Malwarebytes won't run due to software permissions? - Infected?

mstroz14 · January 20, 2014

Last Friday, the pc locked up while in Internet Explorer.

When tried to run Malwarebytes, it said that it couldn't run due to software permissions and to check the Event Viewer.

Event Viewer was not easily accessible from the Tools menu any longer.

Ran eventvwr.msc...got it to open. Did see an event ID 866. Software Restriction Policy.

Normally, the pc runs Mcafee VirusScan Enterprise & Antispyware Enterprise 8.8. That too has been disable and when I try to start it up, I get the same type of message that it cannot run due to software permissions.

Microsoft Security Essentials was installed and scanned the pc. Two items were found and deleted.

Wanted to try Malwarebytes again for a complete scan, still receiving the same error regarding software permissions. As well as with McAfee product. The user account has full administrative rights.

I think this pc is still infected....any assistance would be appreciated!!!

kevinf80 · January 20, 2014

Hello and

P2P/Piracy Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

Kevin..

mstroz14 · January 21, 2014

Hi Kevin,

Thank you for your assistance.

I have downloaded the tool (32-bit for WinXP Pro).

It was running the scan and then it had a "Stop Program" message. Here is what the FRST.txt log said...and I did not get an Addition.txt file that was created?

kevinf80 · January 21, 2014

Please download RKill from here: http://www.bleepingcomputer.com/download/rkill/

There are three buttons to choose from with different names on, select the first one and save it to your desktop.

Double-click on the Rkill desktop icon to run the tool.
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
A log pops up at the end of the run. This log file is located at C:\rkill.log. Please post this in your next reply.
If you do not see the black box flash on the screen delete the icon from the desktop and go back to the link for the download, select the next button and try to run the tool again, continue to repeat this process using the remaining buttons until the tool runs. You will find further links if you scroll down the page with other names, try them one at a time.
If the tool does not run from any of the links provided, please let me know.

Next,

Delete any versions of Combofix that you may have on your Desktop, download a fresh copy from the following link :-

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Ensure that Combofix is saved directly to the Desktop <--- Very important
Disable all security programs as they will have a negative effect on Combofix, instructions available here http://www.bleepingcomputer.com/forums/topic114351.html if required. Be aware the list may not have all programs listed, if you need more help please ask.
Close any open browsers and any other programs you might have running
Double click the icon to run the tool (Vista or Windows 7 users right click and select "Run as Administrator)
Instructions for running Combofix available here http://www.bleepingcomputer.com/combofix/how-to-use-combofix if required.
If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?" Please select yes & let it download the files it needs to do this. Once the recovery console is installed Combofix will then offer to scan for malware. Select continue or yes.
When finished, it will produce a report for you. Please post the "C:\ComboFix.txt" for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.

Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell us when you reply. Read here http://thespykiller.co.uk/index.php?page=20 why disabling autoruns is recommended.

*EXTRA NOTES*

    If Combofix detects any Rootkit/Bootkit activity on your system it will give a warning and prompt for a reboot, you must allow it to do so.
    If Combofix reboot's due to a rootkit, the screen may stay black for several minutes on reboot, this is normal
    If after running Combofix you receive any type of warning message about registry key's being listed for deletion when trying to open certain items, reboot the system and this will fix the issue (Those items will not be deleted)

Post the log in next reply please...

Kevin

mstroz14 · January 21, 2014

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 21-01-2014

Ran by lynn (administrator) on GX780-2TNHMM1 on 21-01-2014 14:27:29

Running from S:\mis\MalwarebytesHELP-LynnPC

Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: English(US)

Internet Explorer Version 8

Boot Mode: Normal

The only official download link for FRST:

Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/

Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) ===================

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe

(Wave Systems Corp.) C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe

(Sun Microsystems, Inc.) C:\Program Files\Java\jre6\bin\jqs.exe

(McAfee, Inc.) C:\Program Files\McAfee\Common Framework\FrameworkService.exe

(McAfee, Inc.) C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe

(McAfee, Inc.) C:\WINDOWS\system32\mfevtps.exe

(McAfee, Inc.) C:\Program Files\McAfee\VirusScan Enterprise\mfeann.exe

(TeamViewer GmbH) C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe

(McAfee, Inc.) C:\Program Files\McAfee\Common Framework\naPrdMgr.exe

(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe

(Microsoft Corporation) C:\WINDOWS\system32\wbem\unsecapp.exe

(TeamViewer GmbH) C:\Program Files\TeamViewer\Version8\TeamViewer.exe

(TeamViewer GmbH) C:\Program Files\TeamViewer\Version8\tv_w32.exe

(Analog Devices, Inc.) C:\Program Files\Analog Devices\Core\smax4pnp.exe

(Intel Corporation) C:\WINDOWS\system32\hkcmd.exe

(Intel Corporation) C:\WINDOWS\system32\igfxpers.exe

(Intel Corporation) C:\WINDOWS\system32\igfxsrvc.exe

(Intel Corporation) C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

(Wave Systems Corp.) C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe

(Dell Inc.) C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe

(Broadcom Corporation) C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe

(CyberLink Corp.) C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe

(Business Technical Consulting) C:\Program Files\VizManager\VizManager.exe

(Adobe Systems Inc.) C:\Program Files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe

(Brother Industries, Ltd.) C:\Program Files\Brother\ControlCenter2\brctrcen.exe

(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe

(Microsoft Corporation) C:\Program Files\Windows Live\Messenger\msnmsgr.exe

(Microsoft Corporation) C:\WINDOWS\system32\regsvr32.exe

(Wave Systems Corp.) C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmNotify.exe

(Microsoft Corporation) C:\Program Files\Windows Desktop Search\WindowsSearch.exe

(Macrovision Europe Ltd.) C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

(Microsoft Corporation) C:\Program Files\Windows Live\Toolbar\wltuser.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

(McAfee, Inc.) C:\Program Files\McAfee\VirusScan Enterprise\mcupdate.exe

(McAfee, Inc.) C:\Program Files\McAfee\Common Framework\McScript_InUse.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [soundMAXPnP] - C:\Program Files\Analog Devices\Core\smax4pnp.exe [1044480 2009-06-22] (Analog Devices, Inc.)

HKLM\...\Run: [iAStorIcon] - C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-03] (Intel Corporation)

HKLM\...\Run: [WavXMgr] - C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe [159616 2010-04-14] (Wave Systems Corp.)

HKLM\...\Run: [DellControlPoint] - C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe [657920 2009-11-02] (Dell Inc.)

HKLM\...\Run: [uSCService] - C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe [34232 2010-04-05] (Broadcom Corporation)

HKLM\...\Run: [PDVDDXSrv] - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe [140520 2009-12-29] (CyberLink Corp.)

HKLM\...\Run: [McAfeeUpdaterUI] - C:\Program Files\McAfee\Common Framework\udaterui.exe [161088 2011-01-12] (McAfee, Inc.)

HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [35760 2010-06-19] (Adobe Systems Incorporated)

HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [843712 2012-01-03] (Adobe Systems Incorporated)

HKLM\...\Run: [VizManager] - C:\Program Files\VizManager\VizManager.exe [221184 2008-11-06] (Business Technical Consulting)

HKLM\...\Run: [Acrobat Assistant 8.0] - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe [624248 2007-05-10] (Adobe Systems Inc.)

HKLM\...\Run: [] - [x]

HKLM\...\Run: [ControlCenter2.0] - C:\Program Files\Brother\ControlCenter2\brctrcen.exe [995328 2006-03-13] (Brother Industries, Ltd.)

HKLM\...\Run: [shStatEXE] - C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE [215360 2011-01-12] (McAfee, Inc.)

HKLM\...\Run: [HP Software Update] - C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)

HKLM\...\Run: [AS2014] - C:\Documents and Settings\All Users\Application Data\6sVs3nrg\6sVs3nrg.exe

HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [948440 2013-10-23] (Microsoft Corporation)

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION

HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\Malwarebytes' Anti-Malware <====== ATTENTION

HKLM Group Policy restriction on software: C:\Program Files\McAfee <====== ATTENTION

HKLM\...\Winlogon: [userinit] C:\WINDOWS\system32\userinit.exe,,C:\Documents and Settings\All Users\Application Data\6sVs3nrg\6sVs3nrg.exe -sm,

HKLM\...\Policies\Explorer: [NoControlPanel] 0

HKCU\...\Run: [VizManager] - [x]

HKCU\...\Run: [msnmsgr] - C:\Program Files\Windows Live\Messenger\msnmsgr.exe [3883856 2009-07-26] (Microsoft Corporation)

HKCU\...\Run: [Efqttion] - regsvr32.exe "C:\Documents and Settings\lynn.RSC\Local Settings\Application Data\Efqttion\ep0lvra1.dll" <===== ATTENTION

HKCU\...\Run: [AdobeUpdater] - C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe [2356088 2010-08-09] (Adobe Systems Incorporated)

HKU\Administrator\...\Run: [VizManager] - [x]

HKU\billie\...\Run: [VizManager] - [x]

HKU\rick\...\Run: [VizManager] - [x]

Lsa: [Authentication Packages] msv1_0 wvauth

Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\TdmNotify.lnk

ShortcutTarget: TdmNotify.lnk -> C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmNotify.exe (Wave Systems Corp.)

Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk

ShortcutTarget: Windows Search.lnk -> C:\Program Files\Windows Desktop Search\WindowsSearch.exe (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/USREL/1

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.bing.com

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USREL/1

HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.bing.com/sphome.aspx

HKLM\Software\Microsoft\Internet Explorer\Main,Help_Page = http://support.dell.com/support/index.aspx?c=us&l=en&s=gen

BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20110303145622.dll (McAfee, Inc.)

BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)

BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)

Toolbar: HKLM - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)

Toolbar: HKLM - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

Toolbar: HKCU - &Address - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\Windows\system32\browseui.dll (Microsoft Corporation)

Toolbar: HKCU - &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\Windows\system32\SHELL32.dll (Microsoft Corporation)

Toolbar: HKCU - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)

Toolbar: HKCU - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

DPF: {460324E8-CFB4-4357-85EF-CE3EBFE23A62} http://rsc4:8080/businessobjects/enterprise11/desktoplaunch/viewers/crystalreportviewers11/ActiveXControls/ActiveXViewer.cab

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1281023297079

DPF: {88DD90B6-C770-4CFF-B7A4-3AFD16BB8824} http://rsc5:8080/CrystalReports/crystalreportviewers/ActiveXControls/PrintControl.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://akamaicdn.webex.com/client/WBXclient-T28L10NSP9-15980/webex/ieatgpc.cab

Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

ShellExecuteHooks: Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll [304128 2009-05-24] (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 151.106.100.47 151.106.100.45

Chrome:

=======

CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\24.0.1312.52\PepperFlash\pepflashplayer.dll No File

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\24.0.1312.52\ppGoogleNaClPluginChrome.dll No File

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\24.0.1312.52\pdf.dll No File

CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Java Deployment Toolkit 6.0.200.2) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.)

CHR Plugin: (Java Platform SE 6 U20) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

CHR Plugin: (Microsoft\u00AE DRM) - C:\Program Files\Windows Media Player\npdrmv2.dll (Microsoft Corporation)

CHR Plugin: (Windows Media Player Plug-in Dynamic Link Library) - C:\Program Files\Windows Media Player\npdsplay.dll (Microsoft Corporation (written by Digital Renaissance Inc.))

CHR Plugin: (Microsoft\u00AE DRM) - C:\Program Files\Windows Media Player\npwmsdrm.dll (Microsoft Corporation)

CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File

CHR Plugin: (Windows Live\u00AE Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File

CHR Plugin: (Windows Presentation Foundation) - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

CHR Extension: (Google Docs) - C:\Documents and Settings\lynn.RSC\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-01-17]

CHR Extension: (Google Drive) - C:\Documents and Settings\lynn.RSC\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-01-17]

CHR Extension: (YouTube) - C:\Documents and Settings\lynn.RSC\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-01-17]

CHR Extension: (Google Search) - C:\Documents and Settings\lynn.RSC\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-01-17]

CHR Extension: (Gmail) - C:\Documents and Settings\lynn.RSC\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-01-17]

========================== Services (Whitelisted) =================

R2 JavaQuickStarterService; C:\Program Files\Java\jre6\bin\jqs.exe [153376 2010-07-23] (Sun Microsystems, Inc.)

R2 McAfeeFramework; C:\Program Files\McAfee\Common Framework\FrameworkService.exe [120128 2011-01-12] (McAfee, Inc.)

R2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [159320 2011-03-03] (McAfee, Inc.)

R2 McTaskManager; C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe [209760 2011-01-12] (McAfee, Inc.)

R2 mfevtp; C:\WINDOWS\system32\mfevtps.exe [145936 2011-03-03] (McAfee, Inc.)

R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22208 2013-10-23] (Microsoft Corporation)

S3 SecureStorageService; C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe [1032192 2010-02-03] (Wave Systems Corp.)

S2 tcsd_win32.exe; C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe [1273856 2008-11-12] ()

R2 TdmService; C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe [1164648 2010-03-29] (Wave Systems Corp.)

S3 InforVisualDrillback; "C:/Infor/VISUAL Enterprise/VISUAL Manufacturing/http2vm.exe" -p 9090 -n InforVisualDrillback webserversrvc [x]

==================== Drivers (Whitelisted) ====================

S4 abp480n5; C:\Windows\system32\DRIVERS\ABP480N5.SYS [23552 2001-08-17] (Microsoft Corporation)

R3 e1kexpress; C:\Windows\System32\DRIVERS\e1k5132.sys [166568 2009-11-05] (Intel Corporation)

R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [116104 2011-03-03] (McAfee, Inc.)

R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [171296 2011-03-03] (McAfee, Inc.)

R3 mfebopk; C:\Windows\System32\drivers\mfebopk.sys [58456 2011-03-03] (McAfee, Inc.)

R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [436728 2011-03-03] (McAfee, Inc.)

S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [85152 2011-03-03] (McAfee, Inc.)

R1 mfetdi2k; C:\Windows\System32\drivers\mfetdi2k.sys [88544 2011-03-03] (McAfee, Inc.)

R1 mfetdik; C:\Windows\System32\drivers\mfetdik.sys [52168 2009-06-08] (McAfee, Inc.)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [214696 2013-09-27] (Microsoft Corporation)

R1 MpKslb43b905d; c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C76DC08D-8884-47D5-A9AA-DB5C15112B5C}\MpKslb43b905d.sys [40392 2014-01-21] (Microsoft Corporation)

S3 NAL; C:\WINDOWS\system32\Drivers\iqvw32.sys [30880 2009-10-14] (Intel Corporation )

R0 PBADRV; C:\Windows\System32\DRIVERS\PBADRV.sys [26608 2008-06-04] (Dell Inc)

R0 SFAUDIO; C:\Windows\System32\drivers\sfaudio.sys [24064 2008-03-28] (Sonic Focus, Inc)

R2 WavxDMgr; C:\Windows\System32\DRIVERS\WavxDMgr.sys [233856 2010-01-19] (Wave Systems Corp.)

U3 mfeavfk01; No ImagePath

S1 mferkdk; \??\C:\Program Files\McAfee\VirusScan Enterprise\mferkdk.sys [x]

U1 WS2IFSL;

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-01-21 14:24 - 2014-01-21 14:24 - 00000000 ____D C:\FRST

2014-01-20 08:36 - 2014-01-20 08:36 - 00001700 _____ C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Security Essentials.lnk

2014-01-20 08:36 - 2014-01-20 08:36 - 00000000 ____D C:\Program Files\Microsoft Security Client

2014-01-20 08:35 - 2014-01-20 08:36 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2808679$

2014-01-20 08:35 - 2014-01-20 08:35 - 00010880 _____ C:\WINDOWS\KB2632503-IE8.log

2014-01-20 08:35 - 2014-01-20 08:35 - 00010655 _____ C:\WINDOWS\KB2492386.log

2014-01-20 08:35 - 2014-01-20 08:35 - 00010071 _____ C:\WINDOWS\KB2598845-IE8.log

2014-01-20 08:35 - 2014-01-20 08:35 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2492386$

2014-01-20 08:34 - 2014-01-20 08:36 - 00014111 _____ C:\WINDOWS\KB2808679.log

2014-01-20 08:33 - 2011-08-16 04:45 - 00006144 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\iecompat.dll

2014-01-20 08:33 - 2011-03-11 08:10 - 00225262 ____C C:\WINDOWS\system32\dllcache\msimain.sdb

2014-01-20 08:22 - 2014-01-20 08:22 - 00000788 _____ C:\Documents and Settings\Administrator\Desktop\Windows Media Player.lnk

2014-01-20 08:22 - 2014-01-20 08:22 - 00000000 __SHD C:\Documents and Settings\Administrator\IETldCache

2014-01-20 08:22 - 2014-01-20 08:22 - 00000000 ____D C:\Documents and Settings\Administrator\Local Settings\Application Data\Adobe

2014-01-20 08:22 - 2014-01-20 08:22 - 00000000 ____D C:\Documents and Settings\Administrator\Application Data\Adobe

2014-01-17 16:35 - 2014-01-19 01:32 - 00231584 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe

2014-01-17 16:24 - 2014-01-21 06:43 - 00000384 ____H C:\WINDOWS\Tasks\Microsoft Antimalware Scheduled Scan.job

2014-01-17 16:14 - 2014-01-20 08:36 - 00001945 _____ C:\WINDOWS\epplauncher.mif

2014-01-17 12:06 - 2014-01-17 12:13 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\6sVs3nrg

2014-01-17 12:06 - 2014-01-17 12:06 - 00000000 ____D C:\Documents and Settings\lynn.RSC\Local Settings\Application Data\Efqttion

2014-01-15 14:35 - 2014-01-15 14:35 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2914368$

2014-01-15 14:34 - 2014-01-15 14:35 - 00006460 _____ C:\WINDOWS\KB2914368.log

==================== One Month Modified Files and Folders =======

2014-01-21 14:24 - 2014-01-21 14:24 - 00000000 ____D C:\FRST

2014-01-21 14:22 - 2010-08-05 12:43 - 00000109 _____ C:\WINDOWS\cdlli40.INI

2014-01-21 13:48 - 2013-11-20 08:55 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job

2014-01-21 13:45 - 2010-08-05 04:56 - 00000136 _____ C:\WINDOWS\system32\config\netlogon.ftl

2014-01-21 13:02 - 2010-08-06 07:26 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\pdf995

2014-01-21 11:48 - 2008-04-25 15:28 - 01540902 _____ C:\WINDOWS\WindowsUpdate.log

2014-01-21 06:43 - 2014-01-17 16:24 - 00000384 ____H C:\WINDOWS\Tasks\Microsoft Antimalware Scheduled Scan.job

2014-01-21 06:40 - 2008-04-25 03:17 - 00000000 ____D C:\WINDOWS\security

2014-01-21 06:38 - 2008-04-25 03:22 - 00608280 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2014-01-21 06:35 - 2011-02-22 06:56 - 00000000 ____D C:\Documents and Settings\lynn.RSC\Tracing

2014-01-21 06:34 - 2010-08-05 04:57 - 00000000 _____ C:\Documents and Settings\lynn.RSC\Local Settings\Application Data\WavXMapDrive.bat

2014-01-21 06:34 - 2008-04-25 10:16 - 00001158 _____ C:\WINDOWS\system32\wpa.dbl

2014-01-21 06:34 - 2008-04-25 03:25 - 00000259 _____ C:\WINDOWS\wiadebug.log

2014-01-21 06:33 - 2008-04-25 15:32 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2014-01-21 06:33 - 2008-04-25 03:25 - 00000049 _____ C:\WINDOWS\wiaservc.log

2014-01-20 16:31 - 2010-08-05 04:57 - 00000178 ___SH C:\Documents and Settings\lynn.RSC\ntuser.ini

2014-01-20 16:31 - 2008-04-25 15:32 - 00032428 _____ C:\WINDOWS\SchedLgU.Txt

2014-01-20 15:13 - 2012-06-18 14:05 - 00000000 ____D C:\QUARANTINE

2014-01-20 08:36 - 2014-01-20 08:36 - 00001700 _____ C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Security Essentials.lnk

2014-01-20 08:36 - 2014-01-20 08:36 - 00000000 ____D C:\Program Files\Microsoft Security Client

2014-01-20 08:36 - 2014-01-20 08:35 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2808679$

2014-01-20 08:36 - 2014-01-20 08:34 - 00014111 _____ C:\WINDOWS\KB2808679.log

2014-01-20 08:36 - 2014-01-17 16:14 - 00001945 _____ C:\WINDOWS\epplauncher.mif

2014-01-20 08:36 - 2008-04-25 03:22 - 01586988 _____ C:\WINDOWS\iis6.log

2014-01-20 08:36 - 2008-04-25 03:22 - 01418006 _____ C:\WINDOWS\FaxSetup.log

2014-01-20 08:36 - 2008-04-25 03:22 - 00688338 _____ C:\WINDOWS\ocgen.log

2014-01-20 08:36 - 2008-04-25 03:22 - 00650629 _____ C:\WINDOWS\tsoc.log

2014-01-20 08:36 - 2008-04-25 03:22 - 00478262 _____ C:\WINDOWS\comsetup.log

2014-01-20 08:36 - 2008-04-25 03:22 - 00443148 _____ C:\WINDOWS\msmqinst.log

2014-01-20 08:36 - 2008-04-25 03:22 - 00289301 _____ C:\WINDOWS\ntdtcsetup.log

2014-01-20 08:36 - 2008-04-25 03:22 - 00246460 _____ C:\WINDOWS\netfxocm.log

2014-01-20 08:36 - 2008-04-25 03:22 - 00097480 _____ C:\WINDOWS\MedCtrOC.log

2014-01-20 08:36 - 2008-04-25 03:22 - 00078036 _____ C:\WINDOWS\ocmsn.log

2014-01-20 08:36 - 2008-04-25 03:22 - 00070958 _____ C:\WINDOWS\tabletoc.log

2014-01-20 08:36 - 2008-04-25 03:22 - 00070655 _____ C:\WINDOWS\msgsocm.log

2014-01-20 08:36 - 2008-04-25 03:22 - 00001374 _____ C:\WINDOWS\imsins.log

2014-01-20 08:35 - 2014-01-20 08:35 - 00010880 _____ C:\WINDOWS\KB2632503-IE8.log

2014-01-20 08:35 - 2014-01-20 08:35 - 00010655 _____ C:\WINDOWS\KB2492386.log

2014-01-20 08:35 - 2014-01-20 08:35 - 00010071 _____ C:\WINDOWS\KB2598845-IE8.log

2014-01-20 08:35 - 2014-01-20 08:35 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2492386$

2014-01-20 08:35 - 2010-08-05 12:07 - 00000000 ____D C:\WINDOWS\ie8updates

2014-01-20 08:35 - 2009-11-03 16:26 - 00000000 ___HD C:\WINDOWS\$hf_mig$

2014-01-20 08:35 - 2009-11-03 16:08 - 00131027 _____ C:\WINDOWS\updspapi.log

2014-01-20 08:35 - 2008-04-25 03:22 - 00001374 _____ C:\WINDOWS\imsins.BAK

2014-01-20 08:25 - 2008-04-25 15:32 - 00000178 ___SH C:\Documents and Settings\Administrator\ntuser.ini

2014-01-20 08:22 - 2014-01-20 08:22 - 00000788 _____ C:\Documents and Settings\Administrator\Desktop\Windows Media Player.lnk

2014-01-20 08:22 - 2014-01-20 08:22 - 00000000 __SHD C:\Documents and Settings\Administrator\IETldCache

2014-01-20 08:22 - 2014-01-20 08:22 - 00000000 ____D C:\Documents and Settings\Administrator\Local Settings\Application Data\Adobe

2014-01-20 08:22 - 2014-01-20 08:22 - 00000000 ____D C:\Documents and Settings\Administrator\Application Data\Adobe

2014-01-20 08:22 - 2010-07-23 10:34 - 00000000 _____ C:\Documents and Settings\Administrator\Local Settings\Application Data\WavXMapDrive.bat

2014-01-20 08:22 - 2010-07-23 10:25 - 00038184 _____ C:\Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2014-01-20 08:22 - 2008-04-25 15:32 - 00000805 _____ C:\Documents and Settings\Administrator\Start Menu\Programs\Internet Explorer.lnk

2014-01-20 08:22 - 2008-04-25 15:32 - 00000794 _____ C:\Documents and Settings\Administrator\Start Menu\Programs\Windows Media Player.lnk

2014-01-20 08:22 - 2008-04-25 15:32 - 00000740 _____ C:\Documents and Settings\Administrator\Start Menu\Programs\Outlook Express.LNK

2014-01-20 08:22 - 2008-04-25 15:32 - 00000000 ___RD C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories

2014-01-20 08:22 - 2008-04-25 15:32 - 00000000 ____D C:\Documents and Settings\Administrator

2014-01-20 08:22 - 2008-04-25 15:26 - 00010182 _____ C:\WINDOWS\wmsetup.log

2014-01-20 08:15 - 2012-05-09 12:22 - 00000786 _____ C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk

2014-01-20 08:15 - 2010-10-01 08:21 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware

2014-01-20 08:15 - 2010-10-01 08:21 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware

2014-01-19 01:32 - 2014-01-17 16:35 - 00231584 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe

2014-01-17 12:13 - 2014-01-17 12:06 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\6sVs3nrg

2014-01-17 12:06 - 2014-01-17 12:06 - 00000000 ____D C:\Documents and Settings\lynn.RSC\Local Settings\Application Data\Efqttion

2014-01-15 14:37 - 2013-08-14 15:20 - 00000000 ____D C:\WINDOWS\system32\MRT

2014-01-15 14:37 - 2010-08-05 12:12 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Microsoft Help

2014-01-15 14:35 - 2014-01-15 14:35 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2914368$

2014-01-15 14:35 - 2014-01-15 14:34 - 00006460 _____ C:\WINDOWS\KB2914368.log

2014-01-15 14:35 - 2010-08-05 11:48 - 83425928 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

2014-01-13 15:39 - 2010-08-05 12:15 - 00065536 _____ C:\WINDOWS\system32\config\ODiag.evt

2014-01-10 12:42 - 2013-06-13 11:44 - 00000000 ____T C:\Documents and Settings\lynn.RSC\Desktop\tracking

kevinf80 · January 21, 2014

I assumed you meant FRST did not run, that is why I posted the previous reply to run RKill and Combofix, leave that for now. You have posted a partial FRST.txt, but no Addition.txt.

If you navigate here: C:\FRST\Logs see if full logs are in that folder, if so can you post again..

mstroz14 · January 21, 2014

Sorry, I was having trouble with the paste of the "partial" log.

I checked the c:\frst\logs directory and there are not any files in there.

Here is the rkill.log...so do I continue with combofix.exe? I will await your instructions...sorry about the delay in response.Rkill 2.6.5 by Lawrence Abrams (Grinler)

http://www.bleepingcomputer.com/

More Information about Rkill can be found at this link:

http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 01/21/2014 03:32:36 PM in x86 mode.

Windows Version: Microsoft Windows XP Service Pack 3

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* No malware processes found to kill.

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* Reparse Point/Junctions Found (Most likely legitimate)!

* C:\WINDOWS\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a => C:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_4.0.0.0_x-ww_29b51492 [Dir]

Checking Windows Service Integrity:

* Security Center (wscsvc) is not Running.

Startup Type set to: Disabled

Searching for Missing Digital Signatures:

* No issues found.

Checking HOSTS File:

* HOSTS file entries found:

127.0.0.1 localhost

Program finished at: 01/21/2014 03:33:09 PM

Execution time: 0 hours(s), 0 minute(s), and 33 seconds(s)

kevinf80 · January 21, 2014

Leave Combofix and re-run FRST one more time, make sure all entries under "Whitelist" are checked and Addition.txt is checked under "Optional scan"

The partial log does show infection but i`d rather see a full set of logs if possible...

mstroz14 · January 21, 2014

I GOT IT this time!!! I'll await further instructions...thank you!!

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 21-01-2014

Ran by lynn (administrator) on GX780-2TNHMM1 on 21-01-2014 16:20:44

Running from C:\Documents and Settings\lynn.RSC\Desktop