|
Unknown virus blocking access to websites and various other ailments
|
|
Moderator
1 product review
|
10. September 2013 @ 13:57 |
Link to this message
|
Long time no see ladies and gents.
Two weeks ago I picked up the webcake and, I can't remember the name, supersearch something or rather. Removed them easily or so I thought. Now comes last Thursday, Shockwave crashes and Chrome freezes. Firefox gets dreaded "program not responding". Whole PC freezes periodically etc. When Chrome does work the only websites I can access while not in safe mode are facebook, google and youtube. Facebook appears to have full functionality, but after performing a search in google none of the links open and I eventualy get a time out message and the same for youtube, I can click on a link to a video but it never plays.
I posted a DDS log at Bleeping Computer, but have yet to receive a response. While waiting I ran several programs as suggested to others with similar issues on BC to no avail. I've removed everything that they have returned but nothing has changed performance wise on my PC.
This is the order and the programs that I used, all done in safe mode and run as administrator:
Rkill
RogueKiller
ADWCleaner
MBAM
ESET Online Scanner
JRT
MBAR
ComboFix
After removing everything they've found nothing has changed performance wise so there is something I'm missing. Below is a fresh DDS log after all the cleaning I've done:
DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 10.0.9200.16660
Run by STEELY DAN II at 13:40:43 on 2013-09-10
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.7655.4734 [GMT -4:00]
.
AV: Bitdefender Antivirus Free Edition *Enabled/Updated* {9B5F5313-CAF9-DD97-C460-E778420237B4}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Spybot - Search and Destroy *Disabled/Outdated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Bitdefender Antivirus Free Edition *Enabled/Updated* {203EB2F7-ECC3-D219-FED0-DC0A39857D09}
.
============== Running Processes ===============
.
C:\windows\system32\lsm.exe
C:\windows\system32\svchost.exe -k DcomLaunch
C:\Program Files\Bitdefender\Antivirus Free Edition\gzserv.exe
C:\windows\system32\svchost.exe -k RPCSS
C:\windows\system32\atiesrxx.exe
C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\windows\system32\svchost.exe -k LocalService
C:\windows\system32\svchost.exe -k netsvcs
C:\Program Files\HitmanPro\hmpsched.exe
C:\windows\system32\svchost.exe -k NetworkService
C:\windows\system32\atieclxx.exe
C:\windows\System32\spoolsv.exe
C:\windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Bitdefender\Antivirus Free Edition\gziface.exe
C:\windows\system32\Dwm.exe
C:\windows\system32\taskhost.exe
C:\windows\Explorer.EXE
C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\Google\Update\1.3.21.153\GoogleCrashHandler.exe
C:\Program Files (x86)\Google\Update\1.3.21.153\GoogleCrashHandler64.exe
C:\windows\system32\svchost.exe -k imgsvc
C:\windows\system32\TODDSrv.exe
C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files (x86)\Mobile Stream\EasyTether\easytthr.exe
C:\Users\STEELY DAN II\AppData\Roaming\uTorrent\uTorrent.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\HTC\ModeSelection\VMMModeSelection.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
C:\Program Files\TOSHIBA\TECO\TecoService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\windows\system32\SearchIndexer.exe
C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Users\STEELY DAN II\Downloads\AutoClicker\AutoClicker.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\STEELY DAN II\AppData\Local\Google\Chrome SxS\Application\chrome.exe
C:\Users\STEELY DAN II\AppData\Local\Google\Chrome SxS\Application\chrome.exe
C:\Users\STEELY DAN II\AppData\Local\Google\Chrome SxS\Application\chrome.exe
C:\Users\STEELY DAN II\AppData\Local\Google\Chrome SxS\Application\chrome.exe
C:\Users\STEELY DAN II\AppData\Local\Google\Chrome SxS\Application\chrome.exe
C:\Users\STEELY DAN II\AppData\Local\Google\Chrome SxS\Application\chrome.exe
C:\Users\STEELY DAN II\AppData\Local\Google\Chrome SxS\Application\chrome.exe
C:\Users\STEELY DAN II\AppData\Local\Google\Chrome SxS\Application\chrome.exe
C:\Users\STEELY DAN II\AppData\Local\Google\Chrome SxS\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\windows\system32\wbem\wmiprvse.exe
C:\windows\System32\svchost.exe -k WerSvcGroup
C:\windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://search.yahoo.com?type=714647&fr=spigot-yhp-ie
uProxyOverride = localhost;127.0.0.1;<local>;*.local
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: TOSHIBA Media Controller Plug-in: {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\Toshiba\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll
uRun: [EasyTether] "C:\Program Files (x86)\Mobile Stream\EasyTether\easytthr.exe"
uRun: [uTorrent] "C:\Users\STEELY DAN II\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED
uRun: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [VMM Mode Selection] C:\Program Files\HTC\ModeSelection\VMMModeSelection.exe
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [SDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDrives = dword:0
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
TCP: NameServer = 192.168.1.1
TCP: Interfaces\{5B4D5D6B-3709-401D-812C-38B01D03FAAE} : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{5B4D5D6B-3709-401D-812C-38B01D03FAAE}\3416D656C6F64733 : DHCPNameServer = 172.24.1.1
TCP: Interfaces\{C4627585-9A35-4CA1-96EB-BC8AD0F14AC9} : DHCPNameServer = 8.8.8.8 8.8.4.4
TCP: Interfaces\{CBEF9348-E751-4D83-B472-0F7A732F21BD} : DHCPNameServer = 75.75.75.75 75.75.76.76
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
Notify: SDWinLogon - SDWinLogon.dll
SSODL: WebCheck - <orphaned>
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
x64-BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
x64-BHO: TOSHIBA Media Controller Plug-in: {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\Toshiba\TOSHIBA Media Controller Plug-in\x64\TOSHIBAMediaControllerIE.dll
x64-Run: [TPwrMain] C:\Program Files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE
x64-Run: [HSON] C:\Program Files (x86)\TOSHIBA\TBS\HSON.exe
x64-Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe /t
x64-Run: [cAudioFilterAgent] C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe
x64-Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe
x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
x64-SSODL: WebCheck - <orphaned>
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\STEELY DAN II\AppData\Roaming\Mozilla\Firefox\Profiles\qcr7ryhp.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://search.yahoo.com?type=714647&fr=spigot-yhp-ff
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=714647&p=
FF - plugin: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll
FF - plugin: c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrlui.dll
FF - plugin: C:\Users\STEELY DAN II\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll
FF - plugin: C:\windows\System32\Macromed\Flash\NPSWF64_11_8_800_94.dll
FF - plugin: C:\windows\System32\npDeployJava1.dll
FF - plugin: C:\windows\System32\npmproxy.dll
.
============= SERVICES / DRIVERS ===============
.
R0 avc3;avc3;C:\windows\System32\drivers\avc3.sys [2013-8-22 718840]
R1 bdfwfpf;bdfwfpf;C:\Program Files\Bitdefender\Antivirus Free Edition\bdfwfpf.sys [2013-9-9 121928]
R1 gzflt;gzflt;C:\windows\System32\drivers\gzflt.sys [2013-8-22 148696]
R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]
R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2013-5-23 143120]
R2 AMD External Events Utility;AMD External Events Utility;C:\windows\System32\atiesrxx.exe [2012-2-19 204288]
R2 gzserv;Bitdefender Antivirus Free Edition;C:\Program Files\Bitdefender\Antivirus Free Edition\gzserv.exe [2013-8-29 64224]
R2 HitmanProScheduler;HitmanPro Scheduler;C:\Program Files\HitmanPro\hmpsched.exe [2013-9-8 109352]
R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-1-30 418376]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-1-30 701512]
R2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;C:\windows\System32\drivers\TVALZFL.sys [2009-6-19 14472]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;C:\windows\System32\drivers\AtihdW76.sys [2012-2-19 116752]
R3 avckf;avckf;C:\windows\System32\drivers\avckf.sys [2013-8-22 593144]
R3 easytether;easytether;C:\windows\System32\drivers\easytthr.sys [2012-4-10 20752]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\windows\System32\drivers\L1C62x64.sys [2011-2-9 77424]
R3 MBAMProtector;MBAMProtector;C:\windows\System32\drivers\mbam.sys [2013-1-30 25928]
R3 PGEffect;Pangu effect driver;C:\windows\System32\drivers\PGEffect.sys [2012-2-19 38096]
R3 QIOMem;Generic IO & Memory Access;C:\windows\System32\drivers\QIOMem.sys [2009-6-15 12800]
R3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;C:\windows\System32\drivers\rtl8192ce.sys [2012-2-19 1109096]
R3 Sftfs;Sftfs;C:\windows\System32\drivers\Sftfslh.sys [2011-10-1 764264]
R3 Sftplay;Sftplay;C:\windows\System32\drivers\Sftplaylh.sys [2011-10-1 268648]
R3 Sftvol;Sftvol;C:\windows\System32\drivers\Sftvollh.sys [2011-10-1 22376]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2012-1-4 822624]
S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]
S3 htcusbnet;HTC USB-NDIS miniport;C:\windows\System32\drivers\htcusbnet.sys [2012-4-10 153600]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\windows\System32\drivers\RtsUStor.sys [2012-2-19 250984]
S3 RSUSBVSTOR;RTSUVSTOR.Sys Realtek USB Card Reader;C:\windows\System32\drivers\rtsuvstor.sys [2012-2-19 307304]
S3 Sftredir;Sftredir;C:\windows\System32\drivers\Sftredirlh.sys [2011-10-1 25960]
S3 TsUsbFlt;TsUsbFlt;C:\windows\System32\drivers\TsUsbFlt.sys [2010-11-20 59392]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\windows\System32\drivers\TsUsbGD.sys [2010-11-20 31232]
S3 USBAAPL64;Apple Mobile USB Driver;C:\windows\System32\drivers\usbaapl64.sys [2012-12-13 54784]
.
=============== Created Last 30 ================
.
2013-09-09 20:13:42 -------- d-sh--w- C:\$RECYCLE.BIN
2013-09-09 20:05:23 98816 ----a-w- C:\windows\sed.exe
2013-09-09 20:05:23 256000 ----a-w- C:\windows\PEV.exe
2013-09-09 20:05:23 208896 ----a-w- C:\windows\MBR.exe
2013-09-09 02:52:41 -------- d-----w- C:\Program Files\HitmanPro
2013-09-09 02:52:08 -------- d-----w- C:\ProgramData\HitmanPro
2013-09-09 01:15:13 -------- d-----w- C:\Users\STEELY DAN II\AppData\Roaming\SUPERAntiSpyware.com
2013-09-09 01:15:05 -------- d-----w- C:\ProgramData\SUPERAntiSpyware.com
2013-09-09 01:15:05 -------- d-----w- C:\Program Files\SUPERAntiSpyware
2013-09-08 21:48:57 -------- d-----w- C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-09-08 21:20:23 -------- d-----w- C:\windows\ERUNT
2013-09-08 19:21:03 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy
2013-09-08 19:10:06 -------- d-----w- C:\AdwCleaner
2013-09-08 19:02:59 17272 ----a-w- C:\windows\System32\sdnclean64.exe
2013-09-08 19:02:53 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-09-07 21:24:51 -------- d-----w- C:\Users\STEELY DAN II\AppData\Local\ElevatedDiagnostics
2013-09-06 19:52:02 -------- d-----w- C:\Users\STEELY DAN II\Microsoft WINDOWS 8 1 RTM x64 ISO [ThumperDC]
2013-08-22 10:09:06 261056 ----a-w- C:\windows\System32\drivers\avchv.sys
2013-08-22 10:05:30 718840 ----a-w- C:\windows\System32\drivers\avc3.sys
2013-08-22 10:05:30 593144 ----a-w- C:\windows\System32\drivers\avckf.sys
2013-08-22 10:02:45 -------- d-----w- C:\Users\STEELY DAN II\AppData\Roaming\QuickScan
2013-08-22 10:02:26 -------- d-----w- C:\Program Files\Bitdefender
2013-08-22 10:02:24 148696 ----a-w- C:\windows\System32\drivers\gzflt.sys
2013-08-22 10:02:21 382536 ----a-w- C:\windows\System32\drivers\trufos.sys
2013-08-13 23:01:53 1472512 ----a-w- C:\windows\System32\crypt32.dll
.
==================== Find3M ====================
.
2013-08-20 23:08:28 71048 ----a-w- C:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-08-20 23:08:28 692104 ----a-w- C:\windows\SysWow64\FlashPlayerApp.exe
2013-07-26 05:13:37 2241024 ----a-w- C:\windows\System32\wininet.dll
2013-07-26 05:12:08 3958784 ----a-w- C:\windows\System32\jscript9.dll
2013-07-26 05:12:04 136704 ----a-w- C:\windows\System32\iesysprep.dll
2013-07-26 05:12:03 67072 ----a-w- C:\windows\System32\iesetup.dll
2013-07-26 03:35:08 2706432 ----a-w- C:\windows\System32\mshtml.tlb
2013-07-26 03:13:24 1767936 ----a-w- C:\windows\SysWow64\wininet.dll
2013-07-26 03:12:04 2877440 ----a-w- C:\windows\SysWow64\jscript9.dll
2013-07-26 03:12:00 61440 ----a-w- C:\windows\SysWow64\iesetup.dll
2013-07-26 03:12:00 109056 ----a-w- C:\windows\SysWow64\iesysprep.dll
2013-07-26 02:49:14 2706432 ----a-w- C:\windows\SysWow64\mshtml.tlb
2013-07-26 02:39:38 89600 ----a-w- C:\windows\System32\RegisterIEPKEYs.exe
2013-07-26 01:59:38 71680 ----a-w- C:\windows\SysWow64\RegisterIEPKEYs.exe
2013-07-25 09:25:54 1888768 ----a-w- C:\windows\System32\WMVDECOD.DLL
2013-07-25 08:57:27 1620992 ----a-w- C:\windows\SysWow64\WMVDECOD.DLL
2013-07-19 01:58:42 2048 ----a-w- C:\windows\System32\tzres.dll
2013-07-19 01:41:01 2048 ----a-w- C:\windows\SysWow64\tzres.dll
2013-07-09 06:03:30 5550528 ----a-w- C:\windows\System32\ntoskrnl.exe
2013-07-09 05:54:22 1732032 ----a-w- C:\windows\System32\ntdll.dll
2013-07-09 05:53:12 243712 ----a-w- C:\windows\System32\wow64.dll
2013-07-09 05:52:52 224256 ----a-w- C:\windows\System32\wintrust.dll
2013-07-09 05:51:16 1217024 ----a-w- C:\windows\System32\rpcrt4.dll
2013-07-09 05:46:20 184320 ----a-w- C:\windows\System32\cryptsvc.dll
2013-07-09 05:46:20 139776 ----a-w- C:\windows\System32\cryptnet.dll
2013-07-09 05:03:34 3968960 ----a-w- C:\windows\SysWow64\ntkrnlpa.exe
2013-07-09 05:03:34 3913664 ----a-w- C:\windows\SysWow64\ntoskrnl.exe
2013-07-09 04:53:47 1292192 ----a-w- C:\windows\SysWow64\ntdll.dll
2013-07-09 04:52:33 663552 ----a-w- C:\windows\SysWow64\rpcrt4.dll
2013-07-09 04:52:33 5120 ----a-w- C:\windows\SysWow64\wow32.dll
2013-07-09 04:52:10 175104 ----a-w- C:\windows\SysWow64\wintrust.dll
2013-07-09 04:46:31 140288 ----a-w- C:\windows\SysWow64\cryptsvc.dll
2013-07-09 04:46:31 1166848 ----a-w- C:\windows\SysWow64\crypt32.dll
2013-07-09 04:46:31 103936 ----a-w- C:\windows\SysWow64\cryptnet.dll
2013-07-09 04:45:07 44032 ----a-w- C:\windows\apppatch\acwow64.dll
2013-07-09 02:49:42 25600 ----a-w- C:\windows\SysWow64\setup16.exe
2013-07-09 02:49:41 7680 ----a-w- C:\windows\SysWow64\instnm.exe
2013-07-09 02:49:39 14336 ----a-w- C:\windows\SysWow64\ntvdm64.dll
2013-07-09 02:49:38 2048 ----a-w- C:\windows\SysWow64\user.exe
2013-07-06 06:03:53 1910208 ----a-w- C:\windows\System32\drivers\tcpip.sys
2013-06-15 04:32:16 39936 ----a-w- C:\windows\System32\drivers\tssecsrv.sys
.
============= FINISH: 13:41:49.15 ===============
|
|
Advertisement
|
|
|
|
|
ddp
Moderator
|
10. September 2013 @ 19:32 |
Link to this message
|
|
hello loco, have you tried system restore even in safemode to before the problem started?
|
Moderator
1 product review
|
10. September 2013 @ 20:33 |
Link to this message
|
|
I did, but it wouldn't complete...I got an error that my AV was preventing it, but I turned it all off before hand. Safe mode or regular mode.
|
|
ddp
Moderator
|
10. September 2013 @ 20:50 |
Link to this message
|
|
uninstall the av than retry the system restore.
|
AfterDawn Addict
|
10. September 2013 @ 21:33 |
Link to this message
|
Hi LOCOENG, it's been a long, long time. hate to hear from you under these circumstances...
Sounds like you have picked up the ZeroAccess rootkit that can completely destroy your operating system.
Run this one and maybe it will show up to see if that's what it really is:
if it is; system restore won't work.
RogueKiller
Please download and save RogueKiller to your Desktop.
32bit -> HERE!
64bit -> HERE!
? Quit all programs that you may have started.
? Please disconnect any USB or external drives from the computer before you run this scan!
? For Vista or Windows 7, right-click and select "Run as Administrator to start" For Windows XP, double-click to start.
? Wait until Prescan has finished ...
? Then Click on "Scan" button
? Wait until the Status box shows "Scan Finished"
? click on "delete"
? Wait until the Status box shows "Deleting Finished"
? Click on "Report" and copy/paste the content of the Notepad into your next reply.
? The log should be found in RKreport[1].txt on your Desktop
? Exit/Close RogueKiller+
EDIT sorry see that you have ran RK missed it..
2oG
There are three kinds of men: The ones that learn by reading; The few who learn by observation;
The rest of them have to pee on the electric fence and find out for themselves...This message has been edited since posting. Last time this message was edited on 10. September 2013 @ 21:36
|
AfterDawn Addict
|
10. September 2013 @ 21:47 |
Link to this message
|
The last time I got a ZeroAccess Rootkit it fragmented my OS all over the disk and nothing would work.
The way I found it was that I had MyDefrag and it gave me a picture of the OS fragmentation. The way I fixed it was that I had a Image backup of my C drive from Acronis True Image. Saved my ass!
There are three kinds of men: The ones that learn by reading; The few who learn by observation;
The rest of them have to pee on the electric fence and find out for themselves... |
Moderator
1 product review
|
10. September 2013 @ 22:02 |
Link to this message
|
|
Interesting....after DDP asking about the restore I tried that as I hadn't after starting the removal processes. The restore failed, but webpages that weren't loading before are now loading. I'll watch it tonight and see about system freezes/lockups. Maybe trying to restore shook something loose :P
|
|
Advertisement
|
|
|
AfterDawn Addict
|
10. September 2013 @ 22:05 |
Link to this message
|
Originally posted by LOCOENG:
Interesting....after DDP asking about the restore I tried that as I hadn't after starting the removal processes. The restore failed, but webpages that weren't loading before are now loading. I'll watch it tonight and see about system freezes/lockups. Maybe trying to restore shook something loose :P
Hopefully... Fingers crossed for you.
|
