exe [2011-11-10 167264]

R3 dc3d;MS Hardware Device Detection Driver (HID);c:\windows\system32\DRIVERS\dc3d.sys [2010-04-17 22416]

R3 nosGetPlusHelper;getPlus® Helper 3004;c:\windows\System32\svchost.exe [2009-07-14 20992]

R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2010-06-15 3583592]

R3 SWDUMon;SWDUMon;c:\windows\system32\DRIVERS\SWDUMon.sys [2011-04-29 11232]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-07-01 1343400]

S0 AVGIDSEH;AVGIDSEH;c:\windows\system32\DRIVERS\AVGIDSEH.Sys [2011-02-22 22992]

S1 Avgtdix;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdix.sys [2011-04-05 297168]

S1 HssDRV6;Hotspot Shield Routing Driver 6;c:\windows\system32\DRIVERS\hssdrv6.sys [2012-07-24 35560]

S2 avgwd;AVG WatchDog;c:\program files\AVG\AVG10\avgwdsvc.exe [2011-02-08 269520]

S2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-04-05 418376]

S2 vToolbarUpdater;vToolbarUpdater;c:\program files\Common Files\AVG Secure Search\vToolbarUpdater\8.0.1\ToolbarUpdater.exe [2013-07-26 246600]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-04-05 22856]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

nosGetPlusHelper REG_MULTI_SZ nosGetPlusHelper

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

HPService REG_MULTI_SZ HPSLPSVC

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

.

Contents of the 'Scheduled Tasks' folder

.

2013-07-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3737616515-2033285701-3433021707-1000Core.job

- c:\users\Jhon\AppData\Local\Google\Update\GoogleUpdate.exe [2006-01-12 06:54]

.

2013-07-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3737616515-2033285701-3433021707-1000UA.job

- c:\users\Jhon\AppData\Local\Google\Update\GoogleUpdate.exe [2006-01-12 06:54]

.

------- Supplementary Scan -------

.

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

Trusted Zone: adobe.com\www

Trusted Zone: facebook.com\www

TCP: DhcpNameServer = 192.168.1.1

Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files\Common Files\AVG Secure Search\ViProtocolInstaller\8.0.1\ViProtocol.dll

.

- - - - ORPHANS REMOVED - - - -

.

URLSearchHooks-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)

BHO-{95B7759C-8C7F-4BF1-B163-73684A933233} - c:\program files\AVG Secure Search\8.0.0.34\AVG Secure Search_toolbar.dll

Toolbar-{95B7759C-8C7F-4BF1-B163-73684A933233} - c:\program files\AVG Secure Search\8.0.0.34\AVG Secure Search_toolbar.dll

SafeBoot-01684263.sys

SafeBoot-12887236.sys

SafeBoot-72862528.sys

MSConfigStartUp-iTunesHelper - c:\program files\iTunes\iTunesHelper.exe

MSConfigStartUp-Logitech Vid - c:\program files\Logitech\Vid HD\Vid.exe

MSConfigStartUp-LogitechQuickCamRibbon - c:\program files\Logitech\Logitech WebCam Software\LWS.exe

MSConfigStartUp-QuickTime Task - c:\program files\QuickTime\QTTask.exe

MSConfigStartUp-ROC_roc_dec12 - c:\program files\AVG Secure Search\ROC_roc_dec12.exe

AddRemove-Logitech Vid - c:\program files\Logitech\Vid HD\uninst.exe

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_USERS\S-1-5-21-3737616515-2033285701-3433021707-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.download\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="SafariDownload"

.

[HKEY_USERS\S-1-5-21-3737616515-2033285701-3433021707-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]

@Denied: (2) (S-1-5-21-3737616515-2033285701-3433021707-1000)

@Denied: (2) (LocalSystem)

"Progid"="FirefoxHTML"

.

[HKEY_USERS\S-1-5-21-3737616515-2033285701-3433021707-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]

@Denied: (2) (S-1-5-21-3737616515-2033285701-3433021707-1000)

@Denied: (2) (LocalSystem)

"Progid"="FirefoxHTML"

.

[HKEY_USERS\S-1-5-21-3737616515-2033285701-3433021707-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.safariextz\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="SafariExtension"

.

[HKEY_USERS\S-1-5-21-3737616515-2033285701-3433021707-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]

@Denied: (2) (S-1-5-21-3737616515-2033285701-3433021707-1000)

@Denied: (2) (LocalSystem)

"Progid"="FirefoxHTML"

.

[HKEY_USERS\S-1-5-21-3737616515-2033285701-3433021707-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="SafariHTML"

.

[HKEY_USERS\S-1-5-21-3737616515-2033285701-3433021707-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.webarchive\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="SafariHTML"

.

[HKEY_USERS\S-1-5-21-3737616515-2033285701-3433021707-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]

@Denied: (2) (S-1-5-21-3737616515-2033285701-3433021707-1000)

@Denied: (2) (LocalSystem)

"Progid"="FirefoxHTML"

.

[HKEY_USERS\S-1-5-21-3737616515-2033285701-3433021707-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]

@Denied: (2) (S-1-5-21-3737616515-2033285701-3433021707-1000)

@Denied: (2) (LocalSystem)

"Progid"="FirefoxHTML"

.

[HKEY_USERS\S-1-5-21-3737616515-2033285701-3433021707-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="SafariHTML"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Completion time: 2013-07-25 14:44:37

ComboFix-quarantined-files.txt 2013-07-26 02:44

.

Pre-Run: 113,297,268,736 bytes free

Post-Run: 113,370,013,696 bytes free

.

- - End Of File - - BD7C9B3E66A27E5EA2BB39ECA5F27400

A36C5E4F47E84449FF07ED3517B43A31