NotReallyBob Posted October 28, 2014 ID:897896 Share Posted October 28, 2014 Looks like I have a client with Poweliks issues. I run MBAM, Avast, even MSE. I scan with Farbar. I have attached the scan results. Looking for some help please.FRST.txtAddition.txt Link to post Share on other sites More sharing options...
Naathim Posted October 29, 2014 ID:898237 Share Posted October 29, 2014 My name's Naathim and I'm a GeekU Minion! Now that we are mates and will be working together to clean your machine out of any junkware, feel free to call me Naat Before we start please note the following:Analysis and research take some time, also sometimes real life gets in the way, please be patient.Limit your internet access to posting here, some infections just wait to steal typed-in passwords.Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.Paste the logs in your posts, attachments make my work harder and more complicated.Stay with me to the end, the absence of symtoms doesn't mean that your machine is fully operational.Note that we may live in totally different time zones, what may cause some delays between answers.I can't foresee everything, so if anything unexpected happens, please stop and inform me!There are no silly questions. Never be afraid to ask if in doubt!Let's start and enjoy the fight! Rules and policiesWe won't support any piracy. That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!Failure to follow these guidelines will result with closing your topic and withdrawning any assistance. Scan with RogueKillerPlease download RogueKiller and save the file to your desktop.Temporary disable your AntiVirus and AntiSpyware protection - instructions here.Right-click on icon and select Run as Administrator to start the tool.Wait patiently until the pre-scan will be done. It shouldn't take more than 2-3 minutes.Accept the Terms of use.When the Scan button becomes available, please click it. RogueKiller will start a full scan.Let this process run uninterrupted!.When finished, a Report button will become available. Click it. You will be presented with a logfile.Please include the content of this logfile in your next reply. Link to post Share on other sites More sharing options...
NotReallyBob Posted October 29, 2014 Author ID:898630 Share Posted October 29, 2014 here is the log RogueKiller V10.0.4.0 [Oct 29 2014] by Adlice Softwaremail : http://www.adlice.com/contact/Feedback : http://forum.adlice.comWebsite : http://www.adlice.com/softwares/roguekiller/Blog : http://www.adlice.comOperating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits versionStarted in : Normal modeUser : admin [Administrator]Mode : Scan -- Date : 10/29/2014 13:19:09¤¤¤ Processes : 1 ¤¤¤[Proc.Svchost] svchost.exe -- [x] -> Killed [TermThr]¤¤¤ Registry : 6 ¤¤¤[PUM.HomePage] HKEY_USERS\S-1-5-21-3368086640-2439188754-4288494395-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome -> Found [PUM.SearchPage] HKEY_USERS\S-1-5-21-3368086640-2439188754-4288494395-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> Found [PUM.SearchPage] HKEY_USERS\S-1-5-21-3368086640-2439188754-4288494395-1012\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> Found [PUM.SearchPage] HKEY_USERS\S-1-5-21-3368086640-2439188754-4288494395-1012-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> Found [PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Found[PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Found¤¤¤ Tasks : 0 ¤¤¤¤¤¤ Files : 0 ¤¤¤¤¤¤ Hosts File : 0 ¤¤¤¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤¤¤¤ Web browsers : 0 ¤¤¤¤¤¤ MBR Check : ¤¤¤+++++ PhysicalDrive0: HITACHI HDS725050KLA360 ATA Device +++++--- User ---[MBR] 30e50a02b01be0ee8681f0dfa702683a[bSP] 711de694e41ac6657848d06f889100c1 : Windows Vista/7/8 MBR CodePartition table:0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 101 MB1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 208845 | Size: 476835 MBUser = LL1 ... OKUser = LL2 ... OK============================================RKreport_DEL_10282014_232552.log - RKreport_DEL_10282014_234522.log - RKreport_DEL_10282014_234528.log - RKreport_SCN_10282014_232358.logRKreport_SCN_10282014_234336.log Link to post Share on other sites More sharing options...
Naathim Posted October 29, 2014 ID:898637 Share Posted October 29, 2014 Are you doing it for your client? Link to post Share on other sites More sharing options...
NotReallyBob Posted October 29, 2014 Author ID:898650 Share Posted October 29, 2014 I handle the website for a company. They asked for help with one of the user computers. Link to post Share on other sites More sharing options...
Naathim Posted October 30, 2014 ID:899132 Share Posted October 30, 2014 Hi We need to clarify one thing. I help regular home users who have troubles and can't get it on their own. Companies make good revenue, and I don't see any reason why somebody shouldn't be paid for that. We are volunteers here, we don't do this for any profit. I may help you clean it, but please bare in mind what I told you. Scan with ComboFixThis is a very powerful tool that should be used only if advised by Malware Analyst.Do not run ComboFix on your own!Referring to this instruction, please download ComboFix by sUBs and save it to your desktop.Temporary disable your AntiVirus and AntiSpyware protection - instructions here.If you are a user of CD emulation software (like Daemon Tools or Alcohol) also disable it for the cleaning process - instructions here.Right-click on icon and select Run as Administrator to start the tool.Accept the disclaimer and agree if prompted to install Recovery Console.Do not take any actions while ComboFix goes through your System - it may cause it to stall!This scan may take some time!When finished - it will display a logfile (located also on your main drive, usually C:\ComboFix.txt).Include that log in your next reply. If you'll encounter any issues with internet connection after running ComboFix, please visit this link. If an error about operation on the key marked for deletion will appear after running the tool, please reboot your machine. Don't forget to re-enable your previously switched-off protection software! Link to post Share on other sites More sharing options...
NotReallyBob Posted November 3, 2014 Author ID:901831 Share Posted November 3, 2014 I thank you for your time. I was able to use RoguekillerCMD to fix the issue. I apologize if offended you. If this were an issue I was being compensated for I have not problem passing the benefit or compensation to others for the help solving an issue. Link to post Share on other sites More sharing options...
Naathim Posted November 3, 2014 ID:901891 Share Posted November 3, 2014 Glad to her that. Should we mark this thread as closed? Link to post Share on other sites More sharing options...
NotReallyBob Posted November 6, 2014 Author ID:903598 Share Posted November 6, 2014 Yes you can mark it as closed. Link to post Share on other sites More sharing options...
LDTate Posted November 20, 2014 ID:910590 Share Posted November 20, 2014 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts