Should I be Worried about this

[phat2h123]

I ran rouge killer after i noticed malwarebytes was blocking suspcious ip's trying to connect to my svchost again. But this time it found rootkits. I am about to run malwarebytes anti rootkit but first i was wondering how bad this is.  Heres the log: 

 

 

RogueKiller V9.2.4.0 (x64) [Jul 11 2014] by Adlice Software

mail : http://www.adlice.com/contact/

Feedback : http://forum.adlice.com

Website : http://www.adlice.com/softwares/roguekiller/

Blog : http://www.adlice.com

 

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : User [Admin rights]

Mode : Scan -- Date : 08/06/2014  13:48:26

 

¤¤¤ Bad processes : 0 ¤¤¤

 

¤¤¤ Registry Entries : 24 ¤¤¤

[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | EnableLUA : 0  -> FOUND

[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | EnableLUA : 0  -> FOUND

[PUM.Policies] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0  -> FOUND

[PUM.Policies] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0  -> FOUND

[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-10993255-1859570673-1900244754-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowSetProgramAccessAndDefaults : 0  -> FOUND

[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-10993255-1859570673-1900244754-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowPrinters : 0  -> FOUND

[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-10993255-1859570673-1900244754-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0  -> FOUND

[PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-10993255-1859570673-1900244754-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowHelp : 0  -> FOUND

[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-10993255-1859570673-1900244754-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowSetProgramAccessAndDefaults : 0  -> FOUND

[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-10993255-1859570673-1900244754-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowPrinters : 0  -> FOUND

[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-10993255-1859570673-1900244754-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0  -> FOUND

[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-10993255-1859570673-1900244754-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowHelp : 0  -> FOUND

[PUM.DesktopIcons] (X64) HKEY_USERS\S-1-5-21-10993255-1859570673-1900244754-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {645FF040-5081-101B-9F08-00AA002F954E} : 1  -> FOUND

[PUM.DesktopIcons] (X64) HKEY_USERS\S-1-5-21-10993255-1859570673-1900244754-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> FOUND

[PUM.DesktopIcons] (X86) HKEY_USERS\S-1-5-21-10993255-1859570673-1900244754-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {645FF040-5081-101B-9F08-00AA002F954E} : 1  -> FOUND

[PUM.DesktopIcons] (X86) HKEY_USERS\S-1-5-21-10993255-1859570673-1900244754-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> FOUND

[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> FOUND

[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1  -> FOUND

[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> FOUND

[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1  -> FOUND

[PUM.DesktopIcons] (X64) HKEY_USERS\S-1-5-21-10993255-1859570673-1900244754-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {645FF040-5081-101B-9F08-00AA002F954E} : 1  -> FOUND

[PUM.DesktopIcons] (X64) HKEY_USERS\S-1-5-21-10993255-1859570673-1900244754-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> FOUND

[PUM.DesktopIcons] (X86) HKEY_USERS\S-1-5-21-10993255-1859570673-1900244754-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {645FF040-5081-101B-9F08-00AA002F954E} : 1  -> FOUND

[PUM.DesktopIcons] (X86) HKEY_USERS\S-1-5-21-10993255-1859570673-1900244754-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> FOUND

 

 

¤¤¤ Files : 0 ¤¤¤

 

¤¤¤ HOSTS File : 0 ¤¤¤

 

¤¤¤ Antirootkit : 3 (Driver: LOADED) ¤¤¤

[Filter(Root.Keylogger)] \Driver\kbdclass @ Unknown : \Driver\SynTP @ \Device\0000008f (\SystemRoot\system32\DRIVERS\tunnel.sys)

[Filter(Root.Keylogger)] \Driver\kbdclass @ Unknown : \Driver\SynTP @ \Device\0000008a (\SystemRoot\system32\DRIVERS\tunnel.sys)

[Filter(Root.Keylogger)] \Driver\kbdclass @ Unknown : \Driver\SynTP @ \Device\00000077 (\SystemRoot\system32\DRIVERS\tunnel.sys)

 

¤¤¤ Web browsers : 0 ¤¤¤

 

¤¤¤ MBR Check : ¤¤¤

+++++ PhysicalDrive0: ST9500325AS +++++

--- User ---

[MBR] 0c7b1bbb597c3925a21eb7f7de5747e9

[bSP] 5401513b52712fcd31d78ec15dad466c : Windows Vista/7/8 MBR Code

Partition table:

0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 2048 | Size: 100 MB

1 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 206848 | Size: 15000 MB

2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 30926848 | Size: 461838 MB

User = LL1 ... OK

User = LL2 ... OK

 

 

============================================

RKreport_SCN_07302014_045119.log

[daledoc1]

Hi:

 

We cannot analyze scan logs or work on malware removal in this area of the forum.

 

Is this the same computer as here: https://forums.malwarebytes.org/index.php?/topic/153926-svchost-infected-wierd-domain-attempting-to-use-it/???

 

If so, it would be advisable to send a PM to the forum Admin, AdvancedSetup, asking that the topic be re-opened, so that you can continue to work with your helper.

 

If not, then I would suggest starting with this pinned topic, which explains how to get expert help: Available Assistance for Possibly Infected Computers

 

Thanks!

[phat2h123]

ohh ok thank u