nojustice7 Posted August 19, 2013 ID:717393 Share Posted August 19, 2013 Hello, my laptop has contracted the FBI moneypak malware. I have encountered different renditions of this malware several times before and seemed to successfully remove it via step by step instructions according to a youtube video. The issue now is that I cannot log into safe mode or safe mode with command prompt to remove the malware. Every time that I try to sign in, a few seconds into the loading for the login I am logged off and the computer is automatically restarted. I have no option but a regular login where the ransomware appears and advertises its demands. What can I do to remove this kind of moneypak? It has probably been around two weeks since I've been able to use my laptop. Link to post Share on other sites More sharing options...
MrCharlie Posted August 19, 2013 ID:717426 Share Posted August 19, 2013 Welcome to the forum, here's how we deal with that malware:Please download Farbar Recovery Scan Tool and save it to a flash drive. Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version. Plug the flash drive into the infected PC.If you are using Windows 8 consult How to use the Windows 8 System Recovery Environment Command Prompt to enter System Recovery Command prompt. If you are using Vista or Windows 7 enter System Recovery Options. To enter System Recovery Options from the Advanced Boot Options:Restart the computer.As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.Use the arrow keys to select the Repair your computer menu item.Select US as the keyboard language settings, and then click Next.Select the operating system you want to repair, and then click Next.Select your user account an click Next.Note: In case you can not enter System Recovery Options by using F8 method, you can use Windows installation disc, or make a repair disc. Any Windows installation disc or a repair disc made on another computer can be used. To make a repair disk on Windows 7 consult: http://www.sevenforums.com/tutorials/2083-system-repair-disc-create.html To enter System Recovery Options by using Windows installation disc:Insert the installation disc.Restart your computer.If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.Click Repair your computer.Select US as the keyboard language settings, and then click Next.Select the operating system you want to repair, and then click Next.Select your user account and click Next.On the System Recovery Options menu you will get the following options:Startup Repair System Restore Windows Complete PC Restore Windows Memory Diagnostic Tool Command Prompt Select Command Prompt Once in the Command Prompt:In the command window type in notepad and press Enter.The notepad opens. Under File menu select Open.Select "Computer" and find your flash drive letter and close the notepad.In the command window type e:\frst (for x64 bit version type e:\frst64) and press Enter Note: Replace letter e with the drive letter of your flash drive.The tool will start to run.When the tool opens click Yes to disclaimer.Press Scan button.It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.MrC Link to post Share on other sites More sharing options...
nojustice7 Posted August 21, 2013 Author ID:718501 Share Posted August 21, 2013 Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-08-2013 04Ran by SYSTEM on 21-08-2013 18:58:42Running from H:\Windows 7 Home Premium (X64) OS Language: English(US)Internet Explorer Version 10Boot Mode: RecoveryThe current controlset is ControlSet001ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.==================== Registry (Whitelisted) ==================HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9644576 2009-12-14] (Realtek Semiconductor)HKLM\...\Run: [intelWireless] - C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1928976 2010-03-04] (Intel® Corporation)HKLM\...\Run: [synTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2074408 2010-02-26] (Synaptics Incorporated)HKLM-x32\...\Run: [updateLBPShortCut] - C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)HKLM-x32\...\Run: [CLMLServer] - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-12-03] (CyberLink)HKLM-x32\...\Run: [updateP2GoShortCut] - C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)HKLM-x32\...\Run: [updatePDRShortCut] - C:\Program Files (x86)\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)HKLM-x32\...\Run: [RemoteControl8] - C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe [91432 2009-07-16] (CyberLink Corp.)HKLM-x32\...\Run: [PDVD8LanguageShortcut] - C:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe [50472 2009-04-15] (CyberLink Corp.)HKLM-x32\...\Run: [bDRegion] - C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe [75048 2010-01-12] (cyberlink)HKLM-x32\...\Run: [updatePPShortCut] - C:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)HKLM-x32\...\Run: [updatePSTShortCut] - C:\Program Files (x86)\CyberLink\Blu-ray Disc Suite\MUITransfer\MUIStartMenu.exe [210216 2010-01-11] (CyberLink Corp.)HKLM-x32\...\Run: [uCam_Menu] - C:\Program Files (x86)\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)HKLM-x32\...\Run: [sunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [249064 2010-10-29] (Sun Microsystems, Inc.)HKLM-x32\...\Run: [] - [x]HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-01-28] (Apple Inc.)HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-10-24] (Apple Inc.)HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-02-20] (Apple Inc.)HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [x]HKU\Chris\...\Run: [Google Update] - C:\Users\Chris\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-10-18] (Google Inc.)HKU\Chris\...\Run: [MobileDocuments] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe [x]HKU\Chris\...\Run: [iCloudServices] - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59872 2012-12-17] (Apple Inc.)HKU\Chris\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-05-02] (Google Inc.)HKU\Chris\...\Run: [Google Update] - C:\Users\Chris\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-10-18] (Google Inc.)HKU\Chris\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\Users\Chris\AppData\Local\Temp\sbhmylqdxxcpobqgr.exe [68608 2013-07-31] () <===== ATTENTIONHKU\Chris\...\RunOnce: [FlashPlayerUpdate] - C:\windows\SysWOW64\Macromed\Flash\FlashUtil32_11_7_700_224_ActiveX.exe [814472 2013-06-11] (Adobe Systems Incorporated)HKU\Chris\...\Winlogon: [shell] cmd.exe [345088 2010-11-20] (Microsoft Corporation) <==== ATTENTIONHKU\Chris\...\Command Processor: "C:\Users\Chris\AppData\Local\Temp\sbhmylqdxxcpobqgr.exe" <===== ATTENTION!HKU\Mcx1-CHRIS-PC\...\Winlogon: [shell] C:\windows\eHome\McrMgr.exe [343552 2009-07-13] (Microsoft Corporation) <==== ATTENTIONAppInit_DLLs: [0 ] ()AppInit_DLLs-x32: c:\progra~2\websea~1\sprote~1.dll [1044480 2013-01-24] ()Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Best Buy Software Installer.lnkShortcutTarget: Best Buy Software Installer.lnk -> C:\Program Files\Best Buy Software Installer\Best Buy Software Installer.exe (Best Buy®)Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Best Buy Software Installer.lnkShortcutTarget: Best Buy Software Installer.lnk -> C:\Program Files\Best Buy Software Installer\Best Buy Software Installer.exe (Best Buy®)Startup: C:\Users\Mcx1-CHRIS-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Best Buy Software Installer.lnkShortcutTarget: Best Buy Software Installer.lnk -> C:\Program Files\Best Buy Software Installer\Best Buy Software Installer.exe (Best Buy®)==================== Services (Whitelisted) =================S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2010-03-04] ()S2 NSL; C:\Program Files (x86)\Norton Safe Web Lite\Engine\1.2.0.7\ccSvcHst.exe [130000 2010-11-23] (Symantec Corporation)S2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-07-07] ()S2 0034851374939269mcinstcleanup; C:\Users\Chris\AppData\Local\Temp\003485~1.EXE -cleanup -nolog [x]==================== Drivers (Whitelisted) ====================S3 usbio; C:\Windows\System32\Drivers\dsiarhwprog_x64.sys [51600 2007-02-08] (Thesycon GmbH, Germany)S3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-09-28] ()S2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}; C:\Program Files (x86)\CyberLink\PowerDVD8\000.fcl [146928 2010-01-12] (CyberLink Corp.)S2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}; C:\Program Files (x86)\CyberLink\PowerDVD8\000.fcl [146928 2010-01-12] (CyberLink Corp.)==================== NetSvcs (Whitelisted) ======================================= One Month Created Files and Folders ========2013-07-31 17:14 - 2013-07-31 17:14 - 02019329 _____ C:\ProgramData\2433f4332013-07-31 17:14 - 2013-07-31 17:14 - 02019312 _____ C:\Users\Chris\AppData\Roaming\2433f4332013-07-31 17:14 - 2013-07-31 17:14 - 02019307 _____ C:\Users\Chris\AppData\Local\2433f4332013-07-28 18:03 - 2013-07-28 18:03 - 00000098 ____H C:\Users\Chris\Downloads\.~lock.ePayroll Brochure 2012.doc#2013-07-27 14:54 - 2013-07-28 16:22 - 00000000 ____D C:\Users\Chris\AppData\Roaming\PhotoScape2013-07-27 14:53 - 2013-07-27 14:53 - 06578310 _____ C:\Users\Chris\Downloads\Attachments_2013727.zip2013-07-27 14:52 - 2013-07-27 14:54 - 00000000 ____D C:\Program Files (x86)\PhotoScape2013-07-27 14:52 - 2013-07-27 14:52 - 00001031 _____ C:\Users\Chris\Desktop\PhotoScape.lnk2013-07-27 14:51 - 2013-07-27 14:51 - 21331096 _____ (Mooii) C:\Users\Chris\Downloads\PhotoScape_V3.6.5.exe2013-07-27 08:27 - 2013-07-27 08:27 - 00072240 _____ C:\Users\Chris\AppData\Local\GDIPFONTCACHEV1.DAT2013-07-23 17:02 - 2013-04-25 21:51 - 00751104 _____ (Microsoft Corporation) C:\Windows\System32\win32spl.dll2013-07-23 17:02 - 2013-04-25 20:55 - 00492544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll==================== One Month Modified Files and Folders =======2013-08-21 18:58 - 2013-08-21 18:58 - 00000000 ____D C:\FRST2013-07-31 18:13 - 2010-08-30 00:45 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job2013-07-31 18:12 - 2013-05-14 05:16 - 00002856 _____ C:\Windows\setupact.log2013-07-31 18:12 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT2013-07-31 17:14 - 2013-07-31 17:14 - 02019329 _____ C:\ProgramData\2433f4332013-07-31 17:14 - 2013-07-31 17:14 - 02019312 _____ C:\Users\Chris\AppData\Roaming\2433f4332013-07-31 17:14 - 2013-07-31 17:14 - 02019307 _____ C:\Users\Chris\AppData\Local\2433f4332013-07-31 17:13 - 2010-08-27 06:13 - 00000000 ____D C:\Users\Chris\AppData\Local\Google2013-07-31 17:10 - 2013-05-14 05:19 - 01589776 _____ C:\Windows\WindowsUpdate.log2013-07-31 17:00 - 2011-12-07 10:08 - 00000908 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2950786308-227742302-1544317472-1000UA.job2013-07-31 17:00 - 2010-08-30 00:45 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job2013-07-31 16:58 - 2012-07-18 07:05 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job2013-07-31 14:12 - 2011-12-07 10:08 - 00000856 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2950786308-227742302-1544317472-1000Core.job2013-07-30 19:22 - 2011-09-23 07:45 - 00000452 ____H C:\Windows\Tasks\Norton Security Scan for Chris.job2013-07-28 18:03 - 2013-07-28 18:03 - 00000098 ____H C:\Users\Chris\Downloads\.~lock.ePayroll Brochure 2012.doc#2013-07-28 16:22 - 2013-07-27 14:54 - 00000000 ____D C:\Users\Chris\AppData\Roaming\PhotoScape2013-07-28 13:16 - 2009-07-13 20:45 - 00014144 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A02013-07-28 13:16 - 2009-07-13 20:45 - 00014144 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A02013-07-27 14:54 - 2013-07-27 14:52 - 00000000 ____D C:\Program Files (x86)\PhotoScape2013-07-27 14:53 - 2013-07-27 14:53 - 06578310 _____ C:\Users\Chris\Downloads\Attachments_2013727.zip2013-07-27 14:52 - 2013-07-27 14:52 - 00001031 _____ C:\Users\Chris\Desktop\PhotoScape.lnk2013-07-27 14:51 - 2013-07-27 14:51 - 21331096 _____ (Mooii) C:\Users\Chris\Downloads\PhotoScape_V3.6.5.exe2013-07-27 08:27 - 2013-07-27 08:27 - 00072240 _____ C:\Users\Chris\AppData\Local\GDIPFONTCACHEV1.DAT2013-07-27 08:26 - 2009-07-13 21:13 - 00727334 _____ C:\Windows\System32\PerfStringBackup.INI2013-07-27 07:46 - 2013-07-21 11:10 - 00004828 _____ C:\Windows\PFRO.log2013-07-27 07:34 - 2013-06-27 15:19 - 00000000 ____D C:\Program Files\McAfee2013-07-23 17:34 - 2009-07-13 20:45 - 00320552 _____ C:\Windows\System32\FNTCACHE.DAT2013-07-23 17:30 - 2010-05-03 14:38 - 00000000 ____D C:\Program Files\Windows Journal2013-07-23 17:30 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files\Windows Defender2013-07-23 17:30 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files (x86)\Windows DefenderZeroAccess:C:\$Recycle.Bin\S-1-5-21-2950786308-227742302-1544317472-1000\$8b29f98aca21910275e3c79a5aa0f795Files to move or delete:====================C:\Users\Chris\AppData\Local\Temp\sbhmylqdxxcpobqgr.exeZeroAccess:C:\Users\Chris\AppData\Local\Google\Desktop\Install\{8b29f98a-ca21-9102-75e3-c79a5aa0f795}==================== Known DLLs (Whitelisted) ==================================== Bamital & volsnap Check =================C:\Windows\System32\winlogon.exe => MD5 is legitC:\Windows\System32\wininit.exe => MD5 is legitC:\Windows\SysWOW64\wininit.exe => MD5 is legitC:\Windows\explorer.exe => MD5 is legitC:\Windows\SysWOW64\explorer.exe => MD5 is legitC:\Windows\System32\svchost.exe => MD5 is legitC:\Windows\SysWOW64\svchost.exe => MD5 is legitC:\Windows\System32\services.exe => MD5 is legitC:\Windows\System32\User32.dll => MD5 is legitC:\Windows\SysWOW64\User32.dll => MD5 is legitC:\Windows\System32\userinit.exe => MD5 is legitC:\Windows\SysWOW64\userinit.exe => MD5 is legitC:\Windows\System32\Drivers\volsnap.sys => MD5 is legitATTENTION: ZeroAccess. Use DeleteJunctionsIndirectory: C:\Windows\system64==================== EXE ASSOCIATION =====================HKLM\...\.exe: exefile => OKHKLM\...\exefile\DefaultIcon: %1 => OKHKLM\...\exefile\open\command: "%1" %* => OK==================== Restore Points =========================Restore point made on: 2013-07-21 08:57:48Restore point made on: 2013-07-23 16:48:07Restore point made on: 2013-07-25 14:01:55==================== Memory info =========================== Percentage of memory in use: 15%Total physical RAM: 3892.54 MBAvailable physical RAM: 3272.1 MBTotal Pagefile: 3890.69 MBAvailable Pagefile: 3268.82 MBTotal Virtual: 8192 MBAvailable Virtual: 8191.85 MB==================== Drives ================================Drive c: () (Fixed) (Total:100 GB) (Free:26.23 GB) NTFSDrive e: () (Fixed) (Total:350.66 GB) (Free:340.82 GB) NTFSDrive f: (RECOVERY) (Fixed) (Total:15 GB) (Free:2.12 GB) NTFS ==>[system with boot components (obtained from reading drive)]Drive g: (Shape Your Face) (CDROM) (Total:1.14 GB) (Free:0 GB) UDFDrive h: () (Removable) (Total:0.94 GB) (Free:0.94 GB) FATDrive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFSDrive y: (SYSTEM) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[system with boot components (obtained from reading drive)]==================== MBR & Partition Table ==========================================================================Disk: 0 (Size: 466 GB) (Disk ID: 376EA6A7)Partition 1: (Not Active) - (Size=15 GB) - (Type=27)Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)Partition 3: (Not Active) - (Size=100 GB) - (Type=07 NTFS)Partition 4: (Not Active) - (Size=351 GB) - (Type=07 NTFS)========================================================Disk: 1 (Size: 962 MB) (Disk ID: 73696420)No partition Table on disk 1.LastRegBack: 2013-06-18 17:33==================== End Of Log ============================ Link to post Share on other sites More sharing options...
MrCharlie Posted August 21, 2013 ID:718510 Share Posted August 21, 2013 Please read the following information first. You're infected with Rootkit.ZeroAccess, a BackDoor Trojan also.BACKDOOR WARNING------------------------------One or more of the identified infections is known to use a backdoor.This allows hackers to remotely control your computer, steal critical system information and download and execute files.I would advice you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.Though the infection has been identified and because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?http://www.dslreports.com/faq/10451When Should I Format, How Should I Reinstallhttp://www.dslreports.com/faq/10063I will try my best to clean this machine but I can't guarantee that it will be 100% secure afterwards.Let me know what you decide to do. If you decide to go through with the cleanup, please proceed with the following steps.-----------------------------------------OK, here you go......this should get you going:Please download the attached fixlist.txt and copy it to your flashdrive.NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating systemOn Vista or Windows 7: Now please enter System Recovery Options. (as you did before)Run FRST64 or FRST (which ever one you're using) and press the Fix button just once and wait.The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.See if the computer boots normally now and if so..........run MBARIf not...rescan with FRST and post the new logDownload Malwarebytes Anti-Rootkit from HEREUnzip the contents to a folder in a convenient location.Open the folder where the contents were unzipped and run mbar.exeFollow the instructions in the wizard to update and allow the program to scan your computer for threats.Click on the Cleanup button to remove any threats and reboot if prompted to do so.Wait while the system shuts down and the cleanup process is performed.Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txtTo attach a log if needed:Bottom right corner of this page.New window that comes up.~~~~~~~~~~~~~~~~~~~~~~~Note: You Must Run the fixdamage toolIf no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:Internet accessWindows UpdateWindows FirewallIf there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot. It's located in the Plugins folder which is in the MBAR folder.Just run fixdamage.exe.Verify that they are now functioning normally.MrC Link to post Share on other sites More sharing options...
nojustice7 Posted August 22, 2013 Author ID:718557 Share Posted August 22, 2013 Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 20-08-2013 04Ran by SYSTEM at 2013-08-21 20:34:35 Run:1Running from H:\Boot Mode: Recovery==============================================Content of fixlist:*****************HKU\Chris\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] - C:\Users\Chris\AppData\Local\Temp\sbhmylqdxxcpobqgr.exe [68608 2013-07-31] ()HKU\Chris\...\Winlogon: [shell] cmd.exe [345088 2010-11-20] (Microsoft Corporation)HKU\Chris\...\Command Processor: "C:\Users\Chris\AppData\Local\Temp\sbhmylqdxxcpobqgr.exe"HKU\Mcx1-CHRIS-PC\...\Winlogon: [shell] C:\windows\eHome\McrMgr.exe [343552 2009-07-13] (Microsoft Corporation)C:\Users\Chris\AppData\Local\Temp\sbhmylqdxxcpobqgr.exeC:\windows\eHome\McrMgr.exeC:\ProgramData\2433f433C:\Users\Chris\AppData\Roaming\2433f433C:\Users\Chris\AppData\Local\2433f433C:\$Recycle.Bin\S-1-5-21-2950786308-227742302-1544317472-1000\$8b29f98aca21910275e3c79a5aa0f795C:\Users\Chris\AppData\Local\Google\Desktop\Install\{8b29f98a-ca21-9102-75e3-c79a5aa0f795}*****************HKU\Chris\Software\Microsoft\Windows\CurrentVersion\Run\\qcgce2mrvjq91kk1e7pnbb19m52fx => Value deleted successfully.HKU\Chris\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.HKU\Chris\Software\Microsoft\Command Processor\\AutoRun => Value deleted successfully.HKU\Mcx1-CHRIS-PC\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.C:\Users\Chris\AppData\Local\Temp\sbhmylqdxxcpobqgr.exe => Moved successfully.C:\windows\eHome\McrMgr.exe => Moved successfully.C:\ProgramData\2433f433 => Moved successfully.C:\Users\Chris\AppData\Roaming\2433f433 => Moved successfully.C:\Users\Chris\AppData\Local\2433f433 => Moved successfully.C:\$Recycle.Bin\S-1-5-21-2950786308-227742302-1544317472-1000\$8b29f98aca21910275e3c79a5aa0f795 => Moved successfully.C:\Users\Chris\AppData\Local\Google\Desktop\Install\{8b29f98a-ca21-9102-75e3-c79a5aa0f795} => Moved successfully.==== End of Fixlog ==== Link to post Share on other sites More sharing options...
nojustice7 Posted August 22, 2013 Author ID:718655 Share Posted August 22, 2013 Two Scans: Malwarebytes Anti-Rootkit BETA 1.06.1.1005www.malwarebytes.org Database version: v2013.08.21.07 Windows 7 Service Pack 1 x64 NTFSInternet Explorer 10.0.9200.16635Chris :: CHRIS-PC [administrator] 8/21/2013 8:54:24 PMmbar-log-2013-08-21 (20-54-24).txt Scan type: Quick scanScan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUM | P2PScan options disabled: PUPObjects scanned: 285787Time elapsed: 15 minute(s), 52 second(s) Memory Processes Detected: 0(No malicious items detected) Memory Modules Detected: 0(No malicious items detected) Registry Keys Detected: 2HKCU\SOFTWARE\CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} (Hijack.Trojan.Siredef.C) -> Delete on reboot.HKCU\SOFTWARE\CLASSES\CLSID\{FBEB8A05-BEEE-4442-804E-409D6C4515E9}\INPROCSERVER32 (Trojan.Zaccess) -> Delete on reboot. Registry Values Detected: 2HKCU\SOFTWARE\CLASSES\CLSID\{FBEB8A05-BEEE-4442-804E-409D6C4515E9}\INPROCSERVER32| (Trojan.Zaccess) -> Data: C:\$Recycle.Bin\S-1-5-21-2950786308-227742302-1544317472-1000\$8b29f98aca21910275e3c79a5aa0f795\n. -> Delete on reboot.HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|Google Update (Trojan.Zaccess) -> Data: "C:\Users\Chris\AppData\Local\Google\Update\GoogleUpdate.exe" /c -> Delete on reboot. Registry Data Items Detected: 1HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page (Hijack.StartPage) -> Bad: (http://start.sweetpacks.com/?src=10&st=12&crg=3.5000006.10042&barid={C9DDEB0C-A159-11E2-89A9-002454A0E3B6}) Good: (http://www.google.com) -> Replace on reboot. Folders Detected: 0(No malicious items detected) Files Detected: 5c:\Users\Chris\AppData\Local\Temp\hwmnrd (Rootkit.ZAccess) -> Delete on reboot.c:\Users\Chris\AppData\Local\Temp\msimg32.dll (Rootkit.ZAccess) -> Delete on reboot.c:\$Recycle.Bin\S-1-5-21-2950786308-227742302-1544317472-1000\$RG8B0Y9.dat (Trojan.Agent.ED) -> Delete on reboot.c:\$Recycle.Bin\S-1-5-21-2950786308-227742302-1544317472-1000\$RSAGV72.exe (Trojan.Agent.ED) -> Delete on reboot.c:\Users\Chris\AppData\Roaming\Microsoft\Windows\Templates\2433f433 (Trojan.Agent.TPL) -> Delete on reboot. Physical Sectors Detected: 0(No malicious items detected)------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Malwarebytes Anti-Rootkit BETA 1.06.1.1005www.malwarebytes.org Database version: v2013.08.21.07 Windows 7 Service Pack 1 x64 NTFSInternet Explorer 10.0.9200.16635Chris :: CHRIS-PC [administrator] 8/21/2013 9:17:11 PMmbar-log-2013-08-21 (21-17-11).txt Scan type: Quick scanScan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUM | P2PScan options disabled: PUPObjects scanned: 285180Time elapsed: 17 minute(s), 49 second(s) Memory Processes Detected: 0(No malicious items detected) Memory Modules Detected: 0(No malicious items detected) Registry Keys Detected: 0(No malicious items detected) Registry Values Detected: 1HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|Google Update (Trojan.Zaccess) -> Data: -> Delete on reboot. Registry Data Items Detected: 0(No malicious items detected) Folders Detected: 0(No malicious items detected) Files Detected: 0(No malicious items detected) Physical Sectors Detected: 0(No malicious items detected) (end)------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Link to post Share on other sites More sharing options...
MrCharlie Posted August 22, 2013 ID:718661 Share Posted August 22, 2013 Please download Farbar Recovery Scan Tool and save it to a folder. (64 bit version)Double-click to run it. When the tool opens click Yes to disclaimer.Press Scan button.It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.MrC Link to post Share on other sites More sharing options...
nojustice7 Posted August 22, 2013 Author ID:718685 Share Posted August 22, 2013 System-log.txt ---------------------------------------Malwarebytes Anti-Rootkit BETA 1.06.1.1005 © Malwarebytes Corporation 2011-2012 OS version: 6.1.7601 Windows 7 Service Pack 1 x64 Account is Administrative Internet Explorer version: 10.0.9200.16635 Java version: 1.6.0_24 File system is: NTFSDisk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, Q:\ DRIVE_FIXEDCPU speed: 2.260000 GHzMemory total: 4081627136, free: 1922691072 Downloaded database version: v2013.08.21.07Initializing...------------ Kernel report ------------ 08/21/2013 20:54:15------------ Loaded modules -----------\SystemRoot\system32\ntoskrnl.exe\SystemRoot\system32\hal.dll\SystemRoot\system32\kdcom.dll\SystemRoot\system32\mcupdate_GenuineIntel.dll\SystemRoot\system32\PSHED.dll\SystemRoot\system32\CLFS.SYS\SystemRoot\system32\CI.dll\SystemRoot\system32\drivers\Wdf01000.sys\SystemRoot\system32\drivers\WDFLDR.SYS\SystemRoot\system32\drivers\ACPI.sys\SystemRoot\system32\drivers\WMILIB.SYS\SystemRoot\system32\drivers\msisadrv.sys\SystemRoot\system32\drivers\pci.sys\SystemRoot\system32\drivers\vdrvroot.sys\SystemRoot\System32\drivers\partmgr.sys\SystemRoot\system32\DRIVERS\compbatt.sys\SystemRoot\system32\DRIVERS\BATTC.SYS\SystemRoot\system32\drivers\volmgr.sys\SystemRoot\System32\drivers\volmgrx.sys\SystemRoot\System32\drivers\mountmgr.sys\SystemRoot\system32\DRIVERS\iaStor.sys\SystemRoot\system32\drivers\atapi.sys\SystemRoot\system32\drivers\ataport.SYS\SystemRoot\system32\drivers\msahci.sys\SystemRoot\system32\drivers\PCIIDEX.SYS\SystemRoot\system32\drivers\amdxata.sys\SystemRoot\system32\drivers\fltmgr.sys\SystemRoot\system32\drivers\fileinfo.sys\SystemRoot\System32\Drivers\Ntfs.sys\SystemRoot\System32\Drivers\msrpc.sys\SystemRoot\System32\Drivers\ksecdd.sys\SystemRoot\System32\Drivers\cng.sys\SystemRoot\System32\drivers\pcw.sys\SystemRoot\System32\Drivers\Fs_Rec.sys\SystemRoot\system32\drivers\ndis.sys\SystemRoot\system32\drivers\NETIO.SYS\SystemRoot\System32\Drivers\ksecpkg.sys\SystemRoot\System32\drivers\tcpip.sys\SystemRoot\System32\drivers\fwpkclnt.sys\SystemRoot\system32\drivers\volsnap.sys\SystemRoot\System32\Drivers\spldr.sys\SystemRoot\System32\drivers\rdyboost.sys\SystemRoot\System32\Drivers\mup.sys\SystemRoot\System32\drivers\hwpolicy.sys\SystemRoot\System32\DRIVERS\fvevol.sys\SystemRoot\system32\DRIVERS\disk.sys\SystemRoot\system32\DRIVERS\CLASSPNP.SYS\SystemRoot\system32\drivers\cdrom.sys\SystemRoot\System32\Drivers\Null.SYS\SystemRoot\System32\Drivers\Beep.SYS\SystemRoot\System32\drivers\vga.sys\SystemRoot\System32\drivers\VIDEOPRT.SYS\SystemRoot\System32\drivers\watchdog.sys\SystemRoot\System32\DRIVERS\RDPCDD.sys\SystemRoot\system32\drivers\rdpencdd.sys\SystemRoot\system32\drivers\rdprefmp.sys\SystemRoot\System32\Drivers\Msfs.SYS\SystemRoot\System32\Drivers\Npfs.SYS\SystemRoot\system32\DRIVERS\tdx.sys\SystemRoot\system32\DRIVERS\TDI.SYS\SystemRoot\System32\DRIVERS\netbt.sys\SystemRoot\system32\drivers\afd.sys\SystemRoot\system32\DRIVERS\wfplwf.sys\SystemRoot\system32\DRIVERS\pacer.sys\SystemRoot\system32\DRIVERS\vwififlt.sys\SystemRoot\system32\DRIVERS\netbios.sys\SystemRoot\system32\DRIVERS\wanarp.sys\SystemRoot\system32\drivers\termdd.sys\??\C:\windows\system32\Drivers\SABI.sys\SystemRoot\system32\DRIVERS\rdbss.sys\SystemRoot\system32\drivers\nsiproxy.sys\SystemRoot\system32\drivers\mssmbios.sys\SystemRoot\System32\drivers\discache.sys\SystemRoot\System32\Drivers\dfsc.sys\SystemRoot\system32\DRIVERS\blbdrive.sys\SystemRoot\system32\DRIVERS\tunnel.sys\SystemRoot\system32\DRIVERS\igdkmd64.sys\SystemRoot\System32\drivers\dxgkrnl.sys\SystemRoot\System32\drivers\dxgmms1.sys\SystemRoot\system32\DRIVERS\HECIx64.sys\SystemRoot\system32\drivers\usbehci.sys\SystemRoot\system32\drivers\USBPORT.SYS\SystemRoot\system32\drivers\HDAudBus.sys\SystemRoot\system32\DRIVERS\NETw5s64.sys\SystemRoot\system32\DRIVERS\vwifibus.sys\SystemRoot\system32\DRIVERS\yk62x64.sys\SystemRoot\system32\DRIVERS\CmBatt.sys\SystemRoot\system32\drivers\i8042prt.sys\SystemRoot\system32\drivers\kbdclass.sys\SystemRoot\system32\DRIVERS\SynTP.sys\SystemRoot\system32\DRIVERS\USBD.SYS\SystemRoot\system32\drivers\mouclass.sys\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys\SystemRoot\system32\DRIVERS\Impcd.sys\SystemRoot\system32\DRIVERS\intelppm.sys\SystemRoot\system32\drivers\CompositeBus.sys\SystemRoot\system32\DRIVERS\AgileVpn.sys\SystemRoot\system32\DRIVERS\rasl2tp.sys\SystemRoot\system32\DRIVERS\ndistapi.sys\SystemRoot\system32\DRIVERS\ndiswan.sys\SystemRoot\system32\DRIVERS\raspppoe.sys\SystemRoot\system32\DRIVERS\raspptp.sys\SystemRoot\system32\DRIVERS\rassstp.sys\SystemRoot\system32\drivers\swenum.sys\SystemRoot\system32\drivers\ks.sys\SystemRoot\system32\DRIVERS\umbus.sys\SystemRoot\system32\DRIVERS\WDKMD.sys\SystemRoot\system32\DRIVERS\usbhub.sys\SystemRoot\System32\Drivers\NDProxy.SYS\SystemRoot\system32\drivers\RTKVHD64.sys\SystemRoot\system32\drivers\portcls.sys\SystemRoot\system32\drivers\drmk.sys\SystemRoot\system32\drivers\ksthunk.sys\SystemRoot\system32\DRIVERS\IntcDAud.sys\SystemRoot\system32\DRIVERS\udfs.sys\SystemRoot\System32\win32k.sys\SystemRoot\System32\drivers\Dxapi.sys\SystemRoot\system32\DRIVERS\usbccgp.sys\SystemRoot\System32\Drivers\usbvideo.sys\SystemRoot\System32\Drivers\crashdmp.sys\SystemRoot\System32\Drivers\dump_iaStor.sys\SystemRoot\System32\Drivers\dump_dumpfve.sys\SystemRoot\system32\DRIVERS\monitor.sys\SystemRoot\System32\TSDDD.dll\SystemRoot\System32\cdd.dll\SystemRoot\system32\drivers\luafv.sys\SystemRoot\system32\DRIVERS\Sftvollh.sys\SystemRoot\system32\DRIVERS\lltdio.sys\SystemRoot\system32\DRIVERS\nwifi.sys\SystemRoot\system32\DRIVERS\ndisuio.sys\SystemRoot\system32\DRIVERS\rspndr.sys\SystemRoot\system32\drivers\HTTP.sys\SystemRoot\System32\DRIVERS\srvnet.sys\SystemRoot\system32\DRIVERS\bowser.sys\SystemRoot\System32\drivers\mpsdrv.sys\SystemRoot\system32\DRIVERS\mrxsmb.sys\SystemRoot\system32\DRIVERS\mrxsmb10.sys\SystemRoot\system32\DRIVERS\mrxsmb20.sys\SystemRoot\System32\DRIVERS\srv2.sys\SystemRoot\System32\DRIVERS\srv.sys\SystemRoot\system32\DRIVERS\vwifimp.sys\SystemRoot\system32\drivers\peauth.sys\SystemRoot\System32\Drivers\secdrv.SYS\SystemRoot\system32\DRIVERS\Sftfslh.sys\SystemRoot\system32\DRIVERS\Sftplaylh.sys\SystemRoot\System32\drivers\tcpipreg.sys\SystemRoot\system32\drivers\tdtcp.sys\SystemRoot\System32\DRIVERS\tssecsrv.sys\??\C:\Program Files (x86)\CyberLink\PowerDVD8\000.fcl\SystemRoot\System32\Drivers\RDPWD.SYS\SystemRoot\system32\DRIVERS\Sftredirlh.sys\??\C:\windows\system32\drivers\mbamchameleon.sys\??\C:\windows\system32\drivers\mbamswissarmy.sys\Windows\System32\ntdll.dll\Windows\System32\smss.exe\Windows\System32\apisetschema.dll\Windows\System32\autochk.exe\Windows\System32\urlmon.dll\Windows\System32\ole32.dll\Windows\System32\msvcrt.dll\Windows\System32\msctf.dll\Windows\System32\shlwapi.dll\Windows\System32\lpk.dll\Windows\System32\wininet.dll\Windows\System32\rpcrt4.dll\Windows\System32\comdlg32.dll\Windows\System32\psapi.dll\Windows\System32\sechost.dll\Windows\System32\ws2_32.dll\Windows\System32\imagehlp.dll\Windows\System32\difxapi.dll\Windows\System32\advapi32.dll\Windows\System32\usp10.dll\Windows\System32\gdi32.dll\Windows\System32\setupapi.dll\Windows\System32\oleaut32.dll\Windows\System32\user32.dll\Windows\System32\Wldap32.dll\Windows\System32\nsi.dll\Windows\System32\iertutil.dll\Windows\System32\imm32.dll\Windows\System32\normaliz.dll\Windows\System32\shell32.dll\Windows\System32\clbcatq.dll\Windows\System32\kernel32.dll\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll\Windows\System32\crypt32.dll\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll\Windows\System32\devobj.dll\Windows\System32\cfgmgr32.dll\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll\Windows\System32\wintrust.dll\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll\Windows\System32\KernelBase.dll\Windows\System32\comctl32.dll\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll\Windows\System32\msasn1.dll\Windows\SysWOW64\normaliz.dll----------- End -----------Done!<<<1>>>Upper Device Name: \Device\Harddisk0\DR0Upper Device Object: 0xfffffa80045a7060Upper Device Driver Name: \Driver\Disk\Lower Device Name: \Device\Ide\IAAStorageDevice-1\Lower Device Object: 0xfffffa8004334050Lower Device Driver Name: \Driver\iaStor\<<<2>>>Device number: 0, partition: 3Physical Sector Size: 512Drive: 0, DevicePointer: 0xfffffa80045a7060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\--------- Disk Stack ------DevicePointer: 0xfffffa80045a7ab0, DeviceName: Unknown, DriverName: \Driver\partmgr\DevicePointer: 0xfffffa80045a7060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\DevicePointer: 0xfffffa8004334050, DeviceName: \Device\Ide\IAAStorageDevice-1\, DriverName: \Driver\iaStor\------------ End ----------Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\Upper DeviceData: 0x0, 0x0, 0x0Lower DeviceData: 0x0, 0x0, 0x0<<<3>>>Volume: C:File system type: NTFSSectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes<<<2>>>Device number: 0, partition: 3<<<3>>>Volume: C:File system type: NTFSSectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytesScanning drivers directory: C:\windows\system32\drivers...<<<2>>>Device number: 0, partition: 3<<<3>>>Volume: C:File system type: NTFSSectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytesDone!Drive 0Scanning MBR on drive 0...Inspecting partition table:MBR Signature: 55AADisk Signature: 376EA6A7 Partition information: Partition 0 type is Other (0x27) Partition is NOT ACTIVE. Partition starts at LBA: 2048 Numsec = 31457280 Partition 1 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 31459328 Numsec = 204800 Partition file system is NTFS Partition is bootable Partition 2 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 31664128 Numsec = 209715200 Partition 3 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 241379328 Numsec = 735389696 Disk Size: 500107862016 bytesSector size: 512 bytes Scanning physical sectors of unpartitioned space on drive 0 (1-2047-976753168-976773168)...Done!Infected: c:\Users\Chris\AppData\Local\Temp\hwmnrd --> [Rootkit.ZAccess]Infected: c:\Users\Chris\AppData\Local\Temp\msimg32.dll --> [Rootkit.ZAccess]Infected: c:\$Recycle.Bin\S-1-5-21-2950786308-227742302-1544317472-1000\$RG8B0Y9.dat --> [Trojan.Agent.ED]Infected: c:\$Recycle.Bin\S-1-5-21-2950786308-227742302-1544317472-1000\$RSAGV72.exe --> [Trojan.Agent.ED]Infected: c:\Users\Chris\AppData\Roaming\Microsoft\Windows\Templates\2433f433 --> [Trojan.Agent.TPL]Infected: HKCU\SOFTWARE\CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} --> [Hijack.Trojan.Siredef.C]Infected: HKCU\SOFTWARE\CLASSES\CLSID\{FBEB8A05-BEEE-4442-804E-409D6C4515E9}\INPROCSERVER32| --> [Trojan.Zaccess]Infected: HKCU\SOFTWARE\CLASSES\CLSID\{FBEB8A05-BEEE-4442-804E-409D6C4515E9}\INPROCSERVER32 --> [Trojan.Zaccess]Infected: HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|Google Update --> [Trojan.Zaccess]Infected: HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page --> [Hijack.StartPage]Scan finishedCreating System Restore point...Cleaning up...Executing an action fixdamage.exe...Success!Queuing an action fixdamage.exeRemoval scheduling successful. System shutdown needed.System shutdown occurred======================================= Removal queue found; removal startedRemoving c:\programdata\malwarebytes' anti-malware (portable)\mbr_0_i.mbam...Removing c:\programdata\malwarebytes' anti-malware (portable)\bootstrap_0_1_31459328_i.mbam...Removing c:\programdata\malwarebytes' anti-malware (portable)\mbr_0_r.mbam...Removal finished---------------------------------------Malwarebytes Anti-Rootkit BETA 1.06.1.1005 © Malwarebytes Corporation 2011-2012 OS version: 6.1.7601 Windows 7 Service Pack 1 x64 Account is Administrative Internet Explorer version: 10.0.9200.16635 Java version: 1.6.0_24 File system is: NTFSDisk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, Q:\ DRIVE_FIXEDCPU speed: 2.260000 GHzMemory total: 4081627136, free: 2904309760 Initializing...------------ Kernel report ------------ 08/21/2013 21:16:58------------ Loaded modules -----------\SystemRoot\system32\ntoskrnl.exe\SystemRoot\system32\hal.dll\SystemRoot\system32\kdcom.dll\SystemRoot\system32\mcupdate_GenuineIntel.dll\SystemRoot\system32\PSHED.dll\SystemRoot\system32\CLFS.SYS\SystemRoot\system32\CI.dll\SystemRoot\system32\drivers\Wdf01000.sys\SystemRoot\system32\drivers\WDFLDR.SYS\SystemRoot\system32\drivers\ACPI.sys\SystemRoot\system32\drivers\WMILIB.SYS\SystemRoot\system32\drivers\msisadrv.sys\SystemRoot\system32\drivers\pci.sys\SystemRoot\system32\drivers\vdrvroot.sys\SystemRoot\System32\drivers\partmgr.sys\SystemRoot\system32\DRIVERS\compbatt.sys\SystemRoot\system32\DRIVERS\BATTC.SYS\SystemRoot\system32\drivers\volmgr.sys\SystemRoot\System32\drivers\volmgrx.sys\SystemRoot\System32\drivers\mountmgr.sys\SystemRoot\system32\DRIVERS\iaStor.sys\SystemRoot\system32\drivers\atapi.sys\SystemRoot\system32\drivers\ataport.SYS\SystemRoot\system32\drivers\msahci.sys\SystemRoot\system32\drivers\PCIIDEX.SYS\SystemRoot\system32\drivers\amdxata.sys\SystemRoot\system32\drivers\fltmgr.sys\SystemRoot\system32\drivers\fileinfo.sys\SystemRoot\System32\Drivers\Ntfs.sys\SystemRoot\System32\Drivers\msrpc.sys\SystemRoot\System32\Drivers\ksecdd.sys\SystemRoot\System32\Drivers\cng.sys\SystemRoot\System32\drivers\pcw.sys\SystemRoot\System32\Drivers\Fs_Rec.sys\SystemRoot\system32\drivers\ndis.sys\SystemRoot\system32\drivers\NETIO.SYS\SystemRoot\System32\Drivers\ksecpkg.sys\SystemRoot\System32\drivers\tcpip.sys\SystemRoot\System32\drivers\fwpkclnt.sys\SystemRoot\system32\drivers\volsnap.sys\SystemRoot\System32\Drivers\spldr.sys\SystemRoot\System32\drivers\rdyboost.sys\SystemRoot\System32\Drivers\mup.sys\SystemRoot\System32\drivers\hwpolicy.sys\SystemRoot\System32\DRIVERS\fvevol.sys\SystemRoot\system32\DRIVERS\disk.sys\SystemRoot\system32\DRIVERS\CLASSPNP.SYS\SystemRoot\system32\drivers\cdrom.sys\SystemRoot\System32\Drivers\Null.SYS\SystemRoot\System32\Drivers\Beep.SYS\SystemRoot\System32\drivers\vga.sys\SystemRoot\System32\drivers\VIDEOPRT.SYS\SystemRoot\System32\drivers\watchdog.sys\SystemRoot\System32\DRIVERS\RDPCDD.sys\SystemRoot\system32\drivers\rdpencdd.sys\SystemRoot\system32\drivers\rdprefmp.sys\SystemRoot\System32\Drivers\Msfs.SYS\SystemRoot\System32\Drivers\Npfs.SYS\SystemRoot\system32\DRIVERS\tdx.sys\SystemRoot\system32\DRIVERS\TDI.SYS\SystemRoot\System32\DRIVERS\netbt.sys\SystemRoot\system32\drivers\afd.sys\SystemRoot\system32\DRIVERS\wfplwf.sys\SystemRoot\system32\DRIVERS\pacer.sys\SystemRoot\system32\DRIVERS\vwififlt.sys\SystemRoot\system32\DRIVERS\netbios.sys\SystemRoot\system32\DRIVERS\wanarp.sys\SystemRoot\system32\drivers\termdd.sys\??\C:\windows\system32\Drivers\SABI.sys\SystemRoot\system32\DRIVERS\rdbss.sys\SystemRoot\system32\drivers\nsiproxy.sys\SystemRoot\system32\drivers\mssmbios.sys\SystemRoot\System32\drivers\discache.sys\SystemRoot\System32\Drivers\dfsc.sys\SystemRoot\system32\DRIVERS\blbdrive.sys\SystemRoot\system32\DRIVERS\tunnel.sys\SystemRoot\system32\DRIVERS\igdkmd64.sys\SystemRoot\System32\drivers\dxgkrnl.sys\SystemRoot\System32\drivers\dxgmms1.sys\SystemRoot\system32\DRIVERS\HECIx64.sys\SystemRoot\system32\drivers\usbehci.sys\SystemRoot\system32\drivers\USBPORT.SYS\SystemRoot\system32\drivers\HDAudBus.sys\SystemRoot\system32\DRIVERS\NETw5s64.sys\SystemRoot\system32\DRIVERS\vwifibus.sys\SystemRoot\system32\DRIVERS\yk62x64.sys\SystemRoot\system32\DRIVERS\CmBatt.sys\SystemRoot\system32\drivers\i8042prt.sys\SystemRoot\system32\drivers\kbdclass.sys\SystemRoot\system32\DRIVERS\SynTP.sys\SystemRoot\system32\DRIVERS\USBD.SYS\SystemRoot\system32\drivers\mouclass.sys\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys\SystemRoot\system32\DRIVERS\Impcd.sys\SystemRoot\system32\DRIVERS\intelppm.sys\SystemRoot\system32\drivers\CompositeBus.sys\SystemRoot\system32\DRIVERS\AgileVpn.sys\SystemRoot\system32\DRIVERS\rasl2tp.sys\SystemRoot\system32\DRIVERS\ndistapi.sys\SystemRoot\system32\DRIVERS\ndiswan.sys\SystemRoot\system32\DRIVERS\raspppoe.sys\SystemRoot\system32\DRIVERS\raspptp.sys\SystemRoot\system32\DRIVERS\rassstp.sys\SystemRoot\system32\drivers\swenum.sys\SystemRoot\system32\drivers\ks.sys\SystemRoot\system32\DRIVERS\umbus.sys\SystemRoot\system32\DRIVERS\WDKMD.sys\SystemRoot\system32\DRIVERS\usbhub.sys\SystemRoot\System32\Drivers\NDProxy.SYS\SystemRoot\system32\drivers\RTKVHD64.sys\SystemRoot\system32\drivers\portcls.sys\SystemRoot\system32\drivers\drmk.sys\SystemRoot\system32\drivers\ksthunk.sys\SystemRoot\system32\DRIVERS\IntcDAud.sys\SystemRoot\system32\DRIVERS\udfs.sys\SystemRoot\System32\win32k.sys\SystemRoot\System32\drivers\Dxapi.sys\SystemRoot\system32\DRIVERS\usbccgp.sys\SystemRoot\System32\Drivers\usbvideo.sys\SystemRoot\System32\Drivers\crashdmp.sys\SystemRoot\System32\Drivers\dump_iaStor.sys\SystemRoot\System32\Drivers\dump_dumpfve.sys\SystemRoot\system32\DRIVERS\monitor.sys\SystemRoot\System32\TSDDD.dll\SystemRoot\System32\cdd.dll\SystemRoot\system32\drivers\luafv.sys\SystemRoot\system32\DRIVERS\Sftvollh.sys\SystemRoot\system32\DRIVERS\lltdio.sys\SystemRoot\system32\DRIVERS\nwifi.sys\SystemRoot\system32\DRIVERS\ndisuio.sys\SystemRoot\system32\DRIVERS\rspndr.sys\SystemRoot\system32\drivers\HTTP.sys\SystemRoot\System32\DRIVERS\srvnet.sys\SystemRoot\system32\DRIVERS\bowser.sys\SystemRoot\System32\drivers\mpsdrv.sys\SystemRoot\system32\DRIVERS\mrxsmb.sys\SystemRoot\system32\DRIVERS\mrxsmb10.sys\SystemRoot\system32\DRIVERS\mrxsmb20.sys\SystemRoot\System32\DRIVERS\srv2.sys\SystemRoot\System32\DRIVERS\srv.sys\SystemRoot\system32\DRIVERS\vwifimp.sys\SystemRoot\system32\drivers\peauth.sys\SystemRoot\System32\Drivers\secdrv.SYS\SystemRoot\system32\DRIVERS\Sftfslh.sys\SystemRoot\system32\DRIVERS\Sftplaylh.sys\SystemRoot\System32\drivers\tcpipreg.sys\??\C:\Program Files (x86)\CyberLink\PowerDVD8\000.fcl\SystemRoot\system32\drivers\tdtcp.sys\SystemRoot\System32\DRIVERS\tssecsrv.sys\SystemRoot\System32\Drivers\RDPWD.SYS\SystemRoot\system32\DRIVERS\Sftredirlh.sys\SystemRoot\system32\drivers\spsys.sys\??\C:\windows\system32\drivers\mbamchameleon.sys\??\C:\windows\system32\drivers\mbamswissarmy.sys\Windows\System32\ntdll.dll\Windows\System32\smss.exe\Windows\System32\apisetschema.dll\Windows\System32\autochk.exe\Windows\System32\ws2_32.dll\Windows\System32\lpk.dll\Windows\System32\clbcatq.dll\Windows\System32\iertutil.dll\Windows\System32\user32.dll\Windows\System32\shell32.dll\Windows\System32\setupapi.dll\Windows\System32\sechost.dll\Windows\System32\imagehlp.dll\Windows\System32\oleaut32.dll\Windows\System32\difxapi.dll\Windows\System32\urlmon.dll\Windows\System32\shlwapi.dll\Windows\System32\ole32.dll\Windows\System32\rpcrt4.dll\Windows\System32\Wldap32.dll\Windows\System32\kernel32.dll\Windows\System32\usp10.dll\Windows\System32\comdlg32.dll\Windows\System32\gdi32.dll\Windows\System32\msvcrt.dll\Windows\System32\msctf.dll\Windows\System32\normaliz.dll\Windows\System32\psapi.dll\Windows\System32\nsi.dll\Windows\System32\imm32.dll\Windows\System32\wininet.dll\Windows\System32\advapi32.dll\Windows\System32\cfgmgr32.dll\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll\Windows\System32\devobj.dll\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll\Windows\System32\KernelBase.dll\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll\Windows\System32\crypt32.dll\Windows\System32\comctl32.dll\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll\Windows\System32\wintrust.dll\Windows\System32\msasn1.dll\Windows\SysWOW64\normaliz.dll----------- End -----------Done!<<<1>>>Upper Device Name: \Device\Harddisk0\DR0Upper Device Object: 0xfffffa80045a8060Upper Device Driver Name: \Driver\Disk\Lower Device Name: \Device\Ide\IAAStorageDevice-1\Lower Device Object: 0xfffffa800431b050Lower Device Driver Name: \Driver\iaStor\<<<2>>>Device number: 0, partition: 3Physical Sector Size: 512Drive: 0, DevicePointer: 0xfffffa80045a8060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\--------- Disk Stack ------DevicePointer: 0xfffffa80044a39d0, DeviceName: Unknown, DriverName: \Driver\partmgr\DevicePointer: 0xfffffa80045a8060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\DevicePointer: 0xfffffa800431b050, DeviceName: \Device\Ide\IAAStorageDevice-1\, DriverName: \Driver\iaStor\------------ End ----------Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\Upper DeviceData: 0x0, 0x0, 0x0Lower DeviceData: 0x0, 0x0, 0x0<<<3>>>Volume: C:File system type: NTFSSectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes<<<2>>>Device number: 0, partition: 3<<<3>>>Volume: C:File system type: NTFSSectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytesScanning drivers directory: C:\windows\system32\drivers...<<<2>>>Device number: 0, partition: 3<<<3>>>Volume: C:File system type: NTFSSectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytesDone!Drive 0Scanning MBR on drive 0...Inspecting partition table:MBR Signature: 55AADisk Signature: 376EA6A7 Partition information: Partition 0 type is Other (0x27) Partition is NOT ACTIVE. Partition starts at LBA: 2048 Numsec = 31457280 Partition 1 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 31459328 Numsec = 204800 Partition file system is NTFS Partition is bootable Partition 2 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 31664128 Numsec = 209715200 Partition 3 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 241379328 Numsec = 735389696 Disk Size: 500107862016 bytesSector size: 512 bytes Scanning physical sectors of unpartitioned space on drive 0 (1-2047-976753168-976773168)...Done!Infected: HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|Google Update --> [Trojan.Zaccess]Scan finishedCreating System Restore point...Cleaning up...Executing an action fixdamage.exe...Success!Queuing an action fixdamage.exeRemoval scheduling successful. System shutdown needed.System shutdown occurred======================================= Removal queue found; removal startedRemoving c:\programdata\malwarebytes' anti-malware (portable)\mbr_0_i.mbam...Removing c:\programdata\malwarebytes' anti-malware (portable)\bootstrap_0_1_31459328_i.mbam...Removing c:\programdata\malwarebytes' anti-malware (portable)\mbr_0_r.mbam...Removal finished Link to post Share on other sites More sharing options...
MrCharlie Posted August 22, 2013 ID:718687 Share Posted August 22, 2013 http://forums.malwarebytes.org/index.php?showtopic=131410&p=718661 Run FRST...MrC Link to post Share on other sites More sharing options...
nojustice7 Posted August 22, 2013 Author ID:718688 Share Posted August 22, 2013 Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-08-2013 02Ran by Chris (administrator) on 21-08-2013 22:50:24Running from C:\Users\Chris\DownloadsWindows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)Internet Explorer Version 10Boot Mode: Normal ==================== Processes (Whitelisted) ================= (Microsoft Corporation) C:\windows\system32\WLANExt.exe(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe(Symantec Corporation) C:\Program Files (x86)\Norton Safe Web Lite\Engine\1.2.0.7\ccSvcHst.exe(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE(SAMSUNG Electronics) C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe(SEC) C:\Program Files (x86)\Samsung\Samsung Recovery Solution 4\WCScheduler.exe(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe(Intel Corporation) C:\Windows\System32\igfxtray.exe(Intel Corporation) C:\Windows\System32\hkcmd.exe(Intel Corporation) C:\Windows\System32\igfxpers.exe(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exeAddition.txt Link to post Share on other sites More sharing options...
MrCharlie Posted August 22, 2013 ID:718767 Share Posted August 22, 2013 Can you please post or attach the complete FRST log. MrC Link to post Share on other sites More sharing options...
nojustice7 Posted August 24, 2013 Author ID:719748 Share Posted August 24, 2013 I didn't know exactly which to post so I attached them.Fixlog_21-08-2013_20-34-37.txtFRST_21-08-2013_18-59-42.txtFRST_21-08-2013_22-52-07.txt Link to post Share on other sites More sharing options...
MrCharlie Posted August 24, 2013 ID:719866 Share Posted August 24, 2013 Download the attached fixlist.txt to the same folder as FRST. Run FRST and click Fix only once and wait The tool will create a log (Fixlog.txt) in the folder, please post it to your reply. Then run MBAR again. MrC Link to post Share on other sites More sharing options...
nojustice7 Posted August 26, 2013 Author ID:720803 Share Posted August 26, 2013 Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 26-08-2013Ran by Chris at 2013-08-26 10:11:33 Run:2Running from C:\FRSTBoot Mode: Normal============================================== Content of fixlist:*****************HKCU\...\Run: [Google Update*] - [x] DeleteJunctionsIndirectory: C:\Windows\system64 ***************** HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\Google Update* => Value deleted successfully."C:\Windows\system64" => Deleting reparse point and unlocking started."C:\Windows\system64" => Deleting reparse point and unlocking done."C:\Windows\system64" => Deleting reparse point and unlocking completed. ==== End of Fixlog ==== Link to post Share on other sites More sharing options...
MrCharlie Posted August 26, 2013 ID:720823 Share Posted August 26, 2013 Please download and run RogueKiller 32 Bit to your desktop. RogueKiller 64 Bit <---use this one for 64 bit systems Quit all running programs. For Windows XP, double-click to start. For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run. Click Scan to scan the system. When the scan completes > Close out the program > Don't Fix anything! Don't run any other options, they're not all bad!!!!!!! Post back the report which should be located on your desktop. (please don't put logs in code or quotes) MrC Link to post Share on other sites More sharing options...
nojustice7 Posted August 28, 2013 Author ID:721699 Share Posted August 28, 2013 RogueKiller V8.6.6 _x64_ [Aug 19 2013] by Tigzymail : tigzyRK<at>gmail<dot>comFeedback : http://www.adlice.com/forum/Website : http://www.adlice.com/softwares/roguekiller/Blog : http://tigzyrk.blogspot.com/ Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits versionStarted in : Normal modeUser : Chris [Admin rights]Mode : Scan -- Date : 08/27/2013 23:02:34| ARK || FAK || MBR | ¤¤¤ Bad processes : 1 ¤¤¤[sUSP PATH] GoogleUpdate.exe -- C:\Users\Chris\AppData\Local\Google\Update\GoogleUpdate.exe [7] -> KILLED [TermThr] ¤¤¤ Registry Entries : 5 ¤¤¤[DNS] HKLM\[...]\CCSet\[...]\{EF069AF1-3055-425F-BEA3-28E79164E846} : NameServer (0.0.0.0) -> FOUND[DNS] HKLM\[...]\CS001\[...]\{EF069AF1-3055-425F-BEA3-28E79164E846} : NameServer (0.0.0.0) -> FOUND[DNS] HKLM\[...]\CS002\[...]\{EF069AF1-3055-425F-BEA3-28E79164E846} : NameServer (0.0.0.0) -> FOUND[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND ¤¤¤ Scheduled tasks : 4 ¤¤¤[V1][sUSP PATH] GoogleUpdateTaskUserS-1-5-21-2950786308-227742302-1544317472-1000UA.job : C:\Users\Chris\AppData\Local\Google\Update\GoogleUpdate.exe - /ua /installsource scheduler [7][x] -> FOUND[V1][sUSP PATH] GoogleUpdateTaskUserS-1-5-21-2950786308-227742302-1544317472-1000Core.job : C:\Users\Chris\AppData\Local\Google\Update\GoogleUpdate.exe - /c [7] -> FOUND[V2][sUSP PATH] GoogleUpdateTaskUserS-1-5-21-2950786308-227742302-1544317472-1000Core : C:\Users\Chris\AppData\Local\Google\Update\GoogleUpdate.exe - /c [7] -> FOUND[V2][sUSP PATH] GoogleUpdateTaskUserS-1-5-21-2950786308-227742302-1544317472-1000UA : C:\Users\Chris\AppData\Local\Google\Update\GoogleUpdate.exe - /ua /installsource scheduler [7][x] -> FOUND ¤¤¤ Startup Entries : 0 ¤¤¤ ¤¤¤ Web browsers : 0 ¤¤¤ ¤¤¤ Particular Files / Folders: ¤¤¤[ZeroAccess][Folder] Install : C:\Users\Chris\AppData\Local\Google\Desktop\Install [-] --> FOUND ¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤ ¤¤¤ External Hives: ¤¤¤ ¤¤¤ Infection : ZeroAccess ¤¤¤ ¤¤¤ HOSTS File: ¤¤¤--> %SystemRoot%\System32\drivers\etc\hosts ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: SAMSUNG HM500JI +++++--- User ---[MBR] 03e127c47f8129e4524a62db98c612aa[bSP] 5cff86a29a20124a1a9450fc6f20b9a6 : KIWI Image system MBR CodePartition table:0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 15360 Mo1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 31459328 | Size: 100 Mo2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 31664128 | Size: 102400 Mo3 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 241379328 | Size: 359077 MoUser = LL1 ... OK!User = LL2 ... OK! Finished : << RKreport[0]_S_08272013_230234.txt >> Link to post Share on other sites More sharing options...
MrCharlie Posted August 28, 2013 ID:721703 Share Posted August 28, 2013 Looks Good...... Lets clean out any adware while you're here: Please download AdwCleaner by Xplode and save to your Desktop.Double click on AdwCleaner.exe to run the tool. Vista/Windows 7/8 users right-click and select Run As AdministratorClick on the Scan button.AdwCleaner will begin...be patient as the scan may take some time to complete.After the scan has finished, click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.Copy and paste the contents of that logfile in your next reply.A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.If you agree with everything listed to be removed in the folders section........... Double click on AdwCleaner.exe to run the tool again.Click on the Scan button.AdwCleaner will begin to scan your computer like it did before.After the scan has finished...This time click on the Clean button.Press OK when asked to close all programs and follow the onscreen prompts.Press OK again to allow AdwCleaner to restart the computer and complete the removal process.After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.Copy and paste the contents of that logfile in your next reply.A copy of that logfile will also be saved in the C:\AdwCleaner folder.Then.................. Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select Show in Results List and Check for removal. Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report. Make sure that everything is checked, and click Remove Selected. Please let me know how computer is running now, MrC Link to post Share on other sites More sharing options...
MrCharlie Posted August 31, 2013 ID:723134 Share Posted August 31, 2013 How are we doing?? Do you still need help or can I close this post?? MrC Link to post Share on other sites More sharing options...
LDTate Posted September 1, 2013 ID:723751 Share Posted September 1, 2013 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
nojustice7 Posted September 15, 2013 Author ID:730342 Share Posted September 15, 2013 Hi, I apologize for the long delay for my response. I have been quite ill and bedridden recently. Here's the log: # AdwCleaner v3.004 - Report created 15/09/2013 at 12:45:43# Updated 15/09/2013 by Xplode# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)# Username : Chris - CHRIS-PC# Running from : C:\Users\Chris\Downloads\AdwCleaner.exe# Option : Scan ***** [ Services ] ***** ***** [ Files / Folders ] ***** File Found : C:\Users\Chris\Desktop\HDVidCodec.lnkFile Found : C:\windows\System32\Tasks\Scheduled Update for Ask ToolbarFolder Found C:\Program Files (x86)\Ask.comFolder Found C:\Program Files (x86)\HDvidCodec.comFolder Found C:\Program Files (x86)\vShareFolder Found C:\Program Files (x86)\WebSearchFolder Found C:\ProgramData\BabylonFolder Found C:\ProgramData\boost_interprocessFolder Found C:\ProgramData\Browser ManagerFolder Found C:\ProgramData\PartnerFolder Found C:\ProgramData\SearcH-yNeewTabaFolder Found C:\ProgramData\SearcH-yNeewTabaFolder Found C:\ProgramData\SoftSafeFolder Found C:\ProgramData\Tarma InstallerFolder Found C:\Users\Chris\AppData\Local\PutLockerDownloaderFolder Found C:\Users\Chris\AppData\LocalLow\AskToolbarFolder Found C:\Users\Chris\AppData\LocalLow\BabylonToolbarFolder Found C:\Users\Chris\AppData\LocalLow\vShareFolder Found C:\Users\Chris\AppData\Roaming\BabylonFolder Found C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FTDownloader.comFolder Found C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HDvidCodec.comFolder Found C:\Users\Chris\AppData\Roaming\registry mechanic ***** [ Shortcuts ] ***** ***** [ Registry ] ***** Key Found : HKCU\Software\1ClickDownloadKey Found : HKCU\Software\5f0d7dab56dea17Key Found : HKCU\Software\APNKey Found : HKCU\Software\AppDataLow\AskToolbarInfoKey Found : HKCU\Software\AppDataLow\Software\AskToolbarKey Found : HKCU\Software\AppDataLow\SProtectorKey Found : HKCU\Software\Ask.comKey Found : HKCU\Software\DataMngrKey Found : HKCU\Software\DataMngr_ToolbarKey Found : HKCU\Software\ilividKey Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{043C5167-00BB-4324-AF7E-62013FAEDACF}Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{483830EE-A4CD-4B71-B0A3-3D82E62A6909}Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3B7599DF-3D5D-4EF5-BF51-9C2EDA788E83}Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}Key Found : HKCU\Software\PrivitizeVPNInstallDatesKey Found : HKCU\Software\StartSearchKey Found : HKCU\Software\vShareKey Found : HKCU\Software\YahooPartnerToolbarKey Found : HKCU\Software\ZugoKey Found : [x64] HKCU\Software\1ClickDownloadKey Found : [x64] HKCU\Software\APNKey Found : [x64] HKCU\Software\Ask.comKey Found : [x64] HKCU\Software\DataMngrKey Found : [x64] HKCU\Software\DataMngr_ToolbarKey Found : [x64] HKCU\Software\ilividKey Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{043C5167-00BB-4324-AF7E-62013FAEDACF}Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{483830EE-A4CD-4B71-B0A3-3D82E62A6909}Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}Key Found : [x64] HKCU\Software\PrivitizeVPNInstallDatesKey Found : [x64] HKCU\Software\StartSearchKey Found : [x64] HKCU\Software\vShareKey Found : [x64] HKCU\Software\YahooPartnerToolbarKey Found : [x64] HKCU\Software\ZugoKey Found : HKLM\SOFTWARE\5f0d7dab56dea17Key Found : HKLM\Software\APNKey Found : HKLM\Software\AskToolbarKey Found : HKLM\Software\BabylonKey Found : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}Key Found : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}Key Found : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLLKey Found : HKLM\SOFTWARE\Classes\Applications\ilividsetup.exeKey Found : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}Key Found : HKLM\SOFTWARE\Classes\CLSID\{3B7599DF-3D5D-4EF5-BF51-9C2EDA788E83}Key Found : HKLM\SOFTWARE\Classes\CLSID\{3F3A4B8A-86FC-43A4-BB00-6D7EBE9D4484}Key Found : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}Key Found : HKLM\SOFTWARE\Classes\driverscannerKey Found : HKLM\SOFTWARE\Classes\FTDownloaderKey Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWndKey Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1Key Found : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}Key Found : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}Key Found : HKLM\SOFTWARE\Classes\Interface\{20ED5AF7-D9C4-409E-9EB3-D2A44A77FB6D}Key Found : HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}Key Found : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}Key Found : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}Key Found : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}Key Found : HKLM\SOFTWARE\Classes\Prod.capKey Found : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\vsharechromeKey Found : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}Key Found : HKLM\SOFTWARE\Classes\TypeLib\{3E315C81-442B-431C-AEC8-ED189699EC24}Key Found : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}Key Found : HKLM\SOFTWARE\Classes\vShare.IMedixProtocolKey Found : HKLM\SOFTWARE\Classes\vShare.IMedixProtocol.1Key Found : HKLM\SOFTWARE\Classes\vShare.PugiObjKey Found : HKLM\SOFTWARE\Classes\vShare.PugiObj.1Key Found : HKLM\SOFTWARE\Classes\vShare.ScriptHelpersKey Found : HKLM\SOFTWARE\Classes\vShare.ScriptHelpers.1Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\kpkbnefaikfaeadgidhpoanckoiaheliKey Found : HKLM\SOFTWARE\Google\Chrome\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcjKey Found : HKLM\Software\iLividSRTBKey Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{043C5167-00BB-4324-AF7E-62013FAEDACF}Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}Key Found : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_RASAPI32Key Found : HKLM\SOFTWARE\Microsoft\tracing\askpartnercobrandingtool_RASMANCSKey Found : HKLM\SOFTWARE\Microsoft\Tracing\iLivid_RASAPI32Key Found : HKLM\SOFTWARE\Microsoft\Tracing\iLivid_RASMANCSKey Found : HKLM\SOFTWARE\Microsoft\Tracing\iLividMediaBar_RASAPI32Key Found : HKLM\SOFTWARE\Microsoft\Tracing\iLividMediaBar_RASMANCSKey Found : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetup_RASAPI32Key Found : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetup_RASMANCSKey Found : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32Key Found : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCSKey Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3B7599DF-3D5D-4EF5-BF51-9C2EDA788E83}Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\1ClickDownloadKey Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search Results ToolbarKey Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SP_4e24eecbKey Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\vShareKey Found : HKLM\Software\SP GlobalKey Found : HKLM\Software\SProtectorKey Found : [x64] HKLM\SOFTWARE\DataMngrKey Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}Key Found : [x64] HKLM\SOFTWARE\Tarma InstallerValue Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{043C5167-00BB-4324-AF7E-62013FAEDACF}]Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}] ***** [ Browsers ] ***** -\\ Internet Explorer v10.0.9200.16686 -\\ Mozilla Firefox v21.0 (en-US) [ File : C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\prefs.js ] [ File : C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\f0ptetok.default\prefs.js ] -\\ Google Chrome v [ File : C:\Users\Chris\AppData\Local\Google\Chrome\User Data\Default\preferences ] Found : homepage ************************* AdwCleaner[R0].txt - [9395 octets] - [15/09/2013 12:45:43] ########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [9455 octets] ########## Link to post Share on other sites More sharing options...
MrCharlie Posted September 15, 2013 ID:730349 Share Posted September 15, 2013 You can clean all those up and then run a quick scan with MB: Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select Show in Results List and Check for removal. Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report. Make sure that everything is checked, and click Remove Selected. Please let me know how computer is running now, MrC Link to post Share on other sites More sharing options...
nojustice7 Posted September 15, 2013 Author ID:730352 Share Posted September 15, 2013 Log file after rebooting: # AdwCleaner v3.004 - Report created 15/09/2013 at 14:48:25# Updated 15/09/2013 by Xplode# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)# Username : Chris - CHRIS-PC# Running from : C:\Users\Chris\Downloads\AdwCleaner.exe# Option : Clean ***** [ Services ] ***** ***** [ Files / Folders ] ***** Folder Deleted : C:\ProgramData\BabylonFolder Deleted : C:\ProgramData\boost_interprocess[#] Folder Deleted : C:\ProgramData\Browser ManagerFolder Deleted : C:\ProgramData\PartnerFolder Deleted : C:\ProgramData\SoftSafeFolder Deleted : C:\ProgramData\Tarma InstallerFolder Deleted : C:\ProgramData\SearcH-yNeewTabaFolder Deleted : C:\Program Files (x86)\Ask.comFolder Deleted : C:\Program Files (x86)\HDvidCodec.comFolder Deleted : C:\Program Files (x86)\vShareFolder Deleted : C:\Program Files (x86)\WebSearchFolder Deleted : C:\Users\Chris\AppData\Local\PutLockerDownloaderFolder Deleted : C:\Users\Chris\AppData\LocalLow\AskToolbarFolder Deleted : C:\Users\Chris\AppData\LocalLow\BabylonToolbarFolder Deleted : C:\Users\Chris\AppData\LocalLow\vShareFolder Deleted : C:\Users\Chris\AppData\Roaming\BabylonFolder Deleted : C:\Users\Chris\AppData\Roaming\registry mechanicFolder Deleted : C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FTDownloader.comFolder Deleted : C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HDvidCodec.comFile Deleted : C:\Users\Chris\Desktop\HDVidCodec.lnkFile Deleted : C:\windows\System32\Tasks\Scheduled Update for Ask Toolbar ***** [ Shortcuts ] ***** ***** [ Registry ] ***** Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\kpkbnefaikfaeadgidhpoanckoiaheliKey Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcjKey Deleted : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLLKey Deleted : HKLM\SOFTWARE\Classes\Applications\ilividsetup.exeKey Deleted : HKLM\SOFTWARE\Classes\driverscannerKey Deleted : HKLM\SOFTWARE\Classes\FTDownloaderKey Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWndKey Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1Key Deleted : HKLM\SOFTWARE\Classes\Prod.capKey Deleted : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\vsharechromeKey Deleted : HKLM\SOFTWARE\Classes\vShare.IMedixProtocolKey Deleted : HKLM\SOFTWARE\Classes\vShare.IMedixProtocol.1Key Deleted : HKLM\SOFTWARE\Classes\vShare.PugiObjKey Deleted : HKLM\SOFTWARE\Classes\vShare.PugiObj.1Key Deleted : HKLM\SOFTWARE\Classes\vShare.ScriptHelpersKey Deleted : HKLM\SOFTWARE\Classes\vShare.ScriptHelpers.1Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_RASAPI32Key Deleted : HKLM\SOFTWARE\Microsoft\tracing\askpartnercobrandingtool_RASMANCSKey Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLivid_RASAPI32Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLivid_RASMANCSKey Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLividMediaBar_RASAPI32Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLividMediaBar_RASMANCSKey Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetup_RASAPI32Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetup_RASMANCSKey Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCSKey Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SP_4e24eecbKey Deleted : HKCU\Software\5f0d7dab56dea17Key Deleted : HKLM\SOFTWARE\5f0d7dab56dea17Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3B7599DF-3D5D-4EF5-BF51-9C2EDA788E83}Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3F3A4B8A-86FC-43A4-BB00-6D7EBE9D4484}Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{20ED5AF7-D9C4-409E-9EB3-D2A44A77FB6D}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{3E315C81-442B-431C-AEC8-ED189699EC24}Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3B7599DF-3D5D-4EF5-BF51-9C2EDA788E83}Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3B7599DF-3D5D-4EF5-BF51-9C2EDA788E83}Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{043C5167-00BB-4324-AF7E-62013FAEDACF}Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{043C5167-00BB-4324-AF7E-62013FAEDACF}Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{483830EE-A4CD-4B71-B0A3-3D82E62A6909}Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{043C5167-00BB-4324-AF7E-62013FAEDACF}]Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}Key Deleted : HKCU\Software\1ClickDownloadKey Deleted : HKCU\Software\APNKey Deleted : HKCU\Software\Ask.comKey Deleted : HKCU\Software\DataMngr[#] Key Deleted : HKCU\Software\DataMngr_ToolbarKey Deleted : HKCU\Software\ilividKey Deleted : HKCU\Software\PrivitizeVPNInstallDatesKey Deleted : HKCU\Software\StartSearchKey Deleted : HKCU\Software\vShareKey Deleted : HKCU\Software\YahooPartnerToolbarKey Deleted : HKCU\Software\ZugoKey Deleted : HKCU\Software\AppDataLow\AskToolbarInfoKey Deleted : HKCU\Software\AppDataLow\SProtectorKey Deleted : HKCU\Software\AppDataLow\Software\AskToolbarKey Deleted : HKLM\Software\APNKey Deleted : HKLM\Software\AskToolbarKey Deleted : HKLM\Software\BabylonKey Deleted : HKLM\Software\iLividSRTBKey Deleted : HKLM\Software\SP GlobalKey Deleted : HKLM\Software\SProtectorKey Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\1ClickDownloadKey Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Search Results ToolbarKey Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\vShareKey Deleted : [x64] HKLM\SOFTWARE\DataMngrKey Deleted : [x64] HKLM\SOFTWARE\Tarma Installer ***** [ Browsers ] ***** -\\ Internet Explorer v10.0.9200.16686 Setting Restored : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [start Page] -\\ Mozilla Firefox v21.0 (en-US) [ File : C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\prefs.js ] [ File : C:\Users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\f0ptetok.default\prefs.js ] -\\ Google Chrome v [ File : C:\Users\Chris\AppData\Local\Google\Chrome\User Data\Default\preferences ] Deleted : homepage ************************* AdwCleaner[R0].txt - [9611 octets] - [15/09/2013 12:45:43]AdwCleaner[R1].txt - [9671 octets] - [15/09/2013 14:25:08]AdwCleaner[s0].txt - [8635 octets] - [15/09/2013 14:48:25] ########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [8695 octets] ########## Link to post Share on other sites More sharing options...
MrCharlie Posted September 15, 2013 ID:730374 Share Posted September 15, 2013 Malwarebytes log??? MrC Link to post Share on other sites More sharing options...
nojustice7 Posted September 15, 2013 Author ID:730421 Share Posted September 15, 2013 Malwarebytes log: Malwarebytes Anti-Malware 1.75.0.1300www.malwarebytes.org Database version: v2013.09.15.06 Windows 7 Service Pack 1 x64 NTFSInternet Explorer 10.0.9200.16686Chris :: CHRIS-PC [administrator] 9/15/2013 2:59:25 PMmbam-log-2013-09-15 (14-59-25).txt Scan type: Quick scanScan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUMScan options disabled: P2PObjects scanned: 261266Time elapsed: 11 minute(s), 42 second(s) Memory Processes Detected: 0(No malicious items detected) Memory Modules Detected: 0(No malicious items detected) Registry Keys Detected: 1HKLM\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> Quarantined and deleted successfully. Registry Values Detected: 3HKLM\SOFTWARE\Mozilla\Firefox\Extensions\{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD} (PUP.Optional.SweetPacks) -> Data: -> Quarantined and deleted successfully.HKLM\SOFTWARE\Mozilla\Firefox\Extensions|{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD} (PUP.Optional.SweetPacks) -> Data: C:\Program Files\Updater By SweetPacks\Firefox -> Quarantined and deleted successfully.HKLM\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Data: {C9DDEB0C-A159-11E2-89A9-002454A0E3B6} -> Quarantined and deleted successfully. Registry Data Items Detected: 0(No malicious items detected) Folders Detected: 0(No malicious items detected) Files Detected: 6C:\Users\Chris\AppData\Roaming\FrostWire\.AppSpecialShare\frostwire-4.21.3.windows.exe (PUP.Optional.AskToolbar) -> Quarantined and deleted successfully.C:\Users\Chris\Downloads\4shared_desktop_3.3.5.exe (PUP.Optional.4Squared) -> Quarantined and deleted successfully.C:\Users\Chris\Downloads\codec_pack_685765_ch.exe (PUP.BundleInstaller.DW) -> Quarantined and deleted successfully.C:\Users\Chris\Downloads\iLividSetup.exe (PUP.Optional.Bandoo) -> Quarantined and deleted successfully.C:\Users\Chris\Downloads\PhotoScape_V3.6.5.exe (PUP.Optional.OpenCandy) -> Quarantined and deleted successfully.C:\Users\Chris\Downloads\rm10989_1500_[samantha_38G_-_Remastered_Sex_in_the_City].exe (PUP.BundleInstaller.DW) -> Quarantined and deleted successfully. (end) The computer is running smoothly without any apparent signs of infections. Link to post Share on other sites More sharing options...
MrCharlie Posted September 15, 2013 ID:730426 Share Posted September 15, 2013 Great...... Lets check your computers security before you go and we have a little cleanup to do also: Download Security Check by screen317 from HERE or HERE.Save it to your Desktop.Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.If you get Unsupported operating system. Aborting now, just reboot and try again.A Notepad document should open automatically called checkup.txt.Please Post the contents of that document.Do Not Attach It!!!MrC Link to post Share on other sites More sharing options...
Recommended Posts