TechSpot

Constant Temp folder creation

By Eric Witzling
Feb 6, 2015
  1. I have already gone over some usual cleanup on a user's PC, which stopped certain popups from happening, stopped "Powershell has failed" popups and otherwise, but one of the biggest issues it had still continues.

    The user had 20GB with more than 1mil files in tens of thousands of directories in their User/AppData/Local/Temp folder, largely referencing their own internal AppData\Local\Microsoft\* internal folder structure, and hiding a weird assortment of things within it. Most of all the folders were cleared once, and started rebuilding (quickly). Then they were fully cleared from the admin profile in safe mode, but they still came back when logging back into the user normally. They start reproducing in both Safe and Normal mode, but only when there is an internet connection. Sometimes slowly and acting in normal ways I would expect the IE Temps to act, but at other times in RAPID succession. And they will build without IE being open.

    I also uninstalled IE11 (so the machine is now running IE9) in case an add-on built for one would be disrupted with the rollback, but the behavior is still repeating. That's what I'm trying to catch.

    Your requested logs are below. I ran MalwareBytes once yesterday, so I will include that log in a reply.

    ---------------------------------------------

    Malwarebytes Anti-Malware
    www.malwarebytes.org
    Scan Date: 2/6/2015
    Scan Time: 1:31:30 PM
    Logfile: mbamlog.txt
    Administrator: Yes
    Version: 2.00.4.1028
    Malware Database: v2015.02.06.07
    Rootkit Database: v2015.02.03.01
    License: Free
    Malware Protection: Disabled
    Malicious Website Protection: Disabled
    Self-protection: Disabled
    OS: Windows 7 Service Pack 1
    CPU: x86
    File System: NTFS
    User: Neil
    Scan Type: Threat Scan
    Result: Completed
    Objects Scanned: 496643
    Time Elapsed: 18 min, 37 sec
    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Disabled
    Heuristics: Enabled
    PUP: Enabled
    PUM: Enabled
    Processes: 0
    (No malicious items detected)
    Modules: 0
    (No malicious items detected)
    Registry Keys: 0
    (No malicious items detected)
    Registry Values: 0
    (No malicious items detected)
    Registry Data: 0
    (No malicious items detected)
    Folders: 0
    (No malicious items detected)
    Files: 0
    (No malicious items detected)
    Physical Sectors: 0
    (No malicious items detected)

    (end)

    ----

    DDS (Ver_2012-11-20.01) - NTFS_x86
    Internet Explorer: 9.0.8112.16520 BrowserJavaVersion: 11.31.2
    Run by Neil at 13:33:26 on 2015-02-06
    Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.3524.1396 [GMT -5:00]
    .
    AV: GFI Software VIPRE *Enabled/Updated* {FFE93D16-FD09-0282-C7D3-8B1731B6A051}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: GFI Software VIPRE *Enabled/Updated* {4488DCF2-DB33-0D0C-FD63-B0654A31EAEC}
    .
    ============== Running Processes ================
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\servicing\TrustedInstaller.exe
    C:\Windows\System32\spoolsv.exe
    C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
    C:\Windows\system32\atashost.exe
    C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe
    C:\Program Files\Intel\iCLS Client\HeciServer.exe
    C:\Windows\system32\IProsetMonitor.exe
    C:\Program Files\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
    C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
    C:\Program Files\LogMeIn\x86\RaMaint.exe
    C:\Program Files\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe
    c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
    C:\Program Files\Motorola\MotForwardDaemon\ForwardDaemon.exe
    C:\Program Files\Timberline Office\Shared\Sage.CRE.PervasiveLicenseService.exe
    C:\Program Files\Sage\SIM\Client\Sage.Sim.Client.WindowsService.exe
    C:\Program Files\GFI Software\GFIAgent\SBPIMSvc.exe
    C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
    C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
    C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Security Runtime\sntlsrtsrvr.exe
    c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
    c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Program Files\LogMeIn\x86\LogMeIn.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Program Files\Common Files\Sage\LS1\ServiceHost\Sage.LS1.ServiceHost.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\taskhost.exe
    C:\Program Files\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\taskeng.exe
    c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
    c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
    C:\Program Files\Google\Update\1.3.25.11\GoogleCrashHandler.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
    C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
    C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
    C:\Windows\System32\igfxtray.exe
    C:\Windows\System32\hkcmd.exe
    C:\Windows\System32\igfxpers.exe
    C:\Program Files\Sage\SIM\Client\SimNotify.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\Users\neil\AppData\Roaming\Verizon\SUA\VZWSUAM.exe
    C:\Program Files\GFI Software\GFIAgent\SBAMSvc.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Windows\system32\dllhost.exe
    C:\Program Files\GFI Software\GFIAgent\SBAMTray.exe
    C:\Windows\system32\msiexec.exe
    C:\Windows\system32\dllhost.exe
    C:\Windows\system32\cmmon32.exe
    C:\Windows\system32\rundll32.exe
    C:\Windows\system32\upnpcont.exe
    C:\Windows\system32\fixmapi.exe
    C:\Windows\system32\dvdupgrd.exe
    C:\Windows\system32\msfeedssync.exe
    C:\Windows\system32\systray.exe
    C:\Windows\system32\wiaacmgr.exe
    C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
    C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
    C:\Windows\system32\wuauclt.exe
    C:\Windows\system32\conhost.exe
    C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\conhost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Windows\System32\svchost.exe -k HPZ12
    C:\Windows\System32\svchost.exe -k HPZ12
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Windows\System32\svchost.exe -k secsvcs
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.google.com/
    uSearch Bar = Preserve
    BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre1.8.0_31\bin\ssv.dll
    BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - c:\program files\microsoft office\office14\URLREDIR.DLL
    BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre1.8.0_31\bin\jp2ssv.dll
    uRun: [CardScan AutoSync] <no file>
    mRun: [IAStorIcon] c:\program files\intel\intel(r) rapid storage technology\IAStorIcon.exe
    mRun: [RTHDVCPL] c:\program files\realtek\audio\hda\RtHDVCpl.exe -s
    mRun: [LogMeIn GUI] "c:\program files\logmein\x86\LogMeInSystray.exe"
    mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
    mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
    mRun: [Persistence] c:\windows\system32\igfxpers.exe
    mRun: [SBAMTray] "c:\program files\gfi software\gfiagent\SBAMTray.exe"
    mRun: [SimNotify.exe] c:\program files\sage\sim\client\SimNotify.exe
    mRunOnce: [Launcher] c:\program files\sminst\Launcher.exe
    StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\verizo~1.lnk - c:\users\neil\appdata\roaming\verizon\sua\VZWSUAM.exe
    uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
    mPolicies-Explorer: NoDrives = dword:0
    mPolicies-System: ConsentPromptBehaviorAdmin = dword:0
    mPolicies-System: ConsentPromptBehaviorUser = dword:3
    mPolicies-System: EnableLUA = dword:0
    mPolicies-System: EnableUIADesktopToggle = dword:0
    mPolicies-System: PromptOnSecureDesktop = dword:0
    mPolicies-System: SoftwareSASGeneration = dword:1
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll
    IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll
    DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} - hxxps://secure.logmein.com//activex/ractrl.cab?lmi=1007
    TCP: NameServer = 192.168.2.225 208.67.222.222 8.8.8.8
    TCP: Interfaces\{892BCCC5-A03E-42B6-852F-210B5A467C29} : NameServer = 192.168.100.240,208.67.222.222
    TCP: Interfaces\{892BCCC5-A03E-42B6-852F-210B5A467C29} : DHCPNameServer = 192.168.2.225 208.67.222.222 8.8.8.8
    Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL
    Notify: igfxcui - igfxdev.dll
    SSODL: WebCheck - <orphaned>
    mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\40.0.2214.111\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - c:\users\neil\appdata\roaming\mozilla\firefox\profiles\io8i0jjy.default\
    FF - plugin: c:\progra~1\common~1\nero\browse~1\npBrowserPlugin.dll
    FF - plugin: c:\progra~1\micros~1\office14\NPAUTHZ.DLL
    FF - plugin: c:\progra~1\micros~1\office14\NPSPWRAP.DLL
    FF - plugin: c:\program files\adobe\reader 11.0\reader\air\nppdf32.dll
    FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
    FF - plugin: c:\program files\google\update\1.3.25.11\npGoogleUpdate3.dll
    FF - plugin: c:\program files\intel\intel(r) management engine components\ipt\npIntelWebAPIIPT.dll
    FF - plugin: c:\program files\intel\intel(r) management engine components\ipt\npIntelWebAPIUpdater.dll
    FF - plugin: c:\program files\java\jre1.8.0_31\bin\dtplugin\npdeployJava1.dll
    FF - plugin: c:\program files\java\jre1.8.0_31\bin\plugin2\npjp2.dll
    FF - plugin: c:\program files\microsoft silverlight\5.1.30514.0\npctrlui.dll
    FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_16_0_0_296.dll
    .
    ============= SERVICES / DRIVERS ===============
    .
    R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-22 12880]
    R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-12 67664]
    R2 atashost;WebEx Service Host for Support Center;c:\windows\system32\atashost.exe [2013-5-3 118056]
    R2 HP LaserJet Service;HP LaserJet Service;c:\program files\hp\hplaserjetservice\HPLaserJetService.exe [2010-10-25 145920]
    R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\intel\intel(r) rapid storage technology\IAStorDataMgrSvc.exe [2013-4-30 13592]
    R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\intel\icls client\HeciServer.exe [2012-4-20 462048]
    R2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service;c:\windows\system32\IPROSetMonitor.exe [2013-4-30 132768]
    R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files\intel\intel(r) management engine components\dal\Jhi_service.exe [2013-4-30 165760]
    R2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\logmein\x86\LMIGuardianSvc.exe [2013-3-19 375144]
    R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\logmein\x86\rainfo.sys [2012-11-29 13624]
    R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2013-5-2 47640]
    R2 Motorola Device Manager;Motorola Device Manager Service;c:\program files\motorola mobility\motorola device manager\MotoHelperService.exe [2013-11-15 137528]
    R2 MSSQL$SAGECRE;SQL Server (SAGECRE);c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe [2010-12-10 29293408]
    R2 PPNT;PPNT;c:\windows\system32\drivers\ppnt.sys [2002-11-13 13824]
    R2 PST Service;PST Service;c:\program files\motorola\motforwarddaemon\ForwardDaemon.exe [2013-12-30 65657]
    R2 Sage.CRE.PervasiveLicenseService;Sage Pervasive License Service;c:\program files\timberline office\shared\Sage.CRE.PervasiveLicenseService.exe [2013-7-8 33072]
    R2 Sage.LS1.ServiceHost;Sage Service Host (v13.1);c:\program files\common files\sage\ls1\servicehost\Sage.LS1.ServiceHost.exe [2013-7-8 108848]
    R2 SageInstMgrClient;Sage Installation Manager Client;c:\program files\sage\sim\client\Sage.Sim.Client.WindowsService.exe [2013-7-8 17712]
    R2 SBAMSvc;VIPRE Business;c:\program files\gfi software\gfiagent\SBAMSvc.exe [2013-5-30 3681016]
    R2 sbapifs;sbapifs;c:\windows\system32\drivers\sbapifs.sys [2013-1-15 68904]
    R2 SBPIMSvc;SB Recovery Service;c:\program files\gfi software\gfiagent\SBPIMSvc.exe [2013-5-30 176536]
    R2 SentinelKeysServer;Sentinel Keys Server;c:\program files\common files\safenet sentinel\sentinel keys server\sntlkeyssrvr.exe [2009-9-17 369952]
    R2 SentinelSecurityRuntime;Sentinel Security Runtime;c:\program files\common files\safenet sentinel\sentinel security runtime\sntlsrtsrvr.exe [2009-9-17 292128]
    R2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files\intel\intel(r) management engine components\uns\UNS.exe [2013-4-30 364416]
    R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys [2015-2-5 114904]
    R3 MEI;Intel(R) Management Engine Interface ;c:\windows\system32\drivers\HECI.sys [2013-4-30 55104]
    R3 sbwtis;sbwtis;c:\windows\system32\drivers\sbwtis.sys [2013-1-15 76064]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]
    S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
    S3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\drivers\motfilt.sys [2013-3-20 6272]
    S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\drivers\ssudbus.sys [2014-1-22 88576]
    S3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
    S3 gfiark;gfiark;c:\windows\system32\drivers\gfiark.sys [2013-5-16 43368]
    S3 gfiutil;gfiutil;c:\windows\system32\drivers\gfiutil.sys [2013-6-11 24040]
    S3 motandroidusb;Mot ADB Interface Driver;c:\windows\system32\drivers\motoandroid.sys [2013-3-26 26240]
    S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2013-3-19 21376]
    S3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\drivers\Motousbnet.sys [2013-3-19 23936]
    S3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\drivers\motusbdevice.sys [2013-3-20 11264]
    S3 radpms;Driver for RADPMS Device;c:\windows\system32\drivers\radpms.sys [2012-11-29 13408]
    S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-12-18 14848]
    S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\drivers\ssadbus.sys [2014-2-12 121064]
    S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\drivers\ssadmdfl.sys [2014-2-12 12776]
    S3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\drivers\ssadmdm.sys [2014-2-12 136808]
    S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\drivers\ssudmdm.sys [2014-1-22 184192]
    S3 StorSvc;Storage Service;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992]
    S3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [2012-12-18 24064]
    S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2012-12-18 49664]
    S3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2012-12-18 27136]
    S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2013-5-2 1343400]
    S4 NAUpdate;Nero Update;c:\program files\nero\update\NASvc.exe [2012-7-13 769432]
    .
    =============== Created Last 30 ================
    .
    2015-02-06 15:51:53 -------- d-----w- c:\windows\pss
    2015-02-06 06:41:08 9054624 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{c38023de-35aa-4e7a-8962-574b7fa90ffa}\mpengine.dll
    2015-02-05 20:55:27 -------- d-----w- c:\users\neil\appdata\roaming\SUPERAntiSpyware.com
    2015-02-05 20:55:04 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
    2015-02-05 20:55:04 -------- d-----w- c:\program files\SUPERAntiSpyware
    2015-02-05 20:51:35 114904 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
    2015-02-05 20:51:19 75480 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
    2015-02-05 20:51:19 51928 ----a-w- c:\windows\system32\drivers\mwac.sys
    2015-02-05 20:51:19 23256 ----a-w- c:\windows\system32\drivers\mbam.sys
    2015-02-05 20:51:19 -------- d-----w- c:\programdata\Malwarebytes
    2015-02-05 20:51:19 -------- d-----w- c:\program files\Malwarebytes Anti-Malware
    2015-02-05 20:25:07 -------- d-sh--w- C:\$RECYCLE.BIN
    2015-02-05 20:25:04 -------- d-----w- c:\users\neil\appdata\local\temp
    2015-02-05 18:00:07 -------- d-----w- c:\windows\system32\appmgmt
    2015-02-05 07:18:05 208896 ----a-w- c:\windows\MBR.exe
    2015-02-05 07:18:00 256000 ----a-w- c:\windows\PEV.exe
    2015-02-05 07:17:54 98816 ----a-w- c:\windows\sed.exe
    2015-02-04 22:01:02 -------- d-----w- C:\AdwCleaner
    2015-02-04 21:33:36 220784 ----a-w- c:\program files\mozilla firefox\sandboxbroker.dll
    2015-02-04 19:11:36 -------- d-----w- c:\windows\system32\vbox
    2015-02-04 18:16:23 -------- d-----w- c:\programdata\AVAST Software
    2015-02-04 18:13:10 -------- d-----w- c:\users\neil\appdata\roaming\K9-PCFixer
    2015-02-04 18:11:31 -------- d-----w- c:\users\neil\appdata\local\Programs
    2015-02-03 20:25:42 -------- d--h--w- c:\programdata\Common Files
    2015-02-03 20:25:42 -------- d-----w- c:\users\neil\appdata\local\MFAData
    2015-02-03 20:25:42 -------- d-----w- c:\users\neil\appdata\local\Avg2015
    2015-02-03 20:25:42 -------- d-----w- c:\programdata\MFAData
    2015-02-03 19:52:06 -------- d-----w- C:\found.000
    2015-01-14 12:39:46 3971512 ----a-w- c:\windows\system32\ntkrnlpa.exe
    2015-01-14 12:39:46 3916728 ----a-w- c:\windows\system32\ntoskrnl.exe
    2015-01-14 12:39:43 242688 ----a-w- c:\windows\system32\nlasvc.dll
    2015-01-14 12:39:42 56320 ----a-w- c:\windows\system32\TSWbPrxy.exe
    2015-01-14 12:39:42 164864 ----a-w- c:\windows\system32\profsvc.dll
    2015-01-14 12:39:42 116224 ----a-w- c:\windows\system32\drivers\mrxdav.sys
    .
    ==================== Find3M ====================
    .
    2015-01-26 14:52:02 71344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2015-01-26 14:52:02 701616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
    2015-01-22 13:56:36 96680 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
    2015-01-20 13:22:22 86912 ----a-w- c:\windows\system32\LMIRfsClientNP.dll
    2015-01-20 13:22:22 53096 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\LMIproc.dll
    2015-01-20 13:22:21 85864 ----a-w- c:\windows\system32\LMIinit.dll
    2015-01-20 13:22:21 31592 ----a-w- c:\windows\system32\LMIport.dll
    2015-01-06 09:36:02 249488 ------w- c:\windows\system32\MpSigStub.exe
    2014-12-04 04:38:59 337920 ----a-w- c:\windows\system32\generaltel.dll
    2014-12-04 04:38:45 610304 ----a-w- c:\windows\system32\invagent.dll
    2014-12-04 04:38:40 315392 ----a-w- c:\windows\system32\devinv.dll
    2014-12-04 04:38:37 728576 ----a-w- c:\windows\system32\appraiser.dll
    2014-12-04 04:38:36 202752 ----a-w- c:\windows\system32\aepdu.dll
    2014-12-04 04:38:36 159744 ----a-w- c:\windows\system32\aepic.dll
    2014-12-04 04:34:13 873984 ----a-w- c:\windows\system32\aeinv.dll
    2014-12-01 23:28:26 1160872 ----a-w- c:\windows\system32\aitstatic.exe
    2014-11-26 12:48:44 86912 ----a-w- c:\windows\system32\LMIRfsClientNP.dll.000.bak
    2014-11-19 09:31:16 1217192 ----a-w- c:\windows\system32\FM20.DLL
    2014-11-11 02:44:45 1230336 ----a-w- c:\windows\system32\WindowsCodecs.dll
    2014-11-11 02:44:32 186880 ----a-w- c:\windows\system32\pku2u.dll
    2014-11-11 02:44:25 550912 ----a-w- c:\windows\system32\kerberos.dll
    2014-11-11 01:32:14 74752 ----a-w- c:\windows\system32\drivers\tdx.sys
    .
    ============= FINISH: 13:35:02.92 ===============


    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2012-11-20.01)
    .
    Microsoft Windows 7 Professional
    Boot Device: \Device\HarddiskVolume1
    Install Date: 5/2/2013 4:24:53 PM
    System Uptime: 2/6/2015 1:24:10 PM (0 hours ago)
    .
    Motherboard: Intel Corporation | | DH61CR
    Processor: Intel(R) Core(TM) i3-3220 CPU @ 3.30GHz | CPU 1 | 3300/100mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 454 GiB total, 378.808 GiB free.
    D: is CDROM ()
    .
    ==== Disabled Device Manager Items =============
    .
    ==== System Restore Points ===================
    .
    RP199: 1/20/2015 7:40:29 AM - Windows Update
    RP200: 1/28/2015 7:31:36 AM - Windows Update
    RP201: 2/3/2015 7:31:19 AM - Windows Update
    RP203: 2/4/2015 1:26:35 PM - avast! antivirus system restore point
    RP205: 2/4/2015 4:29:10 PM - avast! antivirus system restore point
    .
    ==== Installed Programs ======================
    .
    32 Bit HP CIO Components Installer
    Aatrix Forms for Sage Timberline Office
    Adobe Flash Player 16 ActiveX
    Adobe Flash Player 16 NPAPI
    Adobe Reader XI (11.0.02)
    Adobe Refresh Manager
    CardScan 6.0.4
    Definition Update for Microsoft Office 2010 (KB2910899) 32-Bit Edition
    Dropbox
    GFI Business Agent
    Google Chrome
    Google Earth
    Google Update Helper
    HP LaserJet Professional M1530 MFP Series
    HP LJ M1530 MFP Series HP Scan
    HP Update
    HPLaserJetHelp_LearnCenter
    HPLJUT
    hppFaxDrvM1530
    hppFaxUtilityM1530
    hppLaserJetService
    hppM1530LaserJetService
    hppSendFaxM1530
    hppTLBXFXM1530
    hpzTLBXFX
    I.R.I.S. OCR
    Intel(R) Control Center
    Intel(R) Management Engine Components
    Intel(R) Network Connections 16.8.46.0
    Intel(R) Processor Graphics
    Intel(R) Rapid Storage Technology
    Intel(R) SDK for OpenCL - CPU Only Runtime Package
    Intel® Trusted Connect Service Client
    Java 7 Update 51
    Java 8 Update 25
    Java 8 Update 31
    Java Auto Updater
    LogMeIn
    Malwarebytes Anti-Malware version 2.0.4.1028
    Microsoft .NET Framework 4.5.1
    Microsoft Mouse and Keyboard Center
    Microsoft Office
    Microsoft Office Access MUI (English) 2010
    Microsoft Office Access Setup Metadata MUI (English) 2010
    Microsoft Office Excel MUI (English) 2010
    Microsoft Office OneNote MUI (English) 2010
    Microsoft Office Outlook MUI (English) 2010
    Microsoft Office PowerPoint MUI (English) 2010
    Microsoft Office Professional 2010
    Microsoft Office Proof (English) 2010
    Microsoft Office Proof (French) 2010
    Microsoft Office Proof (Spanish) 2010
    Microsoft Office Proofing (English) 2010
    Microsoft Office Publisher MUI (English) 2010
    Microsoft Office Shared MUI (English) 2010
    Microsoft Office Shared Setup Metadata MUI (English) 2010
    Microsoft Office Single Image 2010
    Microsoft Office Word MUI (English) 2010
    Microsoft Silverlight
    Microsoft SQL Server 2005
    Microsoft SQL Server 2005 Express Edition (SAGECRE)
    Microsoft SQL Server Native Client
    Microsoft SQL Server Setup Support Files (English)
    Microsoft SQL Server VSS Writer
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
    Motorola Device Manager
    Motorola Device Software Update
    Motorola Mobile Drivers Installation 6.3.0
    Mozilla Firefox 34.0.5 (x86 en-US)
    Mozilla Maintenance Service
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    MSXML 4.0 SP3 Parser
    MSXML 4.0 SP3 Parser (KB2758694)
    Nero 12 Essentials
    Nero Audio Pack 1
    Nero Blu-ray Player
    Nero Blu-ray Player Help (CHM)
    Nero ControlCenter
    Nero ControlCenter Help (CHM)
    Nero Core Components
    Nero Disc Menus Basic
    Nero Effects Basic
    Nero Express
    Nero Express Help (CHM)
    Nero Kwik Media
    Nero Kwik Media Help (CHM)
    Nero Kwik Themes Basic
    Nero PiP Effects Basic
    Nero SharedVideoCodecs
    Nero Update
    Nero Video
    Nero Video Help (CHM)
    neroxml
    Nexlink Recovery Center
    Office Connector (Remove Only)
    Pervasive PSQL v11 Workgroup (32-bit)
    Pervasive PSQL v11 Workgroup (32-bit) SP3
    Prerequisite installer
    Realtek High Definition Audio Driver
    RoofCAD
    RoofLogic Client
    Sage 300 Construction and Real Estate Client
    Sage Office Connector Menu Integration
    Sage Timberline Estimating
    SAMSUNG USB Driver for Mobile Phones
    Security Update for CAPICOM (KB931906)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2894854v2)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2898869)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2901126)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2931368)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2972107)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2972216)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2978128)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2979578v2)
    Security Update for Microsoft Excel 2010 (KB2910902) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2553154) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2553284) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2687423) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2810073) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2850016) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2880971) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2881071) 32-Bit Edition
    Security Update for Microsoft Word 2010 (KB2899519) 32-Bit Edition
    Sentinel Protection Installer 7.6.1
    Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition
    ServiceCEO Client
    SUPERAntiSpyware
    ThermaCAM Connect
    Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition
    Update for Microsoft Excel 2010 (KB2589348) 32-Bit Edition
    Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition
    Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2553140) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2589386) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2597089) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2687275) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2825635) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2837581) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2837602) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2837606) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2883019) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2889818) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2889828) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2910896) 32-Bit Edition
    Update for Microsoft OneNote 2010 (KB2597088) 32-Bit Edition
    Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition
    Update for Microsoft PowerPoint 2010 (KB2880517) 32-Bit Edition
    Update for Microsoft Visio 2010 (KB2880526) 32-Bit Edition
    Update for Microsoft Visio Viewer 2010 (KB2837587) 32-Bit Edition
    Verizon Wireless Software Upgrade Assistant - Samsung
    Verizon Wireless Software Upgrade Assistant - SAMSUNG (TL-PC)
    Windows Live ID Sign-in Assistant
    .
    ==== Event Viewer Messages From Past Week ========
    .
    2/6/2015 9:35:17 AM, Error: Service Control Manager [7022] - The VIPRE Business service hung on starting.
    2/6/2015 7:17:07 AM, Error: Schannel [36888] - The following fatal alert was generated: 40. The internal error state is 252.
    2/6/2015 5:07:45 AM, Error: Schannel [36887] - The following fatal alert was received: 20.
    2/6/2015 10:35:34 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD CSC DfsC discache NetBIOS NetBT nsiproxy Psched rdbss SASDIFSV SASKUTIL spldr tdx Wanarpv6 WfpLwf ws2ifsl
    2/6/2015 10:35:31 AM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    2/6/2015 10:35:31 AM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    2/6/2015 10:35:31 AM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
    2/6/2015 10:35:31 AM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    2/6/2015 10:35:31 AM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    2/6/2015 10:35:31 AM, Error: Service Control Manager [7001] - The PST Service service depends on the Workstation service which failed to start because of the following error: The dependency service or group failed to start.
    2/6/2015 10:35:31 AM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.
    2/6/2015 10:35:31 AM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    2/6/2015 10:35:31 AM, Error: Service Control Manager [7001] - The Network Connections service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    2/6/2015 10:35:31 AM, Error: Service Control Manager [7001] - The Netlogon service depends on the Workstation service which failed to start because of the following error: The dependency service or group failed to start.
    2/6/2015 10:35:31 AM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    2/6/2015 10:35:31 AM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    2/6/2015 10:35:31 AM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    2/6/2015 10:24:00 AM, Error: Service Control Manager [7034] - The Net Driver HPZ12 service terminated unexpectedly. It has done this 1 time(s).
    2/6/2015 10:22:32 AM, Error: Microsoft-Windows-WER-SystemErrorReporting [1001] - The computer has rebooted from a bugcheck. The bugcheck was: 0x000000f4 (0x00000003, 0x881f5530, 0x881f569c, 0x82428f30). A dump was saved in: C:\Windows\MEMORY.DMP. Report Id: 020615-24859-01.
    2/6/2015 1:25:26 PM, Error: Microsoft-Windows-GroupPolicy [1129] - The processing of Group Policy failed because of lack of network connectivity to a domain controller. This may be a transient condition. A success message would be generated once the machine gets connected to the domain controller and Group Policy has succesfully processed. If you do not see a success message for several hours, then contact your administrator.
    2/6/2015 1:24:26 PM, Error: NETLOGON [5719] - This computer was not able to set up a secure session with a domain controller in domain PIEROSROOFING due to the following: There are currently no logon servers available to service the logon request. This may lead to authentication problems. Make sure that this computer is connected to the network. If the problem persists, please contact your domain administrator. ADDITIONAL INFO If this computer is a domain controller for the specified domain, it sets up the secure session to the primary domain controller emulator in the specified domain. Otherwise, this computer sets up the secure session to any domain controller in the specified domain.
    2/6/2015 1:23:38 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
    2/6/2015 1:23:12 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service VSS with arguments "" in order to run the server: {0B5A2C52-3EB9-470A-96E2-6C6D4570E40F}
    2/6/2015 1:06:06 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
    2/6/2015 1:06:06 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
    2/6/2015 1:06:04 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    2/6/2015 1:05:57 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
    2/6/2015 1:05:47 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: discache SASDIFSV SASKUTIL spldr Wanarpv6
    2/6/2015 1:04:46 PM, Error: Microsoft-Windows-GroupPolicy [1055] - The processing of Group Policy failed. Windows could not resolve the computer name. This could be caused by one of more of the following: a) Name Resolution failure on the current domain controller. b) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller).
    2/5/2015 3:23:51 PM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
    2/5/2015 3:15:37 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service VSS with arguments "" in order to run the server: {E579AB5F-1CC4-44B4-BED9-DE0991FF0623}
    2/5/2015 3:08:51 PM, Error: Microsoft-Windows-DistributedCOM [10000] - Unable to start a DCOM Server: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}. The error: "5" Happened while starting this command: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
    2/5/2015 3:07:19 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: discache spldr Wanarpv6
    2/5/2015 11:37:03 AM, Error: Service Control Manager [7023] - The Windows Time service terminated with the following error: A system shutdown is in progress.
    2/5/2015 11:37:03 AM, Error: Microsoft-Windows-Time-Service [5] - The time provider 'NtpClient' returned the following error during shutdown: A system shutdown is in progress. (0x8007045B)
    2/5/2015 11:37:03 AM, Error: Microsoft-Windows-Time-Service [46] - The time service encountered an error and was forced to shut down. The error was: 0x800706D3: The authentication service is unknown.
    2/4/2015 4:58:48 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
    2/4/2015 4:58:46 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service LMIGuardianSvc with arguments "" in order to run the server: {D4258A22-CF85-489D-83AE-49FCD0DFAD29}
    2/4/2015 4:54:53 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the TrustedInstaller service.
    2/4/2015 4:25:19 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Intel(R) PROSet Monitoring Service service to connect.
    2/4/2015 4:25:19 PM, Error: Service Control Manager [7000] - The Intel(R) PROSet Monitoring Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    2/4/2015 11:47:04 PM, Error: Service Control Manager [7034] - The VIPRE Business service terminated unexpectedly. It has done this 1 time(s).
    2/4/2015 11:47:02 PM, Error: Service Control Manager [7034] - The WebEx Service Host for Support Center service terminated unexpectedly. It has done this 1 time(s).
    2/4/2015 11:47:02 PM, Error: Service Control Manager [7034] - The SB Recovery Service service terminated unexpectedly. It has done this 1 time(s).
    2/4/2015 10:10:12 AM, Error: Service Control Manager [7022] - The Intel(R) Management and Security Application User Notification Service service hung on starting.
    2/4/2015 10:06:39 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the eventlog service.
    2/4/2015 1:04:05 AM, Error: Schannel [36887] - The following fatal alert was received: 40.
    2/3/2015 4:22:35 PM, Error: Service Control Manager [7001] - The Fax service depends on the Print Spooler service which failed to start because of the following error: The dependency service or group failed to start.
    2/3/2015 4:03:08 PM, Error: Service Control Manager [7022] - The Windows Defender service hung on starting.
    2/3/2015 3:37:02 PM, Error: Service Control Manager [7022] - The Security Center service hung on starting.
    2/3/2015 3:34:59 PM, Error: Service Control Manager [7022] - The Software Protection service hung on starting.
    2/3/2015 3:32:06 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Google Update Service (gupdate) service to connect.
    2/3/2015 3:32:06 PM, Error: Service Control Manager [7000] - The Google Update Service (gupdate) service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    2/3/2015 3:28:09 PM, Error: Microsoft-Windows-GroupPolicy [1053] - The processing of Group Policy failed. Windows could not resolve the user name. This could be caused by one of more of the following: a) Name Resolution failure on the current domain controller. b) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller).
    2/3/2015 3:19:30 PM, Error: Service Control Manager [7000] - The Software Protection service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    2/3/2015 3:19:29 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Software Protection service to connect.
    2/3/2015 3:18:53 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Nero Update service to connect.
    2/3/2015 3:18:01 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Intel(R) Rapid Storage Technology service to connect.
    2/3/2015 3:18:01 PM, Error: Service Control Manager [7000] - The Intel(R) Rapid Storage Technology service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    2/3/2015 3:12:28 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
    2/3/2015 3:12:17 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
    2/3/2015 3:12:17 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
    2/3/2015 3:11:58 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD CSC DfsC discache NetBIOS NetBT nsiproxy Psched rdbss spldr tdx Wanarpv6 WfpLwf
    2/3/2015 3:07:04 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service BBUpdate with arguments "-Service" in order to run the server: {D6381B4A-D254-46EB-9018-A62E0F4BA6BA}
    2/3/2015 3:06:51 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the BBUpdate service to connect.
    2/3/2015 3:06:51 PM, Error: Service Control Manager [7000] - The BBUpdate service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    2/3/2015 3:01:57 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Intel(R) Management and Security Application User Notification Service service to connect.
    2/3/2015 3:01:57 PM, Error: Service Control Manager [7000] - The Intel(R) Management and Security Application User Notification Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    2/3/2015 2:53:38 PM, Error: Microsoft-Windows-Kernel-General [5] - {Registry Hive Recovered} Registry hive (file): '\??\C:\Users\neil\ntuser.dat' was corrupted and it has been recovered. Some data might have been lost.
    .
    ==== End Of File ===========================
     
  2. Eric Witzling

    Eric Witzling TS Enthusiast Topic Starter Posts: 119

    Thanks for whatever help you can provide. The PC was so slow as to be almost unusable before the initial temp wiping and first cleanups. (Includes MBAM, SuperAntiSpyware, AdwCleaner, ComfoFix and more) It is still herky-jerky now when I watch more temp directories being created. (Even typing in this reply field is being disrupted.)

    Below is the log from the MBAM scan I ran yesterday:

    ------------------------------------------------------------

    Malwarebytes Anti-Malware
    www.malwarebytes.org
    Scan Date: 2/5/2015
    Scan Time: 3:55:31 PM
    Logfile: mbamlogdaybefore.txt
    Administrator: Yes
    Version: 2.00.4.1028
    Malware Database: v2015.02.05.09
    Rootkit Database: v2015.02.03.01
    License: Free
    Malware Protection: Disabled
    Malicious Website Protection: Disabled
    Self-protection: Disabled
    OS: Windows 7 Service Pack 1
    CPU: x86
    File System: NTFS
    User: Neil
    Scan Type: Threat Scan
    Result: Completed
    Objects Scanned: 497783
    Time Elapsed: 51 min, 19 sec
    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Disabled
    Heuristics: Enabled
    PUP: Enabled
    PUM: Enabled
    Processes: 0
    (No malicious items detected)
    Modules: 0
    (No malicious items detected)
    Registry Keys: 0
    (No malicious items detected)
    Registry Values: 0
    (No malicious items detected)
    Registry Data: 0
    (No malicious items detected)
    Folders: 0
    (No malicious items detected)
    Files: 1
    Trojan.Agent, C:\Users\administrator\AppData\Local\temp\Quarantine.exe, Quarantined, [8954ce4c69214de9bbdcfc1ff80acb35],
    Physical Sectors: 0
    (No malicious items detected)

    (end)
     
  3. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ================================

    [​IMG] Download RogueKiller from one of the following links and save it to your Desktop:

    Link 1
    Link 2

    • Close all the running programs
    • Windows Vista/7/8 users: right click on RogueKiller.exe, click Run as Administrator
    • Otherwise just double-click on RogueKiller.exe
    • Pre-scan will start. Let it finish.
    • Click on SCAN button.
    • Wait until the Status box shows Scan Finished
    • Click on Delete.
    • Wait until the Status box shows Deleting Finished.
    • Click on Report and copy/paste the content of the Notepad into your next reply.
    • RKreport.txt could also be found on your desktop.
    • If more than one log is produced post all logs.
    • If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again

    [​IMG] Create new restore point before proceeding with the next step....
    How to: http://www.smartestcomputing.us.com/topic/63983-how-to-create-new-restore-point-all-windows/

    Download [​IMG] Malwarebytes Anti-Rootkit (MBAR) to your desktop.
    • Warning! Malwarebytes Anti-Rootkit needs to be run from an account with administrator rights.
    • Double click on downloaded file. OK self extracting prompt.
    • MBAR will start. Click "Next" to continue.
    • Click in the following screen "Update" to obtain the latest malware definitions.
    • Once the update is complete select "Next" and click "Scan".
    • When the scan is finished and no malware has been found select "Exit".
    • If malware was detected, make sure to check all the items and click "Cleanup". Reboot your computer.
    • Open the MBAR folder located on your Desktop and paste the content of the following files in your next reply:
      • "mbar-log-{date} (xx-xx-xx).txt"
      • "system-log.txt"
    NOTE. If you see This version requires you to completely exit the Anti Malware application message right click on the Malwarebytes Anti-Malware icon in the system tray and click on Exit.
     
  4. Eric Witzling

    Eric Witzling TS Enthusiast Topic Starter Posts: 119

    RogueKiller V10.2.0.0 [Jan 19 2015] by Adlice Software
    mail : http://www.adlice.com/contact/
    Feedback : http://forum.adlice.com
    Website : http://www.adlice.com/softwares/roguekiller/
    Blog : http://www.adlice.com

    Operating System : Windows 7 (6.1.7601 Service Pack 1) 32 bits version
    Started in : Normal mode
    User : Neil [Administrator]
    Mode : Delete -- Date : 02/06/2015 17:29:18

    ¤¤¤ Processes : 3 ¤¤¤
    [Suspicious.Path] VZWSUAM.exe(5052) -- C:\Users\neil\AppData\Roaming\Verizon\SUA\VZWSUAM.exe[7] -> Killed [TermProc]
    [Tr.Poweliks] dllhost.exe(4384) -- C:\Windows\system32\dllhost.exe[7] -> Killed [TermProc]
    [Proc.Svchost] svchost.exe(13036) -- C:\Program Files\Internet Explorer\iexplore.exe[7] -> Killed [TermThr]

    ¤¤¤ Registry : 16 ¤¤¤
    [Suspicious.Path] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\catchme (\??\C:\Users\ADMINI~1\AppData\Local\Temp\catchme.sys) -> Not selected
    [Suspicious.Path] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\mbr (\??\C:\Users\neil\AppData\Local\Temp\mbr.sys) -> Not selected
    [Suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\catchme (\??\C:\Users\ADMINI~1\AppData\Local\Temp\catchme.sys) -> Not selected
    [Suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\catchme (\??\C:\Users\ADMINI~1\AppData\Local\Temp\catchme.sys) -> Not selected
    [Suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\mbr (\??\C:\Users\neil\AppData\Local\Temp\mbr.sys) -> Not selected
    [Suspicious.Path] HKEY_LOCAL_MACHINE\System\ControlSet003\Services\catchme (\??\C:\Users\ADMINI~1\AppData\Local\Temp\catchme.sys) -> Not selected
    [PUM.HomePage] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome -> Not selected
    [PUM.HomePage] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome -> Not selected
    [PUM.SearchPage] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> Not selected
    [PUM.SearchPage] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> Not selected
    [PUM.Policies] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System | ConsentPromptBehaviorAdmin : 0 -> Not selected
    [PUM.StartMenu] HKEY_USERS\S-1-5-21-3616689922-1190870720-954016002-1154\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowMyGames : 0 -> Not selected
    [PUM.StartMenu] HKEY_USERS\S-1-5-21-3616689922-1190870720-954016002-1154\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowRecentDocs : 0 -> Not selected
    [PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Not selected
    [PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Not selected
    [Tr.Poweliks] HKEY_USERS\S-1-5-21-3616689922-1190870720-954016002-1154\Software\classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\LocalServer32 -> Deleted

    ¤¤¤ Tasks : 0 ¤¤¤

    ¤¤¤ Files : 0 ¤¤¤

    ¤¤¤ Hosts File : 1 ¤¤¤
    [C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 localhost

    ¤¤¤ Antirootkit : 0 (Driver: Loaded) ¤¤¤

    ¤¤¤ Web browsers : 0 ¤¤¤

    ¤¤¤ MBR Check : ¤¤¤
    +++++ PhysicalDrive0: +++++
    --- User ---
    [MBR] a159197eca149596ce24db3748676346
    [BSP] a7ea35c3ca3eebe6ea4d160369aa6fa2 : HP MBR Code
    Partition table:
    0 - [ACTIVE] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 11800 MB
    1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 24168448 | Size: 465139 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]
    User = LL1 ... OK
    User = LL2 ... OK


    ============================================
    RKreport_SCN_02062015_172853.log




    Malwarebytes Anti-Rootkit BETA 1.08.3.1004
    www.malwarebytes.org

    Database version:
    main: v2015.02.06.08
    rootkit: v2015.02.03.01

    Windows 7 Service Pack 1 x86 NTFS
    Internet Explorer 9.0.8112.16421
    Neil :: PIEROS-NEX-0513 [administrator]

    2/6/2015 5:31:02 PM
    mbar-log-2015-02-06 (17-31-02).txt

    Scan type: Quick scan
    Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
    Scan options disabled:
    Objects scanned: 497478
    Time elapsed: 19 minute(s), 43 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 1
    HKU\S-1-5-21-3616689922-1190870720-954016002-1154_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5} (Trojan.Poweliks.B) -> Delete on reboot. [370921fa8307c47272fd7f837c8403fd]

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 0
    (No malicious items detected)

    Physical Sectors Detected: 0
    (No malicious items detected)

    (end)



    ---------------------------------------
    Malwarebytes Anti-Rootkit BETA 1.08.3.1004

    (c) Malwarebytes Corporation 2011-2012

    OS version: 6.1.7601 Windows 7 Service Pack 1 x86

    Account is Administrative

    Internet Explorer version: 9.0.8112.16421

    File system is: NTFS
    Disk drives: C:\ DRIVE_FIXED
    CPU speed: 3.292000 GHz
    Memory total: 3694768128, free: 1639469056

    ---------------------------------------
    Malwarebytes Anti-Rootkit BETA 1.08.3.1004

    (c) Malwarebytes Corporation 2011-2012

    OS version: 6.1.7601 Windows 7 Service Pack 1 x86

    Account is Administrative

    Internet Explorer version: 9.0.8112.16421

    File system is: NTFS
    Disk drives: C:\ DRIVE_FIXED
    CPU speed: 3.292000 GHz
    Memory total: 3694768128, free: 1682628608

    No address found
    =======================================


    Host not found
    Downloaded database version: v2015.02.06.08
    Downloaded database version: v2015.02.03.01
    Downloaded database version: v2014.12.06.01
    =======================================
    Initializing...
    ------------ Kernel report ------------
    02/06/2015 17:30:51
    ------------ Loaded modules -----------
    \SystemRoot\system32\ntkrnlpa.exe
    \SystemRoot\system32\halmacpi.dll
    \SystemRoot\system32\kdcom.dll
    \SystemRoot\system32\mcupdate_GenuineIntel.dll
    \SystemRoot\system32\PSHED.dll
    \SystemRoot\system32\BOOTVID.dll
    \SystemRoot\system32\CLFS.SYS
    \SystemRoot\system32\CI.dll
    \SystemRoot\system32\drivers\Wdf01000.sys
    \SystemRoot\system32\drivers\WDFLDR.SYS
    \SystemRoot\system32\drivers\ACPI.sys
    \SystemRoot\system32\drivers\WMILIB.SYS
    \SystemRoot\system32\drivers\msisadrv.sys
    \SystemRoot\system32\drivers\pci.sys
    \SystemRoot\system32\drivers\vdrvroot.sys
    \SystemRoot\System32\drivers\partmgr.sys
    \SystemRoot\system32\drivers\volmgr.sys
    \SystemRoot\System32\drivers\volmgrx.sys
    \SystemRoot\System32\drivers\mountmgr.sys
    \SystemRoot\system32\DRIVERS\iaStor.sys
    \SystemRoot\system32\drivers\atapi.sys
    \SystemRoot\system32\drivers\ataport.SYS
    \SystemRoot\system32\drivers\msahci.sys
    \SystemRoot\system32\drivers\PCIIDEX.SYS
    \SystemRoot\system32\drivers\amdxata.sys
    \SystemRoot\system32\drivers\fltmgr.sys
    \SystemRoot\system32\drivers\fileinfo.sys
    \SystemRoot\System32\Drivers\Ntfs.sys
    \SystemRoot\System32\Drivers\msrpc.sys
    \SystemRoot\System32\Drivers\ksecdd.sys
    \SystemRoot\System32\Drivers\cng.sys
    \SystemRoot\System32\drivers\pcw.sys
    \SystemRoot\System32\Drivers\Fs_Rec.sys
    \SystemRoot\system32\drivers\ndis.sys
    \SystemRoot\system32\drivers\NETIO.SYS
    \SystemRoot\System32\Drivers\ksecpkg.sys
    \SystemRoot\System32\drivers\tcpip.sys
    \SystemRoot\System32\drivers\fwpkclnt.sys
    \SystemRoot\system32\drivers\vmstorfl.sys
    \SystemRoot\system32\drivers\volsnap.sys
    \SystemRoot\System32\Drivers\spldr.sys
    \SystemRoot\System32\drivers\rdyboost.sys
    \SystemRoot\System32\Drivers\mup.sys
    \SystemRoot\System32\drivers\hwpolicy.sys
    \SystemRoot\System32\DRIVERS\fvevol.sys
    \SystemRoot\system32\drivers\disk.sys
    \SystemRoot\system32\drivers\CLASSPNP.SYS
    \SystemRoot\system32\DRIVERS\cdrom.sys
    \SystemRoot\System32\Drivers\Null.SYS
    \SystemRoot\System32\Drivers\Beep.SYS
    \SystemRoot\System32\drivers\vga.sys
    \SystemRoot\System32\drivers\VIDEOPRT.SYS
    \SystemRoot\System32\drivers\watchdog.sys
    \SystemRoot\System32\DRIVERS\RDPCDD.sys
    \SystemRoot\system32\drivers\rdpencdd.sys
    \SystemRoot\system32\drivers\rdprefmp.sys
    \SystemRoot\System32\Drivers\Msfs.SYS
    \SystemRoot\System32\Drivers\Npfs.SYS
    \SystemRoot\system32\DRIVERS\tdx.sys
    \SystemRoot\system32\DRIVERS\TDI.SYS
    \SystemRoot\system32\drivers\afd.sys
    \SystemRoot\System32\DRIVERS\netbt.sys
    \SystemRoot\system32\drivers\ws2ifsl.sys
    \SystemRoot\system32\DRIVERS\wfplwf.sys
    \SystemRoot\system32\DRIVERS\pacer.sys
    \SystemRoot\system32\DRIVERS\netbios.sys
    \SystemRoot\system32\DRIVERS\serial.sys
    \SystemRoot\system32\DRIVERS\wanarp.sys
    \SystemRoot\system32\DRIVERS\termdd.sys
    \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
    \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
    \SystemRoot\system32\DRIVERS\rdbss.sys
    \SystemRoot\system32\drivers\nsiproxy.sys
    \SystemRoot\system32\DRIVERS\mssmbios.sys
    \SystemRoot\System32\drivers\discache.sys
    \SystemRoot\system32\drivers\csc.sys
    \SystemRoot\System32\Drivers\dfsc.sys
    \SystemRoot\system32\DRIVERS\blbdrive.sys
    \SystemRoot\system32\DRIVERS\tunnel.sys
    \SystemRoot\system32\DRIVERS\igdkmd32.sys
    \SystemRoot\System32\drivers\dxgkrnl.sys
    \SystemRoot\System32\drivers\dxgmms1.sys
    \SystemRoot\system32\DRIVERS\HECI.sys
    \SystemRoot\system32\DRIVERS\e1c6232.sys
    \SystemRoot\system32\drivers\usbehci.sys
    \SystemRoot\system32\drivers\USBPORT.SYS
    \SystemRoot\system32\DRIVERS\HDAudBus.sys
    \SystemRoot\system32\DRIVERS\serenum.sys
    \SystemRoot\system32\DRIVERS\parport.sys
    \SystemRoot\system32\DRIVERS\intelppm.sys
    \SystemRoot\system32\DRIVERS\CompositeBus.sys
    \SystemRoot\system32\DRIVERS\lmimirr.sys
    \SystemRoot\system32\drivers\serscan.sys
    \SystemRoot\system32\DRIVERS\AgileVpn.sys
    \SystemRoot\system32\DRIVERS\rasl2tp.sys
    \SystemRoot\system32\DRIVERS\ndistapi.sys
    \SystemRoot\system32\DRIVERS\ndiswan.sys
    \SystemRoot\system32\DRIVERS\raspppoe.sys
    \SystemRoot\system32\DRIVERS\raspptp.sys
    \SystemRoot\system32\DRIVERS\rassstp.sys
    \SystemRoot\system32\DRIVERS\rdpbus.sys
    \SystemRoot\system32\DRIVERS\kbdclass.sys
    \SystemRoot\system32\DRIVERS\mouclass.sys
    \SystemRoot\system32\DRIVERS\swenum.sys
    \SystemRoot\system32\DRIVERS\ks.sys
    \SystemRoot\system32\DRIVERS\umbus.sys
    \SystemRoot\system32\DRIVERS\usbhub.sys
    \SystemRoot\System32\Drivers\NDProxy.SYS
    \SystemRoot\system32\drivers\RTKVHDA.sys
    \SystemRoot\system32\drivers\portcls.sys
    \SystemRoot\system32\drivers\drmk.sys
    \SystemRoot\System32\Drivers\crashdmp.sys
    \SystemRoot\System32\Drivers\dump_iaStor.sys
    \SystemRoot\System32\Drivers\dump_dumpfve.sys
    \SystemRoot\System32\win32k.sys
    \SystemRoot\System32\drivers\Dxapi.sys
    \SystemRoot\system32\DRIVERS\monitor.sys
    \SystemRoot\system32\DRIVERS\hidusb.sys
    \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
    \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
    \SystemRoot\system32\DRIVERS\USBD.SYS
    \SystemRoot\system32\DRIVERS\mouhid.sys
    \SystemRoot\system32\DRIVERS\point32.sys
    \SystemRoot\system32\DRIVERS\kbdhid.sys
    \SystemRoot\System32\TSDDD.dll
    \SystemRoot\System32\cdd.dll
    \SystemRoot\system32\drivers\luafv.sys
    \SystemRoot\system32\DRIVERS\sbapifs.sys
    \SystemRoot\system32\DRIVERS\lltdio.sys
    \SystemRoot\system32\DRIVERS\rspndr.sys
    \SystemRoot\system32\drivers\HTTP.sys
    \SystemRoot\system32\DRIVERS\bowser.sys
    \SystemRoot\System32\drivers\mpsdrv.sys
    \SystemRoot\system32\DRIVERS\mrxsmb.sys
    \SystemRoot\system32\DRIVERS\mrxsmb10.sys
    \SystemRoot\system32\DRIVERS\mrxsmb20.sys
    \??\C:\Windows\system32\Drivers\PAR1284.SYS
    \SystemRoot\system32\DRIVERS\parvdm.sys
    \??\C:\Windows\system32\Drivers\PPNT.SYS
    \SystemRoot\System32\Drivers\SENTINEL.SYS
    \??\C:\Program Files\LogMeIn\x86\RaInfo.sys
    \??\C:\Windows\system32\drivers\LMIRfsDriver.sys
    \SystemRoot\system32\drivers\peauth.sys
    \SystemRoot\System32\Drivers\secdrv.SYS
    \SystemRoot\System32\DRIVERS\srvnet.sys
    \SystemRoot\System32\drivers\tcpipreg.sys
    \SystemRoot\System32\DRIVERS\srv2.sys
    \SystemRoot\System32\DRIVERS\srv.sys
    \SystemRoot\system32\DRIVERS\sbwtis.sys
    \??\C:\Users\neil\AppData\Local\Temp\mbr.sys
    \??\C:\Windows\system32\drivers\mbamchameleon.sys
    \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
    \Windows\System32\ntdll.dll
    \Windows\System32\smss.exe
    \Windows\System32\apisetschema.dll
    \Windows\System32\autochk.exe
    \Windows\System32\shell32.dll
    \Windows\System32\lpk.dll
    \Windows\System32\comdlg32.dll
    \Windows\System32\sechost.dll
    \Windows\System32\psapi.dll
    \Windows\System32\ole32.dll
    \Windows\System32\difxapi.dll
    ----------- End -----------
    Done!

    Scan started
    Database versions:
    main: v2015.02.06.08
    rootkit: v2015.02.03.01

    <<<2>>>
    Physical Sector Size: 512
    Drive: 0, DevicePointer: 0xffffffff88d24990, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
    --------- Disk Stack ------
    DevicePointer: 0xffffffff88d245c8, DeviceName: Unknown, DriverName: \Driver\partmgr\
    DevicePointer: 0xffffffff88d24990, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
    DevicePointer: 0xffffffff86a30950, DeviceName: Unknown, DriverName: \Driver\ACPI\
    DevicePointer: 0xffffffff86a03028, DeviceName: \Device\Ide\IAAStorageDevice-1\, DriverName: \Driver\iaStor\
    ------------ End ----------
    Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
    Upper DeviceData: 0x0, 0x0, 0x0
    Lower DeviceData: 0x0, 0x0, 0x0
    <<<3>>>
    Volume: C:
    File system type: NTFS
    SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
    <<<2>>>
    <<<3>>>
    Volume: C:
    File system type: NTFS
    SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
    Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
    Done!
    Drive 0
    This is a System drive
    Scanning MBR on drive 0...
    Inspecting partition table:
    MBR Signature: 55AA
    Disk Signature: 7E12B51D

    Partition information:

    Partition 0 type is Other (0x27)
    Partition is ACTIVE.
    Partition starts at LBA: 2048 Numsec = 24166400
    Partition file system is NTFS
    Partition is bootable

    Partition 1 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 24168448 Numsec = 952604672

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Disk Size: 500107862016 bytes
    Sector size: 512 bytes

    Done!
    Infected: HKU\S-1-5-21-3616689922-1190870720-954016002-1154_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5} --> [Trojan.Poweliks.B]
    Scan finished
    Creating System Restore point...
    Cleaning up...
    Executing an action cmd.exe...
    Success!
    Executing an action cmd.exe...
    Success!
    Removal successful. No system shutdown is required.
    =======================================
     
  5. Eric Witzling

    Eric Witzling TS Enthusiast Topic Starter Posts: 119

    So far no return of the crazy. Will keep watch remotely, over the weekend.
     
  6. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    Good :)

    You were infected with Poweliks trojan.

    Please download Powelikscleaner (by ESET) and save it to your Desktop.

    1. Double-click on ESETPoweliksCleaner.exe to start the tool.

    2. Read the terms of the End-user license agreement and click Agree.

    3. The tool will run automatically. If the cleaner finds a Poweliks infection, press the Y key on your keyboard to remove it.

    [​IMG]

    4. If Poweliks was detected "Win32/Poweliks was successfully removed from your system" will be displayed. Press any key to exit the tool and reboot your PC.

    [​IMG]

    The tool will produce a log in the same directory the tool was run from.

    Please copy and paste the log in your next reply.
     
  7. Eric Witzling

    Eric Witzling TS Enthusiast Topic Starter Posts: 119

    "Threat Not Found"

    No evidence of the previous behavior, even after weekend of online connection, and multiple reboots.

    -----------------------------------------------------------------

    Apologies, but this morning is very busy and I don't have time to keep trying to cut up this enormous log file (418k characters) to try to copy and past contents into the text box here, especially since the limit is 50k and it keeps breaking and forcing me to reload the page when an attempt fails.

    I have used "Upload a File" instead.
     

    Attached Files:

  8. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    Good :)

    Please download ComboFix from Here, Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Never rename Combofix unless instructed.
    • Close any open browsers.
    • Very Important! Temporarily disable your anti-virus and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      If the connection is not there use restore point you created prior to running Combofix.
    • Double click on combofix.exe & follow the prompts.

    • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error Illegal operation attempted on a registery key that has been marked for deletion, restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try the following...

    Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.
    Download Rkill (courtesy of BleepingComputer.com) to your desktop.
    There are 2 different versions. If one of them won't run then download and try to run the other one.
    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
    iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

    Restart computer in safe mode

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Windows Vista, 7 or 8 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    When the scan is done Notepad will open with rKill.txt log.
    NOTE. rKill.txt log will also be present on your desktop.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.
     
  9. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    Still with me?
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...