Possible infection.

[Doctor9fan]

Hi all,

I was having problems with MBAM not starting when Windows starts so was asked to post logs from FRST program, an advisor mentioned having possible malware/virus problems as well as having problems with running two av software (Norton & Defender) which I thought as Norton disabled Defender was strange, I managed to turn off Defender & get MBAM starting with Windows but am concerned that 'nasties' might be present on my laptop.

 

Windows 10 fully patched/upto date, Norton Security w/Backup fully upto date, MBAM fully upto date.

 

I have run FRST again & attached the FRST & Addition txt files to this post.

 

If someone would check them & if something is found help me remove them, computer not running strange & the only pup I have excluded from detection/removal is for a screensaver installer on an external HD.

FRST.txt

Addition.txt

[TwinHeadedEagle]

Hello,

    

 

They call me TwinHeadedEagle around here, and I'll try to help your with your issue.

 

     

    

Before we start please read and note the following:

• We're primarily oriented on malware removal here, so you must know that some issues just cannot be solved and you must be prepared for this. Some tools we use here will remove your browser search history, so backup your important links and all the files whose loss is unacceptable.
• Note that we may live in totally different time zones, what may cause some delays between answers.
• Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
• Do not paste the logs in your posts, attachments make my work easier. There is a More reply options button, that gives you Upload Files option below which you can use to attach your reports. Always attach reports from all tools.
• Always execute my instructions in given order. If for some reason you cannot completely follow one instruction, inform me about that.
• If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.

I can't foresee everything, so if anything not covered in my instructions happens, please stop and inform me!

There are no silly questions. Never be afraid to ask if in doubt!

 

 

 

  Rules and policies

 

We won't support any piracy.

That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!

The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!

 

Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.

 

 

---

Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

createsrpoint;autoclean;emptyclsid;emptyalltemp;ipconfig /flushdns >>"%temp%\log.txt";b

• Right-click on icon and select Run as Administrator to start the tool.
• Wait patiently until the main console will appear, it may take a minute or two.
• In the main box please paste in the following script:
• Make sure that Scan All Users option is checked.
• Push Run Script and wait patiently. The scan may take a couple of minutes.
• When the scan completes, a zoek-results logfile should open in notepad.
• If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

[Doctor9fan]

Here's the log:

Zoek.exe v5.0.0.1 Updated 31-December-2015
Tool run by Virginia on 13/01/2016 at 18:50:53.34.
Microsoft Windows 10 Pro 10.0.10586  x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Virginia\Downloads\zoek.exe [scan all users] [script inserted]

==== System Restore Info ======================

13/01/2016 6:54:47 PM Zoek.exe System Restore Point Created Successfully.

==== Empty Folders Check ======================

C:\PROGRA~2\AGEIA Technologies deleted successfully
C:\PROGRA~3\APN deleted successfully
C:\PROGRA~3\Canon IJ Network Tool deleted successfully
C:\PROGRA~3\Comms deleted successfully
C:\PROGRA~3\PCSettings deleted successfully
C:\PROGRA~3\RealNetworks deleted successfully
C:\PROGRA~3\Skype deleted successfully
C:\PROGRA~3\{BAF091CA-86C4-4627-ADA1-897E2621C1B0} deleted successfully
C:\Users\Virginia\AppData\Local\ActiveSync deleted successfully
C:\Users\Virginia\AppData\Local\EmieBrowserModeList deleted successfully
C:\Users\Virginia\AppData\Local\EmieSiteList deleted successfully
C:\Users\Virginia\AppData\Local\EmieUserList deleted successfully
C:\Users\Virginia\AppData\Local\NetworkTiles deleted successfully
C:\Users\Virginia\AppData\Local\PackageStaging deleted successfully
C:\Users\Virginia\AppData\Local\PeerDistRepub deleted successfully
C:\Users\Virginia\AppData\Local\Samsung deleted successfully
C:\Users\Virginia\AppData\Local\Secunia PSI deleted successfully
C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\PeerDistPub deleted successfully
C:\WINDOWS\serviceprofiles\networkservice\AppData\Local\PeerDistRepub deleted successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-1186474453-134891824-2603582206-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{759D9886-0C6F-4498-BAB6-4A5F47C6C72F} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extension Compatibility\{759D9886-0C6F-4498-BAB6-4A5F47C6C72F} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_USERS\S-1-5-21-1186474453-134891824-2603582206-1001\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{759D9886-0C6F-4498-BAB6-4A5F47C6C72F} deleted successfully

==== Deleting Services ======================

==== Batch Command(s) Run By Tool======================

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

==== Deleting Files \ Folders ======================

C:\PROGRA~2\AGEIA Technologies not found
C:\PROGRA~2\Redemption Cemetery - Grave Testimony Collector's Edition not found
C:\PROGRA~3\{BAF091CA-86C4-4627-ADA1-897E2621C1B0} not found
C:\PROGRA~2\Redemption Cemetery - Grave Testimony Collector’s Edition not found
C:\PROGRA~2\Enigmatis - The Ghosts of Maple Creek Collector's Edition deleted
C:\PROGRA~2\Redemption Cemetery - Children's Plight Collector's Edition deleted
C:\PROGRA~2\MCF - Dire Grove Sacred Grove deleted
C:\PROGRA~2\Enigmatis - The Mists of Ravenwood Collector's Edition deleted
C:\PROGRA~2\Mystery Case Files - Dire Grove Collector's Edition deleted
C:\PROGRA~2\Mystery Case Files - Escape from Ravenhearst Collector's Edition deleted
C:\PROGRA~2\Mystery Case Files - Key to Ravenhearst Collectors Edition deleted
C:\PROGRA~2\Mystery Case Files - Ravenhearst Unlocked Collectors Edition deleted
C:\PROGRA~2\Mystery Case Files - Return to Ravenhearst Original Soundtrack deleted
C:\PROGRA~2\Redemption Cemetery - Salvation of the Lost Collectors Edition deleted
C:\PROGRA~2\Sherlock Holmes and the Hound of the Baskervilles Collector's Edition deleted
C:\PROGRA~2\Dark Realm - Princess of Ice deleted
C:\PROGRA~2\Redemption Cemetery - Bitter Frost Collectors Edition deleted
C:\PROGRA~2\Mystery Case Files - Return to Ravenhearst deleted
C:\PROGRA~3\ProductData deleted
C:\PROGRA~3\Package Cache deleted
C:\Users\Virginia\AppData\Local\CrashRpt deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ScreenSavers deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Haunted Halls - Revenge of Doctor Blackmore Collector's Edition deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mystery Case Files - Escape from Ravenhearst Collector's Edition deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mystery Case Files - Key to Ravenhearst Collectors Edition deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mystery Case Files - Ravenhearst Unlocked Collector's Edition deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mystery Case Files - Return to Ravenhearst deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mystery Case Files - Return to Ravenhearst Original Soundtrack deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnk deleted
C:\windows\SysNative\GroupPolicy\Machine deleted
C:\windows\SysNative\GroupPolicy\User deleted
C:\windows\SysNative\GroupPolicy\gpt.ini deleted
C:\WINDOWS\SysWow64\AI_RecycleBin deleted
C:\Users\Virginia\Documents\Add-in Express deleted
C:\Users\Virginia\AppData\Roaming\Mozilla\Firefox\Profiles\um36m0cp.default-1434230614609\searchplugins\safesearch.xml deleted
"C:\PROGRA~2\Haunted Legends - The Queen of Spades Collector's Edition" deleted
"C:\PROGRA~2\Redemption Cemetery - Curse of the Raven Collector's Edition" deleted
"C:\PROGRA~2\Redemption Cemetery - The Island of the Lost Collectors Edition" deleted
"C:\PROGRA~2\Haunted Halls - Green Hills Sanitarium Collector's Edition" deleted

==== Firefox Start and Search pages ======================

ProfilePath: C:\Users\Virginia\AppData\Roaming\Mozilla\Firefox\Profiles\um36m0cp.default-1434230614609
user_pref("browser.startup.homepage", "http://www.virginmedia.com/");

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"{C1A2A613-35F1-4FCF-B27F-2840527B6556}"="C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NSBU_22.5.4.24\coFFAddon" [13/01/2016 03:06 PM]
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"{C1A2A613-35F1-4FCF-B27F-2840527B6556}"="C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NSBU_22.5.4.24\coFFAddon" [13/01/2016 03:06 PM]

==== Firefox Extensions ======================

ProfilePath: C:\Users\Virginia\AppData\Roaming\Mozilla\Firefox\Profiles\um36m0cp.default-1434230614609
- Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
- Undetermined - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NSBU_22.5.0.120\coFFPlgn

==== Firefox Plugins ======================

==== Chromium Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
cjabmdjcfcfdmffimndhafhblfmpjdpe - C:\Program Files (x86)\Norton Security with Backup\Engine\22.5.5.15\Exts\Chrome.crx[05/11/2015 09:30 PM]
hkhkiakolggnnicallabhkobalpeplpi - No path found[]
iikflkcanblccfahdhdonehdalibjnif - No path found[]

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.virginmedia.com/"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.virginmedia.com/"

==== All HKLM and HKCU SearchScopes ======================

HKLM\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKLM\Wow6432Node\SearchScopes "DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
HKLM\Wow6432Node\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
HKCU\SearchScopes "DefaultScope"="{74F2211B-B651-45BF-8C08-5B2ECA876C6F}"
HKCU\SearchScopes\{012E1000-F331-11DB-8314-0800200C9A66} - http://www.google.com/search?q={searchTerms}
HKCU\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} - http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02
HKCU\SearchScopes\{74F2211B-B651-45BF-8C08-5B2ECA876C6F} - http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}

==== Empty IE Cache ======================

C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Default\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\Virginia\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\Virginia\AppData\Local\Microsoft\Windows\INetCache\Low\Content.IE5 emptied successfully
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\WINDOWS\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 emptied successfully
C:\Users\Default\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\Users\Default User\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\Users\Virginia\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\Users\Virginia\AppData\Local\Microsoft\Windows\INetCache\Low\IE emptied successfully
C:\WINDOWS\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully
C:\WINDOWS\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE emptied successfully

==== Empty FireFox Cache ======================

No FireFox Cache found

==== Empty Chrome Cache ======================

No Chrome User Data found

==== Empty All Flash Cache ======================

No Flash Cache Found

==== Empty All Java Cache ======================

No Java Cache Found

==== C:\zoek_backup content ======================

C:\zoek_backup (files=58452 folders=9007 15019166008 bytes)

==== Empty Temp Folders ======================

C:\WINDOWS\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\WINDOWS\Temp successfully emptied
C:\Users\Virginia\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on 13/01/2016 at 21:17:10.34 ======================

 

 

 

 

I have rebooted.

[TwinHeadedEagle]

Zoek somehow gone crazy and deleted some good files. Can you perform a System Restore named Zoek?

[Doctor9fan]

Yes I noticed it deleted some games of mine.

[Doctor9fan]

Should I run Zoek again after restore or await your reply saying what to do next?

[TwinHeadedEagle]

Don't run Zoek, just perform System Restore.

[Doctor9fan]

Tried twice but restore failed, am now trying restore in safe mode. If that fails will try another restore point.

[Doctor9fan]

Now restored via safe mode.

[TwinHeadedEagle]

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

• Right-click on icon and select Run as Administrator to start the tool.

  (XP users click run after receipt of Windows Security Warning - Open File).

• Make sure that Addition option is checked.
• Press Scan button and wait.
• The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content into your next reply.

[Doctor9fan]

I have rescanned with FRST & have included both files as attachments, defender still says it's enabled even though it is disabled by Norton.

 

 

FRST.txt

Addition.txt

[Doctor9fan]

Update:

Found that after another restart all the games which I thought had been restored with the system restore (originally checked & the folders & files had been returned) had disappeared as though removed, am downloading all the games again.

Laptop is running smoother so I think we can close this thread.

Thanks for the help TwinHeadedEagle.

[LDTate]

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.