Jump to content

pls help! ukash virus and no safe mode, c,d, and x drives!

oscar146

By oscar146
in Resolved Malware Removal Logs

 Share

Recommended Posts

oscar146

oscar146

Posted
Posted

hi all,

 

sorry im very new and have very basic knowledge i hope someone can help me!!  i have had this ukash virus before and i managed to use safe mode with networking and fixed it.

 

however! this time safe mode wont work at all and ive tried to system restore but its saying error!

 

i have gone on earlier and found someone who had this make a txt file of FRST.exe and so ive done that and have my results, could someone please help and look at them for me i am really stuck now!

 

ill be presumptious and post them but sorry if its totally the wrong thing to do!

 

gina

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-10-2013 01
Ran by SYSTEM on MININT-PAJ33JR on 26-10-2013 15:35:53
Running from G:\
Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11785832 2011-03-10] (Realtek Semiconductor)
HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [1356240 2013-08-12] ()
HKLM\...\RunOnce: [*Restore] - C:\Windows\system32\rstrui.exe /RUNONCE [296960 2010-11-20] (Microsoft Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [1103440 2011-06-30] (Dritek System Inc.)
HKU\Default\...\RunOnce: [scrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe [162408 2011-09-12] ()
HKU\Default User\...\RunOnce: [scrSav] - C:\Program Files (x86)\Packard Bell\Screensaver\run_Packard Bell.exe [162408 2011-09-12] ()
HKU\gina\...\Run: [searchProtection] - C:\Users\gina\AppData\Roaming\Search Protection\SearchProtection.EXE [832360 2013-09-03] (Spigot, Inc.)
HKU\gina\...\Run: [Google Update] - C:\Users\gina\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-04-13] (Google Inc.)
HKU\gina\...\Run: [Google Update] - C:\Users\gina\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-04-13] (Google Inc.)
HKU\gina\...\Run: [ChromeFrameHelper] - C:\Users\gina\AppData\Local\Google\Chrome\Application\30.0.1599.101\chrome_frame_helper.exe [83408 2013-10-08] (Google Inc.)
HKU\gina\...\Run: [u3ySajgwS.exe] - C:\Users\gina\AppData\Local\LT4JGd5xZnC\U3ySajgwS.exe [164592 2013-10-26] (Microsoft Corporation)
HKU\gina\...\Run: [internet Security] - C:\Users\gina\AppData\Roaming\iisecurity.exe [836608 2013-10-26] (AVAZD Software)
HKU\gina\...\Winlogon: [shell] cmd.exe [345088 2010-11-20] (Microsoft Corporation) <==== ATTENTION
HKU\gina\...\Command Processor: "C:\Users\gina\AppData\Local\LT4JGd5xZnC\U3ySajgwS.exe" <===== ATTENTION!
BootExecute: autocheck autochk * regdefrag

==================== Services (Whitelisted) =================

S2 ePowerSvc; C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [872552 2011-08-02] (Acer Incorporated)
S2 GREGService; C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe [36456 2011-05-29] (Acer Incorporated)
S2 Live Updater Service; C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [244624 2011-04-22] (Acer Incorporated)
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-08-12] ()
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366600 2013-08-12] ()
S2 *etadpug; "C:\Program Files (x86)\Google\Desktop\Install\{7373881a-857c-3e88-95e3-4fc3a16ac126}\   \...\???\{7373881a-857c-3e88-95e3-4fc3a16ac126}\GoogleUpdate.exe" < <==== ATTENTION (ZeroAccess)

==================== Drivers (Whitelisted) ====================

S3 androidusb; C:\Windows\System32\Drivers\androidusb.sys [32768 2010-04-28] (Google Inc)
S3 gfiark; C:\Windows\System32\drivers\gfiark.sys [39504 2013-04-11] (ThreatTrack Security)
S0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-06-26] (GFI Software)
S3 HTCAND64; C:\Windows\System32\Drivers\ANDROIDUSB.sys [32768 2010-04-28] (Google Inc)
S3 libusb0; C:\Windows\System32\drivers\libusb0.sys [29184 2012-03-01] (http://libusb-win32.sourceforge.net)
S3 libusb0; C:\Windows\SysWow64\drivers\libusb0.sys [21504 2011-05-25] (http://libusb-win32.sourceforge.net)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [247216 2013-06-18] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [139616 2013-06-18] (Microsoft Corporation)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [27520 2007-05-14] (Research In Motion Limited)
S0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2012-05-27] (Duplex Secure Ltd.)

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-10-26 15:35 - 2013-10-26 15:35 - 00000000 ____D C:\FRST
2013-10-26 04:16 - 2013-10-26 04:15 - 00181760 _____ C:\Users\gina\AppData\Roaming\0Z8jRw2v
2013-10-26 04:16 - 2013-10-26 04:15 - 00181760 _____ C:\Users\gina\AppData\Local\6lj5V92g7
2013-10-26 04:16 - 2013-10-26 04:15 - 00181760 _____ C:\ProgramData\R1EvYenBk
2013-10-26 04:14 - 2013-10-26 04:14 - 00181760 _____ C:\Users\gina\AppData\Roaming\fPMVBNcZB
2013-10-26 04:14 - 2013-10-26 04:14 - 00181760 _____ C:\Users\gina\AppData\Local\KeSaacx2
2013-10-26 04:14 - 2013-10-26 04:14 - 00181760 _____ C:\ProgramData\XKFB0FWX3h
2013-10-26 04:08 - 2013-10-26 04:08 - 00181760 _____ C:\Users\gina\AppData\Roaming\DZvh8M45T
2013-10-26 04:08 - 2013-10-26 04:08 - 00181760 _____ C:\Users\gina\AppData\Local\TvlkojlKFsK
2013-10-26 04:08 - 2013-10-26 04:08 - 00181760 _____ C:\ProgramData\YHHCtTSfoiH
2013-10-26 04:05 - 2013-10-26 04:05 - 00181760 _____ C:\Users\gina\AppData\Roaming\4scIYk7Wap
2013-10-26 04:05 - 2013-10-26 04:05 - 00181760 _____ C:\Users\gina\AppData\Local\L8Vqud87
2013-10-26 04:05 - 2013-10-26 04:05 - 00181760 _____ C:\ProgramData\5pA32WGouh
2013-10-26 04:01 - 2013-10-26 04:01 - 00181760 _____ C:\Users\gina\AppData\Roaming\tIvmC1RWZY
2013-10-26 04:01 - 2013-10-26 04:01 - 00181760 _____ C:\Users\gina\AppData\Local\tm2YWhxCJDP
2013-10-26 04:01 - 2013-10-26 04:01 - 00181760 _____ C:\ProgramData\KHcGMdw8l3l
2013-10-26 02:38 - 2013-10-26 02:38 - 00181760 _____ C:\Users\gina\AppData\Roaming\hJ7POyqa
2013-10-26 02:38 - 2013-10-26 02:38 - 00181760 _____ C:\Users\gina\AppData\Local\6JBmA7fV
2013-10-26 02:38 - 2013-10-26 02:38 - 00181760 _____ C:\ProgramData\ijrYScvUGQ
2013-10-26 02:23 - 2013-10-26 15:18 - 00000000 ____D C:\Users\gina\AppData\Local\LT4JGd5xZnC
2013-10-26 02:23 - 2013-10-26 02:23 - 00836608 _____ (AVAZD Software) C:\Users\gina\AppData\Roaming\iisecurity.exe
2013-10-26 02:23 - 2013-10-26 02:23 - 00181760 _____ C:\Users\gina\AppData\Roaming\mE36TJVKBV
2013-10-26 02:23 - 2013-10-26 02:23 - 00181760 _____ C:\Users\gina\AppData\Local\3JyTOxPVHdK
2013-10-26 02:23 - 2013-10-26 02:23 - 00181760 _____ C:\ProgramData\DLWQa62qCJA
2013-10-26 02:23 - 2013-10-26 02:23 - 00000794 _____ C:\Users\gina\Desktop\Internet Security.lnk
2013-10-12 00:08 - 2013-10-12 00:11 - 00000000 ____D C:\Users\gina\Downloads\Cloudy With A Chance Of Meatballs 2 2013 CAM XviD-Srkfan
2013-10-09 23:36 - 2013-09-22 15:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-10-09 23:36 - 2013-09-22 15:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-10-09 23:36 - 2013-09-22 15:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-10-09 23:36 - 2013-09-22 15:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-10-09 23:36 - 2013-09-22 15:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-10-09 23:36 - 2013-09-22 15:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-10-09 23:36 - 2013-09-22 15:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-10-09 23:36 - 2013-09-22 15:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-10-09 23:36 - 2013-09-22 15:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-10-09 23:36 - 2013-09-22 15:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-10-09 23:36 - 2013-09-22 15:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-10-09 23:36 - 2013-09-22 15:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-10-09 23:36 - 2013-09-22 15:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-10-09 23:36 - 2013-09-22 14:55 - 02241024 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-10-09 23:36 - 2013-09-22 14:55 - 01365504 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-10-09 23:36 - 2013-09-22 14:55 - 00051712 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-10-09 23:36 - 2013-09-22 14:54 - 19252224 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-10-09 23:36 - 2013-09-22 14:54 - 15404544 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-10-09 23:36 - 2013-09-22 14:54 - 03959296 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-10-09 23:36 - 2013-09-22 14:54 - 02647552 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-10-09 23:36 - 2013-09-22 14:54 - 00855552 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-10-09 23:36 - 2013-09-22 14:54 - 00603136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-10-09 23:36 - 2013-09-22 14:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-10-09 23:36 - 2013-09-22 14:54 - 00136704 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-10-09 23:36 - 2013-09-22 14:54 - 00067072 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-10-09 23:36 - 2013-09-22 14:54 - 00053248 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-10-09 23:36 - 2013-09-22 14:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-10-09 23:36 - 2013-09-20 19:38 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-10-09 23:36 - 2013-09-20 19:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-10-09 23:36 - 2013-09-20 18:48 - 00089600 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-10-09 23:36 - 2013-09-20 18:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-10-08 23:01 - 2013-09-07 18:30 - 01903552 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-10-08 23:01 - 2013-09-07 18:27 - 00327168 _____ (Microsoft Corporation) C:\Windows\System32\mswsock.dll
2013-10-08 23:01 - 2013-07-12 02:41 - 00185344 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbvideo.sys
2013-10-08 23:01 - 2013-07-12 02:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbcir.sys
2013-10-08 23:01 - 2013-07-04 04:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\System32\WebClnt.dll
2013-10-08 23:01 - 2013-07-04 04:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\System32\comctl32.dll
2013-10-08 23:01 - 2013-07-04 04:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\System32\davclnt.dll
2013-10-08 23:01 - 2013-07-04 03:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2013-10-08 23:01 - 2013-07-04 03:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2013-10-08 23:01 - 2013-07-04 03:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2013-10-08 23:01 - 2013-07-04 02:11 - 00140800 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\mrxdav.sys
2013-10-08 23:01 - 2013-07-02 20:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\hidclass.sys
2013-10-08 23:01 - 2013-07-02 20:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\hidparse.sys
2013-10-08 23:01 - 2013-06-25 14:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\Wdf01000.sys
2013-10-08 23:01 - 2013-06-05 21:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\System32\lpk.dll
2013-10-08 23:01 - 2013-06-05 21:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\System32\fontsub.dll
2013-10-08 23:01 - 2013-06-05 21:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\System32\dciman32.dll
2013-10-08 23:01 - 2013-06-05 21:47 - 00046080 _____ (Adobe Systems) C:\Windows\System32\atmlib.dll
2013-10-08 23:01 - 2013-06-05 20:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2013-10-08 23:01 - 2013-06-05 20:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2013-10-08 23:01 - 2013-06-05 20:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2013-10-08 23:01 - 2013-06-05 19:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\System32\atmfd.dll
2013-10-08 23:01 - 2013-06-05 19:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2013-10-08 23:01 - 2013-06-05 19:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2013-10-08 23:00 - 2013-09-13 17:10 - 00497152 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\afd.sys
2013-10-08 23:00 - 2013-09-07 18:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2013-10-08 23:00 - 2013-09-04 04:12 - 00343040 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbhub.sys
2013-10-08 23:00 - 2013-09-04 04:11 - 00325120 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbport.sys
2013-10-08 23:00 - 2013-09-04 04:11 - 00099840 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbccgp.sys
2013-10-08 23:00 - 2013-09-04 04:11 - 00052736 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbehci.sys
2013-10-08 23:00 - 2013-09-04 04:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbuhci.sys
2013-10-08 23:00 - 2013-09-04 04:11 - 00025600 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbohci.sys
2013-10-08 23:00 - 2013-09-04 04:11 - 00007808 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbd.sys
2013-10-08 23:00 - 2013-08-28 18:17 - 05549504 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-10-08 23:00 - 2013-08-28 18:16 - 01732032 _____ (Microsoft Corporation) C:\Windows\System32\ntdll.dll
2013-10-08 23:00 - 2013-08-28 18:16 - 00859648 _____ (Microsoft Corporation) C:\Windows\System32\tdh.dll
2013-10-08 23:00 - 2013-08-28 18:16 - 00243712 _____ (Microsoft Corporation) C:\Windows\System32\wow64.dll
2013-10-08 23:00 - 2013-08-28 18:13 - 00878080 _____ (Microsoft Corporation) C:\Windows\System32\advapi32.dll
2013-10-08 23:00 - 2013-08-28 17:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-10-08 23:00 - 2013-08-28 17:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-10-08 23:00 - 2013-08-28 17:50 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-10-08 23:00 - 2013-08-28 17:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2013-10-08 23:00 - 2013-08-28 17:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-10-08 23:00 - 2013-08-28 17:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2013-10-08 23:00 - 2013-08-28 16:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-10-08 23:00 - 2013-08-28 16:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-10-08 23:00 - 2013-08-28 16:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-10-08 23:00 - 2013-08-28 16:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-10-08 23:00 - 2013-08-27 17:21 - 03155968 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-10-08 23:00 - 2013-08-27 17:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\System32\scavengeui.dll
2013-10-08 23:00 - 2013-08-01 04:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys
2013-10-08 23:00 - 2013-07-20 02:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\System32\PresentationCFFRasterizerNative_v0300.dll
2013-10-08 23:00 - 2013-07-20 02:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2013-10-05 12:03 - 2013-10-16 02:22 - 00002195 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-10-05 12:02 - 2013-10-26 06:12 - 00000890 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-05 12:02 - 2013-10-26 04:19 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-10-05 12:02 - 2013-10-11 00:14 - 00003890 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-10-05 12:02 - 2013-10-11 00:14 - 00003638 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-10-05 11:22 - 2013-10-26 04:12 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-05 11:22 - 2013-10-08 23:12 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-10-04 09:34 - 2013-10-26 15:10 - 00000000 ____D C:\Users\gina\Downloads\The Internship [2013] HDRip XViD-ETRG
2013-09-30 08:59 - 2013-10-08 23:12 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-30 08:59 - 2013-10-08 23:12 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-30 08:58 - 2013-09-30 08:59 - 00000000 ___HD C:\Windows\AxInstSV
2013-09-27 10:34 - 2013-09-27 10:39 - 00000000 ____D C:\Users\gina\Downloads\TURBO 2013 R6 DVDSCR X264 MP3 AVi MURDER

==================== One Month Modified Files and Folders =======

2013-10-26 15:35 - 2013-10-26 15:35 - 00000000 ____D C:\FRST
2013-10-26 15:18 - 2013-10-26 02:23 - 00000000 ____D C:\Users\gina\AppData\Local\LT4JGd5xZnC
2013-10-26 15:18 - 2013-07-02 11:44 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-10-26 15:18 - 2012-05-13 05:06 - 00000000 ____D C:\Users\gina\AppData\Roaming\vlc
2013-10-26 15:18 - 2012-04-07 07:00 - 00000000 ____D C:\users\gina
2013-10-26 15:18 - 2011-10-11 04:31 - 00000000 ___HD C:\OEM
2013-10-26 15:18 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-10-26 15:11 - 2013-07-02 11:44 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2013-10-26 15:11 - 2012-04-07 08:30 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-10-26 15:11 - 2012-04-07 08:30 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-10-26 15:11 - 2009-07-13 19:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-10-26 15:10 - 2013-10-04 09:34 - 00000000 ____D C:\Users\gina\Downloads\The Internship [2013] HDRip XViD-ETRG
2013-10-26 15:10 - 2012-05-15 11:06 - 00000000 ____D C:\Users\gina\AppData\Roaming\BitTorrent
2013-10-26 15:10 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache
2013-10-26 06:12 - 2013-10-05 12:02 - 00000890 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-26 06:12 - 2013-05-27 13:21 - 00020832 _____ C:\Windows\setupact.log
2013-10-26 06:12 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-26 05:53 - 2009-07-13 20:45 - 00016976 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-26 05:53 - 2009-07-13 20:45 - 00016976 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-26 05:49 - 2013-06-26 11:24 - 00042080 _____ C:\Windows\PFRO.log
2013-10-26 05:40 - 2012-01-26 08:32 - 01713489 _____ C:\Windows\WindowsUpdate.log
2013-10-26 05:29 - 2012-04-16 11:47 - 00000000 ____D C:\Users\gina\AppData\Local\CrashDumps
2013-10-26 05:29 - 2011-10-11 04:04 - 00000000 ____D C:\Program Files\Packard Bell
2013-10-26 05:29 - 2011-10-11 03:50 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-10-26 04:19 - 2013-10-05 12:02 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-10-26 04:19 - 2009-07-13 21:13 - 00005024 _____ C:\Windows\System32\PerfStringBackup.INI
2013-10-26 04:15 - 2013-10-26 04:16 - 00181760 _____ C:\Users\gina\AppData\Roaming\0Z8jRw2v
2013-10-26 04:15 - 2013-10-26 04:16 - 00181760 _____ C:\Users\gina\AppData\Local\6lj5V92g7
2013-10-26 04:15 - 2013-10-26 04:16 - 00181760 _____ C:\ProgramData\R1EvYenBk
2013-10-26 04:14 - 2013-10-26 04:14 - 00181760 _____ C:\Users\gina\AppData\Roaming\fPMVBNcZB
2013-10-26 04:14 - 2013-10-26 04:14 - 00181760 _____ C:\Users\gina\AppData\Local\KeSaacx2
2013-10-26 04:14 - 2013-10-26 04:14 - 00181760 _____ C:\ProgramData\XKFB0FWX3h
2013-10-26 04:12 - 2013-10-05 11:22 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-26 04:08 - 2013-10-26 04:08 - 00181760 _____ C:\Users\gina\AppData\Roaming\DZvh8M45T
2013-10-26 04:08 - 2013-10-26 04:08 - 00181760 _____ C:\Users\gina\AppData\Local\TvlkojlKFsK
2013-10-26 04:08 - 2013-10-26 04:08 - 00181760 _____ C:\ProgramData\YHHCtTSfoiH
2013-10-26 04:06 - 2012-04-13 09:23 - 00000904 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2556482551-3916483557-3486083999-1000UA.job
2013-10-26 04:05 - 2013-10-26 04:05 - 00181760 _____ C:\Users\gina\AppData\Roaming\4scIYk7Wap
2013-10-26 04:05 - 2013-10-26 04:05 - 00181760 _____ C:\Users\gina\AppData\Local\L8Vqud87
2013-10-26 04:05 - 2013-10-26 04:05 - 00181760 _____ C:\ProgramData\5pA32WGouh
2013-10-26 04:01 - 2013-10-26 04:01 - 00181760 _____ C:\Users\gina\AppData\Roaming\tIvmC1RWZY
2013-10-26 04:01 - 2013-10-26 04:01 - 00181760 _____ C:\Users\gina\AppData\Local\tm2YWhxCJDP
2013-10-26 04:01 - 2013-10-26 04:01 - 00181760 _____ C:\ProgramData\KHcGMdw8l3l
2013-10-26 02:38 - 2013-10-26 02:38 - 00181760 _____ C:\Users\gina\AppData\Roaming\hJ7POyqa
2013-10-26 02:38 - 2013-10-26 02:38 - 00181760 _____ C:\Users\gina\AppData\Local\6JBmA7fV
2013-10-26 02:38 - 2013-10-26 02:38 - 00181760 _____ C:\ProgramData\ijrYScvUGQ
2013-10-26 02:23 - 2013-10-26 02:23 - 00836608 _____ (AVAZD Software) C:\Users\gina\AppData\Roaming\iisecurity.exe
2013-10-26 02:23 - 2013-10-26 02:23 - 00181760 _____ C:\Users\gina\AppData\Roaming\mE36TJVKBV
2013-10-26 02:23 - 2013-10-26 02:23 - 00181760 _____ C:\Users\gina\AppData\Local\3JyTOxPVHdK
2013-10-26 02:23 - 2013-10-26 02:23 - 00181760 _____ C:\ProgramData\DLWQa62qCJA
2013-10-26 02:23 - 2013-10-26 02:23 - 00000794 _____ C:\Users\gina\Desktop\Internet Security.lnk
2013-10-26 02:21 - 2013-05-17 06:24 - 00000000 ____D C:\ProgramData\MFAData
2013-10-26 02:17 - 2012-07-04 09:36 - 00000000 ____D C:\Program Files (x86)\Google
2013-10-24 11:06 - 2012-04-13 09:23 - 00000852 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2556482551-3916483557-3486083999-1000Core.job
2013-10-20 22:05 - 2009-07-13 21:08 - 00032620 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-10-19 16:06 - 2013-03-19 10:58 - 00000512 _____ C:\Windows\Tasks\Malwarebytes' Scheduled Scan for gina.job
2013-10-19 16:00 - 2013-03-19 10:58 - 00000498 _____ C:\Windows\Tasks\Malwarebytes' Scheduled Update for gina.job
2013-10-16 02:22 - 2013-10-05 12:03 - 00002195 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-10-13 11:47 - 2012-04-13 09:23 - 00000000 ____D C:\Users\gina\AppData\Local\Google
2013-10-12 15:16 - 2012-06-22 12:34 - 00000024 _____ C:\Users\gina\random.dat
2013-10-12 11:12 - 2013-03-09 10:56 - 00000043 _____ C:\Users\gina\jagex_cl_oldschool_LIVE.dat
2013-10-12 00:11 - 2013-10-12 00:08 - 00000000 ____D C:\Users\gina\Downloads\Cloudy With A Chance Of Meatballs 2 2013 CAM XviD-Srkfan
2013-10-11 00:14 - 2013-10-05 12:02 - 00003890 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-10-11 00:14 - 2013-10-05 12:02 - 00003638 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-10-10 11:01 - 2012-04-13 09:23 - 00003872 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2556482551-3916483557-3486083999-1000UA
2013-10-10 11:01 - 2012-04-13 09:23 - 00003476 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2556482551-3916483557-3486083999-1000Core
2013-10-10 10:23 - 2009-07-13 20:45 - 00292616 _____ C:\Windows\System32\FNTCACHE.DAT
2013-10-09 23:39 - 2012-05-11 07:37 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-09 22:53 - 2013-08-14 12:05 - 00000000 ____D C:\Windows\System32\MRT
2013-10-09 22:49 - 2012-06-22 07:05 - 80541720 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-10-09 22:42 - 2013-01-01 04:04 - 00001945 _____ C:\Windows\epplauncher.mif
2013-10-08 23:12 - 2013-10-05 11:22 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-10-08 23:12 - 2013-09-30 08:59 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-10-08 23:12 - 2013-09-30 08:59 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-10-05 12:03 - 2013-01-03 11:28 - 00000000 ____D C:\Users\gina\AppData\Local\Adobe
2013-10-04 09:30 - 2012-05-27 00:18 - 00000000 ____D C:\Users\gina\Downloads\films
2013-10-01 17:16 - 2012-04-16 11:51 - 00000000 ____D C:\Users\gina\AppData\Roaming\SoftGrid Client
2013-09-30 08:59 - 2013-09-30 08:58 - 00000000 ___HD C:\Windows\AxInstSV
2013-09-30 01:44 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\NDF
2013-09-27 10:39 - 2013-09-27 10:34 - 00000000 ____D C:\Users\gina\Downloads\TURBO 2013 R6 DVDSCR X264 MP3 AVi MURDER
2013-09-27 08:33 - 2012-06-05 01:28 - 00000000 ____D C:\Users\gina\Documents\WBFS Manager Covers

ZeroAccess:
C:\Windows\assembly\GAC_32\Desktop.ini

ZeroAccess:
C:\Windows\assembly\GAC_64\Desktop.ini

Files to move or delete:
====================
C:\Users\gina\AppData\Local\LT4JGd5xZnC\U3ySajgwS.exe
ZeroAccess:
C:\Users\gina\AppData\Local\Google\Desktop\Install
ZeroAccess:
C:\Program Files (x86)\Google\Desktop\Install
C:\Users\gina\8907001.exe
C:\Users\gina\jagex_cl_oldschool_LIVE.dat
C:\Users\gina\jagex_cl_runescape_LIVE.dat
C:\Users\gina\jagex_cl_runescape_LIVE1.dat
C:\Users\gina\jagex_cl_runescape_LIVE2.dat
C:\Users\gina\random.dat

Some content of TEMP:
====================
C:\Users\gina\AppData\Local\Temp\InstallFlashPlayer.exe
C:\Users\gina\AppData\Local\Temp\oi_{2F1B3F87-C302-43D8-946D-590EA88C7C0B}.exe
C:\Users\gina\AppData\Local\Temp\SearchProtectionSetup.exe
C:\Users\gina\AppData\Local\Temp\TUUUninstallHelper.exe
C:\Users\gina\AppData\Local\Temp\UNINSTALL.EXE
C:\Users\gina\AppData\Local\Temp\~tmf6294002116931952954.dll

==================== Known DLLs (Whitelisted) ================

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
C:\Program Files\Windows Defender\mpsvc.dll => ATTENTION: ZeroAccess. Use DeleteJunctionsIndirectory: C:\Program Files\Windows Defender
C:\Program Files\Microsoft Security Client\MsMpEng.exe => ATTENTION: ZeroAccess. Use DeleteJunctionsIndirectory: C:\Program Files\Microsoft Security Client

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

5
Restore point made on: 2013-10-09 22:39:53
Restore point made on: 2013-10-13 01:03:25
Restore point made on: 2013-10-20 09:17:19
Restore point made on: 2013-10-26 02:19:53
Restore point made on: 2013-10-26 02:21:24

==================== Memory info ===========================

Percentage of memory in use: 13%
Total physical RAM: 5995.86 MB
Available physical RAM: 5199.16 MB
Total Pagefile: 5994.06 MB
Available Pagefile: 5197.4 MB
Total Virtual: 8192 MB
Available Virtual: 8191.88 MB

==================== Drives ================================

Drive c: (Packard Bell) (Fixed) (Total:445.66 GB) (Free:174.74 GB) NTFS
Drive e: (PQSERVICE) (Fixed) (Total:20 GB) (Free:2.37 GB) NTFS
Drive g: () (Removable) (Total:1.86 GB) (Free:1.86 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[system with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 5F230415)
Partition 1: (Not Active) - (Size=20 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=446 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 2 GB) (Disk ID: C5759A16)
Partition 1: (Not Active) - (Size=2 GB) - (Type=0B)

LastRegBack: 2013-10-13 05:16

 

 

 

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

Please read the following information first.
 

You're infected with Rootkit.ZeroAccess, a BackDoor Trojan.

BACKDOOR WARNING

------------------------------

One or more of the identified infections is known to use a backdoor.

This allows hackers to remotely control your computer, steal critical system information and download and execute files.

I would advice you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the infection has been identified and because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
http://www.dslreports.com/faq/10451

When Should I Format, How Should I Reinstall
http://www.dslreports.com/faq/10063

I will try my best to clean this machine but I can't guarantee that it will be 100% secure afterwards.

I would change all my passwords and keep a close eye on all your sensitive accounts.

Let me know what you decide to do. If you decide to go through with the cleanup, please proceed with the following steps.


-----------------------------------------

Please download the attached fixlist.txt and copy it to your flashdrive.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options. (as you did before)

Run FRST64 or FRST (which ever one you're using) and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

See if the computer boots normally now and if so..........

Please download Farbar Recovery Scan Tool and save it to a folder. (use correct version for your system.....Which system am I using?)


Please make sure you click download buttons that look like this not "sponsored ad links":

bleep-crop.jpg

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

MrC

Link to post
Share on other sites
oscar146

oscar146

Posted
  • Author
Posted

thank yu thank you for getting back to me!! im currently on my secure work laptop so ill get on to all my banks now and change all my info, ill try your advice and follow the steps then hopefully i can get onto my computer and get what i need and look at a reformat, but ill try the steps above first fingers crossed here goes! ill let you know how i do.....!

Link to post
Share on other sites
oscar146

oscar146

Posted
  • Author
Posted

right! so ive run the first steps and now im typing from my infected pc so that worked, thank you!

here is my log from the fix:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 26-10-2013 01
Ran by SYSTEM at 2013-10-26 18:45:35 Run:1
Running from G:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
HKU\gina\...\Winlogon: [shell] cmd.exe [345088 2010-11-20] (Microsoft Corporation)
HKU\gina\...\Command Processor: "C:\Users\gina\AppData\Local\LT4JGd5xZnC\U3ySajgwS.exe"
C:\Users\gina\AppData\Local\LT4JGd5xZnC\U3ySajgwS.exe
C:\Users\gina\AppData\Roaming\0Z8jRw2v
C:\Users\gina\AppData\Local\6lj5V92g7
C:\ProgramData\R1EvYenBk
C:\Users\gina\AppData\Roaming\fPMVBNcZB
C:\Users\gina\AppData\Local\KeSaacx2
C:\ProgramData\XKFB0FWX3h
C:\Users\gina\AppData\Roaming\DZvh8M45T
C:\Users\gina\AppData\Local\TvlkojlKFsK
C:\ProgramData\YHHCtTSfoiH
C:\Users\gina\AppData\Roaming\4scIYk7Wap
C:\Users\gina\AppData\Local\L8Vqud87
C:\ProgramData\5pA32WGouh
C:\Users\gina\AppData\Roaming\tIvmC1RWZY
C:\Users\gina\AppData\Local\tm2YWhxCJDP
C:\ProgramData\KHcGMdw8l3l
C:\Users\gina\AppData\Roaming\hJ7POyqa
 C:\Users\gina\AppData\Local\6JBmA7fV
 C:\ProgramData\ijrYScvUGQ
 C:\Users\gina\AppData\Local\LT4JGd5xZnC
C:\Users\gina\AppData\Roaming\iisecurity.exe
C:\Users\gina\AppData\Roaming\mE36TJVKBV
C:\Users\gina\AppData\Local\3JyTOxPVHdK
C:\ProgramData\DLWQa62qCJA
C:\Windows\assembly\GAC_32\Desktop.ini
C:\Windows\assembly\GAC_64\Desktop.ini
C:\Users\gina\AppData\Local\Google\Desktop\Install
C:\Program Files (x86)\Google\Desktop\Install
C:\Users\gina\8907001.exe
C:\Users\gina\jagex_cl_oldschool_LIVE.dat
C:\Users\gina\jagex_cl_runescape_LIVE.dat
C:\Users\gina\jagex_cl_runescape_LIVE1.dat
C:\Users\gina\jagex_cl_runescape_LIVE2.dat
C:\Users\gina\random.dat
C:\Users\gina\AppData\Local\Temp\InstallFlashPlayer.exe
C:\Users\gina\AppData\Local\Temp\oi_{2F1B3F87-C302-43D8-946D-590EA88C7C0B}.exe
C:\Users\gina\AppData\Local\Temp\SearchProtectionSetup.exe
C:\Users\gina\AppData\Local\Temp\TUUUninstallHelper.exe
C:\Users\gina\AppData\Local\Temp\UNINSTALL.EXE
C:\Users\gina\AppData\Local\Temp\~tmf6294002116931952954.dll

 

*****************

HKU\gina\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.
HKU\gina\Software\Microsoft\Command Processor\\AutoRun => Value deleted successfully.
C:\Users\gina\AppData\Local\LT4JGd5xZnC\U3ySajgwS.exe => Moved successfully.
C:\Users\gina\AppData\Roaming\0Z8jRw2v => Moved successfully.
C:\Users\gina\AppData\Local\6lj5V92g7 => Moved successfully.
C:\ProgramData\R1EvYenBk => Moved successfully.
C:\Users\gina\AppData\Roaming\fPMVBNcZB => Moved successfully.
C:\Users\gina\AppData\Local\KeSaacx2 => Moved successfully.
C:\ProgramData\XKFB0FWX3h => Moved successfully.
C:\Users\gina\AppData\Roaming\DZvh8M45T => Moved successfully.
C:\Users\gina\AppData\Local\TvlkojlKFsK => Moved successfully.
C:\ProgramData\YHHCtTSfoiH => Moved successfully.
C:\Users\gina\AppData\Roaming\4scIYk7Wap => Moved successfully.
C:\Users\gina\AppData\Local\L8Vqud87 => Moved successfully.
C:\ProgramData\5pA32WGouh => Moved successfully.
C:\Users\gina\AppData\Roaming\tIvmC1RWZY => Moved successfully.
C:\Users\gina\AppData\Local\tm2YWhxCJDP => Moved successfully.
C:\ProgramData\KHcGMdw8l3l => Moved successfully.
C:\Users\gina\AppData\Roaming\hJ7POyqa => Moved successfully.
C:\Users\gina\AppData\Roaming\iisecurity.exe => Moved successfully.
C:\Users\gina\AppData\Roaming\mE36TJVKBV => Moved successfully.
C:\Users\gina\AppData\Local\3JyTOxPVHdK => Moved successfully.
C:\ProgramData\DLWQa62qCJA => Moved successfully.
C:\Windows\assembly\GAC_32\Desktop.ini => Moved successfully.
C:\Windows\assembly\GAC_64\Desktop.ini => Moved successfully.
C:\Users\gina\AppData\Local\Google\Desktop\Install => Moved successfully.
C:\Program Files (x86)\Google\Desktop\Install => Moved successfully.
C:\Users\gina\8907001.exe => Moved successfully.
C:\Users\gina\jagex_cl_oldschool_LIVE.dat => Moved successfully.
C:\Users\gina\jagex_cl_runescape_LIVE.dat => Moved successfully.
C:\Users\gina\jagex_cl_runescape_LIVE1.dat => Moved successfully.
C:\Users\gina\jagex_cl_runescape_LIVE2.dat => Moved successfully.
C:\Users\gina\random.dat => Moved successfully.
C:\Users\gina\AppData\Local\Temp\InstallFlashPlayer.exe => Moved successfully.
C:\Users\gina\AppData\Local\Temp\oi_{2F1B3F87-C302-43D8-946D-590EA88C7C0B}.exe => Moved successfully.
C:\Users\gina\AppData\Local\Temp\SearchProtectionSetup.exe => Moved successfully.
C:\Users\gina\AppData\Local\Temp\TUUUninstallHelper.exe => Moved successfully.
C:\Users\gina\AppData\Local\Temp\UNINSTALL.EXE => Moved successfully.
C:\Users\gina\AppData\Local\Temp\~tmf6294002116931952954.dll => Moved successfully.

==== End of Fixlog ====

unfortunately though ive tried to download the farbar recovery scan tool but my computer keeps deleting it as I download it as a virus? also windows defender wont turn back on, shall I update my membership to malwarebytes now do you think?

thanks!

 

gina

Link to post
Share on other sites
oscar146

oscar146

Posted
  • Author
Posted

hi again!

its worked, sorry!

here are the files you wanted, I told you I was a bit dim!

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-10-2013 01
Ran by gina (administrator) on GINA-PC on 26-10-2013 19:03:10
Running from F:\
Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Acer Incorporated) C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Spigot, Inc.) C:\Users\gina\AppData\Roaming\Search Protection\SearchProtection.exe
(Google Inc.) C:\Users\gina\AppData\Local\Google\Chrome\Application\30.0.1599.101\chrome_frame_helper.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Google Inc.) C:\Users\gina\AppData\Local\Google\Update\1.3.21.165\GoogleCrashHandler.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Google Inc.) C:\Users\gina\AppData\Local\Google\Update\1.3.21.165\GoogleCrashHandler64.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe

==================== Registry (Whitelisted) ==================

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 26-10-2013 01
Ran by gina at 2013-10-26 19:04:06
Running from F:\
Boot Mode: Normal
==========================================================

==================== Security Center ========================

==================== Installed Programs ======================

µTorrent (x32 Version: 3.1.3)
7-Zip 9.20 (x32)
Adobe AIR (x32 Version: 3.2.0.2070)
Adobe Community Help (x32 Version: 3.2.1)
Adobe Community Help (x32 Version: 3.2.1.650)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.117)
Adobe Photoshop Elements 9 (x32 Version: 9.0)
Adobe Premiere Elements 9 (x32 Version: 9.0)
Adobe Reader X (10.1.0) MUI (x32 Version: 10.1.0)
Adobe Shockwave Player 11.6 (x32 Version: 11.6.8.638)
Agatha Christie - Death on the Nile (x32 Version: 2.2.0.98)
Amazon Kindle (HKCU)
Animal Genius (x32 Version: 2.2.0.97)
Apple Application Support (x32 Version: 2.1.7)
Apple Mobile Device Support (Version: 5.1.1.4)
Apple Software Update (x32 Version: 2.1.3.127)
BBC iPlayer Desktop (x32 Version: 3.2.15)
Bejeweled 2 Deluxe (x32 Version: 2.2.0.95)
BitTorrent (HKCU Version: 7.8.1.30016)
Bonjour (Version: 3.0.0.10)
Broadcom Card Reader Driver Installer (Version: 14.8.2.2)
Broadcom NetLink Controller (Version: 14.8.4.1)
Chuzzle Deluxe (x32 Version: 2.2.0.95)
Crazy Chicken Kart 2 (x32 Version: 2.2.0.97)
CSI - NY (x32 Version: 1.0)
D3DX10 (x32 Version: 15.4.2368.0902)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32)
eBay Worldwide (x32 Version: 2.2.0409)
Elements 9 Organizer (x32 Version: 9.0)
Elements STI Installer (x32 Version: 1.0)
ETDWare PS/2-X64 8.0.6.3_WHQL (Version: 8.0.6.3)
FATE (x32 Version: 2.2.0.97)
Final Drive: Nitro (x32 Version: 2.2.0.95)
foobar2000 v1.1.14 beta 2 (x32 Version: 1.1.14 beta 2)
Fooz Kids (x32 Version: 3.0.8)
Fooz Kids Platform (x32 Version: 2.1)
Fotogalerija Windows Live (x32 Version: 15.4.3502.0922)
Free Studio version 2013 (x32 Version: 6.1.10.812)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922)
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922)
Galeria fotogràfica del Windows Live (x32 Version: 15.4.3502.0922)
Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922)
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922)
Galerie foto Windows Live (x32 Version: 15.4.3502.0922)
Gardenscapes: Mansion Makeover (x32 Version: 2.2.0.110)
Gone Home (x32)
Google Chrome (x32 Version: 30.0.1599.101)
Google Chrome Frame (HKCU Version: 30.0.1599.101)
Google Update Helper (x32 Version: 1.3.21.165)
HomeMedia (x32 Version: 2.0.8920)
Identity Card (x32 Version: 1.00.3501)
ImgBurn (x32 Version: 2.5.4.0)
Insaniquarium Deluxe (x32 Version: 2.2.0.97)
Intel® Control Center (x32 Version: 1.2.1.1007)
Intel® Management Engine Components (x32 Version: 7.0.0.1144)
Intel® Processor Graphics (x32 Version: 8.15.10.2418)
Intel® Rapid Storage Technology (x32 Version: 10.5.0.1026)
iTunes (Version: 10.6.1.7)
Java 7 Update 7 (x32 Version: 7.0.70)
Java Auto Updater (x32 Version: 2.1.9.0)
JavaFX 2.1.1 (x32 Version: 2.1.1)
Jewel Match 3 (x32 Version: 2.2.0.97)
Jewel Quest Solitaire (x32 Version: 2.2.0.95)
John Deere Drive Green (x32 Version: 2.2.0.95)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
Kobo (x32 Version: 2.1.7)
Launch Manager (x32 Version: 5.1.7)
Malwarebytes Anti-Malware version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Mesh Runtime (x32 Version: 15.4.5722.2)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Access MUI (English) 2010 (x32 Version: 14.0.4734.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (x32 Version: 14.0.4734.1000)
Microsoft Office Click-to-Run 2010 (Version: 14.0.4763.1000)
Microsoft Office Click-to-Run 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Excel MUI (English) 2010 (x32 Version: 14.0.4734.1000)
Microsoft Office Groove MUI (English) 2010 (x32 Version: 14.0.4734.1000)
Microsoft Office InfoPath MUI (English) 2010 (x32 Version: 14.0.4734.1000)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.4734.1000)
Microsoft Office OneNote MUI (English) 2010 (x32 Version: 14.0.4734.1000)
Microsoft Office Outlook MUI (English) 2010 (x32 Version: 14.0.4734.1000)
Microsoft Office PowerPoint MUI (English) 2010 (x32 Version: 14.0.4734.1000)
Microsoft Office Professional Plus 2010 (x32 Version: 14.0.4734.1000)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.4734.1000)
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.4734.1000)
Microsoft Office Proof (Spanish) 2010 (x32 Version: 14.0.4734.1000)
Microsoft Office Proofing (English) 2010 (x32 Version: 14.0.4734.1000)
Microsoft Office Publisher MUI (English) 2010 (x32 Version: 14.0.4734.1000)
Microsoft Office Shared 64-bit MUI (English) 2010 (Version: 14.0.4734.1000)
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010 (Version: 14.0.4734.1000)
Microsoft Office Shared MUI (English) 2010 (x32 Version: 14.0.4734.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (x32 Version: 14.0.4734.1000)
Microsoft Office Starter 2010 - English (x32 Version: 14.0.5131.5000)
Microsoft Office Word MUI (English) 2010 (x32 Version: 14.0.4734.1000)
Microsoft Security Client (Version: 4.3.0219.0)
Microsoft Security Essentials (Version: 4.3.219.0)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft WSE 3.0 Runtime (x32 Version: 3.0.5305.0)
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
MSXML 4.0 SP3 Parser (KB2721691) (x32 Version: 4.30.2114.0)
MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0)
MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0)
Mystery of Mortlake Mansion (x32 Version: 2.2.0.98)
Nero BackItUp 10 (x32 Version: 5.8.11000.8.100)
Nero BackItUp 10 Help (CHM) (x32 Version: 10.6.10700)
Nero Control Center 10 (x32 Version: 10.6.12700.0.7)
Nero ControlCenter 10 Help (CHM) (x32 Version: 10.6.10700)
Nero Core Components 10 (x32 Version: 2.0.19900.9.11)
Nero DiscSpeed 10 (x32 Version: 6.2.10500.2.100)
Nero DiscSpeed 10 Help (CHM) (x32 Version: 10.5.10000)
Nero Express 10 (x32 Version: 10.6.10700.5.100)
Nero Express 10 Help (CHM) (x32 Version: 10.6.10700)
Nero Multimedia Suite 10 Essentials (x32 Version: 10.5.10300)
Nero Multimedia Suite 10 Essentials (x32 Version: 10.6.10300)
Nero RescueAgent 10 (x32 Version: 3.6.10500.3.100)
Nero RescueAgent 10 Help (CHM) (x32 Version: 10.6.10700)
Nero StartSmart 10 (x32 Version: 10.2.11600.14.100)
Nero StartSmart 10 Help (CHM) (x32 Version: 10.5.10000)
Nero Update (x32 Version: 1.0.10900.31.0)
Packard Bell Games (x32 Version: 1.0.3.0)
Packard Bell Power Management (x32 Version: 6.00.3008)
Packard Bell Recovery Management (x32 Version: 5.00.3504)
Packard Bell Registration (x32 Version: 1.04.3504)
Packard Bell ScreenSaver (x32 Version: 1.1.0915.2011)
Packard Bell Social Networks (x32 Version: 3.0.3106)
Packard Bell Updater (x32 Version: 1.02.3500)
Penguins! (x32 Version: 2.2.0.95)
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95)
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922)
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922)
Polar Bowler (x32 Version: 2.2.0.97)
Pošta Windows Live (x32 Version: 15.4.3502.0922)
QuickTime (x32 Version: 7.71.80.42)
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6329)
SanDisk ® Media Manager (x32 Version: 2.1.0.4)
Search Protection (HKCU Version: 7.5.0.1)
SearchAmong Toolbar version 1.0 (x32 Version: 1.0)
Shared C Run-time for x64 (Version: 10.0.0)
SimCity 4 Deluxe (x32)
Sky Go Desktop (HKCU)
Skype™ 5.10 (x32 Version: 5.10.116)
Slingo Deluxe (x32 Version: 2.2.0.95)
SpongeBob Typing (x32 Version: 2.2.0.98)
swMSM (x32 Version: 12.0.0.1)
The Sims™ 3 (x32 Version: 1.0.632)
Torchlight (x32 Version: 2.2.0.97)
Universal Extractor 1.6.1 (x32 Version: 1.6.1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
Update for Microsoft Office 2010 (KB2494150) (x32)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (x32)
Update Installer for WildTangent Games App (x32)
Video Web Camera (x32 Version: 1.0.1904)
VIO Player version 1.2 (x32 Version: 1.2)
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.97)
Visual Studio 2010 x64 Redistributables (Version: 13.0.0.1)
Visual Studio 2012 x64 Redistributables (Version: 14.0.0.1)
Visual Studio 2012 x86 Redistributables (x32 Version: 14.0.0.1)
VLC media player 1.1.5 (x32 Version: 1.1.5)
Wad2ISO (Version: 4.7.0.0)
WBFS Manager 3.0 (x32 Version: 3.0)
Wedding Dash (x32 Version: 2.2.0.95)
Welcome Center (x32 Version: 1.02.3504)
WildTangent Games App (Packard Bell Games) (x32 Version: 4.0.5.14)
WinAVI Video Converter (x32 Version: 11.0.0.3995)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3538.0513)
Windows Live Fotogaléria (x32 Version: 15.4.3502.0922)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)
Windows Live Fotogalleri (x32 Version: 15.4.3502.0922)
Windows Live Fotoğraf Galerisi (x32 Version: 15.4.3502.0922)
Windows Live Fotótár (x32 Version: 15.4.3502.0922)
Windows Live Galeria de Fotos (x32 Version: 15.4.3502.0922)
Windows Live Galerija fotografija (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3538.0513)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live Mesh (x32 Version: 15.4.3502.0922)
Windows Live Messenger (x32 Version: 15.4.3538.0513)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
Windows Live 影像中心 (x32 Version: 15.4.3502.0922)
Windows Live 程式集 (x32 Version: 15.4.3502.0922)
Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922)
Windows Liven sähköposti (x32 Version: 15.4.3502.0922)
Windows Liven valokuvavalikoima (x32 Version: 15.4.3502.0922)
WinRAR 4.00 (64-bit) (Version: 4.00.0)
Yontoo 1.10.02 (Version: 1.10.02)
Zuma Deluxe (x32 Version: 2.2.0.95)
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922)
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922)
Почта Windows Live (x32 Version: 15.4.3502.0922)
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922)
Фотогалерия на Windows Live (x32 Version: 15.4.3502.0922)
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922)
بريد Windows Live (x32 Version: 15.4.3502.0922)
معرض صور Windows Live (x32 Version: 15.4.3502.0922)

==================== Restore Points  =========================

10-10-2013 06:39:52 Windows Update
13-10-2013 09:03:24 Windows Update
20-10-2013 17:17:18 Scheduled Checkpoint
26-10-2013 10:19:51 Removed AVG 2014
26-10-2013 10:21:23 Removed AVG 2014

==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {1A4B555F-9D99-44C8-8D38-E1EA3911E40A} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-10-05] (Google Inc.)
Task: {1FEC7CE4-7A5C-44F1-93B9-31321E23863E} - System32\Tasks\Microsoft\Microsoft Antimalware\MpIdleTask => c:\Program Files\Microsoft Security Client\MpCmdRun.exe [2013-08-12] ()
Task: {329817B6-9CB8-43F7-B719-FE44F4A0EACD} - System32\Tasks\{2F334CA5-5107-4BC8-A7DC-2B2BCCDF4260} => C:\Program Files (x86)\VAG-COM\VagCom.exe [2004-11-11] (Ross-Tech, LLC)
Task: {5ABEFE3E-DC46-4F7F-8DE0-02AF09ABA506} - System32\Tasks\{17A89D0C-C943-4D75-A9F6-1CCEF66298C4} => C:\Program Files (x86)\VAG-COM\VagCom.exe [2004-11-11] (Ross-Tech, LLC)
Task: {5B733DFC-0CAC-41C6-A6A9-A65E850B69C9} - System32\Tasks\Malwarebytes' Scheduled Scan for gina => C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe [2013-04-04] (Malwarebytes Corporation)
Task: {66250B8E-7285-46E5-ACA1-680A135E689D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-10-05] (Google Inc.)
Task: {8964F59A-085D-4182-8D1E-481946576E3B} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2556482551-3916483557-3486083999-1000UA => C:\Users\gina\AppData\Local\Google\Update\GoogleUpdate.exe [2012-04-13] (Google Inc.)
Task: {89A5525E-BC69-47B6-A312-E17D944769C5} - System32\Tasks\Malwarebytes' Scheduled Update for gina => C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe [2013-04-04] (Malwarebytes Corporation)
Task: {8B5E2A31-55A6-4644-B5C6-1DC8667751B1} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-09] (Adobe Systems Incorporated)
Task: {91BF373A-20E9-4A39-9F28-F907D784DA84} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2556482551-3916483557-3486083999-1000Core => C:\Users\gina\AppData\Local\Google\Update\GoogleUpdate.exe [2012-04-13] (Google Inc.)
Task: {96A49EA1-94AC-460C-B945-0C60B2323859} - System32\Tasks\Launch HTC Sync Loader => C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe
Task: {B7D2DABE-A713-4179-B42D-0FCB08136760} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {D94849C3-4595-4F16-88B7-B106AED20DA8} - System32\Tasks\NBAgent => C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe [2011-07-05] (Nero AG)
Task: {F885945E-FA4A-4DC5-8E5B-D0266B74E569} - System32\Tasks\{9BD9699D-E26D-4CDF-B439-A40467941902} => C:\Program Files (x86)\VAG-COM\VagCom.exe [2004-11-11] (Ross-Tech, LLC)
Task: {FF18225B-FDE9-4534-A51B-6F63659B925C} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => c:\Program Files\Microsoft Security Client\MpCmdRun.exe [2013-08-12] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2556482551-3916483557-3486083999-1000Core.job => C:\Users\gina\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2556482551-3916483557-3486083999-1000UA.job => C:\Users\gina\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Malwarebytes' Scheduled Scan for gina.job => C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
Task: C:\Windows\Tasks\Malwarebytes' Scheduled Update for gina.job => C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe

==================== Loaded Modules (whitelisted) =============

2012-05-27 18:54 - 2011-03-02 12:40 - 00164864 _____ () C:\Program Files\WinRAR\rarext.dll
2011-10-11 13:33 - 2011-06-10 18:36 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-08-15 16:24 - 2013-08-15 16:24 - 00172544 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\f60b3ee2de3f41a024920486d46d49f2\IsdiInterop.ni.dll
2011-10-11 12:50 - 2011-04-30 08:28 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IsdiInterop.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\Temp:61B54B15
AlternateDataStreams: C:\ProgramData\Temp:F1DEA771

==================== Safe Mode (whitelisted) ===================

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (10/26/2013 06:56:53 PM) (Source: CVHSVC) (User: )
Description: Information only.
Error:  Initialization failed 0x80070424 Type: 88::UnexpectedError.

Error: (10/26/2013 06:51:29 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT AUTHORITY)
Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.

Error: (10/26/2013 06:51:29 PM) (Source: Microsoft-Windows-LoadPerf) (User: NT AUTHORITY)
Description: The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section.

Error: (10/26/2013 06:47:13 PM) (Source: System Restore) (User: )
Description: An unspecified error occurred during System Restore: (Scheduled Checkpoint). Additional information: 0x80070091.

Error: (10/26/2013 02:47:57 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/26/2013 02:29:49 PM) (Source: Application Error) (User: )
Description: Faulting application name: ConfigTskSchler.exe, version: 4.5.3003.0, time stamp: 0x4a8d4f9f
Faulting module name: ConfigTskSchler.exe, version: 4.5.3003.0, time stamp: 0x4a8d4f9f
Exception code: 0xc0000005
Fault offset: 0x00002013
Faulting process id: 0x6e0
Faulting application start time: 0xConfigTskSchler.exe0
Faulting application path: ConfigTskSchler.exe1
Faulting module path: ConfigTskSchler.exe2
Report Id: ConfigTskSchler.exe3

Error: (10/26/2013 02:29:22 PM) (Source: System Restore) (User: )
Description: Failed to create restore point (Process = D:\APP\Packard Bell Recovery Management\Recovery_Management.exe Bell Recovery Management\Recovery_Management.exe" ; Description = Installed Packard Bell Recovery Management; Error = 0x8007043c).

Error: (10/26/2013 02:28:29 PM) (Source: Application Error) (User: )
Description: Faulting application name: ConfigTskSchler.exe, version: 4.5.3003.0, time stamp: 0x4a8d4f9f
Faulting module name: ConfigTskSchler.exe, version: 4.5.3003.0, time stamp: 0x4a8d4f9f
Exception code: 0xc0000005
Fault offset: 0x00001882
Faulting process id: 0x4d4
Faulting application start time: 0xConfigTskSchler.exe0
Faulting application path: ConfigTskSchler.exe1
Faulting module path: ConfigTskSchler.exe2
Report Id: ConfigTskSchler.exe3

Error: (10/26/2013 02:28:13 PM) (Source: System Restore) (User: )
Description: Failed to create restore point (Process = D:\APP\Packard Bell Recovery Management\Recovery_Management.exe Bell Recovery Management\Recovery_Management.exe" ; Description = Removed Packard Bell Recovery Management; Error = 0x8007043c).

Error: (10/26/2013 01:33:06 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

System errors:
=============
Error: (10/26/2013 06:46:48 PM) (Source: Service Control Manager) (User: )
Description: The Function Discovery Resource Publication service terminated with the following error:
%%-2147024891

Error: (10/26/2013 06:46:48 PM) (Source: Service Control Manager) (User: )
Description: The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed.

Error: (10/26/2013 06:46:48 PM) (Source: Service Control Manager) (User: )
Description: The Computer Browser service terminated with the following error:
%%1060

Error: (10/26/2013 06:46:46 PM) (Source: Service Control Manager) (User: )
Description: The Microsoft Antimalware Service service failed to start due to the following error:
%%5

Error: (10/26/2013 03:47:49 PM) (Source: Service Control Manager) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
discache
MpFilter
spldr
sptd
Wanarpv6

Error: (10/26/2013 03:47:49 PM) (Source: Service Control Manager) (User: )
Description: The Client Virtualization Handler service depends on the Application Virtualization Client service which failed to start because of the following error:
%%1068

Error: (10/26/2013 03:47:49 PM) (Source: Service Control Manager) (User: )
Description: The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed.

Error: (10/26/2013 03:47:48 PM) (Source: Service Control Manager) (User: )
Description: The Computer Browser service depends on the Server service which failed to start because of the following error:
%%1068

Error: (10/26/2013 03:47:35 PM) (Source: Service Control Manager) (User: )
Description: The Microsoft Antimalware Service service failed to start due to the following error:
%%5

Error: (10/26/2013 03:47:20 PM) (Source: sptd) (User: )
Description: Driver detected an internal error in its data structures for .

Microsoft Office Sessions:
=========================
Error: (10/26/2013 06:56:53 PM) (Source: CVHSVC)(User: )
Description: Error:  Initialization failed 0x80070424 Type: 88::UnexpectedError.

Error: (10/26/2013 06:51:29 PM) (Source: Microsoft-Windows-LoadPerf)(User: NT AUTHORITY)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (10/26/2013 06:51:29 PM) (Source: Microsoft-Windows-LoadPerf)(User: NT AUTHORITY)
Description: Performance1637070000000000000000000009030000

Error: (10/26/2013 06:47:13 PM) (Source: System Restore)(User: )
Description: Scheduled Checkpoint0x80070091

Error: (10/26/2013 02:47:57 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (10/26/2013 02:29:49 PM) (Source: Application Error)(User: )
Description: ConfigTskSchler.exe4.5.3003.04a8d4f9fConfigTskSchler.exe4.5.3003.04a8d4f9fc0000005000020136e001ced24f68bfd069C:\Windows\OEMTemp\ConfigTskSchler.exeC:\Windows\OEMTemp\ConfigTskSchler.exeaf5e4711-3e42-11e3-80f1-f7582c476c63

Error: (10/26/2013 02:29:22 PM) (Source: System Restore)(User: )
Description: D:\APP\Packard Bell Recovery Management\Recovery_Management.exe Bell Recovery Management\Recovery_Management.exe" Installed Packard Bell Recovery Management0x8007043c

Error: (10/26/2013 02:28:29 PM) (Source: Application Error)(User: )
Description: ConfigTskSchler.exe4.5.3003.04a8d4f9fConfigTskSchler.exe4.5.3003.04a8d4f9fc0000005000018824d401ced24f3907ba6bC:\Windows\OEMTemp\ConfigTskSchler.exeC:\Windows\OEMTemp\ConfigTskSchler.exe7fda8f59-3e42-11e3-80f1-f7582c476c63

Error: (10/26/2013 02:28:13 PM) (Source: System Restore)(User: )
Description: D:\APP\Packard Bell Recovery Management\Recovery_Management.exe Bell Recovery Management\Recovery_Management.exe" Removed Packard Bell Recovery Management0x8007043c

Error: (10/26/2013 01:33:06 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

CodeIntegrity Errors:
===================================
  Date: 2013-05-17 15:45:23.025
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\McAfee\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system.

  Date: 2013-05-17 15:45:23.025
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\McAfee\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system.

  Date: 2013-05-17 15:45:23.025
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\McAfee\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system.

  Date: 2013-03-19 19:04:48.226
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\McAfee\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system.

  Date: 2013-03-19 19:04:48.226
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\McAfee\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system.

  Date: 2013-03-19 19:04:48.226
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\McAfee\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system.

  Date: 2013-01-01 12:23:57.349
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\McAfee\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system.

  Date: 2013-01-01 12:23:57.349
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\McAfee\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system.

  Date: 2013-01-01 12:23:57.349
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\McAfee\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system.

  Date: 2012-06-27 18:36:48.369
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\PROGRA~2\McAfee\SITEAD~1\x64\saHook.dll because the set of per-page image hashes could not be found on the system.

==================== Memory info ===========================

Percentage of memory in use: 29%
Total physical RAM: 5995.86 MB
Available physical RAM: 4230.15 MB
Total Pagefile: 11989.9 MB
Available Pagefile: 10018.03 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (Packard Bell) (Fixed) (Total:445.66 GB) (Free:174.74 GB) NTFS
Drive f: () (Removable) (Total:1.86 GB) (Free:1.86 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 5F230415)
Partition 1: (Not Active) - (Size=20 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=446 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 2 GB) (Disk ID: C5759A16)
Partition 1: (Not Active) - (Size=2 GB) - (Type=0B)

==================== End Of Log ============================

thanks!

gina

Link to post
Share on other sites
oscar146

oscar146

Posted
  • Author
Posted

ive run the malware scan and it detected some Trojans I deleted these but it still wont let me download anything, turn on windows security centre or system restore??

 

but must go to bed and maybe pick this one up tomorrow?

 

many thanks again

 

gina

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

im a bit lost now, I cant download anything from anywhere it keeps saying its a virus,

That's the virus.

--------------------------------------------

What ever way you can do this:

Download the attached fixlist.txt to the same folder as FRST.
Run FRST and click Fix only once and wait
The tool will create a log (Fixlog.txt) in the folder, please post it to your reply.

Then......

Download Malwarebytes Anti-Rootkit from HERE

  • Unzip the contents to a folder in a convenient location.
  • Open the folder where the contents were unzipped and run mbar.exe
  • Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
  • Click on the Cleanup button to remove any threats and reboot if prompted to do so.
  • Wait while the system shuts down and the cleanup process is performed.
  • Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  • When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txt

To attach a log if needed:

Bottom right corner of this page.
reply1.jpg

New window that comes up.
replyer1.jpg

~~~~~~~~~~~~~~~~~~~~~~~

Note: <----You Must Run This!!!!
If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:
Internet access
Windows Update
Windows Firewall
If there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot. It's located in the Plugins folder which is in the MBAR folder.

Just run fixdamage.exe.

Verify that they are now functioning normally.


MrC

Link to post
Share on other sites
oscar146

oscar146

Posted
  • Author
Posted

Hi,

I followed all your advice and..

ran fix

ran anti root kit and it said no threats and no need to clean up

still had problems with firewall and security centre so ran fixdamage and everything seems fine now, its all working as should be!

pls find attached logs you requested,

am I virus free for now?!

thanks again for all your help!

gina

Fixlog.txt

mbar-log-2013-10-27 (09-01-46).txt

system-log.txt

Link to post
Share on other sites
MrCharlie

MrCharlie

Posted
Posted

You can download now??

Lets clean out any adware now: (this will require a reboot so save all your work)

Please download AdwCleaner by Xplode and save to your Desktop.

Make sure you click on download buttons that look like this, not "sponsored ad links":

bleep-crop.jpg

  • Double click on AdwCleaner.exe to run the tool.

    Vista/Windows 7/8 users right-click and select Run As Administrator

  • Click on the Scan button.
  • AdwCleaner will begin...be patient as the scan may take some time to complete.
  • When it's done you'll see: Pending: Please uncheck elements you don't want removed.
  • Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
  • Look over the log especially under Files/Folders for any program you want to save.
  • If there's a program you may want to save, just uncheck it from AdwCleaner.
  • If you're not sure, post the log for review. (all items found are adware/spyware/foistware)
  • If you're ready to clean it all up.....click the Clean button.
  • After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of that logfile will also be saved in the C:\AdwCleaner folder.
  • Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
  • To restore an item that has been deleted:
  • Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.
Then..................

Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.

Make sure that everything is checked, and click Remove Selected.

Please let me know how computer is running now, MrC

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.

  I accept