TechSpot

[A] Askthecrew Google redirect

By gsrobison
Feb 8, 2012
  1. i sent a notebook in to Aaron's repair shop, when it returned, i have this askthecrew redirect virus. it, is either embedded in the hard drive or the bios. As i have reloaded it about 4 times now... 2 times from the recovery partition and 2 times with the recovery cd. the last time i deleted ALL partitions and reloaded. and every time, i go to google, i get redirected to some pumacredit page, which eventually lands me on the askthecrew{dot}net [i truncated the link]

    this thing will NOT die!! i have tried just about everything to kill it... even rkill, combofix, malwarebytes, search and destroy, even bootable antivirus... i ran gmer...

    I need some serious help here...I have an HP notebook, running Window7 pro. 64bit
     
  2. gsrobison

    gsrobison TS Rookie Topic Starter

    ok, here is an update... i have a belkin router... tried doing a hard reset, so far this has fixed the issue?? i guess maybe somehow the router was doing a redirect??? but only on my notebook... have 2 pc's also on wireless!!??
     
  3. Broni

    Broni Malware Annihilator Posts: 52,897   +344

    Welcome aboard [​IMG]

    Please, complete all steps listed here: http://www.techspot.com/vb/topic58138.html
    Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
    Attached logs won't be reviewed.

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.
     
  4. gsrobison

    gsrobison TS Rookie Topic Starter

    fixed i hope

    the issue returned after resetting the router. so i did a hard reset on the DSL modem. so far the issue has not returned!!
     
  5. Broni

    Broni Malware Annihilator Posts: 52,897   +344

    I strongly suggest you follow my instructions.
     
  6. gsrobison

    gsrobison TS Rookie Topic Starter

    scan results

    Avast is clean
    malwarebytes is clean
    gmer is clean
    see dds results


    .
    DDS (Ver_2011-08-26.01) - NTFSAMD64
    Internet Explorer: 8.0.7600.16385
    Run by Gary Robison at 0:21:31 on 2012-02-10
    Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.2811.859 [GMT -6:00]
    .
    AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
    SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Windows\system32\atiesrxx.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\servicing\TrustedInstaller.exe
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
    C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
    C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
    C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
    C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\system32\atieclxx.exe
    C:\Windows\system32\taskhost.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Windows\system32\SearchIndexer.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe
    C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe
    C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
    C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBWebConnector\QBWebConnector.exe
    C:\Windows\System32\svchost.exe -k LocalServicePeerNet
    C:\Program Files (x86)\Intuit\QuickBooks Enterprise Solutions 11.0\QBW32.EXE
    C:\Windows\System32\svchost.exe -k secsvcs
    c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Program Files\AVAST Software\Avast\AvastUI.exe
    C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe
    C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
    C:\Windows\system32\wuauclt.exe
    C:\Windows\system32\vssvc.exe
    C:\Windows\System32\svchost.exe -k swprv
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\conhost.exe
    C:\Windows\SysWOW64\cscript.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    .
    ============== Pseudo HJT Report ===============
    .
    mWinlogon: Userinit=userinit.exe
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
    BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
    TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
    uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    uRun: [38988C7F010632471F0B75CE505187CE3A7B43CD._service_run] "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=service
    uRun: [HPAdvisorDock] C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe
    mRun: [Intuit SyncManager] C:\Program Files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe startup
    mRun: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
    mRun: [Carbonite Backup] C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe
    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    mRun: [StartCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
    dRun: [Bomgar_Cleanup_ZD1037715449] cmd.exe /C rd /S /Q "C:\ProgramData\bomgar-scc-000000004F34A011" & reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Bomgar_Cleanup_ZD1037715449 /f
    StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\INTUIT~1.LNK - C:\Program Files (x86)\Common Files\Intuit\DataProtect\IntuitDataProtect.exe
    StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\QUICKB~3.LNK - C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
    StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\QUICKB~1.LNK - C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBWebConnector\QBWebConnector.exe
    StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\QUICKB~2.LNK - C:\Program Files (x86)\Intuit\QuickBooks Enterprise Solutions 11.0\QBW32.EXE
    mPolicies-explorer: NoActiveDesktop = 1 (0x1)
    mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
    mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
    IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
    DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect118.cab
    TCP: DhcpNameServer = 192.168.1.1
    TCP: Interfaces\{50065C4A-947F-4DD9-BB61-682DE77D41F8} : DhcpNameServer = 192.168.1.1
    TCP: Interfaces\{50065C4A-947F-4DD9-BB61-682DE77D41F8}\237796375676579737 : DhcpNameServer = 68.105.28.11 68.105.29.11 68.105.28.12
    Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
    Handler: intu-help-qb4 - {ACE22922-D07C-4860-B51B-8CF472FEC2CB} - C:\Program Files (x86)\Intuit\QuickBooks Enterprise Solutions 11.0\HelpAsyncPluggableProtocol.dll
    Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\Windows\System32\mscoree.dll
    SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
    BHO-X64: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO-X64: AcroIEHelperStub - No File
    BHO-X64: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
    BHO-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
    TB-X64: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
    mRun-x64: [Intuit SyncManager] C:\Program Files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe startup
    mRun-x64: [GrooveMonitor] "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
    mRun-x64: [Carbonite Backup] C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe
    mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    mRun-x64: [StartCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    mRun-x64: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
    SEH-X64: Groove GFS Stub Execution Hook: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - C:\Users\Gary Robison\AppData\Roaming\Mozilla\Firefox\Profiles\ku5rcyua.default\
    FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 amd_sata;amd_sata;C:\Windows\system32\DRIVERS\amd_sata.sys --> C:\Windows\system32\DRIVERS\amd_sata.sys [?]
    R0 amd_xata;amd_xata;C:\Windows\system32\DRIVERS\amd_xata.sys --> C:\Windows\system32\DRIVERS\amd_xata.sys [?]
    R0 aswNdis;avast! Firewall NDIS Filter Service;C:\Windows\system32\DRIVERS\aswNdis.sys --> C:\Windows\system32\DRIVERS\aswNdis.sys [?]
    R0 aswNdis2;avast! Firewall Core Firewall Service;C:\Windows\system32\drivers\aswNdis2.sys --> C:\Windows\system32\drivers\aswNdis2.sys [?]
    R1 aswFW;avast! TDI Firewall driver;C:\Windows\system32\drivers\aswFW.sys --> C:\Windows\system32\drivers\aswFW.sys [?]
    R1 aswSnx;aswSnx;C:\Windows\system32\drivers\aswSnx.sys --> C:\Windows\system32\drivers\aswSnx.sys [?]
    R1 aswSP;aswSP;C:\Windows\system32\drivers\aswSP.sys --> C:\Windows\system32\drivers\aswSP.sys [?]
    R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
    R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-1-3 63928]
    R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]
    R2 aswFsBlk;aswFsBlk;C:\Windows\system32\drivers\aswFsBlk.sys --> C:\Windows\system32\drivers\aswFsBlk.sys [?]
    R2 aswMonFlt;aswMonFlt;\??\C:\Windows\system32\drivers\aswMonFlt.sys --> C:\Windows\system32\drivers\aswMonFlt.sys [?]
    R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2012-2-9 44768]
    R2 QBVSS;QBIDPService;C:\Program Files (x86)\Common Files\Intuit\DataProtect\QBIDPService.exe [2011-11-9 1248256]
    R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys --> C:\Windows\system32\DRIVERS\atikmdag.sys [?]
    R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?]
    R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
    R3 usbfilter;AMD USB Filter Driver;C:\Windows\system32\DRIVERS\usbfilter.sys --> C:\Windows\system32\DRIVERS\usbfilter.sys [?]
    S2 avast! Firewall;avast! Firewall;C:\Program Files\AVAST Software\Avast\afwServ.exe [2012-2-9 127192]
    S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-2-8 136176]
    S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-2-8 136176]
    S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992]
    S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]
    .
    =============== Created Last 30 ================
    .
    2012-02-10 04:56:58 -------- d-----w- C:\Windows\SysWow64\Wat
    2012-02-10 04:56:58 -------- d-----w- C:\Windows\System32\Wat
    2012-02-10 04:48:42 140120 ----a-w- C:\Windows\System32\drivers\aswFW.sys
    2012-02-10 04:48:09 258392 ----a-w- C:\Windows\System32\drivers\aswNdis2.sys
    2012-02-10 04:48:04 12368 ----a-w- C:\Windows\System32\drivers\aswNdis.sys
    2012-02-10 04:45:05 311808 ----a-w- C:\Windows\System32\msv1_0.dll
    2012-02-10 04:45:05 257024 ----a-w- C:\Windows\SysWow64\msv1_0.dll
    2012-02-10 04:41:53 -------- d-----w- C:\ProgramData\bomgar-scc-000000004F34A011
    2012-02-10 04:32:03 -------- d-----w- C:\Program Files (x86)\Microsoft CAPICOM 2.1.0.2
    2012-02-10 04:29:25 99176 ----a-w- C:\Windows\SysWow64\PresentationHostProxy.dll
    2012-02-10 04:29:25 49472 ----a-w- C:\Windows\SysWow64\netfxperf.dll
    2012-02-10 04:29:25 297808 ----a-w- C:\Windows\SysWow64\mscoree.dll
    2012-02-10 04:29:25 295264 ----a-w- C:\Windows\SysWow64\PresentationHost.exe
    2012-02-10 04:29:24 48960 ----a-w- C:\Windows\System32\netfxperf.dll
    2012-02-10 04:29:24 444752 ----a-w- C:\Windows\System32\mscoree.dll
    2012-02-10 04:29:24 320352 ----a-w- C:\Windows\System32\PresentationHost.exe
    2012-02-10 04:29:24 1942856 ----a-w- C:\Windows\System32\dfshim.dll
    2012-02-10 04:29:24 1130824 ----a-w- C:\Windows\SysWow64\dfshim.dll
    2012-02-10 04:29:24 109912 ----a-w- C:\Windows\System32\PresentationHostProxy.dll
    2012-02-10 03:42:12 591192 ----a-w- C:\Windows\System32\drivers\aswSnx.sys
    2012-02-10 03:42:08 66904 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys
    2012-02-10 03:41:28 41184 ----a-w- C:\Windows\avastSS.scr
    2012-02-10 03:35:04 -------- d-----w- C:\Program Files\CCleaner
    2012-02-09 16:34:20 -------- d-----w- C:\Users\Gary Robison\AppData\Local\CutePDF Writer
    2012-02-09 16:08:40 -------- d-----w- C:\Users\Gary Robison\AppData\Local\Hewlett-Packard
    2012-02-09 16:07:40 -------- d-----w- C:\Users\Gary Robison\AppData\Local\ATI
    2012-02-09 15:06:03 243712 ----a-w- C:\Windows\System32\drivers\ks.sys
    2012-02-09 15:06:03 184832 ----a-w- C:\Windows\System32\drivers\usbvideo.sys
    2012-02-09 15:05:25 38528 ----a-w- C:\Windows\System32\drivers\usbfilter.sys
    2012-02-09 15:01:45 -------- d-----w- C:\Program Files (x86)\ATI Technologies
    2012-02-09 14:56:01 -------- d-----w- C:\Program Files\ATI Technologies
    2012-02-09 14:55:55 -------- d-----w- C:\Program Files\ATI
    2012-02-09 14:50:28 -------- d-----w- C:\system.sav
    2012-02-09 14:50:21 -------- d-----w- C:\hp
    2012-02-09 14:49:57 -------- d-----w- C:\Users\Gary Robison\AppData\Roaming\WinBatch
    2012-02-09 14:49:01 -------- d-----w- C:\Users\Gary Robison\AppData\Roaming\Malwarebytes
    2012-02-09 14:48:55 -------- d-----w- C:\ProgramData\Malwarebytes
    2012-02-09 14:48:54 23152 ----a-w- C:\Windows\System32\drivers\mbam.sys
    2012-02-09 14:48:53 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2012-02-09 05:24:43 -------- d-----w- C:\Program Files (x86)\GPLGS
    2012-02-09 05:24:24 85504 ----a-w- C:\Windows\System32\cpwmon64.dll
    2012-02-09 05:24:20 -------- d-----w- C:\Program Files (x86)\Acro Software
    2012-02-09 04:52:54 -------- d-----w- C:\Windows\SysWow64\Adobe
    2012-02-09 04:50:30 -------- d-----w- C:\Users\Gary Robison\AppData\Local\Adobe
    2012-02-09 04:30:47 14744 ----a-w- C:\Users\Gary Robison\AppData\Roaming\Microsoft\IdentityCRL\Production\ppcrlconfig.dll
    2012-02-09 04:28:50 -------- d-----w- C:\Program Files (x86)\MSECache
    2012-02-09 04:22:44 -------- d-----w- C:\Program Files\Carbonite
    2012-02-09 04:22:32 -------- d-----w- C:\ProgramData\Carbonite
    2012-02-09 04:22:32 -------- d-----w- C:\Program Files (x86)\Carbonite
    2012-02-09 03:49:10 -------- d-----w- C:\Windows\PCHEALTH
    2012-02-09 03:46:12 -------- d-----w- C:\Program Files (x86)\Microsoft Visual Studio 8
    2012-02-09 03:45:06 -------- d-----w- C:\Users\Gary Robison\AppData\Local\Microsoft Help
    2012-02-09 03:39:29 -------- d-----w- C:\Program Files\Common Files\Intuit
    2012-02-09 03:36:29 -------- d-----w- C:\Users\Gary Robison\AppData\Local\Intuit
    2012-02-09 03:31:11 -------- d-----w- C:\ProgramData\Nuance
    2012-02-09 03:31:11 -------- d-----w- C:\ProgramData\Intuit
    2012-02-09 03:31:11 -------- d-----w- C:\Program Files (x86)\Intuit
    2012-02-09 03:31:11 -------- d-----w- C:\Program Files (x86)\Common Files\Intuit
    2012-02-09 03:30:52 -------- d-----w- C:\ProgramData\SQL Anywhere 11
    2012-02-09 03:30:52 -------- d-----w- C:\ProgramData\COMMON FILES
    2012-02-09 03:29:55 -------- d-----w- C:\Program Files (x86)\MSXML 4.0
    2012-02-09 03:21:38 -------- d-----w- C:\Windows\Intuit
    2012-02-08 09:37:46 424960 ----a-w- C:\Windows\System32\secproc.dll
    2012-02-08 09:36:59 43520 ----a-w- C:\Windows\System32\csrsrv.dll
    2012-02-08 09:35:47 662528 ----a-w- C:\Windows\System32\XpsPrint.dll
    2012-02-08 09:35:47 442880 ----a-w- C:\Windows\SysWow64\XpsPrint.dll
    2012-02-08 09:35:39 389632 ----a-w- C:\Windows\System32\winlogon.exe
    2012-02-08 09:35:39 2870272 ----a-w- C:\Windows\explorer.exe
    2012-02-08 09:35:39 2614272 ----a-w- C:\Windows\SysWow64\explorer.exe
    2012-02-08 09:35:32 1359872 ----a-w- C:\Windows\System32\mfc42u.dll
    2012-02-08 09:35:31 1395712 ----a-w- C:\Windows\System32\mfc42.dll
    2012-02-08 09:35:31 1137664 ----a-w- C:\Windows\SysWow64\mfc42.dll
    2012-02-08 09:35:30 1164288 ----a-w- C:\Windows\SysWow64\mfc42u.dll
    2012-02-08 09:35:17 52224 ----a-w- C:\Windows\System32\rtutils.dll
    2012-02-08 09:35:17 37376 ----a-w- C:\Windows\SysWow64\rtutils.dll
    2012-02-08 09:33:59 27008 ----a-w- C:\Windows\System32\drivers\Diskdump.sys
    2012-02-08 09:32:56 320512 ----a-w- C:\Windows\System32\d3d10_1core.dll
    2012-02-08 09:31:28 640896 ----a-w- C:\Windows\System32\winload.efi
    2012-02-08 09:29:59 422400 ----a-w- C:\Windows\System32\KernelBase.dll
    2012-02-08 09:28:54 976896 ----a-w- C:\Windows\System32\inetcomm.dll
    2012-02-08 09:28:54 740864 ----a-w- C:\Windows\SysWow64\inetcomm.dll
    2012-02-08 09:28:49 3141632 ----a-w- C:\Windows\System32\win32k.sys
    2012-02-08 09:28:39 112000 ----a-w- C:\Windows\System32\consent.exe
    2012-02-08 09:28:34 90624 ----a-w- C:\Windows\System32\drivers\bowser.sys
    2012-02-08 09:28:30 723456 ----a-w- C:\Windows\System32\EncDec.dll
    2012-02-08 09:28:29 534528 ----a-w- C:\Windows\SysWow64\EncDec.dll
    2012-02-08 09:28:27 861184 ----a-w- C:\Windows\System32\oleaut32.dll
    2012-02-08 09:28:27 571904 ----a-w- C:\Windows\SysWow64\oleaut32.dll
    2012-02-08 09:28:27 331776 ----a-w- C:\Windows\System32\oleacc.dll
    2012-02-08 09:28:27 233472 ----a-w- C:\Windows\SysWow64\oleacc.dll
    2012-02-08 09:28:18 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
    2012-02-08 09:28:18 2048 ----a-w- C:\Windows\System32\tzres.dll
    2012-02-08 08:58:50 -------- d-----w- C:\Users\Gary Robison\outlook pst
    2012-02-08 08:58:50 -------- d-----w- C:\Users\Gary Robison\outlook nk2
    2012-02-08 08:58:38 -------- d-----w- C:\Users\Gary Robison\Intuit
    2012-02-08 08:48:12 -------- d-----w- C:\Users\Gary Robison\Carbonite Restored OLD User Settings
    2012-02-08 08:48:12 -------- d-----w- C:\Users\Gary Robison\bookmarkbackups
    2012-02-08 08:46:35 -------- d-----w- C:\Users\Gary Robison\Android
    2012-02-08 08:23:38 -------- d-----w- C:\Users\Gary Robison\AppData\Local\Google
    2012-02-08 08:08:30 -------- d-----w- C:\Users\Gary Robison\AppData\Local\Diagnostics
    2012-02-08 08:04:50 -------- d-----w- C:\ProgramData\AVAST Software
    2012-02-08 08:04:50 -------- d-----w- C:\Program Files\AVAST Software
    2012-02-08 08:02:25 -------- d-----w- C:\Windows\Panther
    2012-02-08 08:01:54 -------- d-----w- C:\Windows\System32\OEM
    2012-02-08 06:39:14 -------- d-----w- C:\SwSetup
    2012-02-08 06:37:37 0 ----a-w- C:\Windows\ativpsrm.bin
    2012-02-08 06:34:20 8602168 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{79DCA71C-E632-4E2C-A256-103C50E0A687}\mpengine.dll
    2012-02-08 06:34:19 279656 ------w- C:\Windows\System32\MpSigStub.exe
    2012-02-08 06:21:08 -------- d-----w- C:\Program Files (x86)\HP
    2012-02-08 06:19:55 -------- d-sh--w- C:\Windows\Installer
    2012-02-08 06:19:52 220672 ----a-w- C:\Windows\System32\wintrust.dll
    2012-02-08 06:19:52 139264 ----a-w- C:\Windows\System32\cabview.dll
    2012-02-08 06:19:52 132608 ----a-w- C:\Windows\SysWow64\cabview.dll
    2012-02-08 06:19:51 172032 ----a-w- C:\Windows\SysWow64\wintrust.dll
    2012-02-08 06:12:54 -------- d-sh--w- C:\Recovery
    .
    ==================== Find3M ====================
    .
    2011-11-19 15:07:41 77312 ----a-w- C:\Windows\System32\packager.dll
    2011-11-19 14:06:13 67072 ----a-w- C:\Windows\SysWow64\packager.dll
    2011-11-17 07:17:03 152432 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys
    2011-11-17 07:17:02 95088 ----a-w- C:\Windows\System32\drivers\ksecdd.sys
    2011-11-17 07:15:08 460296 ----a-w- C:\Windows\System32\drivers\cng.sys
    2011-11-17 07:14:10 1739160 ----a-w- C:\Windows\System32\ntdll.dll
    2011-11-17 07:12:02 395776 ----a-w- C:\Windows\System32\webio.dll
    2011-11-17 07:11:33 28672 ----a-w- C:\Windows\System32\sspisrv.dll
    2011-11-17 07:11:33 136192 ----a-w- C:\Windows\System32\sspicli.dll
    2011-11-17 07:11:02 28160 ----a-w- C:\Windows\System32\secur32.dll
    2011-11-17 07:10:58 340992 ----a-w- C:\Windows\System32\schannel.dll
    2011-11-17 07:08:18 1446912 ----a-w- C:\Windows\System32\lsasrv.dll
    2011-11-17 07:05:16 31232 ----a-w- C:\Windows\System32\lsass.exe
    2011-11-17 05:41:38 1292592 ----a-w- C:\Windows\SysWow64\ntdll.dll
    2011-11-17 05:39:28 314368 ----a-w- C:\Windows\SysWow64\webio.dll
    2011-11-17 05:39:21 224768 ----a-w- C:\Windows\SysWow64\schannel.dll
    2011-11-17 05:39:21 22016 ----a-w- C:\Windows\SysWow64\secur32.dll
    2011-11-17 05:35:13 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll
    .
    ============= FINISH: 0:22:17.91 ===============
     
  7. Broni

    Broni Malware Annihilator Posts: 52,897   +344

    I still need Attach.txt part of DDS.

    Then....

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.



    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode (How to...)

    2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
    Do NOT run it yet.

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    Rkill.com
    Rkill.scr
    Rkill.exe

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...