Solved DOJ Malware Got me.

Pepse · 2013/01/12

[Resolved] DOJ Malware Got me.

I got this trojan/Malware a couple days ago on my tower, Win7 Ult. I did a Google search and there are ways to do it but I feel better dealing with it here. Since I have been here for a long time. Anyway what can I do to start removing this department of justice trojan? My tower has a Linux hard drive if it helps to go through Linux to the Win7 HDD to remove.

Thanks. Pepse.

Admin. · 2013/01/12

Hi,

Read this post as indicated at the top of this forum & follow the instructions.

Pepse · 2013/01/14

Well, Arie, I would comply with the normal way of dealing with this trojan but I can not do anything in my Win7 desktop except look at the department of justice trojan page. I even tried Safe Mode and I get the same desktop. If you have an idea as to how I can install Malware Bytes and anything else tell me.

The only things I can do is hit CTRL-ALT-DEL and shut it down in which case it has to be forced to shut down because of some issue with Adobe Reader.

I have heard that this trojan piggy backs on some Adobe software when updating. I do believe that because a day after this trojan hit my desktop I had a similar issue with my Win7 laptop after updating Adobe Air. But Avast was able to block it.

Pepse.

broni · 2013/01/14

Please, observe following rules:

Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.

If you're stuck, or you're not sure about certain step, always ask before doing anything else.

Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.

Never run more than one scan at a time.

Keep updating me regarding your computer behavior, good, or bad.

The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.

If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.

I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

=========================

For x32 (x86) bit systems download Farbar Recovery Scan Tool 32-Bit and save it to a flash drive.
For x64 bit systems download Farbar Recovery Scan Tool 64-Bit and save it to a flash drive.

Plug the flashdrive into the infected PC.

If you are using Windows 8 consult How to use the Windows 8 System Recovery Environment Command Prompt to enter System Recovery Command prompt.

If you are using Vista or Windows 7 enter System Recovery Options.

[color= "#0000FF"]To enter System Recovery Options from the Advanced Boot Options:[/color]

Restart the computer.

As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.

Use the arrow keys to select the Repair your computer menu item.

Select US as the keyboard language settings, and then click Next.

Select the operating system you want to repair, and then click Next.

Select your user account an click Next.

[color= "#0000FF"]To enter System Recovery Options by using Windows installation disc:[/color]

Insert the installation disc.

Restart your computer.

If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.

Click Repair your computer.

Select US as the keyboard language settings, and then click Next.

Select the operating system you want to repair, and then click Next.

Select your user account and click Next.

[color= "#008000"]On the System Recovery Options menu you will get the following options:[/color]

Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt

Select Command Prompt

In the command window type in notepad and press Enter.

The notepad opens. Under File menu select Open.

Select "Computer" and find your flash drive letter and close the notepad.

In the command window type [color= "#FF0000"]e[/color]:\frst (for x64 bit version type [color= "#FF0000"]e[/color]:\frst64) and press Enter
Note: Replace letter [color= "#FF0000"]e[/color] with the drive letter of your flash drive.

The tool will start to run.

When the tool opens click Yes to disclaimer.

Press Scan button.

It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

Next...

Re-run FRST again.
Type the following in the edit box after "Search: ".

services.exe

Click Search button and post the log (Search.txt) it makes in your reply.

I'll expect two logs:
- FRST.txt
- Search.txt

Pepse · 2013/01/15

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 15-01-2013
Ran by SYSTEM at 15-01-2013 10:36:36
Running from F:\
Windows 7 Ultimate (X86) OS Language: English(US)
The current controlset is ControlSet001

==================== Registry (Whitelisted) ===================

HKLM\...\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard)
HKLM\...\Run: [SiteRanker] "C:\Program Files\SiteRanker\SiteRankTray.exe" [320000 2011-09-12] (Crawler, LLC)
HKLM\...\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-10-11] (Apple Inc.)
HKLM\...\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard)
HKLM\...\Run: [] [x]
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [946352 2012-12-02] (Adobe Systems Incorporated)
HKLM\...\Run: [avast] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui [4273976 2012-07-03] (AVAST Software)
HKLM\...\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime [421888 2012-10-25] (Apple Inc.)
HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM\...\Run: [TkBellExe] "c:\program files\real\realplayer\Update\realsched.exe" -osboot [295072 2013-01-02] (RealNetworks, Inc.)
HKU\Jim Sekola\...\Run: [DriverFinder] C:\Program Files\DriverFinder\DriverFinder.exe [x]
HKU\Jim Sekola\...\Run: [Google Update] "C:\Users\Jim Sekola\AppData\Local\Google\Update\GoogleUpdate.exe" /c [136176 2011-09-12] (Google Inc.)
HKU\Jim Sekola\...\Run: [Akamai NetSession Interface] "C:\Users\Jim Sekola\AppData\Local\Akamai\netsession_win.exe" [4441920 2012-10-09] (Akamai Technologies, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Startup: C:\Users\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\Users\Jim Sekola\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Jim Sekola\Start Menu\Programs\Startup\runctf.lnk
ShortcutTarget: runctf.lnk -> C:\Windows\System32\rundll32.exe (Microsoft Corporation)

==================== Services (Whitelisted) ===================

2 AdobeActiveFileMonitor8.0; C:\Program Files\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [169312 2009-09-06] (Adobe Systems Incorporated)
3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
2 avast! Antivirus; "C:\Program Files\Alwil Software\Avast5\AvastSvc.exe" [44808 2012-07-03] (AVAST Software)
2 NAUpdate; "C:\Program Files\Nero\Update\NASvc.exe" [503080 2010-05-04] (Nero AG)
2 RealNetworks Downloader Resolver Service; "C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe" [38608 2012-11-29] ()
2 Winmgmt; C:\Users\JIMSEK~1\wgsdgsdgdsgsd.dll [189192 2013-01-09] (?????????? ??????????)

==================== Drivers (Whitelisted) ====================

1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [18544 2011-01-10] ()
2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [21256 2012-07-03] (AVAST Software)
2 aswMonFlt; \??\C:\Windows\system32\drivers\aswMonFlt.sys [57656 2012-07-03] (AVAST Software)
1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [44784 2012-07-03] (AVAST Software)
1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [721000 2012-07-03] (AVAST Software)
1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [353688 2012-07-03] (AVAST Software)
1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [54232 2012-07-03] (AVAST Software)
3 nmwcdnsu; C:\Windows\System32\drivers\nmwcdnsu.sys [137600 2010-12-02] (Nokia)
3 Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys [x]
3 tsusbhub; C:\Windows\System32\drivers\tsusbhub.sys [x]
3 VGPU; C:\Windows\System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-01-15 10:25 - 2013-01-15 10:25 - 00000000 ____D C:\FRST
2013-01-09 09:13 - 2013-01-13 22:42 - 95023320 ___AT C:\Users\All Users\dsgsdgdsgdsgw.pad
2013-01-09 09:13 - 2013-01-09 09:13 - 00189192 ____A (?????????? ??????????) C:\Users\Jim Sekola\wgsdgsdgdsgsd.dll
2013-01-09 09:13 - 2013-01-09 09:13 - 00002959 ____A C:\Users\All Users\dsgsdgdsgdsgw.js
2013-01-02 22:20 - 2013-01-02 22:20 - 00000000 ____D C:\Users\Jim Sekola\AppData\Roaming\RealNetworks
2013-01-02 21:46 - 2013-01-02 21:46 - 00201424 ____A (RealNetworks, Inc.) C:\Windows\System32\rmoc3260.dll
2013-01-02 21:46 - 2013-01-02 21:46 - 00006656 ____A (RealNetworks, Inc.) C:\Windows\System32\pndx5016.dll
2013-01-02 21:46 - 2013-01-02 21:46 - 00005632 ____A (RealNetworks, Inc.) C:\Windows\System32\pndx5032.dll
2013-01-02 21:46 - 2013-01-02 21:46 - 00001016 ____A C:\Users\Public\Desktop\RealPlayer.lnk
2013-01-02 21:46 - 2013-01-02 21:46 - 00000000 ____D C:\Users\All Users\RealNetworks
2013-01-02 21:46 - 2013-01-02 21:46 - 00000000 ____D C:\Program Files\RealNetworks
2013-01-02 21:46 - 2013-01-02 21:46 - 00000000 ____D C:\Program Files\Common Files\xing shared
2013-01-01 20:58 - 2013-01-01 20:58 - 00013490 ____A C:\Users\Jim Sekola\Documents\Labels1.odt
2013-01-01 20:19 - 2013-01-01 20:19 - 00000000 ____D C:\Users\Jim Sekola\AppData\Roaming\LibreOffice
2013-01-01 20:18 - 2013-01-01 20:18 - 00001070 ____A C:\Users\Public\Desktop\LibreOffice 3.6.lnk
2013-01-01 20:13 - 2013-01-01 19:55 - 214724608 ____A C:\Users\Jim Sekola\Documents\LibO_3.6.4_Win_x86_install_multi.msi
2013-01-01 20:13 - 2013-01-01 19:46 - 08548352 ____A C:\Users\Jim Sekola\Documents\LibO_3.6.4_Win_x86_helppack_en-US.msi
2013-01-01 20:12 - 2013-01-01 20:18 - 00000000 ____D C:\Program Files\LibreOffice 3.6
2013-01-01 19:45 - 2013-01-01 19:55 - 214724608 ____A C:\Users\Jim Sekola\Desktop\LibO_3.6.4_Win_x86_install_multi.msi
2012-12-25 23:50 - 2012-12-25 23:51 - 00000000 ____D C:\Users\Jim Sekola\Desktop\HD_Audio
2012-12-25 23:36 - 2012-12-25 23:42 - 124038686 ____A C:\Users\Jim Sekola\Desktop\mb_driver_audio_realtek_azalia.exe
2012-12-21 11:33 - 2012-12-16 06:13 - 00295424 ____A (Adobe Systems Incorporated) C:\Windows\System32\atmfd.dll
2012-12-21 11:33 - 2012-12-16 06:13 - 00034304 ____A (Adobe Systems) C:\Windows\System32\atmlib.dll

==================== One Month Modified Files and Folders ========

2013-01-15 10:25 - 2013-01-15 10:25 - 00000000 ____D C:\FRST
2013-01-13 22:42 - 2013-01-09 09:13 - 95023320 ___AT C:\Users\All Users\dsgsdgdsgdsgw.pad
2013-01-13 22:38 - 2011-10-31 10:33 - 00000000 ____D C:\Users\All Users\NVIDIA
2013-01-13 22:38 - 2011-06-15 09:32 - 00000000 ____D C:\Program Files\SiteRanker
2013-01-13 22:38 - 2011-01-23 09:49 - 00000890 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-01-13 22:38 - 2009-07-13 20:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-01-13 22:38 - 2009-07-13 20:39 - 00084047 ____A C:\Windows\setupact.log
2013-01-12 09:28 - 2011-01-18 12:19 - 01492022 ____A C:\Windows\WindowsUpdate.log
2013-01-12 09:28 - 2009-07-13 20:34 - 00017440 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-01-12 09:28 - 2009-07-13 20:34 - 00017440 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-01-09 22:01 - 2011-10-15 21:03 - 00000928 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3766567189-2379603247-3129890486-1001UA.job
2013-01-09 21:54 - 2012-04-13 00:40 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-01-09 21:41 - 2011-01-23 09:49 - 00000894 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-01-09 21:34 - 2012-11-27 23:40 - 00000348 ____A C:\Windows\Tasks\HP Photo Creations Communicator.job
2013-01-09 09:13 - 2013-01-09 09:13 - 00189192 ____A (?????????? ??????????) C:\Users\Jim Sekola\wgsdgsdgdsgsd.dll
2013-01-09 09:13 - 2013-01-09 09:13 - 00002959 ____A C:\Users\All Users\dsgsdgdsgdsgw.js
2013-01-09 09:13 - 2011-01-18 10:34 - 00000000 ____D C:\users\Jim Sekola
2013-01-09 08:53 - 2012-04-13 00:40 - 00697864 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-01-09 08:53 - 2011-05-13 00:55 - 00074248 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-01-08 23:01 - 2011-10-15 21:03 - 00000876 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3766567189-2379603247-3129890486-1001Core.job
2013-01-02 22:20 - 2013-01-02 22:20 - 00000000 ____D C:\Users\Jim Sekola\AppData\Roaming\RealNetworks
2013-01-02 21:47 - 2011-03-11 09:23 - 00000000 ____D C:\Users\Jim Sekola\AppData\Roaming\Real
2013-01-02 21:46 - 2013-01-02 21:46 - 00201424 ____A (RealNetworks, Inc.) C:\Windows\System32\rmoc3260.dll
2013-01-02 21:46 - 2013-01-02 21:46 - 00006656 ____A (RealNetworks, Inc.) C:\Windows\System32\pndx5016.dll
2013-01-02 21:46 - 2013-01-02 21:46 - 00005632 ____A (RealNetworks, Inc.) C:\Windows\System32\pndx5032.dll
2013-01-02 21:46 - 2013-01-02 21:46 - 00001016 ____A C:\Users\Public\Desktop\RealPlayer.lnk
2013-01-02 21:46 - 2013-01-02 21:46 - 00000000 ____D C:\Users\All Users\RealNetworks
2013-01-02 21:46 - 2013-01-02 21:46 - 00000000 ____D C:\Program Files\RealNetworks
2013-01-02 21:46 - 2013-01-02 21:46 - 00000000 ____D C:\Program Files\Common Files\xing shared
2013-01-02 21:46 - 2011-03-11 09:23 - 00272896 ____A (Progressive Networks) C:\Windows\System32\pncrt.dll
2013-01-02 21:46 - 2011-03-11 09:23 - 00000000 ____D C:\Users\All Users\Real
2013-01-02 21:46 - 2011-03-11 09:23 - 00000000 ____D C:\Program Files\Real
2013-01-02 21:46 - 2009-05-21 18:21 - 00499712 ____A (Microsoft Corporation) C:\Windows\System32\msvcp71.dll
2013-01-02 21:46 - 2009-05-21 16:57 - 00348160 ____A (Microsoft Corporation) C:\Windows\System32\msvcr71.dll
2013-01-01 22:37 - 2009-07-13 20:33 - 00330280 ____A C:\Windows\System32\FNTCACHE.DAT
2013-01-01 21:01 - 2011-01-19 23:54 - 00068904 ____A C:\Users\Jim Sekola\AppData\Local\GDIPFONTCACHEV1.DAT
2013-01-01 20:58 - 2013-01-01 20:58 - 00013490 ____A C:\Users\Jim Sekola\Documents\Labels1.odt
2013-01-01 20:19 - 2013-01-01 20:19 - 00000000 ____D C:\Users\Jim Sekola\AppData\Roaming\LibreOffice
2013-01-01 20:18 - 2013-01-01 20:18 - 00001070 ____A C:\Users\Public\Desktop\LibreOffice 3.6.lnk
2013-01-01 20:18 - 2013-01-01 20:12 - 00000000 ____D C:\Program Files\LibreOffice 3.6
2013-01-01 20:18 - 2009-07-13 23:49 - 00000000 ____D C:\Windows\ShellNew
2013-01-01 19:55 - 2013-01-01 20:13 - 214724608 ____A C:\Users\Jim Sekola\Documents\LibO_3.6.4_Win_x86_install_multi.msi
2013-01-01 19:55 - 2013-01-01 19:45 - 214724608 ____A C:\Users\Jim Sekola\Desktop\LibO_3.6.4_Win_x86_install_multi.msi
2013-01-01 19:46 - 2013-01-01 20:13 - 08548352 ____A C:\Users\Jim Sekola\Documents\LibO_3.6.4_Win_x86_helppack_en-US.msi
2012-12-25 23:51 - 2012-12-25 23:50 - 00000000 ____D C:\Users\Jim Sekola\Desktop\HD_Audio
2012-12-25 23:42 - 2012-12-25 23:36 - 124038686 ____A C:\Users\Jim Sekola\Desktop\mb_driver_audio_realtek_azalia.exe
2012-12-23 09:11 - 2011-02-02 07:41 - 00014268 ____A C:\Windows\PFRO.log
2012-12-23 09:10 - 2011-10-16 20:33 - 00000000 ____D C:\Program Files\Yontoo Layers Runtime
2012-12-17 08:38 - 2012-11-27 23:44 - 00000000 ___RD C:\Users\Jim Sekola\Documents\HP Photo Creations
2012-12-17 08:38 - 2012-11-27 11:47 - 00000000 ____D C:\Users\All Users\HP Photo Creations
2012-12-16 08:22 - 2012-05-05 10:41 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2012-12-16 06:13 - 2012-12-21 11:33 - 00295424 ____A (Adobe Systems Incorporated) C:\Windows\System32\atmfd.dll
2012-12-16 06:13 - 2012-12-21 11:33 - 00034304 ____A (Adobe Systems) C:\Windows\System32\atmlib.dll

==================== Known DLLs (Whitelisted) =================

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

Restore point made on: 2012-12-21 08:13:58
Restore point made on: 2012-12-21 11:32:58
Restore point made on: 2012-12-23 17:00:20
Restore point made on: 2012-12-25 19:20:03
Restore point made on: 2012-12-30 17:00:29
Restore point made on: 2013-01-01 18:50:56
Restore point made on: 2013-01-01 19:59:23
Restore point made on: 2013-01-01 20:12:41
Restore point made on: 2013-01-01 20:16:54
Restore point made on: 2013-01-04 21:44:38
Restore point made on: 2013-01-06 19:12:12
Restore point made on: 2013-01-09 09:28:31

==================== Memory info ===========================

Percentage of memory in use: 11%
Total physical RAM: 4094.49 MB
Available physical RAM: 3610.64 MB
Total Pagefile: 4092.77 MB
Available Pagefile: 3618.23 MB
Total Virtual: 2047.88 MB
Available Virtual: 1957.62 MB

==================== Partitions =============================

2 Drive c: () (Fixed) (Total:465.75 GB) (Free:345.06 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
5 Drive f: (KINGSTON) (Removable) (Total:1.87 GB) (Free:1.86 GB) FAT
6 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 149 GB 0 B
Disk 1 Online 465 GB 7168 KB
Disk 2 Online 1911 MB 0 B

Partitions of Disk 0:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 142 GB 1024 KB
Partition 0 Extended 6235 MB 142 GB
Partition 2 Logical 6235 MB 142 GB

=========================================================

Disk: 0
Partition 1
Type : 83
Hidden: Yes
Active: Yes

There is no volume associated with this partition.

=========================================================

Disk: 0
Partition 2
Type : 82
Hidden: Yes
Active: No

There is no volume associated with this partition.

=========================================================

Partitions of Disk 1:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 465 GB 31 KB

=========================================================

Disk: 1
Partition 1
Type : 07
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 C NTFS Partition 465 GB Healthy

=========================================================

Partitions of Disk 2:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Primary 1910 MB 64 KB

=========================================================

Disk: 2
Partition 1
Type : 06
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 F KINGSTON FAT Removable 1910 MB Healthy

=========================================================

Last Boot: 2013-01-04 09:29

==================== End Of Log ============================

broni · 2013/01/15

Download attached fixlist.txt file and save it to the very same USB flash drive you've been using. Plug the drive back in.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options.
On Windows XP: Now please boot into the UBCD.
Run [color= "#0000FF"]FRST/FRST64[/color] and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

See if you can start computer normally.

Pepse · 2013/01/15

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 15-01-2013
Ran by SYSTEM at 2013-01-15 13:33:15 Run:1
Running from F:\

==============================================

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ Default Value restored successfully.
C:\Users\Jim Sekola\Start Menu\Programs\Startup\runctf.lnk moved successfully.
C:\Users\All Users\dsgsdgdsgdsgw.pad moved successfully.
C:\Users\Jim Sekola\wgsdgsdgdsgsd.dll moved successfully.
C:\Users\All Users\dsgsdgdsgdsgw.js moved successfully.

==== End of Fixlog ====

Pepse · 2013/01/15

Well, it loaded up okay and after about 3 minutes no trojans or anything. But it is really slow going on the internet. I have to go to work but will check it out in about 9 hours.

Pepse.

broni · 2013/01/15

That's good.

Now...

Please, complete all steps listed HERE

Pepse · 2013/01/16

Malwarebytes Anti-Malware 1.70.0.1100
www.malwarebytes.org

Database version: v2013.01.16.05

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 8.0.7601.17514
Jim Sekola :: JIMSEKOLA-PC [administrator]

1/16/2013 10:48:54 AM
mbam-log-2013-01-16 (10-48-54).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 236544
Time elapsed: 7 minute(s), 23 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

Pepse · 2013/01/16

aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2013-01-16 12:42:07
-----------------------------
12:42:07.563 OS Version: Windows 6.1.7601 Service Pack 1
12:42:07.563 Number of processors: 2 586 0x170A
12:42:07.563 ComputerName: JIMSEKOLA-PC UserName: Jim Sekola
12:42:09.043 Initialize success
12:42:13.839 AVAST engine defs: 13011600
12:42:24.837 Disk 0 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2
12:42:24.837 Disk 0 Vendor: ST3160215SCE 3.ACF Size: 152627MB BusType: 3
12:42:24.868 Disk 1 (boot) \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP2T1L0-4
12:42:24.868 Disk 1 Vendor: WDC_WD5000AAKS-75YGA0 12.01C02 Size: 476938MB BusType: 3
12:42:24.915 Disk 1 MBR read successfully
12:42:24.915 Disk 1 MBR scan
12:42:24.915 Disk 1 Windows 7 default MBR code
12:42:24.930 Disk 1 Partition 1 80 (A) 07 HPFS/NTFS NTFS 476929 MB offset 63
12:42:24.977 Disk 1 scanning sectors +976752000
12:42:25.039 Disk 1 scanning C:\Windows\system32\drivers
12:42:35.018 Service scanning
12:42:49.984 Modules scanning
12:43:02.875 Disk 1 trace - called modules:
12:43:02.890 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll ataport.SYS pciide.sys PCIIDEX.SYS atapi.sys
12:43:02.890 1 nt!IofCallDriver -> \Device\Harddisk1\DR1[0x8675b950]
12:43:02.906 3 CLASSPNP.SYS[8c48159e] -> nt!IofCallDriver -> [0x862dd918]
12:43:02.921 5 ACPI.sys[8bcbc3d4] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T1L0-4[0x86683908]
12:43:03.826 AVAST engine scan C:\Windows
12:43:06.041 AVAST engine scan C:\Windows\system32
12:44:52.192 AVAST engine scan C:\Windows\system32\drivers
12:45:03.916 AVAST engine scan C:\Users\Jim Sekola
12:55:21.783 Disk 1 MBR has been saved successfully to "C:\Users\Jim Sekola\Desktop\MBR.dat "
12:55:21.799 The log file has been saved successfully to "C:\Users\Jim Sekola\Desktop\aswMBR.txt "

Pepse · 2013/01/16

.
==== Installed Programs ======================
.
1600
1600_Help
1600Trb
32 Bit HP CIO Components Installer
Acrobat.com
Adobe AIR
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Photoshop Elements 8.0
Adobe Photoshop.com Inspiration Browser
Adobe Reader X (10.1.5)
AIO_CDB_ProductContext
AIO_CDB_Software
AIO_Scan
Akamai NetSession Interface
Apple Application Support
Apple Software Update
avast! Free Antivirus
BearShare
BufferChm
Cisco Connect
Copy
Coupon Printer for Windows
Crawler Wallpaper
Destinations
DeviceDiscovery
DJ_AIO_06_F2400_SW_Min
DocProc
F2400
Fax
Google Chrome
Google Earth
Google Update Helper
GPBaseService2
Hewlett-Packard ACLM.NET v1.1.0.0
HP Customer Participation Program 14.0
HP Deskjet F2400 All-in-One Driver Software 14.0 Rel. 6
HP Imaging Device Functions 14.0
HP Photo Creations
HP Photosmart Essential 3.5
HP Photosmart Officejet and Deskjet All-In-One Driver Software 13.0 Rel. B
HP Product Detection
HP Smart Web Printing 4.60
HP Solution Center 14.0
HP Update
HPDiagnosticAlert
HPPhotoSmartDiscLabelContent1
HPPhotosmartEssential
HPProductAssistant
HPSSupply
Java 7 Update 11
Java Auto Updater
Java(TM) 6 Update 22
Java(TM) 6 Update 35
LibreOffice 3.6
LibreOffice 3.6 Help Pack (English)
LizardTech DjVu Control (autoinstall)
Malwarebytes Anti-Malware version 1.70.0.1100
MarketResearch
Masque IGT Slots Lucky Larry's Lobstermania
Masque IGT Slots Wolf Run
Microsoft .NET Framework 4 Client Profile
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Mozilla Firefox 17.0.1 (x86 en-US)
Mozilla Maintenance Service
Mozilla Thunderbird 17.0.2 (x86 en-US)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
NEC DISPLAY SOLUTIONS: Monitor Installer
Nero BurnLite 10
Nero Control Center 10
Nero ControlCenter 10 Help (CHM)
Nero Core Components 10
Nero Update
Network
NVIDIA 3D Vision Controller Driver 306.23
NVIDIA 3D Vision Driver 306.97
NVIDIA Control Panel 306.97
NVIDIA Graphics Driver 306.97
NVIDIA HD Audio Driver 1.3.18.0
NVIDIA Install Application
NVIDIA PhysX
NVIDIA PhysX System Software 9.12.0604
NVIDIA Stereoscopic 3D Driver
NVIDIA Update 1.10.8
NVIDIA Update Components
OCR Software by I.R.I.S. 13.0
ON_OFF Charge B11.0110.1
OpenOffice.org 3.3
Oracle VM VirtualBox 4.1.2
Pidgin
PowerManga (Uninstall)
QuickTime
RealDownloader
RealNetworks - Microsoft Visual C++ 2008 Runtime
RealNetworks - Microsoft Visual C++ 2010 Runtime
RealPlayer
RealUpgrade 1.1
Scan
SeaMonkey (2.2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Shop for HP Supplies
SiteRanker
SmartWebPrinting
SolutionCenter
Status
System Requirements Lab
The KMPlayer (remove only)
Toolbox
TrayApp
UnloadSupport
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
WebReg
WMS Slots Reel 'em In
Yontoo Layers Runtime 1.10.01
.
==== End Of File ===========================

Pepse · 2013/01/16

DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 10.11.2
Run by Jim Sekola at 12:57:10 on 2013-01-16
.
============== Running Processes ================
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\nvvsvc.exe
C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
C:\Program Files\SiteRanker\SiteRankTray.exe
C:\Program Files\HP\HP Software Update\hpwuschd2.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Real\RealPlayer\Update\realsched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\SearchIndexer.exe
C:\Users\Jim Sekola\AppData\Local\Akamai\netsession_win.exe
C:\Users\Jim Sekola\AppData\Local\Akamai\netsession_win.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\Nero\Update\NASvc.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_5_502_146.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_5_502_146.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k hpdevmgmt
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\svchost.exe -k HPService
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Windows\System32\svchost.exe -k secsvcs
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uProxyOverride = <local>
BHO: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: <No Name>: {11BF46C6-B3DE-48BD-BF70-3AD85CAB80B5} - c:\program files\siteranker\SiteRank.dll
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealNetworks Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\programdata\realnetworks\realdownloader\browserplugins\ie\rndlbrowserrecordplugin.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\alwil software\avast5\aswWebRepIE.dll
BHO: MediaBar: {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} -
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
BHO: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: MediaBar: {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} -
TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - c:\program files\alwil software\avast5\aswWebRepIE.dll
EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [DriverFinder] c:\program files\driverfinder\DriverFinder.exe
uRun: [Google Update] "c:\users\jim sekola\appdata\local\google\update\GoogleUpdate.exe" /c
uRun: [Akamai NetSession Interface] "c:\users\jim sekola\appdata\local\akamai\netsession_win.exe "
mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe
mRun: [SiteRanker] "c:\program files\siteranker\SiteRankTray.exe "
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe "
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
mRun: [avast] "c:\program files\alwil software\avast5\avastUI.exe" /nogui
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe "
mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot
mRunOnce: [Malwarebytes Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} - hxxp://biz.lgservice.com/DjvuViewer/DjVuControl-6.1.4.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
TCP: NameServer = 192.168.1.1
TCP: Interfaces\{91F2DB31-4D27-476E-963A-F3A8B06DDA0D} : DHCPNameServer = 192.168.1.1
SSODL: WebCheck - <orphaned>
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\jim sekola\appdata\roaming\mozilla\firefox\profiles\8o0odotb.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - google.com
FF - prefs.js: keyword.URL - chrome://browser-region/locale/region.properties
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpClipBook.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpClipBookDB.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpNeoLogger.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpSaturn.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpSeymour.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpSmartSelect.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpSmartWebPrinting.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpSWPOperation.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpXPLogging.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpXPMTC.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpXPMTL.dll
FF - component: c:\program files\hp\digital imaging\smart web printing\mozillaaddon3\components\hpXREStub.dll
FF - component: c:\program files\siteranker\firefox\components\siterank.dll
FF - component: c:\programdata\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrowserrecordext.dll
FF - component: c:\programdata\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrowserrecordlegacyext.dll
FF - component: c:\users\jim sekola\appdata\roaming\mozilla\firefox\profiles\8o0odotb.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCoreGecko19.dll
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.3.21.123\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\4.1.10329.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npMozCouponPrinter.dll
FF - plugin: c:\program files\mozilla firefox\plugins\nprpplugin.dll
FF - plugin: c:\program files\nvidia corporation\3d vision\npnv3dv.dll
FF - plugin: c:\program files\nvidia corporation\3d vision\npnv3dvstreaming.dll
FF - plugin: c:\program files\real\realplayer\netscape6\nprpplugin.dll
FF - plugin: c:\programdata\realnetworks\realdownloader\browserplugins\mozillaplugins\nprndlchromebrowserrecordext.dll
FF - plugin: c:\programdata\realnetworks\realdownloader\browserplugins\mozillaplugins\nprndlhtml5videoshim.dll
FF - plugin: c:\programdata\realnetworks\realdownloader\browserplugins\mozillaplugins\nprndlpepperflashvideoshim.dll
FF - plugin: c:\programdata\realnetworks\realdownloader\browserplugins\npdlplugin.dll
FF - plugin: c:\programdata\visan\plugins\npRLSecurePluginLayer.dll
FF - plugin: c:\users\jim sekola\appdata\local\google\update\1.3.21.123\npGoogleUpdate3.dll
FF - plugin: c:\users\jim sekola\appdata\roaming\mozilla\firefox\profiles\8o0odotb.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\plugins\np-mswmp.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_5_502_146.dll
FF - ExtSQL: 2013-01-02 23:46; {34712C68-7391-4c47-94F3-8F88D49AD632}; c:\programdata\realnetworks\realdownloader\browserplugins\firefox\Ext
FF - ExtSQL: !HIDDEN! 2011-02-08 12:07; smartwebprinting@hp.com; c:\program files\hp\digital imaging\smart web printing\MozillaAddOn3
.
---- FIREFOX POLICIES ----
FF - user.js: extentions.y2layers.installId - 6ca1c28a-1b8b-43f7-bed1-53a8464b9fc3
FF - user.js: extentions.y2layers.defaultEnableAppsList - Buzzdock,BuzzdockTease,DropDownDeals,BestVideoDownloader,BestVideoDownloader,
.
============= SERVICES / DRIVERS ===============
.
R? AppleChargerSrv;AppleChargerSrv
R? b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0
R? clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86
R? nmwcdnsu;Nokia USB Flashing Phone Parent
R? RdpVideoMiniport;Remote Desktop Video Miniport Driver
R? Synth3dVsc;Synth3dVsc
R? TsUsbFlt;TsUsbFlt
R? tsusbhub;tsusbhub
R? VGPU;VGPU
R? WatAdminSvc;Windows Activation Technologies Service
S? AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8
S? AppleCharger;AppleCharger
S? aswFsBlk;aswFsBlk
S? aswMonFlt;aswMonFlt
S? aswSnx;aswSnx
S? aswSP;aswSP
S? avast! Antivirus;avast! Antivirus
S? NAUpdate;Nero Update
S? RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service
S? RTL8167;Realtek 8167 NT Driver
S? Stereo Service;NVIDIA Stereoscopic 3D Driver Service
.
=============== Created Last 30 ================
.
2013-01-16 17:23:50 60872 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{d6a6046e-2f7f-4c6d-b10c-ba7dced86cea}\offreg.dll
2013-01-16 16:47:08 21104 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-01-16 16:47:08 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-01-16 08:29:23 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-01-16 08:12:19 6812136 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{d6a6046e-2f7f-4c6d-b10c-ba7dced86cea}\mpengine.dll
2013-01-15 18:25:43 -------- d-----w- C:\FRST
2013-01-09 17:42:13 492032 ----a-w- c:\windows\system32\win32spl.dll
2013-01-09 17:42:11 626688 ----a-w- c:\windows\system32\usp10.dll
2013-01-09 17:42:09 2345984 ----a-w- c:\windows\system32\win32k.sys
2013-01-09 17:38:45 46592 ----a-w- c:\windows\system32\fpb.rs
2013-01-09 17:37:31 220160 ----a-w- c:\windows\system32\ncrypt.dll
2013-01-09 17:37:30 49152 ----a-w- c:\windows\system32\taskhost.exe
2013-01-03 06:20:11 -------- d-----w- c:\users\jim sekola\appdata\roaming\RealNetworks
2013-01-03 05:46:52 -------- d-----w- c:\program files\RealNetworks
2013-01-03 05:46:50 -------- d-----w- c:\programdata\RealNetworks
2013-01-03 05:46:37 -------- d-----w- c:\program files\common files\xing shared
2013-01-03 05:46:31 153296 ----a-w- c:\program files\mozilla firefox\plugins\nppl3260.dll
2013-01-03 05:46:26 124056 ----a-w- c:\program files\mozilla firefox\plugins\nprpplugin.dll
2013-01-02 04:19:22 -------- d-----w- c:\users\jim sekola\appdata\roaming\LibreOffice
2013-01-02 04:12:49 -------- d-----w- c:\program files\LibreOffice 3.6
2012-12-28 19:31:27 -------- d-----w- c:\users\jim sekola\appdata\local\Programs
2012-12-21 19:33:08 295424 ----a-w- c:\windows\system32\atmfd.dll
2012-12-21 19:33:07 34304 ----a-w- c:\windows\system32\atmlib.dll
2012-12-18 14:28:14 186584 ----a-w- c:\program files\mozilla firefox\plugins\nppdf32.dll
2012-12-18 14:28:14 186584 ----a-w- c:\program files\internet explorer\plugins\nppdf32.dll
.
==================== Find3M ====================
.
2013-01-09 16:53:29 74248 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-01-09 16:53:29 697864 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-01-03 05:46:18 499712 ----a-w- c:\windows\system32\msvcp71.dll
2013-01-03 05:46:18 348160 ----a-w- c:\windows\system32\msvcr71.dll
2012-12-07 12:26:17 308736 ----a-w- c:\windows\system32\Wpc.dll
2012-12-07 12:20:43 2576384 ----a-w- c:\windows\system32\gameux.dll
2012-11-30 04:53:34 169984 ----a-w- c:\windows\system32\winsrv.dll
2012-11-30 04:47:45 293376 ----a-w- c:\windows\system32\KernelBase.dll
2012-11-30 02:55:25 271360 ----a-w- c:\windows\system32\conhost.exe
2012-11-30 02:38:59 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2012-11-30 02:38:59 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2012-11-30 02:38:59 3584 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2012-11-30 02:38:59 3072 ---ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2012-11-13 05:37:34 821736 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-11-13 05:37:34 746984 ----a-w- c:\windows\system32\deployJava1.dll
2012-11-12 11:52:18 1638912 ----a-w- c:\windows\system32\mshtml.tlb
2012-11-09 04:42:49 2048 ----a-w- c:\windows\system32\tzres.dll
2012-11-02 05:11:31 376832 ----a-w- c:\windows\system32\dpnet.dll
2012-11-01 04:47:54 1389568 ----a-w- c:\windows\system32\msxml6.dll
2012-10-27 06:26:55 981504 ----a-w- c:\windows\system32\wininet.dll
2012-10-25 09:12:26 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2012-10-25 09:12:26 69632 ----a-w- c:\windows\system32\QuickTime.qts
.
============= FINISH: 12:58:01.65 ===============

Pepse · 2013/01/16

Sorry I didn't read everything first then post. I did things as I was going step by step.

Pepse.

broni · 2013/01/16

Download RogueKiller on the desktop

Close all the running programs

Windows Vista/7 users: right click on RogueKiller.exe, click Run as Administrator

Otherwise just double-click on RogueKiller.exe

Pre-scan will start. Let it finish.

Click on SCAN button.

Wait until the Status box shows Scan Finished

Click on Delete.

Wait until the Status box shows Deleting Finished.

Click on Report and copy/paste the content of the Notepad into your next reply.

RKreport.txt could also be found on your desktop.

If more than one log is produced post all logs.

If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again

==========================

Download Malwarebytes Anti-Rootkit (MBAR) from HERE

Unzip downloaded file.

Open the folder where the contents were unzipped and run mbar.exe

Follow the instructions in the wizard to update and allow the program to scan your computer for threats.

Click on the Cleanup button to remove any threats and reboot if prompted to do so.

Wait while the system shuts down and the cleanup process is performed.

Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.

When done, please post the two logs produced they will be in the MBAR folder..... mbar-log-xxxxx.txt and system-log.txt

Pepse · 2013/01/17

RogueKiller V8.4.3 [Jan 10 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Normal mode
User : Jim Sekola [Admin rights]
Mode : Scan -- Date : 01/17/2013 00:25:53

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 4 ¤¤¤
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ DLL][Rans.Gendarm] HKLM\[...]\ControlSet001\Services\winmgmt\Parameters : ServiceDll (C:\Users\JIMSEK~1\wgsdgsdgdsgsd.dll) -> FOUND
[HJ DLL][Rans.Gendarm] HKLM\[...]\ControlSet002\Services\winmgmt\Parameters : ServiceDll (C:\Users\JIMSEK~1\wgsdgsdgdsgsd.dll) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ Infection : Rans.Gendarm ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: +++++
--- User ---
[MBR] fd2920b75a11f4f543aeb5bd045c2216
[BSP] 095a755ee88dbdf7b77c808d708dfb85 : Linux MBR Code
Partition table:
0 - [ACTIVE] LINUX (0x83) [VISIBLE] Offset (sectors): 2048 | Size: 146390 Mo
1 - [XXXXXX] EXTEN (0x05) [VISIBLE] Offset (sectors): 299810814 | Size: 6235 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: +++++
--- User ---
[MBR] 9383f59d773f32a48c04eadec74f778c
[BSP] 8389c8979cea352e467007ab7bf33b8a : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 476929 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[1]_S_01172013_02d0025.txt >>
RKreport[1]_S_01172013_02d0025.txt

Pepse · 2013/01/17

RogueKiller V8.4.3 [Jan 10 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
Started in : Normal mode
User : Jim Sekola [Admin rights]
Mode : Remove -- Date : 01/17/2013 00:39:21

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 4 ¤¤¤
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
[HJ DLL][Rans.Gendarm] HKLM\[...]\ControlSet001\Services\winmgmt\Parameters : ServiceDll (C:\Users\JIMSEK~1\wgsdgsdgdsgsd.dll) -> REPLACED (%SystemRoot%\system32\wbem\WMIsvc.dll)
[HJ DLL][Rans.Gendarm] HKLM\[...]\ControlSet002\Services\winmgmt\Parameters : ServiceDll (C:\Users\JIMSEK~1\wgsdgsdgdsgsd.dll) -> REPLACED (%SystemRoot%\system32\wbem\WMIsvc.dll)

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ Infection : Rans.Gendarm ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: +++++
--- User ---
[MBR] fd2920b75a11f4f543aeb5bd045c2216
[BSP] 095a755ee88dbdf7b77c808d708dfb85 : Linux MBR Code
Partition table:
0 - [ACTIVE] LINUX (0x83) [VISIBLE] Offset (sectors): 2048 | Size: 146390 Mo
1 - [XXXXXX] EXTEN (0x05) [VISIBLE] Offset (sectors): 299810814 | Size: 6235 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: +++++
--- User ---
[MBR] 9383f59d773f32a48c04eadec74f778c
[BSP] 8389c8979cea352e467007ab7bf33b8a : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 476929 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[2]_D_01172013_02d0039.txt >>
RKreport[1]_S_01172013_02d0025.txt ; RKreport[2]_D_01172013_02d0039.txt

Pepse · 2013/01/17

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.01.0.1016

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x86

Account is Administrative

Internet Explorer version: 8.0.7601.17514

Java version: 1.6.0_35

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED
CPU speed: 2.999000 GHz
Memory total: 3488079872, free: 2141384704

------------ Kernel report ------------
01/17/2013 00:58:19
------------ Loaded modules -----------
\SystemRoot\system32\ntkrnlpa.exe
\SystemRoot\system32\halmacpi.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\drivers\pciide.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\vmbus.sys
\SystemRoot\system32\drivers\winhv.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\PxHelp20.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\drivers\vmstorfl.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\DRIVERS\disk.sys
\SystemRoot\system32\DRIVERS\CLASSPNP.SYS
\SystemRoot\system32\drivers\cdrom.sys
\SystemRoot\System32\Drivers\aswSnx.SYS
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\System32\Drivers\aswTdi.SYS
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\Drivers\aswrdr2.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\serial.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\VBoxUSBMon.sys
\SystemRoot\system32\DRIVERS\VBoxDrv.sys
\SystemRoot\system32\drivers\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\drivers\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\system32\drivers\csc.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\System32\Drivers\aswSP.SYS
\SystemRoot\system32\DRIVERS\AppleCharger.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\nvlddmkm.sys
\SystemRoot\System32\Drivers\nvBridge.kmd
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\drivers\HDAudBus.sys
\SystemRoot\system32\DRIVERS\usbuhci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\Rt86win7.sys
\SystemRoot\system32\DRIVERS\fdc.sys
\SystemRoot\system32\DRIVERS\serenum.sys
\SystemRoot\system32\DRIVERS\parport.sys
\SystemRoot\system32\drivers\i8042prt.sys
\SystemRoot\system32\drivers\kbdclass.sys
\SystemRoot\system32\drivers\CompositeBus.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\VBoxNetAdp.sys
\SystemRoot\system32\DRIVERS\rdpbus.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\VBoxNetFlt.sys
\SystemRoot\system32\drivers\swenum.sys
\SystemRoot\system32\drivers\ks.sys
\SystemRoot\system32\drivers\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\system32\DRIVERS\flpydisk.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\nvhda32v.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\HdAudio.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_dumpata.sys
\SystemRoot\System32\Drivers\dump_atapi.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\system32\DRIVERS\usbscan.sys
\SystemRoot\system32\DRIVERS\usbprint.sys
\SystemRoot\system32\DRIVERS\dot4usb.sys
\SystemRoot\system32\DRIVERS\Dot4.sys
\SystemRoot\system32\DRIVERS\Dot4Prt.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\luafv.sys
\??\C:\Windows\system32\drivers\aswMonFlt.sys
\SystemRoot\System32\Drivers\aswFsBlk.SYS
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\DRIVERS\parvdm.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\asyncmac.sys
\??\C:\Windows\system32\drivers\TrueSight.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\mbamswissarmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
\Windows\System32\autochk.exe
\Windows\System32\rpcrt4.dll
\Windows\System32\gdi32.dll
\Windows\System32\usp10.dll
\Windows\System32\kernel32.dll
\Windows\System32\comdlg32.dll
\Windows\System32\oleaut32.dll
\Windows\System32\shlwapi.dll
\Windows\System32\nsi.dll
\Windows\System32\ws2_32.dll
\Windows\System32\iertutil.dll
\Windows\System32\advapi32.dll
\Windows\System32\wininet.dll
\Windows\System32\imm32.dll
\Windows\System32\urlmon.dll
\Windows\System32\sechost.dll
\Windows\System32\msvcrt.dll
\Windows\System32\imagehlp.dll
\Windows\System32\ole32.dll
\Windows\System32\difxapi.dll
\Windows\System32\clbcatq.dll
\Windows\System32\normaliz.dll
\Windows\System32\Wldap32.dll
\Windows\System32\setupapi.dll
\Windows\System32\shell32.dll
\Windows\System32\lpk.dll
\Windows\System32\msctf.dll
\Windows\System32\psapi.dll
\Windows\System32\user32.dll
\Windows\System32\cfgmgr32.dll
\Windows\System32\comctl32.dll
\Windows\System32\KernelBase.dll
\Windows\System32\devobj.dll
\Windows\System32\wintrust.dll
\Windows\System32\crypt32.dll
\Windows\System32\msasn1.dll
----------- End -----------
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR1
Upper Device Object: 0xffffffff8675b958
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP2T1L0-4\
Lower Device Object: 0xffffffff866873f0
Lower Device Driver Name: \Driver\atapi\
Driver name found: atapi
Initialization returned 0x0
Port sub-driver loaded: \??\C:\Windows\System32\drivers\ataport.sys (0x0)
Load Function returned 0x0
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffffff8675b030
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP2T0L0-2\
Lower Device Object: 0xffffffff8667f030
Lower Device Driver Name: \Driver\atapi\
Driver name found: atapi
Downloaded database version: v2013.01.17.03
Initializing...
Done!
<<<2>>>
Device number: 1, partition: 1
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xffffffff8675b958, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff8675b638, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff8675b958, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff86278918, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xffffffff866873f0, DeviceName: \Device\Ide\IdeDeviceP2T1L0-4\, DriverName: \Driver\atapi\
------------ End ----------
Upper DeviceData: 0xffffffff9c83c8a8, 0xffffffff8675b958, 0xffffffff862a4048
Lower DeviceData: 0xffffffffb2d7f078, 0xffffffff866873f0, 0xffffffff860137d0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning directory: C:\Windows\system32\drivers...
Done!
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff8675b030, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff8675a170, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff8675b030, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff86262918, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xffffffff8667f030, DeviceName: \Device\Ide\IdeDeviceP2T0L0-2\, DriverName: \Driver\atapi\
------------ End ----------
Upper DeviceData: 0xffffffffb4a2b4c0, 0xffffffff8675b030, 0xffffffff861af398
Lower DeviceData: 0xffffffffb6d9ea88, 0xffffffff8667f030, 0xffffffff86043f08
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 3B3F5

Partition information:

Partition 0 type is Other (0x83)
Partition is ACTIVE.
Partition starts at LBA: 2048 Numsec = 299806720
Partition is not bootable

Partition 1 type is Extended with CSH (0x5)
Partition is NOT ACTIVE.
Partition starts at LBA: 299810814 Numsec = 12769282

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 160041885696 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-312561808-312581808)...
Drive 1
Scanning MBR on drive 1...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 98AD98AD

Partition information:

Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 63 Numsec = 976751937
Partition file system is NTFS
Partition is bootable

Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 500106780160 bytes
Sector size: 512 bytes

Done!
Performing system, memory and registry scan...
Read File: File "c:\ProgramData\{8F6A59AE-835F-46B0-90B3-07ADBC8494F0}\BearShare_V10_en_Setup.dat" is compressed (flags = 1)
Read File: File "c:\ProgramData\{8F6A59AE-835F-46B0-90B3-07ADBC8494F0}\BearShare_V10_en_Setup.lnk" is compressed (flags = 1)
Read File: File "c:\ProgramData\{8F6A59AE-835F-46B0-90B3-07ADBC8494F0}\instance.dat" is compressed (flags = 1)
Read File: File "c:\ProgramData\{8F6A59AE-835F-46B0-90B3-07ADBC8494F0}\BearShare_V10_en_Setup.dat" is compressed (flags = 1)
Read File: File "c:\ProgramData\{8F6A59AE-835F-46B0-90B3-07ADBC8494F0}\BearShare_V10_en_Setup.lnk" is compressed (flags = 1)
Read File: File "c:\ProgramData\{8F6A59AE-835F-46B0-90B3-07ADBC8494F0}\instance.dat" is compressed (flags = 1)
Done!
Scan finished
=======================================

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.01.0.1016

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x86

Account is Administrative

Internet Explorer version: 8.0.7601.17514

Java version: 1.6.0_35

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED
CPU speed: 2.999000 GHz
Memory total: 3488079872, free: 2166599680

------------ Kernel report ------------
01/17/2013 01:17:45
------------ Loaded modules -----------
\SystemRoot\system32\ntkrnlpa.exe
\SystemRoot\system32\halmacpi.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\drivers\pciide.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\vmbus.sys
\SystemRoot\system32\drivers\winhv.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\PxHelp20.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\drivers\vmstorfl.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\DRIVERS\disk.sys
\SystemRoot\system32\DRIVERS\CLASSPNP.SYS
\SystemRoot\system32\drivers\cdrom.sys
\SystemRoot\System32\Drivers\aswSnx.SYS
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\System32\Drivers\aswTdi.SYS
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\Drivers\aswrdr2.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\serial.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\VBoxUSBMon.sys
\SystemRoot\system32\DRIVERS\VBoxDrv.sys
\SystemRoot\system32\drivers\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\drivers\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\system32\drivers\csc.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\System32\Drivers\aswSP.SYS
\SystemRoot\system32\DRIVERS\AppleCharger.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\nvlddmkm.sys
\SystemRoot\System32\Drivers\nvBridge.kmd
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\drivers\HDAudBus.sys
\SystemRoot\system32\DRIVERS\usbuhci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\Rt86win7.sys
\SystemRoot\system32\DRIVERS\fdc.sys
\SystemRoot\system32\DRIVERS\serenum.sys
\SystemRoot\system32\DRIVERS\parport.sys
\SystemRoot\system32\drivers\i8042prt.sys
\SystemRoot\system32\drivers\kbdclass.sys
\SystemRoot\system32\drivers\CompositeBus.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\VBoxNetAdp.sys
\SystemRoot\system32\DRIVERS\rdpbus.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\VBoxNetFlt.sys
\SystemRoot\system32\drivers\swenum.sys
\SystemRoot\system32\drivers\ks.sys
\SystemRoot\system32\drivers\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\system32\DRIVERS\flpydisk.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\nvhda32v.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\HdAudio.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_dumpata.sys
\SystemRoot\System32\Drivers\dump_atapi.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\system32\DRIVERS\usbscan.sys
\SystemRoot\system32\DRIVERS\usbprint.sys
\SystemRoot\system32\DRIVERS\dot4usb.sys
\SystemRoot\system32\DRIVERS\Dot4.sys
\SystemRoot\system32\DRIVERS\Dot4Prt.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\luafv.sys
\??\C:\Windows\system32\drivers\aswMonFlt.sys
\SystemRoot\System32\Drivers\aswFsBlk.SYS
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\DRIVERS\parvdm.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\asyncmac.sys
\??\C:\Windows\system32\drivers\TrueSight.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\mbamswissarmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
\Windows\System32\autochk.exe
\Windows\System32\rpcrt4.dll
\Windows\System32\gdi32.dll
\Windows\System32\usp10.dll
\Windows\System32\kernel32.dll
\Windows\System32\comdlg32.dll
\Windows\System32\oleaut32.dll
\Windows\System32\shlwapi.dll
\Windows\System32\nsi.dll
\Windows\System32\ws2_32.dll
\Windows\System32\iertutil.dll
\Windows\System32\advapi32.dll
\Windows\System32\wininet.dll
\Windows\System32\imm32.dll
\Windows\System32\urlmon.dll
\Windows\System32\sechost.dll
\Windows\System32\msvcrt.dll
\Windows\System32\imagehlp.dll
\Windows\System32\ole32.dll
\Windows\System32\difxapi.dll
\Windows\System32\clbcatq.dll
\Windows\System32\normaliz.dll
\Windows\System32\Wldap32.dll
\Windows\System32\setupapi.dll
\Windows\System32\shell32.dll
\Windows\System32\lpk.dll
\Windows\System32\msctf.dll
\Windows\System32\psapi.dll
\Windows\System32\user32.dll
\Windows\System32\cfgmgr32.dll
\Windows\System32\comctl32.dll
\Windows\System32\KernelBase.dll
\Windows\System32\devobj.dll
\Windows\System32\wintrust.dll
\Windows\System32\crypt32.dll
\Windows\System32\msasn1.dll
----------- End -----------
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR1
Upper Device Object: 0xffffffff8675b958
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP2T1L0-4\
Lower Device Object: 0xffffffff866873f0
Lower Device Driver Name: \Driver\atapi\
Device already Exists: 0xffffffff860137d0
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffffff8675b030
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP2T0L0-2\
Lower Device Object: 0xffffffff8667f030
Lower Device Driver Name: \Driver\atapi\
Device already Exists: 0xffffffff86043f08
Initializing...
Done!
<<<2>>>
Device number: 1, partition: 1
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xffffffff8675b958, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff8675b638, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff8675b958, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff86278918, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xffffffff866873f0, DeviceName: \Device\Ide\IdeDeviceP2T1L0-4\, DriverName: \Driver\atapi\
------------ End ----------
Upper DeviceData: 0xffffffff8dc0c588, 0xffffffff8675b958, 0xffffffff862a4048
Lower DeviceData: 0xffffffffb2a2a8e8, 0xffffffff866873f0, 0xffffffff860137d0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning directory: C:\Windows\system32\drivers...
Done!
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff8675b030, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xffffffff8675a170, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff8675b030, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xffffffff86262918, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xffffffff8667f030, DeviceName: \Device\Ide\IdeDeviceP2T0L0-2\, DriverName: \Driver\atapi\
------------ End ----------
Upper DeviceData: 0xffffffffb3f03798, 0xffffffff8675b030, 0xffffffff861af398
Lower DeviceData: 0xffffffffc27fb478, 0xffffffff8667f030, 0xffffffff86043f08
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 3B3F5

Partition information:

Partition 0 type is Other (0x83)
Partition is ACTIVE.
Partition starts at LBA: 2048 Numsec = 299806720
Partition is not bootable

Partition 1 type is Extended with CSH (0x5)
Partition is NOT ACTIVE.
Partition starts at LBA: 299810814 Numsec = 12769282

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 160041885696 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-312561808-312581808)...
Drive 1
Scanning MBR on drive 1...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 98AD98AD

Partition information:

Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 63 Numsec = 976751937
Partition file system is NTFS
Partition is bootable

Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 500106780160 bytes
Sector size: 512 bytes

Done!
Performing system, memory and registry scan...
Read File: File "c:\ProgramData\{8F6A59AE-835F-46B0-90B3-07ADBC8494F0}\BearShare_V10_en_Setup.dat" is compressed (flags = 1)
Read File: File "c:\ProgramData\{8F6A59AE-835F-46B0-90B3-07ADBC8494F0}\BearShare_V10_en_Setup.lnk" is compressed (flags = 1)
Read File: File "c:\ProgramData\{8F6A59AE-835F-46B0-90B3-07ADBC8494F0}\instance.dat" is compressed (flags = 1)
Read File: File "c:\ProgramData\{8F6A59AE-835F-46B0-90B3-07ADBC8494F0}\BearShare_V10_en_Setup.dat" is compressed (flags = 1)
Read File: File "c:\ProgramData\{8F6A59AE-835F-46B0-90B3-07ADBC8494F0}\BearShare_V10_en_Setup.lnk" is compressed (flags = 1)
Read File: File "c:\ProgramData\{8F6A59AE-835F-46B0-90B3-07ADBC8494F0}\instance.dat" is compressed (flags = 1)
Done!
Scan finished

broni · 2013/01/17

Create new restore point before proceeding with the next step....
How to:
- Windows 8: http://www.vikitech.com/11302/system-restore-windows-8
- Windows 7: http://www.howtogeek.com/howto/3195/create-a-system-restore-point-in-windows-7/
- Vista: http://www.howtogeek.com/howto/wind...tore-point-for-windows-vistas-system-restore/
- XP: http://support.microsoft.com/kb/948247

=====================

Please download ComboFix from Here, Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Never rename Combofix unless instructed.

Close any open browsers.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".

Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

Close any open browsers.

WARNING: Combofix will disconnect your machine from the Internet as soon as it starts

Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
If the connection is not there use restore point you created prior to running Combofix.

Double click on combofix.exe & follow the prompts.

NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.

When finished, it will produce a report for you.

Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results ". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
Use AppRemover to uninstall it: http://www.appremover.com/
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion ", restart computer to fix the issue.
**Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try the following...

Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.
Download Rkill (courtesy of BleepingComputer.com) to your desktop.
There are 2 different versions. If one of them won't run then download and try to run the other one.
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

Restart computer in safe mode

Double-click on the Rkill desktop icon to run the tool.

If using Vista or Windows 7 right-click on it and choose Run As Administrator.

A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.

If not, delete the file, then download and use the one provided in Link 2.

Do not reboot until instructed.

If the tool does not run from any of the links provided, please let me know.

When the scan is done Notepad will open with rKill.txt log.
NOTE. rKill.txt log will also be present on your desktop.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.

Pepse · 2013/01/18

ComboFix 13-01-17.04 - Jim Sekola 01/18/2013 0:19.1.2 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.1.1033.18.3326.2171 [GMT -6:00]
Running from: c:\users\Jim Sekola\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Jim Sekola\AppData\Roaming\Mozilla\Firefox\Profiles\8o0odotb.default\searchplugins\bing-zugo.xml
.
.
((((((((((((((((((((((((( Files Created from 2012-12-18 to 2013-01-18 )))))))))))))))))))))))))))))))
.
.
2013-01-18 06:28 . 2013-01-18 06:29 -------- d-----w- c:\users\Jim Sekola\AppData\Local\temp
2013-01-18 06:28 . 2013-01-18 06:28 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2013-01-18 06:28 . 2013-01-18 06:28 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-01-18 06:21 . 2013-01-18 06:21 60872 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{D6A6046E-2F7F-4C6D-B10C-BA7DCED86CEA}\offreg.dll
2013-01-16 16:37 . 2013-01-16 16:47 -------- d-----w- c:\program files\Mozilla Thunderbird
2013-01-16 08:29 . 2013-01-12 09:30 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-01-16 08:12 . 2012-11-08 18:00 6812136 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{D6A6046E-2F7F-4C6D-B10C-BA7DCED86CEA}\mpengine.dll
2013-01-15 18:25 . 2013-01-15 18:25 -------- d-----w- C:\FRST
2013-01-09 17:42 . 2012-11-09 04:43 492032 ----a-w- c:\windows\system32\win32spl.dll
2013-01-09 17:42 . 2012-11-22 04:45 626688 ----a-w- c:\windows\system32\usp10.dll
2013-01-09 17:42 . 2012-11-23 02:56 2345984 ----a-w- c:\windows\system32\win32k.sys
2013-01-09 17:38 . 2012-12-07 10:46 43520 ----a-w- c:\windows\system32\csrr.rs
2013-01-09 17:37 . 2012-11-20 04:51 220160 ----a-w- c:\windows\system32\ncrypt.dll
2013-01-09 17:37 . 2012-11-23 02:48 49152 ----a-w- c:\windows\system32\taskhost.exe
2013-01-03 06:20 . 2013-01-03 06:20 -------- d-----w- c:\users\Jim Sekola\AppData\Roaming\RealNetworks
2013-01-03 05:46 . 2013-01-03 05:46 -------- d-----w- c:\program files\RealNetworks
2013-01-03 05:46 . 2013-01-03 05:46 -------- d-----w- c:\programdata\RealNetworks
2013-01-03 05:46 . 2013-01-03 05:46 -------- d-----w- c:\program files\Common Files\xing shared
2013-01-03 05:46 . 2013-01-03 05:46 153296 ----a-w- c:\program files\Mozilla Firefox\plugins\nppl3260.dll
2013-01-03 05:46 . 2013-01-03 05:46 124056 ----a-w- c:\program files\Mozilla Firefox\plugins\nprpplugin.dll
2013-01-02 04:19 . 2013-01-02 04:19 -------- d-----w- c:\users\Jim Sekola\AppData\Roaming\LibreOffice
2013-01-02 04:12 . 2013-01-02 04:18 -------- d-----w- c:\program files\LibreOffice 3.6
2012-12-28 19:31 . 2012-12-28 19:31 -------- d-----w- c:\users\Jim Sekola\AppData\Local\Programs
2012-12-21 19:33 . 2012-12-16 14:13 295424 ----a-w- c:\windows\system32\atmfd.dll
2012-12-21 19:33 . 2012-12-16 14:13 34304 ----a-w- c:\windows\system32\atmlib.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-01-09 16:53 . 2012-04-13 08:40 697864 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-01-09 16:53 . 2011-05-13 08:55 74248 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-01-03 05:46 . 2009-05-22 02:21 499712 ----a-w- c:\windows\system32\msvcp71.dll
2013-01-03 05:46 . 2009-05-22 00:57 348160 ----a-w- c:\windows\system32\msvcr71.dll
2012-11-13 05:37 . 2012-06-27 04:46 821736 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-11-13 05:37 . 2011-02-03 17:44 746984 ----a-w- c:\windows\system32\deployJava1.dll
2012-11-12 11:52 . 2012-12-13 07:13 1638912 ----a-w- c:\windows\system32\mshtml.tlb
2012-11-09 04:42 . 2012-12-13 07:13 2048 ----a-w- c:\windows\system32\tzres.dll
2012-11-02 05:11 . 2012-12-13 07:13 376832 ----a-w- c:\windows\system32\dpnet.dll
2012-10-27 06:26 . 2012-12-13 07:13 981504 ----a-w- c:\windows\system32\wininet.dll
2012-10-25 09:12 . 2012-10-25 09:12 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2012-10-25 09:12 . 2012-10-25 09:12 69632 ----a-w- c:\windows\system32\QuickTime.qts
2012-12-15 19:56 . 2012-12-15 19:56 262112 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{11BF46C6-B3DE-48BD-BF70-3AD85CAB80B5}]
2012-02-20 09:34 342232 ----a-w- c:\progra~1\SITERA~1\SiteRank.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@= "{472083B0-C522-11CF-8763-00608CC02F24} "
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2012-07-03 16:21 121528 ----a-w- c:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar "= "c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"Akamai NetSession Interface "= "c:\users\Jim Sekola\AppData\Local\Akamai\netsession_win.exe" [2012-10-09 4441920]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpqSRMon "= "c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-23 150528]
"SiteRanker "= "c:\program files\SiteRanker\SiteRankTray.exe" [2011-09-12 320000]
"APSDaemon "= "c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-12 59280]
"HP Software Update "= "c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"avast "= "c:\program files\Alwil Software\Avast5\avastUI.exe" [2012-07-03 4273976]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2012-10-25 421888]
"SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"TkBellExe "= "c:\program files\real\realplayer\Update\realsched.exe" [2013-01-03 295072]
.
c:\users\Jim Sekola\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin "= 5 (0x5)
"ConsentPromptBehaviorUser "= 3 (0x3)
"EnableUIADesktopToggle "= 0 (0x0)
.
R3 AppleChargerSrv;AppleChargerSrv;c:\windows\system32\AppleChargerSrv.exe [x]
R3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S1 AppleCharger;AppleCharger;c:\windows\system32\DRIVERS\AppleCharger.sys [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [x]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [x]
S2 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;c:\program files\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x]
S2 NAUpdate;Nero Update;c:\program files\Nero\Update\NASvc.exe [x]
S2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files\RealNetworks\RealDownloader\rndlresolversvc.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [x]
S3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder
.
2013-01-18 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-13 16:53]
.
2013-01-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-23 17:49]
.
2013-01-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-23 17:49]
.
2013-01-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3766567189-2379603247-3129890486-1001Core.job
- c:\users\Jim Sekola\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-16 06:09]
.
2013-01-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3766567189-2379603247-3129890486-1001UA.job
- c:\users\Jim Sekola\AppData\Local\Google\Update\GoogleUpdate.exe [2011-10-16 06:09]
.
2013-01-17 c:\windows\Tasks\HP Photo Creations Communicator.job
- c:\programdata\HP Photo Creations\Communicator.exe [2012-11-28 07:40]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = <local>
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Jim Sekola\AppData\Roaming\Mozilla\Firefox\Profiles\8o0odotb.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - google.com
FF - prefs.js: keyword.URL - chrome://browser-region/locale/region.properties
FF - ExtSQL: 2013-01-02 23:46; {34712C68-7391-4c47-94F3-8F88D49AD632}; c:\programdata\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF - ExtSQL: !HIDDEN! 2011-02-08 12:07; smartwebprinting@hp.com; c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF - user.js: extentions.y2layers.installId - 6ca1c28a-1b8b-43f7-bed1-53a8464b9fc3
FF - user.js: extentions.y2layers.defaultEnableAppsList - Buzzdock,BuzzdockTease,DropDownDeals,BestVideoDownloader,BestVideoDownloader,
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-10 - (no file)
HKCU-Run-DriverFinder - c:\program files\DriverFinder\DriverFinder.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2013-01-18 00:30:27
ComboFix-quarantined-files.txt 2013-01-18 06:30
.
Pre-Run: 377,252,773,888 bytes free
Post-Run: 380,789,608,448 bytes free
.
- - End Of File - - 442983EAB73E55E671A0ADF00F660E7B

Log in or Sign up

Solved DOJ Malware Got me.

Pepse Well-Known Member Thread Starter

Admin. Administrator Administrator Staff

Pepse Well-Known Member Thread Starter

broni Moderator Malware Analyst

Pepse Well-Known Member Thread Starter

broni Moderator Malware Analyst

Attached Files:

fixlist.txt

Pepse Well-Known Member Thread Starter

Pepse Well-Known Member Thread Starter

broni Moderator Malware Analyst

Pepse Well-Known Member Thread Starter

Pepse Well-Known Member Thread Starter

Pepse Well-Known Member Thread Starter

Pepse Well-Known Member Thread Starter

Pepse Well-Known Member Thread Starter

broni Moderator Malware Analyst

Pepse Well-Known Member Thread Starter

Pepse Well-Known Member Thread Starter

Pepse Well-Known Member Thread Starter

broni Moderator Malware Analyst

Pepse Well-Known Member Thread Starter

Share This Page

Log in or Sign up

Solved DOJ Malware Got me.

Pepse Well-Known Member Thread Starter

Admin. Administrator Administrator Staff

Pepse Well-Known Member Thread Starter

broni Moderator Malware Analyst

Pepse Well-Known Member Thread Starter

broni Moderator Malware Analyst

Attached Files:

fixlist.txt

Pepse Well-Known Member Thread Starter

Pepse Well-Known Member Thread Starter

broni Moderator Malware Analyst

Pepse Well-Known Member Thread Starter

Pepse Well-Known Member Thread Starter

Pepse Well-Known Member Thread Starter

Pepse Well-Known Member Thread Starter

Pepse Well-Known Member Thread Starter

broni Moderator Malware Analyst

Pepse Well-Known Member Thread Starter

Pepse Well-Known Member Thread Starter

Pepse Well-Known Member Thread Starter

broni Moderator Malware Analyst

Pepse Well-Known Member Thread Starter

Share This Page

Useful Searches