Jump to content

ICE Homeland Security Ransomware Removed but want total confirmation that PC is clean.


Dbriem

Recommended Posts

I used the Kaspersky 10 Rescue Disk to remove the Ransomware and after being able to access the desktop I ran MBAM and DDS just to be safe but I want to know this system is good to go before all this happened as it's still being a bit sluggish. I've just attached the DDS logs but I can also post the MBAM if needed.
 

DDS (Ver_2012-11-20.01) - NTFS_x86 
Internet Explorer: 8.0.6001.18702
Run by Owner at 11:37:02 on 2013-11-27
Microsoft Windows XP Home Edition  5.1.2600.3.1252.1.1033.18.1023.608 [GMT -7:00]
.
AV: OMG Total Protection OMG Total Protection *Enabled/Updated* {964FCE60-0B18-4D30-ADD6-EB178909041C}
.
============== Running Processes ================
.
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
.
============== Pseudo HJT Report ===============
.
uWindow Title = Internet Explorer, optimized for Bing and MSN
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear\wnda3100v2\WNDA3100v2.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
TCP: NameServer = 75.75.75.75 75.75.76.76 192.168.1.1
TCP: Interfaces\{D0F1D738-F426-4D3A-B448-799ECFCD6B5C} : DHCPNameServer = 75.75.75.75 75.75.76.76 192.168.1.1
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\owner\application data\mozilla\firefox\profiles\gbcac4do.default\
.
============= SERVICES / DRIVERS ===============
.
R2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes' anti-malware\mbamscheduler.exe [2013-11-27 418376]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2013-11-27 701512]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-11-27 22856]
.
=============== Created Last 30 ================
.
2013-11-27 09:51:15 -------- d--h--w- c:\documents and settings\all users\application data\Common Files
2013-11-27 09:51:15 -------- d-----w- c:\documents and settings\owner\local settings\application data\MFAData
2013-11-27 09:51:15 -------- d-----w- c:\documents and settings\owner\local settings\application data\Avg2014
2013-11-27 09:51:15 -------- d-----w- c:\documents and settings\all users\application data\MFAData
2013-11-27 09:48:11 -------- d-----w- c:\program files\MSECache
2013-11-27 09:32:05 -------- d-----w- c:\program files\Microsoft ActiveSync
2013-11-27 08:38:55 -------- d-----w- c:\documents and settings\owner\local settings\application data\Apple Computer
2013-11-27 08:08:00 -------- d-----w- c:\documents and settings\owner\local settings\application data\Mozilla
2013-11-27 07:56:13 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes' Anti-Malware (portable)
2013-11-27 07:51:50 47064 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2013-11-27 07:43:36 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-11-27 07:43:36 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-11-25 23:29:53 -------- d-----w- c:\documents and settings\owner\application data\Malwarebytes
2013-11-25 23:18:44 -------- d-----w- c:\documents and settings\owner\local settings\application data\Apple
2013-11-18 19:23:49 -------- d-sh--w- c:\documents and settings\owner\IETldCache
2013-11-18 11:49:02 -------- d-----w- c:\windows\tmp
2013-11-05 03:00:58 -------- d---a-w- C:\Kaspersky Rescue Disk 10.0
2013-11-04 23:32:55 393 ----a-w- c:\documents and settings\all users\application data\w9qqfrbn.reg
2013-10-31 00:13:39 1034240 ----a-w- c:\windows\system32\drivers\bcmwlhigh5.sys
2013-10-29 16:44:08 53299 ----a-w- c:\windows\system32\pthreadVC.dll
2013-10-29 16:44:08 50704 ----a-w- c:\windows\system32\drivers\npf.sys
2013-10-29 16:44:08 281104 ----a-w- c:\windows\system32\wpcap.dll
2013-10-29 16:44:08 100880 ----a-w- c:\windows\system32\Packet.dll
2013-10-29 16:43:48 -------- d-----w- c:\program files\NETGEAR
.
==================== Find3M  ====================
.
2013-10-12 15:56:19 278528 ----a-w- c:\windows\system32\oakley.dll
2013-10-09 13:12:48 287744 ----a-w- c:\windows\system32\gdi32.dll
2013-10-07 10:59:21 603136 ----a-w- c:\windows\system32\crypt32.dll
2013-10-05 01:14:01 7168 ----a-w- c:\windows\system32\xpsp4res.dll
2013-09-23 18:33:58 920064 ----a-w- c:\windows\system32\wininet.dll
2013-09-23 18:33:57 43520 ------w- c:\windows\system32\licmgr10.dll
2013-09-23 18:33:57 1469440 ------w- c:\windows\system32\inetcpl.cpl
2013-09-23 18:33:56 18944 ----a-w- c:\windows\system32\corpol.dll
2013-09-23 18:06:48 385024 ------w- c:\windows\system32\html.iec
2013-09-20 15:38:11 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-09-20 15:38:09 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-09-09 08:52:46 632656 ----a-w- c:\windows\system32\msvcr80.dll
2013-09-09 08:52:46 554832 ----a-w- c:\windows\system32\msvcp80.dll
2013-09-09 08:52:46 479232 ----a-w- c:\windows\system32\msvcm80.dll
.
============= FINISH: 11:37:59.82 ===============
 
 
_______________________________________________________________________________________________________________
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 11/13/2012 12:52:26 PM
System Uptime: 11/27/2013 11:27:19 AM (0 hours ago)
.
Motherboard: Micro-Star Inc.                  |  | MS-6534                         
Processor:               Intel® Pentium® 4 CPU 1.60GHz | PGA478                           | 1600/100mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 37 GiB total, 0.558 GiB free.
D: is CDROM (CDFS)
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP1: 11/18/2013 12:24:23 PM - System Checkpoint
RP2: 11/27/2013 1:38:09 AM - Installed Apple Application Support
RP3: 11/27/2013 2:09:54 AM - Software Distribution Service 3.0
RP4: 11/27/2013 2:19:22 AM - Software Distribution Service 3.0
RP5: 11/27/2013 2:29:37 AM - Installed Microsoft Office Professional Edition 2003
RP6: 11/27/2013 2:49:08 AM - Installed Compatibility Pack for the 2007 Office system
.
==== Installed Programs ======================
.
Apple Application Support
Compatibility Pack for the 2007 Office system
Hotfix for Windows Media Format 11 SDK (KB929399)
Malwarebytes Anti-Malware version 1.75.0.1300
Microsoft Office Professional Edition 2003
Mozilla Firefox 25.0.1 (x86 en-US)
Mozilla Maintenance Service
Security Update for Windows XP (KB2570947)
Security Update for Windows XP (KB2603381)
Security Update for Windows XP (KB2659262)
Security Update for Windows XP (KB2686509)
Security Update for Windows XP (KB2834886)
Security Update for Windows XP (KB2862152)
Security Update for Windows XP (KB2868626)
Security Update for Windows XP (KB2876331)
Security Update for Windows XP (KB2900986)
Update for Windows XP (KB2467659)
Update for Windows XP (KB898461)
WebFldrs XP
WinRAR 5.01 beta 1 (32-bit)
.
==== Event Viewer Messages From Past Week ========
.
11/27/2013 3:01:42 AM, error: sr [1]  - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'.  It has stopped monitoring the volume.
11/27/2013 12:50:30 AM, error: Service Control Manager [7009]  - Timeout (30000 milliseconds) waiting for the MBAMScheduler service to connect.
11/27/2013 12:50:30 AM, error: Service Control Manager [7000]  - The MBAMScheduler service failed to start due to the following error:  The service did not respond to the start or control request in a timely fashion.
11/25/2013 4:47:58 PM, error: Service Control Manager [7034]  - The MBAMService service terminated unexpectedly.  It has done this 1 time(s).
.
==== End Of File ===========================
 

 

Link to post
Share on other sites

Welcome to the forum.

Please download and run RogueKiller 32 Bit to your desktop.

RogueKiller 64 Bit <---use this one for 64 bit systems

Which system am I using?

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7-8, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

(please don't put logs in code or quotes and use the default font)

General P2P/Piracy Warning:

1. If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall it or completely disable it from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

2. If you have illegal/cracked software, cracks, keygens, custom (Adobe) host file, etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Failure to remove such software will result in your topic being closed and no further assistance being provided.

MrC

Note:

Please read all of my instructions completely including these.

Make sure system restore is turned on and running

Make sure you're subscribed to this topic: Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly

Removing malware can be unpredictable...unlikely but things can go very wrong! Backup any files that cannot be replaced. You can copy them to a CD/DVD, external drive or a pen drive

<+>Please don't run any other scans, download, install or uninstall any programs while I'm working with you.

<+>The removal of malware isn't instantaneous, please be patient.

<+>When we are done, I'll give to instructions on how to cleanup all the tools and logs

<+>Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that.

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 24 hours, please send me a PM)

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.