Jump to content

Need assistance removing malware

ogahm

By ogahm
in Resolved Malware Removal Logs

 Share

Recommended Posts

ogahm

ogahm

Posted
Posted

I plugged a friends Seagate Expansion drive (SRD00F1) into my machine's usb port and it started to load the drivers and then stopped. The machine can't see the drive at all. After that I started to see the following occurring:

1) All the normal column names in Explorer are gone, Author is the only one showing. All of the common ones are unavailable when I try to choose details by right clicking the column header, Filename, Date, size etc...

2) Many windows won't open, specifically Control Panel windows like Backup and Restore Center and System.

3) Explorer shows no filenames or folder names.

 

I ran MBAM and it removed some things, but there was no change in the above mentioned issues.

 

Any assistance is appreciated, here are the Farbar Logs:

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-01-2015 01
Ran by Shake (administrator) on MASTERSHAKE on 16-01-2015 14:04:28
Running from C:\Users\Shake\Downloads
Loaded Profiles: Shake (Available profiles: Shake)
Platform: Windows Vista Ultimate Service Pack 2 (X64) OS Language: English (United States)
Internet Explorer Version 9 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Microsoft Corporation) C:\Windows\ehome\ehsched.exe
(Ruiware LLC) C:\Program Files (x86)\Ruiware\WinPatrol\WinPatrol.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Microsoft Corporation) C:\Windows\ehome\ehrecvr.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [LiveUpdate 5] => C:\Program Files (x86)\MSI\Live Update 5\BootStartLiveupdate.exe [322544 2014-03-05] ()
HKLM-x32\...\Run: [NCUpdateHelper] => C:\Program Files (x86)\NCWest\NCLauncher\NCUpdateHelper.exe [526240 2014-05-14] (NCSOFT Corporation)
HKLM-x32\...\Run: [HTC Sync Loader] => C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe [659456 2013-09-03] ()
HKU\S-1-5-21-1027772261-2917165354-2662933974-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [138240 2008-01-20] (Microsoft Corporation)
HKU\S-1-5-21-1027772261-2917165354-2662933974-1000\...\Run: [WinPatrol] => C:\Program Files (x86)\Ruiware\WinPatrol\winpatrol.exe [1154112 2014-07-20] (Ruiware LLC)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1027772261-2917165354-2662933974-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1027772261-2917165354-2662933974-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1027772261-2917165354-2662933974-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 -> DefaultScope value is missing.
SearchScopes: HKU\S-1-5-21-1027772261-2917165354-2662933974-1000 -> {32CB207D-1B68-45D4-9C71-7794F8A99EFD} URL = http://search.us.com/serp?guid={7D834389-C771-4037-A6AC-9B96BAD6DEEE}&k={searchTerms}
SearchScopes: HKU\S-1-5-21-1027772261-2917165354-2662933974-1000 -> {85157EC9-F09F-46DE-86FC-D2093E74E663} URL = http://search.yahoo.com/search?p={searchTerms}&fr=tightropetb&type=11075
Toolbar: HKU\S-1-5-21-1027772261-2917165354-2662933974-1000 -> No Name - {6E4293AD-DA06-4ABE-A098-DF6843B2BEC1} -  No File
DPF: HKLM-x32 {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} http://content.systemrequirementslab.com/bin/srldetect_intel_4.5.22.0.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Shake\AppData\Roaming\Mozilla\Firefox\Profiles\bxglrmeu.default
FF DefaultSearchEngine: Google
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF Plugin-x32: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @mozilla.zeniko.ch/PDFlite_Browser_Plugin -> C:\Program Files (x86)\PDFlite\npPdfViewer.dll (Simon Bünzli)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2014-05-11]

Chrome:
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [3071632 2014-05-06] (INCA Internet Co., Ltd.)
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [167424 2012-12-07] () [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [383544 2008-01-20] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S1 Beep; No ImagePath
R3 hcw18bda; C:\Windows\System32\drivers\hcw18bda.sys [912896 2010-09-20] (Hauppauge Computer Works, Inc)
S3 HtcVCom32; C:\Windows\System32\DRIVERS\HtcVComV64.sys [118872 2009-07-30] (QUALCOMM Incorporated)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-16] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-11-21] (Malwarebytes Corporation)
S3 NTIOLib_1_0_4; C:\Program Files (x86)\MSI\Live Update 5\NTIOLib_X64.sys [14136 2010-10-22] (MSI)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-16 14:04 - 2015-01-16 14:04 - 00007451 _____ () C:\Users\Shake\Downloads\FRST.txt
2015-01-16 14:01 - 2015-01-16 14:04 - 00000000 ____D () C:\FRST
2015-01-16 14:01 - 2015-01-16 14:01 - 02125312 _____ (Farbar) C:\Users\Shake\Downloads\FRST64.exe
2015-01-16 13:16 - 2015-01-16 13:16 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Shake\Downloads\mbam-setup-2.0.4.1028.exe
2015-01-16 13:16 - 2015-01-16 13:16 - 00000941 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-01-16 13:16 - 2015-01-16 13:16 - 00000941 _____ () C:\ProgramData\Desktop\Malwarebytes Anti-Malware.lnk
2015-01-16 13:16 - 2015-01-16 13:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-01-16 13:16 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-01-16 13:16 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-01-16 12:47 - 2015-01-16 12:47 - 00037624 _____ () C:\Windows\system32\Drivers\TrueSight.sys
2015-01-16 12:47 - 2015-01-16 12:47 - 00000000 ____D () C:\ProgramData\RogueKiller
2015-01-16 12:46 - 2015-01-16 12:56 - 18467928 _____ () C:\Users\Shake\Downloads\RogueKillerX64.exe
2015-01-16 12:33 - 2015-01-16 12:33 - 00000000 ____D () C:\Users\Shake\Downloads\RootRepeal
2015-01-16 12:32 - 2015-01-16 12:32 - 00465298 _____ () C:\Users\Shake\Downloads\RootRepeal.rar
2015-01-16 12:19 - 2015-01-16 12:19 - 00380416 _____ () C:\Users\Shake\Downloads\n69lns2d.exe
2015-01-15 22:20 - 2015-01-15 22:20 - 02494560 _____ (Trend Micro Inc.) C:\Users\Shake\Downloads\HousecallLauncher64 (2).exe
2015-01-15 22:11 - 2015-01-15 22:11 - 02494560 _____ (Trend Micro Inc.) C:\Users\Shake\Downloads\HousecallLauncher64 (1).exe
2015-01-15 21:59 - 2015-01-15 21:59 - 00001960 _____ () C:\Users\Shake\Desktop\HiJackThis.lnk
2015-01-15 21:59 - 2015-01-15 21:59 - 00000000 ____D () C:\Users\Shake\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
2015-01-15 21:58 - 2015-01-15 21:58 - 01402880 _____ () C:\Users\Shake\Downloads\HiJackThis.msi
2015-01-15 21:46 - 2015-01-15 21:46 - 00013576 _____ () C:\ComboFix.txt
2015-01-15 21:39 - 2011-06-25 23:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-01-15 21:39 - 2010-11-07 10:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-01-15 21:39 - 2009-04-19 21:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-01-15 21:39 - 2000-08-30 17:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-01-15 21:39 - 2000-08-30 17:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-01-15 21:39 - 2000-08-30 17:00 - 00098816 _____ () C:\Windows\sed.exe
2015-01-15 21:39 - 2000-08-30 17:00 - 00080412 _____ () C:\Windows\grep.exe
2015-01-15 21:39 - 2000-08-30 17:00 - 00068096 _____ () C:\Windows\zip.exe
2015-01-15 21:38 - 2015-01-15 21:46 - 00000000 ____D () C:\Qoobox
2015-01-15 21:38 - 2015-01-15 21:45 - 00000000 ____D () C:\Windows\erdnt
2015-01-15 21:36 - 2015-01-15 21:36 - 05609736 ____R (Swearware) C:\Users\Shake\Downloads\ComboFix.exe
2015-01-15 21:16 - 2015-01-16 13:54 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-15 21:16 - 2015-01-16 13:16 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-15 21:16 - 2015-01-15 21:38 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-01-15 21:15 - 2015-01-15 21:38 - 00000000 ____D () C:\Users\Shake\Desktop\mbar
2015-01-15 21:15 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-01-15 21:14 - 2015-01-15 21:15 - 16448208 _____ (Malwarebytes Corp.) C:\Users\Shake\Downloads\mbar-1.08.2.1001.exe
2015-01-15 21:08 - 2015-01-15 21:08 - 01156136 _____ (Ruiware) C:\Users\Shake\Downloads\wpsetup (1).exe
2015-01-15 21:08 - 2015-01-15 21:08 - 00000000 ____D () C:\Users\Shake\AppData\Roaming\WinPatrol
2015-01-15 21:08 - 2015-01-15 21:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinPatrol
2015-01-15 21:08 - 2015-01-15 21:08 - 00000000 ____D () C:\ProgramData\InstallMate
2015-01-13 11:31 - 2015-01-13 11:31 - 00000000 ____D () C:\Users\Shake\AppData\Roaming\JAM Software
2015-01-07 14:56 - 2015-01-07 15:44 - 00000000 ____D () C:\Users\Shake\AppData\Local\Microsoft Games
2015-01-01 03:43 - 2015-01-01 03:43 - 00000000 ____D () C:\Users\Shake\Documents\My Photos
2015-01-01 03:29 - 2015-01-01 03:29 - 00000000 ____D () C:\Users\Shake\AppData\Roaming\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1
2015-01-01 03:24 - 2015-01-16 13:54 - 00000000 ____D () C:\Users\Shake\AppData\Local\Htc
2015-01-01 03:23 - 2015-01-01 03:43 - 00000000 ____D () C:\Users\Shake\AppData\Roaming\HTC
2015-01-01 03:23 - 2015-01-01 03:23 - 00003534 _____ () C:\Windows\System32\Tasks\Launch HTC Sync Loader
2015-01-01 03:23 - 2015-01-01 03:23 - 00000989 _____ () C:\Users\Public\Desktop\HTC Sync.lnk
2015-01-01 03:23 - 2015-01-01 03:23 - 00000989 _____ () C:\ProgramData\Desktop\HTC Sync.lnk
2015-01-01 03:22 - 2015-01-01 03:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HTC Sync
2015-01-01 03:16 - 2015-01-01 03:16 - 00000000 ____D () C:\Users\Shake\AppData\Local\Downloaded Installations
2015-01-01 03:15 - 2015-01-01 03:20 - 00010544 _____ () C:\Windows\DPINST.LOG
2015-01-01 03:15 - 2015-01-01 03:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HTC
2015-01-01 03:12 - 2015-01-01 03:12 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia
2015-01-01 03:12 - 2015-01-01 03:12 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia
2015-01-01 03:12 - 2015-01-01 03:12 - 00000000 ____D () C:\ProgramData\Adobe
2015-01-01 03:04 - 2015-01-01 03:06 - 165708080 _____ (HTC Corporation ) C:\Users\Shake\Downloads\setup_3.3.63.exe
2015-01-01 03:00 - 2015-01-01 03:01 - 95270347 _____ (HTC_WWE ) C:\Users\Shake\Downloads\AQUA_Cingular_US_634526440942972924_01_131968_Commercial.exe
2014-12-21 21:09 - 2014-12-21 21:09 - 00000000 ____D () C:\Users\Shake\AppData\Local\Macromedia

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-16 13:59 - 2008-02-06 02:04 - 01599190 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-16 13:59 - 2008-02-06 02:03 - 00702696 _____ () C:\Windows\system32\perfh019.dat
2015-01-16 13:59 - 2008-02-06 02:03 - 00147348 _____ () C:\Windows\system32\perfc019.dat
2015-01-16 13:57 - 2008-01-20 18:53 - 01685140 _____ () C:\Windows\WindowsUpdate.log
2015-01-16 13:54 - 2006-11-02 08:06 - 00000000 ___RD () C:\Users\Public\Recorded TV
2015-01-16 13:53 - 2006-11-02 08:40 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-16 13:53 - 2006-11-02 08:39 - 00043152 _____ () C:\Windows\PFRO.log
2015-01-16 13:53 - 2006-11-02 08:21 - 00003760 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-16 13:53 - 2006-11-02 08:21 - 00003760 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-16 13:52 - 2006-11-02 08:15 - 00000000 ____D () C:\Windows\WindowsMobile
2015-01-16 13:51 - 2006-11-02 08:40 - 00021342 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-01-16 12:33 - 2014-05-11 05:41 - 00025600 _____ () C:\Users\Shake\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-01-16 12:14 - 2014-05-14 23:40 - 00000000 ____D () C:\Users\Shake\AppData\Roaming\vlc
2015-01-15 22:23 - 2014-05-23 16:43 - 00000010 _____ () C:\Users\Shake\AppData\Local\sponge.last.runtime.cache
2015-01-15 21:46 - 2006-11-02 06:33 - 00000000 __RHD () C:\Users\Default
2015-01-15 21:45 - 2006-11-02 05:34 - 00000215 _____ () C:\Windows\system.ini
2015-01-15 14:05 - 2014-05-14 15:40 - 00007578 _____ () C:\Users\Shake\Documents\Bills Paid.txt
2015-01-15 12:00 - 2014-10-08 11:47 - 00000000 ____D () C:\Users\Shake\AppData\Roaming\Awesomium
2015-01-15 01:15 - 2014-05-23 16:47 - 00324667 _____ () C:\Users\Shake\AppData\Local\census.cache
2015-01-15 01:15 - 2014-05-23 16:47 - 00198589 _____ () C:\Users\Shake\AppData\Local\ars.cache
2015-01-15 00:54 - 2014-08-16 10:27 - 00000000 ____D () C:\Users\Shake\AppData\Local\CrashDumps
2015-01-13 10:48 - 2014-05-11 14:39 - 00020569 _____ () C:\Windows\DirectX.log
2015-01-01 03:34 - 2006-11-02 08:26 - 00074418 _____ () C:\Windows\setupact.log
2015-01-01 03:20 - 2014-05-11 05:20 - 00000000 ____D () C:\Users\Shake
2015-01-01 03:12 - 2014-05-12 02:43 - 00000000 ____D () C:\Users\Shake\AppData\Roaming\Adobe
2015-01-01 03:12 - 2014-05-12 02:42 - 00000000 ____D () C:\Users\Shake\AppData\Local\Adobe
2014-12-31 18:53 - 2014-11-24 18:48 - 00000000 ____D () C:\Windows\System32\Tasks\NCH Software
2014-12-21 21:08 - 2014-05-12 02:43 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-12-21 21:08 - 2014-05-12 02:43 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

Files to move or delete:
====================
C:\ProgramData\SMRResults410.dat


Some content of TEMP:
====================
C:\Users\Shake\AppData\Local\Temp\dllnt_dump.dll


Some zero byte size files/folders:
==========================
C:\Windows\System32\atiumdag.dll
C:\Windows\System32\atiumdva.dll

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-16 14:04

==================== End Of Log ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-01-2015 01
Ran by Shake at 2015-01-16 14:05:02
Running from C:\Users\Shake\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs

should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.8.0.870 - Adobe Systems Incorporated)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.152 - Adobe Systems

Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems

Incorporated)
File Association Manager (HKLM-x32\...\FileAssociationManager) (Version: 0.9 - File Association Manager)
HiJackThis (HKLM-x32\...\{45A66726-69BC-466B-A7A4-12FCBA4883D7}) (Version: 1.0.0 - Trend Micro)
HTC BMP USB Driver (HKLM-x32\...\{31A559C1-9E4D-423B-9DD3-34A6C5398752}) (Version: 1.0.5375 - HTC)
HTC Driver Installer (HKLM-x32\...\{4CEEE5D0-F905-4688-B9F9-ECC710507796}) (Version: 4.5.0.001 - HTC Corporation)
HTC Sync (HKLM-x32\...\{CBDAE89D-8ABD-4DC5-9309-C2C58696B371}) (Version: 3.3.63 - HTC Corporation)
IPTInstaller (HKLM-x32\...\{08208143-777D-4A06-BB54-71BF0AD1BB70}) (Version: 4.0.8 - HTC)
Lineage II (HKLM-x32\...\{23664DA8-8872-4CF4-A2F2-327CC539823B}) (Version: 4.0.0.2 - NC Interactive, LLC)
Live Update 5 (HKLM-x32\...\{E8BAA541-D161-4C9B-85BF-01F05A56BD7F}}_is1) (Version: 5.0.115 - MSI)
Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 -

Malwarebytes Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 4 Multi-Targeting Pack (HKLM-x32\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}) (Version:

4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 -

Microsoft Corporation)
Microsoft Help Viewer 1.0 (HKLM\...\Microsoft Help Viewer 1.0) (Version: 1.0.30319 - Microsoft Corporation)
Microsoft SQL Server 2008 R2 Management Objects (HKLM-x32\...\{4E968D9C-21A7-4915-B698-F7AEB913541D}) (Version:

10.50.1447.4 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM-x32\...\{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0

- Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 x64 ENU (HKLM\...\{D4AD39AD-091E-4D33-BB2B-59F6FCB8ADC3}) (Version: 3.5.8080.0

- Microsoft Corporation)
Microsoft SQL Server System CLR Types (HKLM-x32\...\{2A2F3AE8-246A-4252-BB26-1BEB45627074}) (Version: 10.50.1447.4 -

Microsoft Corporation)
Microsoft Visual C# 2010 Express - ENU (HKLM-x32\...\Microsoft Visual C# 2010 Express - ENU) (Version: 10.0.30319 -

Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE})

(Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974 (HKLM-x32\...\{B7E38540-E355-3503-AFD7-635B2F2F76E1})

(Version: 9.0.30729.4974 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Runtime - 10.0.30319 (HKLM\...\{94D70749-4281-39AC-AD90-B56A0E0A402E}) (Version:

10.0.30319 - Microsoft Corporation)
Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools (HKLM-x32\...\{14DD7530-CCD2-3798-B37D-3839ED6A441C})

(Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual Studio 2010 Express Prerequisites x64 - ENU (HKLM\...\{BCA26999-EC22-3007-BB79-638913079C9A})

(Version: 10.0.30319 - Microsoft Corporation)
Mozilla Firefox 34.0.5 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 en-US)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 34.0.5 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft

Corporation)
NCH Tone Generator (HKLM-x32\...\ToneGen) (Version: 3.12 - NCH Software)
NCSOFT Game Launcher (HKLM-x32\...\NCLauncher_NCWest) (Version:  - NCSOFT)
PDFlite 1.0.0.0 (HKLM-x32\...\PDFlite) (Version: 1.0.0.0 - Amnis Technology Ltd)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 6.252.1109.2012 -

Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7111 -

Realtek Semiconductor Corp.)
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version:  - )
System Requirements Lab for Intel (HKLM-x32\...\{1EBDF6D2-CEA0-484C-A23E-2DDAD7FD0DD0}) (Version: 4.5.22.0 -

Husdawg, LLC)
Ultimate Extras sounds from Microsoft® Tinker™ (HKLM\...\UltSounds2) (Version:  - Microsoft Corporation)
Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 ENU (HKLM-x32\...\{112C23F2-C036-4D40-BED4-0CB47BF5555C})

(Version: 4.0.8080.0 - Microsoft Corporation)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
WavePad Sound Editor (HKLM-x32\...\WavePad) (Version: 6.02 - NCH Software)
Windows Sound Schemes (HKLM\...\UltSounds) (Version:  - Microsoft Corporation)
WinPatrol (HKLM\...\{6A206A04-6BC1-411B-AA04-4E52EDEEADF2}) (Version: 32.0.2014.5 - Ruiware)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

29-04-2014 23:00:08 Scheduled Checkpoint
01-05-2014 02:56:28 Scheduled Checkpoint
01-05-2014 23:00:08 Scheduled Checkpoint
03-05-2014 03:30:55 Scheduled Checkpoint
03-05-2014 23:14:55 Scheduled Checkpoint
04-05-2014 23:00:05 Scheduled Checkpoint
06-05-2014 22:41:46 Scheduled Checkpoint
08-05-2014 04:43:03 Scheduled Checkpoint
08-05-2014 23:01:05 Scheduled Checkpoint
10-05-2014 05:40:18 Scheduled Checkpoint
17-11-2014 00:36:32 Scheduled Checkpoint
18-11-2014 16:47:50 Scheduled Checkpoint
19-11-2014 13:16:54 Windows Update
21-11-2014 00:58:42 Scheduled Checkpoint
22-11-2014 06:18:14 Scheduled Checkpoint
23-11-2014 06:05:32 Scheduled Checkpoint
27-11-2014 05:27:39 Scheduled Checkpoint
01-12-2014 20:29:19 Scheduled Checkpoint
03-12-2014 01:04:18 Scheduled Checkpoint
04-12-2014 09:33:47 Scheduled Checkpoint
05-12-2014 12:55:40 Scheduled Checkpoint
07-12-2014 15:56:40 Scheduled Checkpoint
09-12-2014 08:02:03 Scheduled Checkpoint
10-12-2014 00:00:04 Scheduled Checkpoint
10-12-2014 20:12:55 Scheduled Checkpoint
11-12-2014 18:07:02 Scheduled Checkpoint
14-12-2014 07:55:53 Scheduled Checkpoint
23-12-2014 00:21:09 Scheduled Checkpoint
24-12-2014 00:19:47 Scheduled Checkpoint
25-12-2014 00:00:12 Scheduled Checkpoint
26-12-2014 04:12:32 Scheduled Checkpoint
27-12-2014 08:23:10 Scheduled Checkpoint
29-12-2014 03:00:42 Scheduled Checkpoint
30-12-2014 00:00:32 Scheduled Checkpoint
31-12-2014 00:23:56 Scheduled Checkpoint
01-01-2015 00:24:23 Scheduled Checkpoint
01-01-2015 03:12:51 Device Driver Package Install: HTC Corporation Ports (COM & LPT)
01-01-2015 03:13:26 Device Driver Package Install: HTC Corporation Modems
01-01-2015 03:15:36 Device Driver Package Install: HTC, Corporation
01-01-2015 03:16:46 Device Driver Package Install: HTC Network Protocol
01-01-2015 03:16:46 Device Driver Package Install: HTC Corporation Network adapters
01-01-2015 03:19:25 Device Driver Package Install: HTC Corporation Portable Devices
01-01-2015 03:21:29 Installed HTC Sync.
02-01-2015 00:00:32 Scheduled Checkpoint
03-01-2015 06:49:36 Scheduled Checkpoint
04-01-2015 06:47:08 Scheduled Checkpoint
05-01-2015 10:04:45 Scheduled Checkpoint
06-01-2015 00:00:22 Scheduled Checkpoint
07-01-2015 00:32:08 Scheduled Checkpoint
08-01-2015 00:31:55 Scheduled Checkpoint
09-01-2015 01:49:00 Scheduled Checkpoint
10-01-2015 00:25:01 Scheduled Checkpoint
11-01-2015 00:41:43 Scheduled Checkpoint
12-01-2015 04:03:36 Scheduled Checkpoint
13-01-2015 00:00:27 Scheduled Checkpoint
14-01-2015 00:00:23 Scheduled Checkpoint
15-01-2015 00:19:08 Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106
15-01-2015 21:58:55 Installed HiJackThis

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 05:34 - 2015-01-15 21:45 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed

separately to be moved.)

Task: {0BC4EB4F-626F-4DB9-9895-761249E8144F} - System32\Tasks\Launch HTC Sync Loader => C:\Program Files (x86)

\HTC\HTC Sync 3.0\htcUPCTLoader.exe [2013-09-03] ()
Task: {497B36FE-60A8-45A7-A1F2-D80E909FD9B0} - System32\Tasks\FileAssociationManagerUpdater => C:\Program Files

(x86)\FileAssociationManager\Updater.exe
Task: {5AE132D7-E995-449C-8C1B-75A40AC5DED1} - \Search-Protect No Task File <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2014-05-14 23:01 - 2013-08-26 05:12 - 00087040 _____ () C:\Windows\System32\redmonnt.dll
2015-01-01 03:16 - 2012-12-07 17:26 - 00167424 _____ () C:\Program Files (x86)\HTC\Internet Pass-

Through\PassThruSvr.exe
2008-06-03 02:35 - 2008-06-03 02:35 - 00116736 _____ () C:\Windows\system32\atitmm64.dll
2014-05-23 16:31 - 2014-05-23 16:31 - 00000000 _____ () C:\Windows\system32\atiumdag.dll
2014-05-23 16:31 - 2014-05-23 16:31 - 00000000 _____ () C:\Windows\system32\atiumdva.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be

restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-1027772261-2917165354-2662933974-500 - Administrator - Disabled)
Guest (S-1-5-21-1027772261-2917165354-2662933974-501 - Limited - Disabled)
Shake (S-1-5-21-1027772261-2917165354-2662933974-1000 - Administrator - Enabled) => C:\Users\Shake

==================== Faulty Device Manager Devices =============

Name: Video Controller
Description: Video Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (01/16/2015 01:54:32 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/16/2015 01:48:06 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-

controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3.manifest1".Error in manifest or policy file

"C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-

controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3.manifest2" on line

C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-

controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-

controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3.manifest.
Component 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-

controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifest.

Error: (01/15/2015 00:54:24 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application iexplore.exe, version 9.0.8112.16592, time stamp 0x544e95a7, faulting module

ntdll.dll, version 6.0.6002.18881, time stamp 0x51da3e00, exception code 0xc0000374, fault offset 0x000abc4f,
process id 0xe9c, application start time 0xiexplore.exe0.

Error: (01/15/2015 00:53:00 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/14/2015 11:53:56 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application housecall.bin, version 1.62.0.1074, time stamp 0x4cc3574b, faulting module

hc_core.dll, version 1.62.0.1074, time stamp 0x547dafbb, exception code 0xc0000005, fault offset 0x00108e69,
process id 0x17dc, application start time 0xhousecall.bin0.

Error: (01/14/2015 11:53:09 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application housecall.bin, version 1.62.0.1074, time stamp 0x4cc3574b, faulting module

hc_core.dll, version 1.62.0.1074, time stamp 0x547dafbb, exception code 0xc0000005, fault offset 0x00108e93,
process id 0x2438, application start time 0xhousecall.bin0.

Error: (01/14/2015 11:37:11 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/14/2015 11:36:50 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application iexplore.exe, version 9.0.8112.16592, time stamp 0x544e95a7, faulting module

ntdll.dll, version 6.0.6002.18881, time stamp 0x51da3e00, exception code 0xc0000374, fault offset 0x000abc4f,
process id 0xf50, application start time 0xiexplore.exe0.

Error: (01/13/2015 10:48:25 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application L2.bin, version 0.0.0.0, time stamp 0x545c7a9b, faulting module D3DDrv.dll,

version 0.0.0.0, time stamp 0x545c7a89, exception code 0xc0000005, fault offset 0x00020bed,
process id 0x19694, application start time 0xL2.bin0.

Error: (01/13/2015 10:47:56 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application L2.bin, version 0.0.0.0, time stamp 0x545c7a9b, faulting module NWindow.dll,

version 0.0.0.0, time stamp 0x545c7b2c, exception code 0xc0000005, fault offset 0x001d4862,
process id 0x19694, application start time 0xL2.bin0.


System errors:
=============
Error: (01/16/2015 01:54:32 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Beep

Error: (01/16/2015 01:53:16 PM) (Source: volmgr) (EventID: 49) (User: )
Description: Configuring the Page file for crash dump failed. Make sure there is a page
file on the boot partition and that is large enough to contain all physical
memory.

Error: (01/16/2015 01:52:42 PM) (Source: volmgr) (EventID: 49) (User: )
Description: Configuring the Page file for crash dump failed. Make sure there is a page
file on the boot partition and that is large enough to contain all physical
memory.

Error: (01/15/2015 09:45:14 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: PEVSystemStart

Error: (01/15/2015 09:44:47 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility with this system.

Please contact your software vendor for a compatible version of the driver.

Error: (01/15/2015 09:43:14 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: PEVSystemStart

Error: (01/15/2015 00:51:40 AM) (Source: volmgr) (EventID: 49) (User: )
Description: Configuring the Page file for crash dump failed. Make sure there is a page
file on the boot partition and that is large enough to contain all physical
memory.

Error: (01/15/2015 00:51:12 AM) (Source: volmgr) (EventID: 49) (User: )
Description: Configuring the Page file for crash dump failed. Make sure there is a page
file on the boot partition and that is large enough to contain all physical
memory.

Error: (01/14/2015 11:35:57 PM) (Source: volmgr) (EventID: 49) (User: )
Description: Configuring the Page file for crash dump failed. Make sure there is a page
file on the boot partition and that is large enough to contain all physical
memory.

Error: (01/14/2015 11:36:01 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: The previous system shutdown at 11:31:51 PM on 1/14/2015 was unexpected.


Microsoft Office Sessions:
=========================
Error: (01/16/2015 01:54:32 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/16/2015 01:48:06 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-

controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.w

indows.common-

controls_6595b64144ccf1df_6.0.6002.18305_none_1509f852f40ee5cd.manifestC:\Users\Shake\AppData\Local\TNT2\2.0.0.1895

\TNT2User.exe

Error: (01/15/2015 00:54:24 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: iexplore.exe9.0.8112.16592544e95a7ntdll.dll6.0.6002.1888151da3e00c0000374000abc4fe9c01d0309856588dbf

Error: (01/15/2015 00:53:00 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/14/2015 11:53:56 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: housecall.bin1.62.0.10744cc3574bhc_core.dll1.62.0.1074547dafbbc000000500108e6917dc01d0308ffefb7021

Error: (01/14/2015 11:53:09 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: housecall.bin1.62.0.10744cc3574bhc_core.dll1.62.0.1074547dafbbc000000500108e93243801d0308fc91ba82c

Error: (01/14/2015 11:37:11 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (01/14/2015 11:36:50 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: iexplore.exe9.0.8112.16592544e95a7ntdll.dll6.0.6002.1888151da3e00c0000374000abc4ff5001d0308d9c9a76b8

Error: (01/13/2015 10:48:25 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: L2.bin0.0.0.0545c7a9bD3DDrv.dll0.0.0.0545c7a89c000000500020bed1969401d02e939d4671ec

Error: (01/13/2015 10:47:56 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: L2.bin0.0.0.0545c7a9bNWindow.dll0.0.0.0545c7b2cc0000005001d48621969401d02e939d4671ec


CodeIntegrity Errors:
===================================
  Date: 2015-01-16 14:04:58.858
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1

\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

  Date: 2015-01-16 14:04:58.761
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1

\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

  Date: 2015-01-16 14:04:58.653
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1

\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

  Date: 2015-01-16 14:04:58.556
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1

\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

  Date: 2015-01-16 14:04:58.369
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1

\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the

system.

  Date: 2015-01-16 14:04:58.272
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1

\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the

system.

  Date: 2015-01-16 14:04:58.173
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1

\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the

system.

  Date: 2015-01-16 14:04:58.064
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1

\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the

system.

  Date: 2015-01-16 14:04:38.232
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1

\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.

  Date: 2015-01-16 14:04:38.131
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1

\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Processor: Intel® Core i7 CPU 920 @ 2.67GHz
Percentage of memory in use: 42%
Total physical RAM: 6133.2 MB
Available physical RAM: 3548.14 MB
Total Pagefile: 11126.74 MB
Available Pagefile: 8333.25 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:2048 GB) (Free:119.66 GB) NTFS
Drive d: () (Fixed) (Total:1397.26 GB) (Free:34.17 GB) NTFS ==>[system with boot components (obtained from reading

drive)]
Drive e: () (Fixed) (Total:149.05 GB) (Free:8.42 GB) NTFS
Drive g: (ROAD_TO_PERDITION) (CDROM) (Total:7.79 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 2794.5 GB) (Disk ID: 70177B72)
Partition 1: (Not Active) - (Size=2048 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 149.1 GB) (Disk ID: 1BE2A512)
Partition 1: (Active) - (Size=149 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows 7 or Vista) (Size: 1397.3 GB) (Disk ID: 4E3F0AC9)
Partition 1: (Active) - (Size=1397.3 GB) - (Type=07 NTFS)

==================== End Of Log ============================

 

Link to post
Share on other sites
TwinHeadedEagle

TwinHeadedEagle

Posted
Posted

Hello,
    
 
They call me TwinHeadedEagle around here, and I'll be working with you.
 
     
    
Before we start please read and note the following:

  • Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
  • Please be patient. I know it is frustrating when your PC isn't working properly, but malware removal takes time.
  • Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
  • Do not paste the logs in your posts, attachments make my work easier. There is a More reply options button, that gives you Upload Files option below which you can use to attach your reports. Always attach reports from all tools.
  • Always execute my instructions in given order. If for some reason you cannot completely follow one instruction, inform me about that.
  • Stay with me to the end, the absence of symptoms doesn't mean that your machine is fully operational.
  • Note that we may live in totally different time zones, what may cause some delays between answers.
  • Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.
  • If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.

:excl: I can't foresee everything, so if anything unexpected happens, please stop and inform me!
:excl: There are no silly questions. Never be afraid to ask if in doubt!
 
 
 
  warning.gif Rules and policies
 
We won't support any piracy.
That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!
The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!
 
Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.
 
 
 
 

Download 51a5f31352b88-icon_MBAR.pngMalwarebytes Anti-Rootkit to your desktop.

  • Double-click the icon to start the tool.
  • It will ask you where to extract it, then it will start.
  • Warning! Malwarebytes Anti-Rootkit needs to be run from an account with administrator rights.
  • Click in the introduction screen "next" to continue.
  • Click in the following screen "Update" to obtain the latest malware definitions.
  • Once the update is complete select "Next" and click "Scan".
  • When the scan is finished and no malware has been found select "Exit".
  • If malware was detected, make sure to check all the items and click "Cleanup". Reboot your computer.
  • Open the MBAR folder and attach the content of the following files in your next reply:
    • "mbar-log-{date} (xx-xx-xx).txt"
    • "system-log.txt"

 

 

 

51a5bf3d99e8a-ComboFixlogo16.png Scan with ComboFix
 
This is a very powerful tool that should be used only if advised by Malware Analyst.
Do not run ComboFix on your own!
 
Referring to this instruction, please download ComboFix by sUBs and save it to your desktop.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

  • Right-click on 51a5bf3d99e8a-ComboFixlogo16.png icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
  • Accept the disclaimer and agree if prompted to install Recovery Console.
  • Do not take any actions while ComboFix goes through your System - it may cause it to stall!
  • This scan may take some time!
  • When finished - it will display a logfile (located also on your main drive, usually C:\ComboFix.txt).

Include that log in your next reply.
icon_idea.gif If you'll encounter any issues with internet connection after running ComboFix, please visit this link.
icon_idea.gif If an error about operation on the key marked for deletion will appear after running the tool, please reboot your machine.

Link to post
Share on other sites
TwinHeadedEagle

TwinHeadedEagle

Posted
Posted

Let's use FRST again:
 
FRST.gif Scan with Farbar Recovery Scan Tool
 
Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

  • Right-click on FRST.gif icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Make sure that Addition option is checked.
  • Press Scan button and wait.
  • The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please upload them into your next reply.

Link to post
Share on other sites
TwinHeadedEagle

TwinHeadedEagle

Posted
Posted

FRST.gif Fix with Farbar Recovery Scan Tool
 


icon_exclaim.gif This fix was created for this user for use on that particular machine. icon_exclaim.gif
icon_exclaim.gif Running it on another one may cause damage and render the system unstable. icon_exclaim.gif

 
Download attached fixlist.txt file and save it to the Desktop:
 
Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

  • Right-click on FRST.gif icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Press the Fix button just once and wait.
  • If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
  • When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please post it to your reply.

fixlist.txt

Link to post
Share on other sites
ogahm

ogahm

Posted
  • Author
Posted

The same issues.

1) All the normal column names in Explorer are gone, Author is the only one showing. All of the common ones are unavailable when I try to choose details by right clicking the column header, Filename, Date, size etc...

2) Many windows won't open, specifically Control Panel windows like Backup and Restore Center and System.

3) Explorer shows no filenames or folder names.

The fact that explorer shows up as not signed in Farbar I think is the clue we are looking for, I'm guessing it's been replaced with some malware. Is there any way of getting an old restore point to run? I can't get into the Backup and restore center.

Link to post
Share on other sites
ogahm

ogahm

Posted
  • Author
Posted

Scandisk ran, found a couple errors, nothing notable.

Ran System File Check, got message: "Windows resource control found errors and made corrections" in CBS. something I think, the window got closed before I could type the full message here, I'm sure it's logged somewhere if you need it let me know. Says I need to reboot. Mostly just logging this so I don't lose it.

Link to post
Share on other sites
ogahm

ogahm

Posted
  • Author
Posted

1) Registry backup says "had errors or failed". Clicking on the "View Logs" button does nothing.

2) The Create Restore Point succeeded. I clicked on Restore just to see what was there, but nothing comes up.

3) I need to note, I cannot open any new windows in IE, not sure how long that has been happening, I've been working in Firefox. Any page I try to go to seems to just time out. I seem to recall on of the tools we ran can do this, I'll look back and see if I can find it.

4) I was looking at the choices in the Repair Tool, did I want to deselect the Windows 8 choices? And do I want to select "Unhide non-system files"?

5) According to the rules, I need to wait I guess, since the registry backup failed. So I'll wait for your response.

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.